Pith. sign in

REVIEW 20 cited by

Gradient-based Adversarial Attacks against Text Transformers

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2104.13733 v1 pith:UIMJ67Z3 submitted 2021-04-15 cs.CL cs.AIcs.CRcs.LG

Chuan Guo , Alexandre Sablayrolles , Hervé Jégou , Douwe Kiela This is my paper · ORCID
classification cs.CLcs.AIcs.CRcs.LG
keywords adversarialattackgradient-baseddistributionattacksattainsblack-boxcontinuous-valued
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

We propose the first general-purpose gradient-based attack against transformer models. Instead of searching for a single adversarial example, we search for a distribution of adversarial examples parameterized by a continuous-valued matrix, hence enabling gradient-based optimization. We empirically demonstrate that our white-box attack attains state-of-the-art attack performance on a variety of natural language tasks. Furthermore, we show that a powerful black-box transfer attack, enabled by sampling from the adversarial distribution, matches or exceeds existing methods, while only requiring hard-label outputs.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 20 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Influence-Guided Concolic Testing of Transformer Robustness

    cs.SE 2025-09 conditional novelty 6.0 of 10

    SHAP-based branch prioritization lets a concolic tester find subtle one-pixel attacks on small Transformer classifiers, but the reported evidence is mixed and the abstract overstates results.

  2. Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoning

    cs.CR 2025-06 conditional novelty 6.0 of 10

    Indirect data poisoning (gradient-matching prompts) makes LLMs learn secret prompt-response pairs absent from training data, detectable with certified p-values and under 0.005% contaminated tokens.

  3. Shaking to Reveal: Perturbation-Based Detection of LLM Hallucinations

    cs.AI 2025-06 conditional novelty 6.0 of 10

    SSP adds a learned, sample-specific noise prompt to an LLM input and scores hallucination by the cosine shift in intermediate representations, outperforming output-confidence baselines on QA benchmarks.

  4. Auto-RT: Automatic Jailbreak Strategy Exploration for Red-Teaming Large Language Models

    cs.CR 2025-01 conditional novelty 6.0 of 10

    Auto-RT uses early-terminated exploration plus reward shaping from progressively weakened copies of the target model to automatically discover jailbreak strategies, reporting up to 16.63% higher attack success than baselines.

  5. Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning

    cs.LG 2024-12 conditional novelty 6.0 of 10

    An automated red-teaming method that uses LLM-generated per-goal rewards and multi-step RL with a style-diversity reward to produce diverse and effective attacks on language models.

  6. DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreak

    cs.CL 2024-12 conditional novelty 6.0 of 10

    A diffusion-based prompt rewriter that pushes rewritten prompts toward harmless regions of a target model's hidden states achieves higher jailbreak success than existing suffix and template attacks.

  7. Are Language Models Agnostic to Linguistically Grounded Perturbations? A Case Study of Indic Languages

    cs.CL 2024-12 conditional novelty 6.0 of 10

    Pre-trained language models are vulnerable to phonologically and orthographically motivated character substitutions in Indic languages, but less so than to unconstrained random character substitution.

  8. GReaTer: Gradients over Reasoning Makes Smaller Language Models Strong Prompt Optimizers

    cs.CL 2024-12 conditional novelty 6.0 of 10

    A gradient-based discrete prompt optimizer that uses reasoning chains to let small LMs self-optimize prompts, outperforming text-feedback baselines on reasoning benchmarks.

  9. Universal and Context-Independent Triggers for Precise Control of LLM Outputs

    cs.CL 2024-11 conditional novelty 6.0 of 10

    A single trained token pair inserted around any target text forces Qwen-2 7B and Llama-3.1 8B to output that text on 54 to 75 percent of unseen prompts.

  10. VERA: Variational Inference Framework for Jailbreaking Large Language Models

    cs.CR 2025-06 conditional novelty 5.0 of 10

    VERA frames black-box jailbreaking as variational inference, training a LoRA-tuned attacker that samples diverse fluent prompts; reported ASRs are high but several evaluation choices weaken the SOTA claims.

  11. Trojan Detection Through Pattern Recognition for Large Language Models

    cs.CL 2025-01 conditional novelty 5.0 of 10

    A logits-only, black-box pipeline with token filtration, greedy or beam-search trigger inversion, and perturbation-based verification detects Trojan triggers in TrojAI and RLHF-poisoned LLMs.

  12. LLM-Virus: Evolutionary Jailbreak Attack on Large Language Models

    cs.CR 2024-12 conditional novelty 5.0 of 10

    LLM-Virus uses an evolutionary algorithm with an LLM as crossover, mutation, and fitness operator to evolve jailbreak templates, reporting state-of-the-art attack success on HarmBench and AdvBench.

  13. DROJ: A Prompt-Driven Attack against Large Language Models

    cs.CL 2024-11 conditional novelty 5.0 of 10

    DROJ optimizes a soft prompt to move hidden representations away from the refusal direction, achieving 100% keyword ASR on LLaMA-2-7b-chat, but the responses are often uninformative repeats.

  14. Universal Adversarial Attack on Aligned Multimodal LLMs

    cs.AI 2025-02 conditional novelty 4.0 of 10

    A single optimized image, trained through the vision and language modules, makes aligned multimodal LLMs produce dangerous responses across diverse prompts and some models.

  15. Large Language Model Adversarial Landscape Through the Lens of Attack Objectives

    cs.CR 2025-02 conditional novelty 4.0 of 10

    A survey that re-frames LLM adversarial attacks and defenses around four attacker objectives: privacy, integrity, availability, and misuse.

  16. On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs

    cs.CR 2024-12 reject novelty 4.0 of 10

    Applying CVSS, DREAD, OWASP, and SSVC to 56 adversarial LLM attacks via three LLM judges yields near-constant factor scores, which the authors take as evidence that these metrics cannot differentiate LLM attacks.

  17. Human-Readable Adversarial Prompts: An Investigation into LLM Vulnerabilities Using Situational Context

    cs.CL 2024-12 reject novelty 4.0 of 10

    Human-readable adversarial insertions placed inside movie-summary prompts can jailbreak several open and closed LLMs, but the paper's measured attack rates are not statistically supported.

  18. Adversarial Vulnerabilities in Large Language Models for Time Series Forecasting

    cs.LG 2024-12 conditional novelty 4.0 of 10

    A simple gradient-free 'directional gradient approximation' attack makes LLM time series forecasters degrade more than equivalent random noise, across GPT-3.5, GPT-4, LLaMa, Mistral, TimeGPT, and TimeLLM.

  19. LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds

    cs.CL 2024-12 reject novelty 4.0 of 10

    LIAR shows that best-of-N sampling of suffixes from a GPT-2 model jailbreaks several aligned LLMs with low-perplexity prompts and far faster time-to-attack than training-based attacks.

  20. A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations

    cs.CR 2025-02 conditional novelty 2.0 of 10

    A literature review that taxonomizes LLM backdoor attacks and defenses by model construction phase, with no new experimental results.

Pith tools