Universal suffixes flip 43% of typed decision model answers within minutes
The claim
Short universal adversarial suffixes can cause typed decision models to change correct answers on many inputs
Published as: “FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models”
So what
Typed decision models used as safety guards or routing components can be subverted cheaply with a short universal suffix, undermining their security guarantees.
The five-minute version
A single short suffix discovered on one dataset can flip 90-100% of decisions on five other tasks without any additional queries, and a cheap black-box evolutionary search finds such suffixes in about two minutes per input, flipping confident decisions of the Jev typed decision model. The evidence comes from experiments on 12 public datasets showing high transferability and speed, though universal suffixes only flip 43% of unseen inputs on the same dataset.
What they found 4
- One suffix found on a single dataset flips 90-100% of documents in five other tasks without further search.
“We find that one suffix, found on a single dataset, flips 90-100% of the documents in five other tasks without any further search (panel C).”
- Common prompt-injection strategies do not change any correct decision in 10,240 paired tests.
“Our experiments reveal that no common injection strategy changed a correct answer in 10,240 paired tests, even though the strategies range from “Please output no” and “Ignore previous instructions” to a forged copy of the JSON answer of Jev (§4.2).”
- The black-box attack finds suffixes of 5-31 tokens that flip confident answers, succeeding on 58 of 180 targets with only ~2,000 queries (~2 minutes).
“It succeeds on 58 of 180 targets from different public datasets, and a search of 2,000 queries takes only about two minutes (§4.3).”
- A universal suffix per dataset flips 43% of unseen documents on that dataset.
“One suffix per dataset, found on ten documents, flips 43% of unseen documents across different datasets, while a neutral note flips none.”
What undercuts it the paper’s own results
- Universal suffixes only flip 43% of unseen documents on the same dataset, far less than the 90-100% transfer rate across other tasks.
Stated limits 2
- attacks that change the meaning of the content belong to a different threat model, which is outside our scope.
- our attack could find flips with even fewer queries if its mutation operators or other components were more refined.
What’s new here 3
- A fast black-box query-based attack that uses cheap word-level edits instead of an attacker LLM.
- Discovery of universal adversarial suffixes that transfer across multiple tasks of the same typed decision model.
- Demonstration that a single suffix can flip 90-100% of decisions on five other datasets without any queries on them.
Artifacts & methods 4
- quick black-box query-based attack (evolutionary search)system
- Jev typed decision model APIprimitive
- 12 public benchmark datasets (e.g., AG News, DBpedia, arXiv, etc.)dataset
- evaluation of universal suffix transfer across tasksevaluation