Papers by Vitaly Shmatikov
Adversarial Decoding: Generating Readable Documents for Adversarial Objectives (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing methods for generating adversarial documents produce gibberish that is easy to detect and filter out. |
| Approach: | They propose a generic text generation technique that produces readable adversarial documents . they demonstrate that adversarials can be used for different objectives . |
| Outcome: | The proposed technique outperforms existing methods while producing readable documents for adversarial objectives. |
Extracting Prompts by Inverting LLM Outputs (2024.emnlp-main)
Copied to clipboard
| Challenge: | Unlike previous methods, output2prompt only needs outputs of normal user queries. |
| Approach: | They propose a black-box method that extracts the model's prompt without accessing its logits and without adversarial or jailbreaking queries. |
| Outcome: | The proposed method extracts the prompt that generated the outputs without accessing the model's logits and without adversarial or jailbreaking queries. |
Adversarial Semantic Collisions (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to generate semantic collisions for NLP tasks are vulnerable to adversarial examples. |
| Approach: | They propose gradient-based approaches for generating semantic collisions given white-box access to a model and deploy them against several NLP tasks. |
| Outcome: | The proposed approaches evade perplexity-based filtering and discuss other potential mitigations. |
Text Embeddings Reveal (Almost) As Much As Text (2023.emnlp-main)
Copied to clipboard
| Challenge: | a vector database of dense text embeddings stores only the text data, not the original text . a multi-step method that iteratively corrects and re-embeds text can recover 92% of 32-token text inputs exactly. |
| Approach: | They propose a method that iteratively corrects and re-embeds text to recover 92% of 32-token text inputs exactly. |
| Outcome: | The proposed method recovers 92% of 32-token text inputs exactly. |