{"id":"09b2c9a4-4beb-470e-adae-3411f407ef8d","arxiv_id":"2506.11111","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"LLM robustness research is organized into adversarial robustness, out-of-distribution robustness, and evaluation, with an accompanying GitHub collection of papers.","lead":"This paper reviews the many ways large language models can be tripped up by unusual or hostile inputs, and groups the research into three buckets: attacks and defenses, unexpected real-world situations, and testing methods. It also maintains a list of related papers online and sketches future research goals.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (1) is an ill-posed training objective rather than a definition of robustness, and it cannot generate the three-branch taxonomy claimed; the formal foundation of the survey is unsupported.","rationale":"The reader's weakest_assumption correctly identifies Eq. (1) as a serious problem, and I agree that the paper's formal foundation is fragile. My partial disagreement is on the diagnosis. The more fundamental issue is not merely unbalanced parentheses or an unspecified d(.,.): even if all syntactic defects were fixed, argmin_theta max_epsilon defines a training objective, not a definition of a model's robustness property, and nothing in the objective yields the separate 'Robustness Evaluation' branch of the taxonomy. The taxonomy may be independently reasonable, so calling it 'arbitrary' overstates the case; rather, it is not established by the formal definition the paper presents. The repository and broad coverage are genuine assets, but they do not compensate for the unsupported claim that the survey's organization is grounded in a formal definition. The issues are addressable through rewriting and re-scoping, so the reader's CONDITIONAL verdict remains appropriate; no verdict change is needed.","tokens_in":39275,"tokens_out":5542,"duration_ms":68110,"concrete_test":"Instantiate Eq. (1) on the PromptBench setting described in Section 5.2.1 with every symbol specified: X, X', Y, Y', Delta, d, L, alpha, and beta. Then use only that instantiated objective as the classification rule for placing each method in Tables 3, 4, and 6 into the three taxonomy branches. If the placements require unformalized notions that are absent from Eq. (1), such as attacker intent, distribution shift, or the meta-activity of evaluation, the taxonomy is not actually derived from the formal definition.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central contribution is a formal definition of LLM robustness (Eq. 1) and a taxonomy claimed to be built on it. This equation cannot bear that weight. The left side, Eval(theta), is defined as an argmin_theta max_epsilon objective, which is an optimization procedure, not a property or metric that characterizes whether a given model is robust. The perturbation set Delta is never linked to a distribution over (X',Y'), so the maximization is not well defined. The distance d(.,.) is described as 'such as KL divergence,' but the consistency term is written as d(L(LLM(X)||L(LLM(X')) with unbalanced parentheses and effectively one argument. The 'reliability' bullet merely states Y' != Y, without specifying what loss or constraint that entails. Beyond syntax, the three-branch taxonomy is not recoverable from Eq. (1): performance, consistency, and reliability do not map to adversarial robustness, OOD robustness, and robustness evaluation, and evaluation appears nowhere in the objective. The taxonomy may still be a useful organizational scheme, and the companion repository is a real asset, but the paper's specific claim of a rigorous, definition-driven foundation is not supported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper is a survey of robustness in large language models. It claims to be the first comprehensive survey focused on LLM robustness, proposes a formal definition of LLM robustness in Eq. (1), and organizes the literature into three parts: adversarial robustness, OOD robustness, and robustness evaluation. It also provides a companion GitHub repository and discusses future directions including human-in-the-loop evaluation.","tokens_in":39553,"tokens_out":5711,"duration_ms":57870,"significance":"If the survey's indexing and taxonomy prove reliable, it would give the community a useful entry point: the three-part division by perturbation type is a reasonable organization, and the companion repository is a practical asset. The discussion of human roles and causal-inference connections is a forward-looking addition. However, the formal foundation is currently not rigorous, and several cited summaries contain errors; because the paper's value as a survey depends on accurate indexing, these issues need to be fixed.","major_comments":[{"comment":"The equation cannot serve as a formal definition of LLM robustness. The expression Eval(theta) is an argmin-max training objective, not a property or metric that characterizes whether a given model is robust. The perturbation set Delta is never linked to a distribution over (X',Y'), so the maximization is not well defined. The distance d(.,.) is left unspecified, the KL term contains unbalanced parentheses and is written with one argument, and