Pith. sign in

REVIEW 4 major objections 4 minor 23 references

This paper claims that visually imperceptible pixel perturbations can forge the content read by OCR-free document VQA models, steering them toward attacker-chosen answers or systematic failures.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 18:33 UTC pith:DEPQ4V7G

load-bearing objection A credible white-box attack result on two DocVQA models, but the 'forge arbitrary content' claim rests on only five fixed refusal strings — the stress test holds. the 4 major comments →

arxiv 2512.04554 v2 pith:DEPQ4V7G submitted 2025-12-04 cs.CV

Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering

Marco Pintore , Maura Pintor , Dimosthenis Karatzas , Battista Biggio This is my paper
classification cs.CV
keywords adversarial machine learningdocument visual question answeringOCR-free document understandingdocument forgeryPix2StructDonutdenial of answerwhite-box attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that document visual question answering (DocVQA) models that read documents without OCR can be forged at the pixel level: an adversary who can alter a document image can make the model answer a preselected wrong string, or refuse to answer at all, with changes barely visible to a person. The authors formalize three attack goals — targeted single-answer, targeted multi-answer, and denial-of-answer — and show that a gradient-based optimizer working directly on raw pixels, with the model's preprocessing made differentiable, achieves high success on two current models. In the strongest setting, Pix2Struct is steered to the attacker's chosen answer in nearly 100% of single-question cases, and Donut in just under 80%; the same method can instead corrupt targeted answers while leaving the rest of the document's answers intact. The stakes are practical because DocVQA is being positioned for automated invoice processing and agent-initiated payments, where a forged total due can turn a perceptual attack into a monetary one. The paper states clearly that this is a white-box upper bound: the attacker must know the model, the exact image, and the exact question.

Core claim

On the paper's own terms, the central discovery is that a document image is an adversarial surface in its own right: the model's answer can be rewritten without rewriting any visible text. The attack minimizes or maximizes a sequence-level loss over the model's autoregressive decoding, pushing the output toward a target string such as $0.00 or a refusal phrase, and the optimization is carried out on the raw pixels before the model's preprocessing. To make this work, the authors reconstruct each model's preprocessing as a differentiable pipeline, including Pix2Struct's rendering of the question onto the image and Donut's resizing, padding, and normalization, so gradients flow to the pixels th

What carries the argument

Three components carry the argument. Projected gradient descent under an ℓ∞ bound produces the adversarial document x+δ while keeping the result a valid image. A reverse-engineered, fully differentiable copy of each model's preprocessing — Pix2Struct's question-header rendering, patch extraction, and normalization; Donut's resizing, padding, and normalization — lets the optimization backpropagate from the output logits all the way to the input pixels. A custom logit loss, which penalizes a target token only when it is not already the highest-scoring token, is what makes targeted attacks succeed against Donut where the standard cross-entropy loss stalls. The patch attack uses the same machine

Load-bearing premise

The attack's success depends on the adversary knowing the exact deployed model, the exact document image, and the exact question that will be asked; if any of these is wrong, or if the document passes through scanning, compression, or re-rendering that the attacker did not replicate, the perturbation may stop working.

What would settle it

Take one of the paper's optimized adversarial documents, re-encode it as a JPEG at quality 90, or rasterize it through a different PDF renderer, and feed the result to the same model; if the attack success rate drops to the unperturbed baseline, the forging effect is an artifact of the exact differentiable preprocessing path rather than a property that survives ordinary document handling.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If DocVQA is used to read invoices automatically, a full-document perturbation invisible to the human eye can change the machine-read total; the paper's Figure 1 shows a total due flipped to $0.00.
  • The attack does not need the whole page: a small patch in a corner (15% of the document's minimum dimension) is enough to reach near-100% success against Pix2Struct in the paper's setup, so a stamp or logo region can be the attack surface.
  • Targeted manipulation of several answers at once is possible against Pix2Struct for small numbers of questions but becomes markedly harder as the number grows; Denial-of-Answer, by contrast, succeeds with a single optimization step and leaves non-targeted answers largely intact.
  • Because the target string is arbitrary, the forged output can be a refusal-like phrase such as No Answer or I won't tell you, which is a plausible policy-compliant answer and so may not trigger alignment-based safety filters.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The per-question, white-box nature of the optimization suggests the attack is brittle outside the lab: re-scanning, JPEG compression, or any re-render not present during optimization should sharply reduce success; a cheap defensive corollary the paper leaves implicit is randomized or hardened preprocessing.
  • The same token-level logit-loss recipe is model-agnostic for autoregressive vision-language decoders, so the vulnerability likely extends beyond Pix2Struct and Donut to other OCR-free document models with the same encoder-decoder structure.
  • Because the attacker can choose any target string, the method could embed machine-readable instructions rather than natural-language answers, turning a forged document into a carrier for downstream prompt injection; the paper notes the possibility but does not demonstrate it.
  • The exact-question assumption is least restrictive in exactly the high-value automated pipelines that fix the question template, such as an invoice system that always asks What is the total due?, which is where the threat matters most.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces a white-box adversarial attack framework against OCR-free DocVQA models. The authors formalize targeted single-answer, targeted multi-answer, and untargeted denial-of-answer scenarios, and craft perturbations via PGD under an ℓ∞ constraint, using a custom logit loss for Donut. They evaluate on a 1000-document subset of PFL-DocVQA against Pix2Struct and Donut, reporting ASR, collateral damage, and ANLS. Full-document perturbations achieve near-100% targeted ASR on Pix2Struct and just below 80% on Donut, while patch attacks are less effective on Donut. The central claim is that visually imperceptible pixel perturbations can forge document content and induce targeted misinformation.

