Papers with defense mechanisms
Arabic Synonym BERT-based Adversarial Examples for Text Classification (2024.eacl-srw)
Copied to clipboard
| Challenge: | Often, research studies quantifying the impact of adversarial text attacks have been applied only to models trained in English. |
| Approach: | They propose a word-level study of adversarial text examples in Arabic . they use a synonym attack with a BERT model to assess their robustness . |
| Outcome: | The proposed attack compares Arabic adversarial examples with their original examples and regains 2% accuracy after training. |
VortexPIA: Indirect Prompt Injection Attack against LLMs for Efficient Extraction of User Privacy (2026.findings-eacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) have been widely deployed in Conversational AIs . however, the methods proposed in the study rely on a white-box setting . |
| Approach: | They propose an indirect prompt injection attack that induces privacy extraction in LLMs . they use token-efficient data containing false memories to inject LLM data . |
| Outcome: | The proposed method outperforms baselines and achieves state-of-the-art performance. |
Two Heads are Better than One: Nested PoE for Robust Defense Against Multi-Backdoors (2024.naacl-long)
Copied to clipboard
| Challenge: | Existing defense mechanisms assume that only one type of trigger is adopted by the attacker, while defending against multiple simultaneous and independent trigger types necessitates general defense frameworks. |
| Approach: | They propose a framework that uses a mixture of experts as a trigger-only ensemble to defend against multiple trigger types. |
| Outcome: | The proposed framework defends against multiple trigger types in a single ensemble and in combination of models. |
Realistic Evaluation of Toxicity in Large Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | a large amount of data exposes large language models to toxicity and bias . prompt engineering can be easily bypassed with minimal prompt engineering. |
| Approach: | They propose a dataset that uses manually crafted prompts to nullify protective layers of large language models. |
| Outcome: | The proposed dataset shows that prompts can nullify protective layers of large language models. |
Canary Extraction in Natural Language Understanding Models (2022.acl-short)
Copied to clipboard
| Challenge: | Recent literature has focused on Model Inversion Attacks (ModIvA) that can extract training data from model parameters. |
| Approach: | They propose an attack that extracts canaries from NLU training data and reconstructs them using non-sensitive tokens. |
| Outcome: | The proposed attack can reconstruct a four digit code in the training dataset with a probability of 0.5 in its best configuration. |
Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring (2025.naacl-long)
Copied to clipboard
Honglin Mu, Han He, Yuxin Zhou, Yunlong Feng, Yang Xu, Libo Qin, Xiaoming Shi, Zeming Liu, Xudong Han, Qi Shi, Qingfu Zhu, Wanxiang Che
| Challenge: | Existing black-box jailbreak methods often rely on model feedback . existing methods may be intercepted by content moderators during the search process . |
| Approach: | They propose a method that guides malicious prompt construction by local training a mirror model of the target black-box model through benign data distillation. |
| Outcome: | The proposed method achieves a 92% attack success rate and 80% stealth rate on a subset of AdvBench. |
Data Poisoning for In-context Learning (2025.findings-naacl)
Copied to clipboard
| Challenge: | In-context learning (ICL) has emerged as a capability of large language models (LLMs) but there is limited understanding of its vulnerability against data poisoning attacks. |
| Approach: | They propose an attack method that exploits ICL’s unique learning mechanisms by identifying discrete text perturbations that influence LLM hidden states. |
| Outcome: | The proposed attack method exploits ICL’s learning mechanisms by identifying discrete text perturbations that influence LLM hidden states. |
Detection of Adversarial Prompts with Model Predictive Entropy (2026.findings-eacl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are increasingly deployed in high-impact scenarios raising concerns about their safety and security. |
| Approach: | They propose an attack-agnostic pipeline for detecting adversarial inputs without prior knowledge of attack specifications. |
| Outcome: | The proposed pipeline outperforms traditional defenses in terms of adaptability and resource efficiency. |
PATCH: Mitigating PII Leakage in Language Models with Privacy-Aware Targeted Circuit PatcHing (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing defense mechanisms to mitigate PII leakage are limited by existing defenses . a new approach, PATCH, identifies and edits PI I circuits to reduce leakage . |
| Approach: | They propose to use PATCH: Privacy-Aware Targeted Circuit Patching to identify PII leakage circuits in language models to reduce leakage. |
| Outcome: | The proposed approach reduces leakage by up to 65% and can reduce residual leakage to as low as 0.01%. |
Merger-as-a-Stealer: Stealing Targeted PII from Aligned LLMs with Model Merging (2025.emnlp-main)
Copied to clipboard
| Challenge: | Model merging is a promising approach for updating large language models . but unmonitored mergers can introduce significant security vulnerabilities . |
| Approach: | They propose a model merging attack surface where a malicious merger can extract PII from an aligned model with model merg. |
| Outcome: | The proposed framework can extract PII from an aligned model with model merging. |
Reconstruct Your Previous Conversations! Comprehensively Investigating Privacy Leakage Risks in Conversations with GPT Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing GPT models allow users to interact with them for multiple rounds to optimize the task execution. |
| Approach: | They propose a conversation reconstruction attack targeting the contents of previous conversations between GPT models and benign users, i.e., the benign users’ input contents during their interaction with GPT. |
| Outcome: | The proposed attacks demonstrate that GPT-4's defense mechanisms are ineffective against these attacks. |
AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization via Multi-LLMs (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing jailbreak research exhibits limitations in universality, validity, and efficiency . Existing methods for jailbreaking LLMs have limited validity and effectiveness . |
| Approach: | They propose a black-box approach that uses wordplay-guided mapping rule sampling to create universal adversarial prompts. |
| Outcome: | The proposed method efficiently identifies security vulnerabilities across various LLMs, achieving an average success rate of over 80% with fewer than 10 queries. |
Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks (2025.acl-long)
Copied to clipboard