the 'reliability' condition (Y' != Y) does not define a loss. Because the paper claims that the three-branch taxonomy is based on this definition, this is a load-bearing issue. The authors should either replace Eq. (1) with a well-typed definition of robustness as a model property, or explicitly present the taxonomy as an organizational choice based on perturbation types, as the abstract already does.","section":"Section 1, Eq. (1)"},{"comment":"The claim 'we are the first to concentrate on the LLM Robustness' is contradicted by the paper's own references. Reference [179] (Wang et al., 'On the robustness of ChatGPT: An adversarial and out-of-distribution perspective') is a robustness-focused study of LLMs, and reference [213] (Yuan et al., 'Revisiting out-of-distribution robustness in NLP: Benchmarks, analysis, and LLMs evaluations') explicitly surveys OOD robustness in LLMs. The novelty claim should be qualified or removed, and the related-work comparison should engage with these existing surveys directly.","section":"Section 1, contributions bullet"},{"comment":"The text states that 'Esiobu et al. [37] proposes ROBUST, the first benchmark for evaluating open information extraction models in real-world scenarios,' but reference [37] is titled 'ROBBIE: Robust bias evaluation of large generative language models' and concerns bias evaluation, not open information extraction. The same benchmark is also listed in Table 6 as 'ROBUST [37]' under 'Open domain generalization,' which is inconsistent. This is a substantive misattribution in a survey whose contribution is reliable indexing.","section":"Section 5.2.2, reference [37]"},{"comment":"The text attributes ALiBi to 'Sun et al. [167]' and says 'Their proposed ALiBi [167]' has been shown to outperform other position embedding methods. Reference [167] is the paper 'A Length-Extrapolatable Transformer' by Sun et al.; ALiBi is by Press et al. [137]. This type of attribution error is material in a survey-as-index. The authors should systematically audit all inline citations and tables against the reference list.","section":"Section 3.2 and Table 3, reference [167]"}],"minor_comments":[{"comment":"References [104] and [105] are the same paper, 'Lost in the Middle: How Language Models Use Long Contexts,' cited with different volume numbers for the same TACL article; they should be merged, and Section 3.2 should cite a single entry.","section":"References [104] and [105]"},{"comment":"There are numerous typos and grammatical errors, including 'wild-range' for 'wide-range,' 'unexpeted' for 'unexpected,' 'perturbated' for 'perturbed,' 'disturber' for 'disturb,' 'finishi' and 'usenormous' in Section 1, and 'fla' for 'flag' in Section 2.2.2. A careful proofreading pass is needed.","section":"Throughout"},{"comment":"Equation (2) writes epsilon in {X' = X + delta, X' = Attack(X), LongContext}, mixing a scalar perturbation symbol with input-transformation conditions; the set-membership notation should be clarified.","section":"Section 2.2.1, Eq. (2)"},{"comment":"The sentence 'there also exist other related work [34, 47, 47, 68, 98, 150, 171]' contains a duplicated reference [47] and should be de-duplicated.","section":"Section 4.4"},{"comment":"The phrase 'he refined robustness metrics' has an unclear antecedent and appears to be a pronoun error; it should be 'they' or a specific author name should be given.","section":"Section 5.2.2"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be an arXiv preprint formatted as an ACM journal article; the venue and publication status should be clarified. The novelty claim should be checked against references [179] and [213], and the attribution errors in Sections 3 and 5 suggest the paper needs a careful verification pass before it can serve as a reliable survey. I see no evidence of misconduct, but the formal-definition issue in Eq. (1) is central enough to require revision rather than minor polishing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know: this is a survey of LLM robustness with a companion GitHub repo. The best parts are the collection protocol and the three-branch taxonomy (adversarial, OOD, evaluation) as an organizing device. The weakest part is the formal definition in Eq. (1), which does not work.\n\nThe paper does not present new methods or experiments, and that is fine for a survey. The repo is a real asset. The coverage of topics—noise prompts, long context, attacks/defenses, OOD detection, PEFT, hallucination, evaluation benchmarks—is broad and gives newcomers a map of the field. The comparison table between ML robustness and LLM robustness is a useful summary.\n\nThe soft spots. Eq. (1) is presented as the foundation but is not a definition. It is an argmin-max training objective with undefined d(.,.), unbalanced parentheses, and a 'reliability' condition that does not specify a loss. The taxonomy of adversarial/OOD/evaluation is not derivable from it; 'evaluation' does not appear in the equation at all. The claim of being 'the first' survey on LLM robustness is contradicted by the paper's own references [22], [41], and [213]. There are duplicated references ([104] and [105] both cite Lost in the Middle) and several paper summaries are too shallow or slightly wrong. These are fixable, but they are the kind of thing that makes a reader doubt the care of the survey.