Significance. If the results hold, the paper identifies a previously underexplored vulnerability in OCR-free DocVQA and provides a reproducible attack implementation with open-source code. The end-to-end differentiable treatment of preprocessing, the use of unmodified public checkpoints, and the comparison across the number of optimized QA pairs are strengths. However, the demonstrated capability is narrower than the 'forgery' framing: systematic targeted-attack experiments use only five refusal-like target strings, and the practical-deployment claims are not supported by robustness tests. With additional evidence on diverse targets and statistical reliability, this could be a useful contribution to adversarial machine learning for document understanding.

major comments (4)
  1. [§3.1, §3.3] All quantitative targeted-attack experiments optimize and evaluate against the fixed set y_t = {"No Answer", "Unclear", "Retry", "Try later", "I won't tell you"}. The abstract and title claim 'forge document content' in a 'semantically targeted manner', which implies arbitrary target strings such as amounts, dates, or IDs. The reported near-100% ASR for Pix2Struct and ~80% for Donut therefore does not establish the headline capability; steering to short high-frequency refusal phrases may be substantially easier than exact-match generation of arbitrary content. The $0.00 example in Fig. 1 is not part of the systematic evaluation. Please evaluate on a diverse set of target strings with per-target ASR, or substantially narrow the claims.
  2. [§3.1, §3.3] The evaluation subset is described only as 'we extracted N=1000 unique samples' with no statement of random sampling or repeated runs. ASR is an exact-match metric with likely high variance across documents; without error bars, confidence intervals, or multiple seeds, it is not possible to assess whether differences such as Pix2Struct near 100% vs Donut below 20% in the patch setting are robust. Please report variance (e.g., bootstrap CIs over documents) and describe the sample-selection procedure.
  3. [§2.2, §3.1] The threat model assumes full white-box access, knowledge of the exact question and exact image, and a differentiable reimplementation of the model-specific preprocessing. The claim that the saved image 'can be stored, transmitted, and processed by any DocVQA system' is verified only for the exact optimized input/condition pair; robustness to JPEG compression, re-rendering, resizing, or preprocessing changes is not tested. Although Section 2.2 acknowledges the white-box assumption as an upper bound, the 'practically deployable' language overstates the evidence. Add robustness experiments to common post-processing or qualify the deployment claims.
  4. [Abstract; Fig. 3; §3.4] The paper repeatedly describes perturbations as 'visually imperceptible' or 'inconspicuous', but no human perceptual study or perceptual similarity metric is reported. The patch setting uses epsilon=96 on a 0–255 scale in a 15% corner region, which may be visible depending on document content. Please provide perceptual evidence (e.g., human ratings or a standard perceptual metric) or soften the imperceptibility claim.
minor comments (4)
  1. [Eq. (12)] The ASR formula appears to contain an extra factor 1/B: if success for multi-answer objectives requires all B answers to match, the average should be (1/N)∑_i ∏_j 1[·], not (1/B)·(1/N)∑_i ∏_j 1[·]. Please check and correct.
  2. [§3.1] The text says both 'we apply a mask to the header part when backpropagating' and 'we reimplement the preprocessing pipeline end-to-end and apply the perturbation before the question is rendered'. These two mechanisms should be reconciled for clarity.
  3. [§3.3] Typo: 'asnwers' should be 'answers' in the targeted multi-answer discussion.
  4. [§3.1] Please state whether the 1000 samples were selected randomly, with a fixed seed, or by some other deterministic rule; this is relevant to reproducibility.

