Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that existing vulnerability scoring systems cannot rank adversarial attacks on LLMs, because scores show minimal variation across 56 attacks and CVSS-style rigid factors are the least informative, pointing to a need for…

desk verdict Useful corpus and a fair question, but the headline claim about 'minimal variation' is not backed by the numbers the paper actually reports. read the letter →

arxiv 2412.20087 v1 pith:6TGOMDND submitted 2024-12-28 cs.CR cs.AI

Atmane Ayoub Mansour Bahar , Ahmad Samer Wazan This is my paper · ORCID
classification cs.CRcs.AI
keywords adversarialattackslargelanguagemodelsvulnerabilityscoringCVSSDREADOWASPRiskRatingSSVCcoefficientofvariation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to test whether four established vulnerability-scoring systems—DREAD, CVSS, OWASP Risk Rating, and SSVC—can meaningfully rank adversarial attacks against large language models. The authors assemble 56 recent attacks in seven categories, have three LLMs score every attack under each metric, average the three assessments with human oversight, and then measure how much each metric's factors vary. They find that scores barely vary across attacks: factors like CVSS attack vector and SSVC exploitability are almost constant, while CIA impacts are fixed within each attack class. The paper concludes that rigid, context-specific factors in traditional metrics are inadequate for LLM adversarial attacks and that flexible, LLM-specific metrics are needed.

What carries the argument

The machinery is a scoring pipeline: three large language models independently assign factor values for each of the 56 attacks under DREAD, CVSS, OWASP Risk Rating, and SSVC; the values are averaged and rounded to produce a consensus vector; the official calculators turn those vectors into scores; then coefficient of variation for numeric DREAD and OWASP factors and Shannon entropy for categorical CVSS and SSVC factors quantify how much each factor distinguishes attacks. A human-in-the-loop pass corrects identified misreadings, and a validation test on published CVEs is used to claim that the LLM-based consensus tracks human-validated scores.

What would settle it

Recompute the CVSS and SSVC scores for the 56 attacks using a majority vote among the three LLM judges instead of averaging encoded categorical values, then compare the spread; if variability rises materially, or if an averaged factor contradicts a two-of-three majority (as in Table A.19, where averaged Confidentiality impact is Low despite two judges saying None), the reported flat scores are an artifact of averaging.

Watch

Extended reading notes

Core claim

The central claim is that existing vulnerability scoring systems yield nearly identical scores across diverse adversarial attacks on LLMs, so the factors they rely on fail to differentiate severity. The evidence is statistical: coefficient of variation below about 10 to 20 percent for most DREAD and OWASP factors, and low entropy for CVSS and SSVC categorical factors. For instance, attack vector is Network for 55 of 56 attacks, 53 of 56 attacks have a proof-of-concept for SSVC exploitation, and CIA factors are constant within attack classes. The paper argues this uniformity shows these metrics cannot rank LLM threats, and that the limitation is worst for context-specific factors or those with predefined value sets.

Load-bearing premise

The load-bearing premise is that averaging integer-encoded categorical values across three LLM judges and rounding to the nearest category yields a valid consensus factor vector; the paper never justifies this mapping.

Editorial extensions

If this is right

  • Security teams cannot rely on CVSS, DREAD, OWASP Risk Rating, or SSVC to decide which LLM adversarial attack to patch first, because the scores across 56 diverse attacks are nearly flat.
  • Factors with rigid predefined value sets, such as CVSS attack vector and SSVC exploitation, are the least informative: 55 of 56 attacks are Network and 53 of 56 have a proof-of-concept, so these factors classify almost every attack identically.
  • Metrics with more general factors and wider scales, notably OWASP Risk Rating, show somewhat more variability, indicating that flexibility rather than granularity is what differentiates attacks.
  • New LLM-specific frameworks should replace CIA-focused impact with model-behavioral harms such as trust erosion and misinformation, add context-aware factors like model size and data sensitivity, and possibly incorporate attack success rates.
  • Using more finely grained qualitative choices, such as attack complexity with four or more levels, would increase score variability and make rankings more actionable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the averaging of categorical values is replaced by majority vote, the spread of CVSS scores may change materially; in the paper's own appendix the averaged Confidentiality impact for White-box attack 1 is Low while two of three judges said None, so the flat-score conclusion should be re-tested per judge before being adopted.
  • The paper's 9-CVE validation table suggests closeness qualitatively but reports no agreement statistic; a larger human-scored benchmark would tell whether LLM consensus scoring is accurate or merely self-consistent.
  • A natural extension is to build severity scales directly from attack outcomes such as policy violation, data extraction, and misinformation, and anchor them to deployment context like chatbot, agent, or code completion, which the existing CIA-centric factors cannot express.
  • Because the 56 attacks were chosen as eight representatives per category, per-class coefficient of variation may understate global spread; a pooled analysis across all 56 attacks would test whether the metrics can rank attacks of different types at all.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper evaluates four traditional vulnerability scoring systems (DREAD, CVSS, OWASP Risk Rating, and SSVC) on 56 adversarial attacks against LLMs. Attacks are grouped into seven types, and each attack is scored independently by three LLMs (GPT-4o, LLAMA3.2, Perplexity AI) with human-in-the-loop revision; the three scores are averaged to produce final factor vectors and composite scores. The paper reports per-factor coefficients of variation for DREAD and OWASP and per-factor Shannon entropies for CVSS and SSVC, grouped by attack class, and interprets these as evidence that the metrics produce 'minimal variation' across attacks and are therefore inadequate for LLM threat assessment. It also proposes directions for future LLM-specific metrics.