\n\nThe central argument—that organizing LLM robustness into these three branches helps—holds up. The formal definition is not load-bearing if you treat it as a schematic rather than a mathematical foundation, but the paper explicitly leans on it, so it has to be repaired or removed.\n\nWho is this for? A newcomer looking for a reading list and a map of the field. It deserves a serious referee, but only with the expectation of major revision. I would not cite it for the formal definition, but I would cite the repo.","headline":"A useful organizational survey with a real repository, but the formal definition at Eq. (1) is ill-posed and should be fixed or dropped before this is referee-ready.","tokens_in":39990,"tokens_out":1656,"would_cite":true,"duration_ms":20088,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A formal definition and three-part taxonomy organize the scattered field of LLM robustness.","keywords":["Large Language Models","Robustness","Adversarial Robustness","Out-of-Distribution Robustness","Hallucination","Robustness Evaluation","Parameter-Efficient Fine-Tuning","Survey"],"falsifier":"If one collected a random sample of robustness papers published in the past year and found a positively reviewed work that cannot be placed in any of the three branches, or that falls in two branches without double counting, the taxonomy's claim to be a comprehensive partition would fail. A simpler check: instantiate Eq. (1) literally, repairing the unbalanced parentheses and specifying the distance function $d(\\cdot,\\cdot)$, and show whether the 'reliability' term $L(\\mathrm{LLM}(X'),Y')$ for $Y'\\neq Y$ is even well-defined as a loss.","tokens_in":39115,"feed_emoji":"🛡️","tokens_out":5169,"duration_ms":55926,"temperature":0.7,"pith_summary":"This survey paper argues that robustness for large language models is a distinct research field deserving its own terminology, and it sets out to provide that terminology. It proposes a formal definition of LLM robustness as a min–max objective over perturbations, and it organizes the existing literature into three branches: adversarial robustness (noise, long context, and toxic prompts), out-of-distribution robustness (detection, tuning, hallucination), and robustness evaluation (datasets, metrics, benchmarks). The paper documents its paper-collection protocol and provides a searchable GitHub repository, so the contribution is as much an index of the field as an argument about its shape. The intended payoff is that researchers can locate their work in a shared topology, see how ML robustness and LLM robustness differ, and use the paper's future-directions table as a roadmap.","feed_headline":"One definition organizes the messy field of LLM robustness","feed_subtitle":"A new survey sorts the literature into adversarial, out-of-distribution, and evaluation buckets.","key_machinery":"The load-bearing object is Eq. (1), a min–max formulation that treats robustness as the worst-case loss over a set $\\Delta$ of perturbation operations, with the original loss, the perturbed loss, and a distance term $d(\\cdot,\\cdot)$ (e.g., KL divergence) balanced by hyperparameters $\\alpha$ and $\\beta$. The formula is intended to cover three facets at once — performance on clean inputs, reliability on perturbed inputs, and consistency between the two outputs — and the paper's taxonomy in Fig. 2(b) is derived from it: adversarial robustness corresponds to perturbations $\\epsilon$ such as $X'=X+\\delta$, attack prompts, or long contexts; OOD robustness corresponds to distribution shifts with a bounded distance $\\eta$ and an explicit \"Not Known\" refusal option; robustness evaluation supplies datasets, metrics, and benchmarks to measure the objective. This machinery carries the survey because every section assignment and every collected paper is justified by which part of Eq. (1) it addresses.","core_discovery":"The paper's central claim is that LLM robustness should be understood as a model's ability to maintain performance, consistency, and reliability across prompt variations, and that this ability can be captured by a single formal objective: $$\\mathrm{Eval}(\\$\\theta$)=\\arg\\min_\\$\\theta$ \\max_{\\epsilon\\in\\$\\Delta$} \\big[ L(\\mathrm{LLM}(X),Y) + \\$\\alpha$ L(\\mathrm{LLM}(X'),Y') + \\$\\beta$\\, d(L(\\mathrm{LLM}(X))\\parallel L(\\mathrm{LLM}(X'))) \\big],$$ where $X',Y'$ are perturbed data, $\\Delta$ is a set of perturbation operations, and hyperparameters $\\alpha,\\beta$ trade off performance, consistency, and reliability. On the basis of this definition and a comparison with ML robustness, the paper proposes a three-part topology — adversarial robustness, OOD robustness, and robustness evaluation — and reviews representative works in each, alongside datasets, benchmarks, and future directions. The paper also asserts it is the first survey devoted specifically to LLM robustness rather than treating it as a subsection of a general LLM survey.","pith_inferences":["Editorial inference: the taxonomy is a claim about how the literature clusters, not a theorem; a different perturbation typology (for example, one