Circularity Check

0 steps flagged

No significant circularity: attack success is measured against unmodified external checkpoints; optimizing the attack loss and then measuring exact match to the optimized target is standard attack evaluation, not a derivation that reduces to its inputs.

full rationale

The paper's chain is: define attacker objectives (Sect. 2.2), formulate the PGD problem in Eq. (8), optimize pixel perturbations with either the model fine-tuning loss (Eq. 6) or the token-logit loss (Eqs. 9-10), and then measure ASR, CDMG, and ANLS (Sect. 3.2) on the unmodified HuggingFace Pix2Struct and Donut checkpoints. The ASR in Eq. 12 is an external empirical quantity: it compares the model's generated string with a fixed target string, and the paper reports failures (e.g., Donut below 80% in the full-document case and below 20% in the patch case; targeted multi-answer ASR dropping with B), which would be impossible if the evaluation were forced by construction. The custom loss of Eq. (10) is an optimization objective, not a fitted predictor; the fact that the attack optimizes toward the same target used in the ASR metric is the standard definition of a targeted adversarial attack, not a circular derivation. The white-box assumption, the fixed target-string set yt = {'No Answer', 'Unclear', 'Retry', 'Try later', 'I won't tell you'}, and the per-question/per-image optimization are acknowledged limitations that narrow external validity and generalization, but they are not circularity: they do not make the measured success rates equal to the attack's inputs by definition. Self-citations [7], [9], [21] are contextual or methodological and none is load-bearing for the central result; no uniqueness theorem, imported ansatz, or renaming of a known result is used. The nearest correctness concern — that the headline 'forge document content' claim is supported quantitatively only for five short refusal strings — is a generalization/overclaim issue, not a circular-reasoning issue, so it does not raise the circularity score.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 0 invented entities

The central results rest on a white-box, per-question threat model and on hand-tuned attack hyperparameters. The paper's practical-impact framing depends on assumptions about attacker knowledge, document digitization, and preprocessing fidelity, which are all explicitly stated but not stress-tested.

free parameters (4)
  • Adversarial budget ε (full-document) = Pix2Struct: 8; Donut: 32
    Chosen per model without a stated selection rule; the higher budget for Donut is likely needed to make attacks succeed.
  • Step size α and iterations K = Pix2Struct: α=2,K=20 (full), α=24,K=25 (patch); Donut: α=2,K=100 (full), α=24,K=100 (patch)
    Hand-selected to achieve success; ASR is sensitive to these, and no ablation is provided.
  • Patch size and placement = Square of 15% of the minimum document dimension, bottom-right corner
    Arbitrary choice; directly affects patch-attack success.
  • Attack loss type = eq. (6) for Pix2Struct, eq. (10) for Donut
    Custom logit loss was introduced because the standard loss stopped improving; this is an ad hoc design choice for the target model.
axioms (6)
  • domain assumption White-box threat model: attacker knows model parameters, gradients, and preprocessing.
    Stated in Sect. 2.2; enables gradient-based optimization, but practical impact is weaker under black-box access.
  • domain assumption Attacker knows the exact question(s) q that will be asked.
    Stated in Sect. 2.2; attacks are optimized per-question and do not generalize to unseen questions (see Fig. 5).
  • domain assumption The reverse-engineered differentiable preprocessing faithfully matches the actual deployed preprocessing.
    Section 3.1 reimplements φ differentiably; success against unmodified HuggingFace checkpoints provides indirect but not complete support.
  • standard math PGD finds a satisfactory local optimum of the non-convex attack objective.
    No convergence guarantee for non-convex deep networks; success rates are empirical outcomes.
  • domain assumption The 1000-document subset is representative of PFL-DocVQA.
    Sampling procedure is not described (Sect. 3.1); this affects generalization of all reported ASR values.
  • domain assumption Perturbations within the stated ε are visually imperceptible to humans.
    Asserted at multiple points but not measured with human raters; ε=32 (Donut full-document) may be noticeable in practice.

pith-pipeline@v1.3.0-alltime-deepseek · 14633 in / 10818 out tokens · 104961 ms · 2026-08-03T18:33:26.467997+00:00 · methodology

0 comments
read the original abstract

Document Visual Question Answering (DocVQA) enables end-to-end reasoning grounded on information present in a document input. While recent models have shown impressive capabilities, they remain vulnerable to adversarial attacks. In this work, we introduce a novel attack scenario that aims to forge document content in a visually imperceptible yet semantically targeted manner, allowing an adversary to induce specific or generally incorrect answers from a DocVQA model. We develop specialized attack algorithms that can produce adversarially forged documents tailored to different attackers' goals, ranging from targeted misinformation to systematic model failure scenarios. We demonstrate the effectiveness of our approach against two end-to-end state-of-the-art models: Pix2Struct, a vision-language transformer that jointly processes image and text through sequence-to-sequence modeling, and Donut, a transformer-based model that directly extracts text and answers questions from document images. Our findings highlight critical vulnerabilities in current DocVQA systems and call for the development of more robust defenses. We release our open source code at https://github.com/pralab/adv-docVQA.