| Challenge: | Multi-agent LLMs are prone to adversarial attacks because of constraints such as limited token bandwidth and latency between message delivery. |
| Approach: | They propose a permutation-invariant adversarial attack that optimizes prompt distribution across latency and bandwidth constraints to bypass distributed safety mechanisms within the system. |
| Outcome: | The proposed method outperforms conventional attacks by up to 7 on multiple models. |
TWIST: Text-encoder Weight-editing for Inserting Secret Trojans in Text-to-Image Models (2025.acl-long)
Copied to clipboard
| Challenge: | Existing Trojan attacks require extensive training data and poor generalization, limiting effectiveness and scalability. |
| Approach: | They propose a method for embedding Trojans into plugins using a single edit layer . they find that the method reduces modified parameters by 8-fold and cuts injection time to 25 seconds . |
| Outcome: | The proposed method achieves an average attack success rate of 91%, a 78% improvement over the state-of-the-art (SOTA) method. |
DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing safety mechanisms for Large Language Models (LLMs) are inadequate to protect against jailbreak attacks, resulting in performance degradation on general tasks. |
| Approach: | They propose a method that directly updates a minimal set of relevant parameters to neutralize harmful behaviors while preserving the model’s utility. |
| Outcome: | The proposed model outperforms baseline methods in mitigating jailbreak attacks while preserving the model’s utility. |
Can an Individual Manipulate the Collective Decisions of Multi-Agents? (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent studies show that coordinated multi-agent systems exhibit enhanced decision-making and reasoning abilities through collaboration. |
| Approach: | They propose a framework that simulates agent interactions within a multi-agent system to generate adversarial samples and use them to manipulate the target agent in the target system. |
| Outcome: | The proposed framework generates adversarial samples that are used to manipulate the target agent in the target system, misleading the system’s decision-making process. |
Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization (2025.findings-emnlp)
Copied to clipboard
| Challenge: | HKVE selectively accepts gradient optimization results based on the distribution of attention scores across different layers, ensuring that every optimization step positively contributes to the attack. |
| Approach: | They propose a framework that selectively accepts gradient optimization results based on the distribution of attention scores across different layers and selectively takes them into account when calculating the attack success rate. |
| Outcome: | The proposed framework outperforms existing methods by achieving success rates of 75.08% on MiniGPT4, 85.84% on LLaVA and 81.00% on Qwen-VL. |
Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replay (2026.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have remarkable capabilities but are vulnerable to adversarial “jailbreak” attacks designed to bypass safety guardrails. |
| Approach: | They propose to empower a large language model to be its own red teamer . safety self-play allows the model to act as both the Attacker and Defender . |
| Outcome: | The proposed approach outperforms baselines trained on static adversarial datasets and establishes a new benchmark for proactive safety alignment. |
Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversion (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak methods face an excessive number of iterative queries and poor generalization across models. |
| Approach: | They propose a jailbreak method that employs **I**ntent **C**oncealment and div**E**rsion to circumvent security constraints. |
| Outcome: | The proposed method outperforms existing jailbreak techniques in question-answering and text-generation tasks. |
ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have proven that private textual data is vulnerable to inversion attacks . authors present a method to reduce the cost of inversion and improve performance . |
| Approach: | They propose a method that aligns victim embeddings to attack space and reconstructs text . they find that none of the defense mechanisms are effective against inversion attacks . |
| Outcome: | The proposed method lowers the cost of inversion and improves performance across languages and domains. |
Safety Alignment via Constrained Knowledge Unlearning (2025.acl-long)
Copied to clipboard
Zesheng Shi, Yucheng Zhou, Jing Li, Yuxin Jin, Yu Li, Daojing He, Fangming Liu, Saleh Alharbi, Jun Yu, Min Zhang
| Challenge: | Existing defense mechanisms have not fully deleted harmful knowledge in large language models (LLMs) Existing methods to address safety alignment have not completely deleted harmful information in LLMs. |
| Approach: | They propose a safety alignment strategy that uses scoring neurons to identify useful knowledge in LLMs and pruning the gradients of neurons in U to preserve beneficial information. |
| Outcome: | The proposed method significantly improves model safety while maintaining utility compared to existing methods. |
XGUARD: A Graded Benchmark for Evaluating Safety Failures of Large Language Models on Extremist Content (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety evaluations rely on binary labels, overlooking the nuanced risk these outputs pose. |
| Approach: | They propose a framework to assess the severity of extremist content generated by Large Language Models (LLMs) it categorizes model responses into five danger levels (0–4) defined by degree of extremism endorsement . |
| Outcome: | The proposed framework categorizes model responses into five danger levels (0–4) defined by degree of extremist endorsement, enabling nuanced analysis of failure frequency and severity. |
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption (2026.findings-acl)
Copied to clipboard
Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, Jun Dai, Xiaoyan Sun, Ping Chen
| Challenge: | Existing defense mechanisms lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content. |
| Approach: | They propose a provably robust retrieval aggregation algorithm designed to defend against poisoning attacks on retrieved texts. |
| Outcome: | Experiments show that PRA-RAG reduces the attack success rate to as low as 1% while maintaining an accuracy of 71%, significantly outperforming representative state-of-the-art (SOTA) methods. |
Hail to the Thief: Exploring Attacks and Defenses in Decentralised GRPO (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent years have seen great interest in Reinforcement Learning (RL) for the purposes of posttraining of Large Language Models (LLMs). |
| Approach: | They propose two defense mechanisms that check logit probabilities of completions or utilize an LLM judge to filter completions. |
| Outcome: | The proposed attacks can achieve attacks success rates of up to 100% in as few as 50 iterations. |