organized by attack surface rather than by input stage) would produce a different survey with equal plausibility.","Editorial inference: Eq. (1) could be turned into a practical evaluation recipe, because fixing $\\alpha$ and $\\beta$ and sampling perturbations from $\\Delta$ defines a family of robustness scores that the field does not yet standardize.","Editorial inference: the same three-branch structure could be applied to multimodal and agentic LLMs, where the 'prompt' becomes a trajectory of observations and actions; whether the topology survives that extension is an open question.","Editorial inference: the paper's own comparison with ML robustness implies that 'Not Known' refusal is a form of robustness, which points toward a testable extension — systems that learn to abstain under distribution shift may score higher on the paper's objective than systems that always answer."],"forward_implications":["Researchers gain a shared vocabulary: 'noise prompt,' 'noise decoding,' 'OOD detection,' 'PEFT methods,' and 'hallucination' become named branches of a single robustness topology rather than separate subfields.","The comparison with ML robustness (input, tuning, output, application) gives a checklist for where LLM robustness research is needed, such as prompt quality, parameter-efficient tuning, and knowledge updating.","The formal definition implies that an LLM that is robust in the paper's sense must simultaneously be good on clean inputs, stable under perturbation, and consistent across paraphrases — three properties that existing benchmarks often measure separately.","The human-in-the-loop framework (annotator, expert, red team, evaluator) provides a concrete process for continuously finding and patching robustness failures, and the future-directions table offers a chronological roadmap to 2029."],"supporting_citations":[{"why":"The general survey on evaluation of large language models that the paper positions itself against by devoting full coverage to robustness.","marker":"[18]"},{"why":"A prior focused study of GPT-3.5 robustness that the paper contrasts with its broader scope across many models and perturbation types.","marker":"[22]"},{"why":"Source for the classical robustness definition (insensitivity to parameter miscalculation) that the paper extends to the LLM setting.","marker":"[124]"},{"why":"An adversarial-and-OOD robustness study of ChatGPT that the paper cites as covering only a narrow slice of LLM robustness.","marker":"[179]"},{"why":"A benchmark-focused survey of OOD robustness in NLP, used as a point of comparison for the paper's broader three-part topology.","marker":"[213]"},{"why":"Provides the neuron-sensitivity notion of adversarial robustness that feeds into the paper's formal definition in Eq. (1).","marker":"[219]"},{"why":"The general survey of large language models that the paper contrasts with its own robustness-centred organization.","marker":"[226]"}],"fun_headline_variants":["One definition unifies the three pillars of LLM robustness","First LLM-robustness survey offers one formula, three fronts","LLM robustness: one objective, three challenges, a new survey","LLM robustness unpacked: adversarial, OOD, and evaluation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The survey's organization rests on the assumption that robustness can be captured by a single min–max formula with two balancing weights, and that the three-way split of the literature follows naturally from that formula.","fun_headline_variants_meta":{"raw":{"variants":["One definition unifies the three pillars of LLM robustness","First LLM-robustness survey offers one formula, three fronts","LLM robustness: one objective, three challenges, a new survey","LLM robustness unpacked: adversarial, OOD, and evaluation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000301,"raw_usage":{"total_tokens":1810,"prompt_tokens":1091,"completion_tokens":719,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":707,"completion_tokens_details":{"reasoning_tokens":645}},"tokens_in":707,"tokens_out":719,"duration_ms":7592,"temperature":1.0,"reasoning_tokens":645,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:38:43.192419+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"If one collected a random sample of robustness papers published in the past year and found a positively reviewed work that cannot be placed in any of the three branches, or that falls in two branches without double counting, the taxonomy's claim to be a comprehensive partition would fail. A simpler check: instantiate Eq. (1) literally, repairing the unbalanced parentheses and specifying the distance function $d(\\cdot,\\cdot)$, and show whether the 'reliability' term $L(\\mathrm{LLM}(X'),Y')$ for $Y'\\neq Y$ is even well-defined as a loss.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"A benchmark-focused survey of OOD robustness in NLP, used as a point of comparison for the paper's broader three-part topology."},{"cited_title":"In The Twelfth International Conference on Learning Representations","cited_arxiv_id":null,"evidence_quote":"Provides the neuron-sensitivity notion of adversarial robustness that feeds into the paper's formal definition in Eq. (1)."}],"review_version":1}