| Challenge: | Existing studies focus on manipulating word inputs, but they lack generalization to versatile real-world attacks. |
| Approach: | They propose a powerful perturbation technique which perturbs the attention scores within the SA matrices via meticulously crafted attention masks. |
| Outcome: | The proposed perturbation technique achieves high attack success rate (98%) and low cost. |
Similar Papers
The Shape of Vulnerability: How Adversarial Perturbations Reshape the Topology of Language Model Latent Spaces (2026.acl-srw)
Copied to clipboard
Angelina Tsai, Shreya Subramanian, Catherine Liu, Kimberly Lopez, Leif Zinn-Brooks, Alexia E. Schulz, Adaku Uchendu
| Challenge: | Large Language Models (LLMs) have unprecedented capabilities, but they pose security concerns . current adversarial attacks exploit vulnerabilities in the embedding space of language models, allowing attackers to bypass safety guardrails and cause significant harmful consequences. |
| Approach: | They propose to use topological data analysis to characterize how adversarial perturbations act on text inputs by computing persistent homology metrics from attention maps across different model architectures. |
| Outcome: | The proposed visualizations show that adversarial perturbations alter higher-dimensional topological features in ways that distinguish them from clean, non-adversarial inputs. |
DeTAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modification (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing defense methods rely on fine-tuning or input modification, which suffer from limited generalization and reduced utility. |
| Approach: | They propose a finetuning-free approach that improves the defensive capabilities against jailbreak attacks of LLMs via targeted attention modification. |
| Outcome: | The proposed approach outperforms baselines in jailbreak defense and exhibits robust generalization across attacks and models, maintaining its effectiveness even on in-the-wild jailbreak data. |
RobustEmbed: Robust Sentence Embeddings Using Self-Supervised Contrastive Pre-Training (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing PLMs suffer from poor robustness in adversarial scenarios, despite their success with unseen samples. |
| Approach: | They propose a self-supervised sentence embedding framework that enhances generalization and robustness in various text representation tasks and against diverse adversarial attacks. |
| Outcome: | The proposed framework improves generalization and robustness in various representation tasks and against diverse adversarial attacks. |
Convolutions and Self-Attention: Re-interpreting Relative Positions in Pre-trained Language Models (2021.acl-long)
Copied to clipboard
| Challenge: | Recent work has shown that convolutions have been successful in natural language learning. |
| Approach: | They propose a convolutional approach to construct relative position embeddings in self-attention layers and propose 'compact attention' they propose multiple ways to integrate convolutions into Transformer self- attention. |
| Outcome: | The proposed composite attention improves performance on multiple downstream tasks, replacing absolute position embeddings, and is more expressive than convolutions in NLP. |
Attention-Enhancing Backdoor Attacks Against BERT-based Models (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing textual backdoor attacks focus on generating stealthy triggers or modifying model weights. |
| Approach: | They propose a Trojan Attention Loss (TAL) which enhances the Trojan behavior by directly manipulating attention patterns. |
| Outcome: | The proposed method improves the effectiveness of the backdoor attacks on different backbone models and tasks. |
Attention Eclipse: Manipulating Attention to Bypass LLM Safety-Alignment (2025.emnlp-main)
Copied to clipboard
Pedram Zaree, Md Abdullah Al Mamun, Quazi Mishkatul Alam, Yue Dong, Ihsen Alouani, Nael Abu-Ghazaleh
| Challenge: | Recent research has shown that carefully crafted jailbreak inputs can induce large language models to produce harmful outputs, despite safety measures such as alignment. |
| Approach: | They propose a method for generating highly effective Jailbreak attacks that selectively strengthen or weaken attention among different parts of the prompt. |
| Outcome: | The proposed attacks amplify the success rate of existing Jailbreak algorithms while lowering generation cost. |
Adversarial Robustness for Large Language NER models using Disentanglement and Word Attributions (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Named Entity Recognition (NER) tasks are becoming more challenging due to the introduction of complex tagsets, which often leads to the failure of existing NER systems in accurately recognizing these entities. |
| Approach: | They propose a novel attack which relies on disentanglement and word attribution techniques to learn an embedding and identifying important words across both components. |
| Outcome: | The proposed approach improves the F1 score over the original LLM model by 8% and 18% on CoNLL-2003 and Ontonotes 5.0 datasets respectively. |
TinyAttack: Exploring Stylistic Vulnerabilities in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing research on robustness of large language models has focused on text-based perturbations and the use of invisible characters and homoglyphs. |
| Approach: | They propose a framework to exploit weaknesses in Large Language Models (LLMs) by changing their stylistic structure using Unicode. |
| Outcome: | The proposed framework exploits vulnerabilities in large language models through Unicode-based stylistic transformations without altering its semantic or syntactic structure. |
Does Self-Attention Need Separate Weights in Transformers? (2025.naacl-industry)
Copied to clipboard
| Challenge: | Experimental results show a 66.53% reduction in parameter size within the attention block and competitive accuracy improvements of 3.55% and 0.89% over symmetric and pairwise attention-based models, respectively. |
| Approach: | They propose a simplified approach where a single weight matrix is used for Keys, Queries, and Values instead of separate matrices for each. |
| Outcome: | The proposed approach outperforms the BERT baseline on GLUE tasks even outperforming the standard BERT model in handling noisy and out-of-domain data. |
Self-Supervised Contrastive Learning with Adversarial Perturbations for Defending Word Substitution-based Attacks (2022.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to improve model robustness against word substitution-based adversarial attacks are too slow to generate adversarials on the fly. |
| Approach: | They propose an approach to improve the robustness of BERT models against word substitution-based adversarial attacks by leveraging adversarials for self-supervised contrastive learning. |
| Outcome: | The proposed method improves robustness of BERT models against word substitution-based adversarial attacks without using any labeled data. |