Figures

Figures reproduced from arXiv: 2512.04554 by Battista Biggio, Dimosthenis Karatzas, Marco Pintore, Maura Pintor.

Figure 1
Figure 1. Figure 1: Example DocVQA task on a synthetic invoice. The model must read and reason over structured document text. In normal operation the model correctly answers questions on the unaltered document (left). By applying a simple adversarial patch perturbation (right), an adversary can force the model to answer a preselected (incorrect) response; for instance, the perturbed document shows $0.00, potentially causing m… view at source ↗
Figure 2
Figure 2. Figure 2: End-to-end attack. The non-differentiable pre￾processing (top), which breaks the computational graph before δ, and our end-to-end differentiable attack (bottom), obtained by reverse engineering the preprocessing ϕ. manipulated images are tested against a newly-instantiated, unmodified version of the HuggingFace models, thereby reflecting realistic attack conditions in which the adversary interacts with the… view at source ↗
Figure 3
Figure 3. Figure 3: Attack Visualization. The document altered with a patch in the lower right corner, with ϵ = 96. 3.2. Evaluation Metrics Across all scenarios, we evaluate attacks using three main metrics: (i) Attack Success Rate (ASR), which measures whether the targeted answers are successfully forced (or corrupted, in untargeted attacks); (ii) Collateral Damage (CDMG), which quantifies unintended changes to non-targeted … view at source ↗
Figure 4
Figure 4. Figure 4: Targeted attack results. All metrics are reported for Pix2Struct and Donut across a different number of optimized QA pairs (B). Top panels show the ASR and the CDMG, while the bottom panels show the ANLS scores. 1 2 3 4 5 QA-pairs in objective (B) 0 25 50 75 100 Evaluation Metric (%) Full-document 1 2 3 4 5 QA-pairs in objective (B) 0 25 50 75 100 Patch 1 2 3 4 5 QA-pairs in objective (B) 0 25 50 75 100 Fu… view at source ↗
Figure 5
Figure 5. Figure 5: Denial of Answer (DoA) results. All metrics are reported for Pix2Struct and Donut across a different number of optimized QA pairs (B). Top panels show the ASR and the CDMG, while the bottom panels show the ANLS scores [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Qualitative example. Targeted multi-answer attack optimized with 5 questions on the full-document scenario. Jailbreaks in autoregressive models. A complementary line of research studies adversarial attacks that exploit the autoregressive generation for LLMs to target alignment mechanisms of LLMs and LVMs. Instead of optimizing directly over the sequential distribution defined by the decoder, these methods … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

23 extracted references · 3 linked inside Pith

  1. [1]

    Docvqa: A dataset for vqa on document images,

    M. Mathew, D. Karatzas, and C. Jawahar, “Docvqa: A dataset for vqa on document images,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2021, pp. 2200–2209

    2021

  2. [2]

    Pix2struct: screenshot parsing as pretraining for visual language understanding,

    K. Lee, M. Joshi, I. Turc, H. Hu, F. Liu, J. Eisenschlos, U. Khan- delwal, P. Shaw, M.-W. Chang, and K. Toutanova, “Pix2struct: screenshot parsing as pretraining for visual language understanding,” inProceedings of the 40th International Conference on Machine Learning, ser. ICML’23. JMLR.org, 2023

    2023

  3. [3]

    Ocr-free document understanding transformer,

    G. Kim, T. Hong, M. Yim, J. Nam, J. Park, J. Yim, W. Hwang, S. Yun, D. Han, and S. Park, “Ocr-free document understanding transformer,” inEuropean Conference on Computer Vision (ECCV), 2022

    2022

  4. [4]

    Evasion attacks against machine learning at test time,

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndi´c, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” inMachine learning and knowledge discovery in databases: European conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, proceedings, part III 13. Springer, 2013, pp. 387–402

