PivotAttack: Rethinking the Search Trajectory in Hard-Label Text Attacks via Pivot Words (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing hard-label text attacks rely on inefficient "outside-in" strategies that traverse vast search spaces. |
| Approach: | They propose a query-efficient "inside-out" framework that perturbs Pivot Sets to induce label flips. |
| Outcome: | The proposed framework outperforms state-of-the-art methods in both Attack Success Rate and query efficiency. |
Similar Papers
TextHacker: Learning based Hybrid Local Search Algorithm for Text Hard-label Adversarial Attack (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing textual adversarial attacks use gradient or prediction confidence to generate adversarials, making it hard to be deployed in real-world applications. |
| Approach: | They propose a textual adversarial attack that randomly perturbs lots of words to craft an adversarial example. |
| Outcome: | The proposed attack outperforms existing hard-label attacks in terms of attack performance and adversary quality. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
Word-level Textual Adversarial Attacking as Combinatorial Optimization (2020.acl-main)
Copied to clipboard
| Challenge: | Existing word-level attack models are far from perfect because of unsuitable search space reduction methods and inefficient optimization algorithms. |
| Approach: | They propose a novel adversarial adversarialist model that incorporates word substitution and particle swarm optimization to solve two problems separately. |
| Outcome: | The proposed model achieves much higher success rates and crafts more high-quality adversarial examples as compared to baseline methods. |
Overcoming Black-box Attack Inefficiency with Hybrid and Dynamic Select Algorithms (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing black-box attack methods require large number of queries, making them inefficient and impractical for researchers. |
| Approach: | proposed new attack selection strategies combine strengths of previous selection algorithms . Hybrid Select merges generalized BinarySelect techniques with GreedySelection . Dynamic Select learns which lengths of texts each selection method should be applied to . |
| Outcome: | proposed methods combine the strengths of previous selection algorithms to improve performance. |
LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation (2026.acl-long)
Copied to clipboard
Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang, Chuang Zhou, Longhao Yang, Lingfei Ren, Xin Yang, Xiao Huang
| Challenge: | Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) however, traditional RAG attacks are difficult to pose an effective threat to GraphRAg systems. |
| Approach: | They propose a novel attack framework that targets logical reasoning rather than injecting false contents into GraphRAG systems by grounding their responses in structured knowledge graphs. |
| Outcome: | The proposed framework outperforms state-of-the-art attacks on GraphRAG systems in both effectiveness and stealth. |
DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLMs Jailbreakers (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing jailbreaking methods view a malicious prompt as a whole but they are not effective at reducing LLMs’ attention on combinations of words with malice. |
| Approach: | They propose an automatic prompt Decomposition and Reconstruction framework for jailbreaking Attack that decomposes a malicious prompt into separate sub-prompts and reassembles them implicitly by In-Context Learning. |
| Outcome: | The proposed framework reduces LLMs' attention on malice words by presenting them to LLM in a fragmented form, addressing these limitations and improving attack effectiveness. |
Context Attribution with Multi-Armed Bandit Optimization (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing approaches to augmenting attribution with retrieval-augmented generation (RAG) focus on training models to explicitly cite context segments during generation, but their reliability remains unverifiable. |
| Approach: | They propose a framework that formulates context attribution as a combinatorial multi-armed bandit problem by using Linear Thompson Sampling to efficiently identify the most influential context segments while minimizing the number of model queries. |
| Outcome: | The proposed method reduces model queries by 30% while matching or exceeding the attribution quality of existing approaches. |
Rethinking Word-level Adversarial Attack: The Trade-off between Efficiency, Effectiveness, and Imperceptibility (2024.lrec-main)
Copied to clipboard
| Challenge: | Neural language models have demonstrated impressive performance but remain vulnerable to word-level adversarial attacks. |
| Approach: | They propose two standardized search spaces to address the problem of word-level adversarial attacks. |
| Outcome: | The proposed search spaces improve performance and trade-offs in different scenarios. |
OpenAttack: An Open-source Textual Adversarial Attack Toolkit (2021.acl-demo)
Copied to clipboard
Guoyang Zeng, Fanchao Qi, Qianrui Zhou, Tingji Zhang, Zixian Ma, Bairu Hou, Yuan Zang, Zhiyuan Liu, Maosong Sun
| Challenge: | Various attack models are distinct and implemented with different programming frameworks and settings, which hinders quick utilization and fair comparison of attack models. |
| Approach: | They propose an open-source textual adversarial attack toolkit to solve these issues by combining 15 typical attack models into one toolkit. |
| Outcome: | The proposed toolkit supports all attack types, multilinguality, and parallel processing. |
ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have proven that private textual data is vulnerable to inversion attacks . authors present a method to reduce the cost of inversion and improve performance . |
| Approach: | They propose a method that aligns victim embeddings to attack space and reconstructs text . they find that none of the defense mechanisms are effective against inversion attacks . |
| Outcome: | The proposed method lowers the cost of inversion and improves performance across languages and domains. |