用可微分方法生成通用对抗后缀，让模型分类出错且信心下降。
Universal Adversarial Suffixes Using Calibrated Gumbel-Softmax Relaxation
- 用改进的Gumbel-Softmax在软空间学习后缀，再离散化用于攻击
- 一个后缀能跨任务、跨模型降低准确率和置信度，最多降18.7%
- 适合研究模型鲁棒性或防御机制的读者参考
语言模型常通过评分标签词实现零样本或少样本分类，但易受对抗提示影响。以往工作多针对特定任务或模型优化触发词，难以比较且泛化能力差。本文研究通用对抗后缀：长度为4-10个词元的短序列，附加任意输入后即可广泛降低多个任务与模型的准确率。方法在可微分的“软”空间中使用Gumbel-Softmax松弛学习后缀，并在推理时离散化。训练过程最大化标签区域的校准交叉熵，同时屏蔽真实标签以防止信息泄露，并加入熵正则项防止退化。单一后缀在Qwen2-1.5B、Phi-1.5、TinyLlama-1.1B等模型上训练后，可在情感分析、自然语言推理、释义检测、常识问答和物理推理任务中有效迁移，平均准确率下降达18.7%，同时校准置信度显著降低。
原文摘要 · Abstract (English)
Language models (LMs) are often used as zero-shot or few-shot classifiers by scoring label words, but they remain fragile to adversarial prompts. Prior work typically optimizes task- or model-specific triggers, making results difficult to compare and limiting transferability. We study universal adversarial suffixes: short token sequences (4-10 tokens) that, when appended to any input, broadly reduce accuracy across tasks and models. Our approach learns the suffix in a differentiable "soft" form using Gumbel-Softmax relaxation and then discretizes it for inference. Training maximizes calibrated cross-entropy on the label region while masking gold tokens to prevent trivial leakage, with entropy regularization to avoid collapse. A single suffix trained on one model transfers effectively to others, consistently lowering both accuracy and calibrated confidence. Experiments on sentiment analysis, natural language inference, paraphrase detection, commonsense QA, and physical reasoning with Qwen2-1.5B, Phi-1.5, and TinyLlama-1.1B demonstrate consistent attack effectiveness and transfer across tasks and model families.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。