    2013

  5. [5]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in 2nd International Conference on Learning Representations, ICLR 2014, 2014

    2014

  6. [6]

    Scene text visual question answering,

    A. F. Biten, R. Tito, A. Mafla, L. Gomez, M. Rusinol, E. Valveny, C. Jawahar, and D. Karatzas, “Scene text visual question answering,” inProceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 4291–4301

    2019

  7. [7]

    Wild patterns: ten years after the rise of adversarial machine learning,

    B. Biggio, F. Roliet al., “Wild patterns: ten years after the rise of adversarial machine learning,”PATTERN RECOGNITION, vol. 84, pp. 317–331, 2018

    2018

  8. [8]

    Adver- sarial patch,

    T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adver- sarial patch,”arXiv preprint arXiv:1712.09665, 2017

    Pith/arXiv arXiv 2017

  9. [9]

    Q. Dong, L. Kang, M. Pintor, and D. Karatzas,Position-Aware Stamp-Like Adversarial Attack for Document Classification. Inter- national Conference on Document Analysis and Recognition, 09 2025, pp. 294–310

    2025

  10. [10]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations, 2018

    2018

  11. [11]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9185–9193

    2018

  12. [12]

    Seeing is not believing: Camouflage attacks on image scaling algorithms,

    Q. Xiao, Y . Chen, C. Shen, Y . Chen, and K. Li, “Seeing is not believing: Camouflage attacks on image scaling algorithms,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 443–460

    2019

  13. [13]

    Privacy- aware document visual question answering,

    R. Tito, K. Nguyen, M. Tobaben, R. Kerkouche, M. A. Souibgui, K. Jung, J. J ¨alk¨o, V . Poulain D’Andecy, A. Joseph, L. Kang, E. Valveny, A. Honkela, M. Fritz, and D. Karatzas, “Privacy- aware document visual question answering,” inProceedings of the International Conference on Document Analysis and Recognition (ICDAR) 2024, 2024

    2024

  14. [14]

    Infographicvqa,

    M. Mathew, V . Bagal, R. Tito, D. Karatzas, E. Valveny, and C. Jawahar, “Infographicvqa,” inProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2022, pp. 1697–1706

    2022

  15. [15]

    Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,” inProceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90

    2023

  16. [16]

    Fooling ocr systems with adversarial text images,

    C. Song and V . Shmatikov, “Fooling ocr systems with adversarial text images,”arXiv preprint arXiv:1802.05385, 2018

    Pith/arXiv arXiv 2018

  17. [17]

    Adversarial preprocessing: Understanding and preventing Image-Scaling attacks in machine learning,

    E. Quiring, D. Klein, D. Arp, M. Johns, and K. Rieck, “Adversarial preprocessing: Understanding and preventing Image-Scaling attacks in machine learning,” in29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 1363–1380. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity20/presentation/quiring

    2020

  18. [18]

    Image hijacks: Adversarial images can control generative models at runtime,

    L. Bailey, E. Ong, S. Russell, and S. Emmons, “Image hijacks: Adversarial images can control generative models at runtime,” inProceedings of the 41st International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, R. Salakhutdinov, Z. Kolter, K. Heller, A. Weller, N. Oliver, J. Scarlett, and F. Berkenkamp, Eds., vol. 235. PMLR...

    2024

  19. [19]

    On the robustness of large multimodal models against image adversarial attacks,

    X. Cui, A. Aparcedo, Y . K. Jang, and S.-N. Lim, “On the robustness of large multimodal models against image adversarial attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 625–24 634

    2024

  20. [20]

    On the adversarial robustness of multi-modal foundation models,

    C. Schlarmann and M. Hein, “On the adversarial robustness of multi-modal foundation models,” in2023 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW). IEEE, 2023, pp. 3679–3687

    2023

  21. [21]

    Docmia: Document-level membership inference attacks against docvqa models,

    K. Nguyen, R. Kerkouche, M. Fritz, and D. Karatzas, “Docmia: Document-level membership inference attacks against docvqa models,” inThe Thirteenth International Conference on Learning Representations, 2025

    2025

  22. [22]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrik- son, “Universal and transferable adversarial attacks on aligned language models,”arXiv preprint arXiv:2307.15043, 2023

    Pith/arXiv arXiv 2023

  23. [23]

    Are aligned neural networks adversarially aligned?

    N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, P. W. W. Koh, D. Ippolito, F. Tramer, and L. Schmidt, “Are aligned neural networks adversarially aligned?”Advances in Neural Information Processing Systems, vol. 36, pp. 61 478–61 500, 2023

    2023