Language models suffer from adversarial vulnerability, where imperceptible perturbations in inputs can mislead model predictions. Existing adversarial training methods enhance model robustness by augmenting training data with worst-case adversarial perturbations for each input. However, these approaches overlook the intrinsic causal relationships within data. We construct causal graphs to model the behavior of encoder-based language models under adversarial inputs, suggesting that adversarial vulnerability is often associated with the model’s overfitting to spurious correlations. Within the adversarial training framework, we formulate expressions for Total Effect (TE) and Natural Direct Effect (NDE), and propose a causal regularization objective based on TE-NDE alignment. Experiments on five benchmark datasets show that this causal adversarial training framework improves adversarial robustness across different settings. We further evaluate the model behavior in a controlled sentiment analysis setting, where the quantitative results provide additional evidence for the effectiveness of our method.
This paper proposes a novel LVLM attack method, called BadPhase with further backdoor designs, to implant adversarial phase as triggers into any image inputs via data poisoning so as to control the LVLMs’ predictions and finds that LVLMs are sensitive to the phase-aware image structure.
Daizong Liu, Junhao Dong, Xiang Fang et al.· 0 citations
A collaborative adversarial fine-tuning framework that maintains multiple experts during training, enables knowledge exchange through embedding-space harmonization, and consolidates the learned knowledge into a single unified robust model.
Nguyen Duc Thai, Junhao Dong, Sua Qi Rong et al.· 0 citations
Adversarial training (AT) is a widely adopted defense against adversarial attacks, but its multi-step optimization process for generating adversarial examples leads to substantial computational overhead. To mitigate this, various single-step adversarial training methods have been proposed. However, these models often suffer from catastrophic overfitting under larger perturbations and exhibit degraded robustness. The core issue is that certain single-step adversarial examples, although successfully learned and correctly classified, fail to expose the true vulnerabilities of models. We refer to these misleading examples as “fakers”. Specifically, we find that fakers exhibit three distinct characteristics compared to standard adversarial examples: 1) they unexpectedly degrade the model robustness rather than improve it; 2) they make it harder for the model to learn their robust features; and 3) they show significantly greater divergence from their clean counterparts. These observations motivate us to proactively reduce the impact of fakers during training. To this end, we propose the Faker-Alleviating Single-step adversarial Training method (FAST), a general and effective framework designed to enhance both accuracy and robustness. Concretely, FAST consists of two main components. First, it dynamically adjusts the label-smoothing level for adversarial examples according to their learning difficulty, making fakers easier for the model to learn. Second, it introduces an auxiliary sample with a weak adversarial effect, derived from the single-step adversarial example, which is used to dynamically ease the alignment with clean data and stabilize the optimization process. We demonstrate the effectiveness of FAST through extensive experiments, showing that our method achieves superior clean accuracy and robustness against various types of adversarial attacks. The code is available at https://github.com/mesunhlf/FAST.
Lifeng Huang, Yuquan Lin, Chen Wan et al.· IEEE Transactions on Informa...· 0 citations
This survey provides a comprehensive analysis of adversarial prompting strategies, ranging from input manipulation techniques to semantic and structural distortions, and explores defense strategies across preprocessing, model-level, postprocessing, and hybrid strategies, highlighting recent advances and their limitations.
A. Nasution, Ahmet Emre Ergün, Aytu˘g Onan et al.· IEEE Access· 0 citations
Evidential Adversarial Training (EV-AT), which models uncertainty through a Dirichlet distribution and combines an evidence-based loss promoting clean accuracy and reliable uncertainty with a robust evidence-alignment loss matching clean and adversarial predictions in log Dirichlet-parameter space, is proposed.
Nicolas Sournac, Ahmed Baha Ben Jmaa, B. Braeckeveldt· 0 citations
This work proposes a white-box spectral-subspace-guided attack (SSGRA) that aligns intermediate representations with the subspace spanned by the bottom right singular vectors, offering a spectral interpretation of adversarial vulnerability in VLMs, providing insights for improving their robustness.
Chethan Krishnamurthy Ramanaik, Tobias Callies, Michael Hecht et al.· 0 citations
