arXiv cs.CL· Ali Al-Lawati, Elsayed Eshra, Dongwon Lee, Suhang Wang·· 13 小时前AI 评分29
用扩散语言模型实现困惑度感知的黑盒攻击
Diffusion Language Models for Perplexity-Aware Black-Box Attacks
AI 导读
研究将连续隐空间黑盒攻击框架直接耦合到连续扩散语言模型（dLLM），用学习到的语言生成分布替代随机映射，同时保留标准高斯隐空间与采样/优化流程。在 RareTrap 采样估计下字符级困惑度从 10^3–10^7 降至 3–5，ThinkTrap 优化搜索下从 20–28 降至 4.3–5.4。两种映射下模型风险估计可相差一个数量级。
正文 · 原文
Abstract:\emph{Continuous-space} attacks find prompts that trigger malicious behaviors, such as overthinking, in black-box LLMs by sampling or optimizing over a low-dimensional Gaussian latent space and decoding it to text through a \emph{random mapping} and nearest-token lookup. Because the random mapping is not learned from language, its prompts can be highly unnatural, and as such easily detectable through input guardrails, and the risk estimates they yield are not grounded in natural prompts. In this paper, we demonstrate that the same continuous latent-space framework can be coupled directly to a learned generative distribution over language, a continuous diffusion language model (dLLM), which removes the artificial random mapping while preserving the standard-Gaussian latent formulation and the downstream sampling or optimization procedure. We evaluate this approach under two settings: sampling-based estimation using \emph{RareTrap} and optimization-based search using \emph{ThinkTrap}. We find that character-level perplexity drops from $10^3$--$10^7$ to 3--5 in RareTrap and from 20--28 to 4.3--5.4 in ThinkTrap. We also find that model risk estimates can differ by an order of magnitude across the two mappings.
| Subjects: | Machine Learning (cs.LG); Computation and Language (cs.CL); Machine Learning (stat.ML) |
| Cite as: | arXiv:2610.31558 [cs.LG] |
| (or arXiv:2610.31558v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.31558 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Ali Al Lawati [view email]
[v1]
Thu, 22 Oct 2026 17:00:39 UTC (222 KB)
来源：arXiv cs.CL · arxiv.org