Significance. The curated list of 56 attacks and the detailed per-LLM scoring tables in the appendix are useful reference material for the community, and the paper addresses a real and timely question: whether legacy vulnerability scoring systems can rank adversarial LLM attacks. The taxonomy in Section 3 is thorough, and the attempt to validate LLM-generated scores against nine existing CVEs is a worthwhile first step. However, the paper's central claim is not supported by the statistics it actually computes, and the scoring pipeline itself has unresolved validity issues. If the claim about low variability are correct, the finding would be important for metric design, but the present evidence does not establish it.

major comments (4)
  1. [Abstract; §2.3; §7] The abstract states that existing scoring systems 'yield vulnerability scores with minimal variation across different attacks,' but the analysis defined in §2.3 and presented in Tables 14–17 computes per-factor dispersion within each attack class, never the dispersion of final composite scores across the 56 attacks. No table or calculation addresses the variation of the final scores. The authors' own reported final scores are not minimally variable: CVSS Base Scores in Sections 6.1.2–6.7.2 range from 5.4 to 9.3, OWASP final scores range from 1.9 to 4.9, and DREAD scores range from 5.6 to 8.0. The paper's own data therefore contradict the abstract's central claim, and the per-factor entropy and CV results in Tables 14–17 support only the weaker claim that individual factors do not differentiate attacks within a class.
  2. [§2.2; Table A.19] For the categorical CVSS and SSVC factors, the paper averages numerical encodings of values such as None/Low/High, but the encoding and the rounding rule are never specified or justified. The averaged factor can disagree with the majority of the three judges and can even be a value that none of the judges assigned: in Table A.19, attack 1, the averaged Confidentiality impact is 'Low' although two of the three LLMs scored it 'None.' Since these averaged vectors are the inputs to the official score calculators and to the entropy analysis in Tables 15 and 17, the resulting scores and conclusions inherit an arbitrary rescaling that is not tied to the metric definitions.
  3. [§2.2; §6.1.3; §6.2.4] The scores that drive the conclusion are generated by LLMs, the same class of systems the attacks target, and the authors intervened to change those scores when they appeared too uniform or inconsistent. For example, §6.1.3 describes prompting GPT-4o to revise identical scores so that the evaluations became more distinct, and §6.2.4 describes prompting LLAMA-3 to change an SSVC Exploitation value from 'Active' to 'Proof-of-Concept.' The revision criteria are not specified, and no inter-annotator agreement or stability analysis is reported. Consequently, the observed low variation is at least partly an artifact of the evaluation procedure and of the shared tendencies of the three LLM judges, rather than a property of the vulnerability metrics under test.
  4. [§2.2; Table 1] The validation of the LLM-scoring approach uses only nine CVEs and reports no quantitative agreement statistics. Visual inspection of Table 1 shows several mismatches, such as CVE-2017-3183, where the LLMs assign Integrity impact N instead of H, and CVE-2015-5374, where the SSVC Exploitation value differs. Since the entire dataset is scored by LLMs, this validation is the only basis for treating LLM-provided scores as a proxy for expert vulnerability assessment; without quantified agreement (e.g., Cohen's kappa or per-factor agreement rates), the proxy assumption is not established.
minor comments (4)
  1. [§5.2.3, Eq. (8)] The OWASP final scores reported in Section 6 are about one tenth of the product of Likelihood and Impact defined by Eq. (8); the implicit division by 10 should be stated so that the calculations are reproducible.
  2. [§6.5] The first sentence of Section 6.5 refers to evaluating attacks with 'the five vulnerability metrics,' but the study uses exactly four metrics; please correct this typo.
  3. [Table A.26] In Table A.26, attack 8, the average DREAD score is labeled 5.2 (H), but according to the criticality ranges defined in Section 5.2.1 a score of 5.2 is Medium; the label should be corrected.
  4. [§6.1.1; §6.1.2] The spider charts in Sections 6.1.1 and 6.1.2 have eight overlaid series with no legend, which makes them difficult to read and prevents verification against the corresponding tables; adding a legend or separate panels per attack would help.

Circularity Check

1 steps flagged · score 6.0 of 10

Central 'minimal variation' claim is partly forced by the paper's scoring definition: vulnerability scores are defined as the average of three LLM ratings, and averaging attenuates variance by construction.

  1. self definitional [Section 2.2 (Score assessments); Abstract; Sections 7.1-7.2 (interpretation of COV/entropy)]
    "For each scoring factor, we calculated the average score provided by the three LLMs, rounded to the closest unit. ... The results indicate that existing scoring-systems yield vulnerability scores with minimal variation across different attacks, suggesting that many of the metric factors are inadequate ... particularly ... those with predefined value sets, such as those in CVSS."

    The reported 'vulnerability score' is the rounded arithmetic mean of three LLM factor ratings, not a raw metric output. For any factor, Var(mean of 3) = Var(raw)/3, so the COV of averaged scores is attenuated by 1/sqrt(3) relative to individual LLM ratings. The paper then attributes this attenuated dispersion to the metric factors ('context-specific factors or those with predefined value sets, such as those in CVSS'). The 'minimal variation' result is therefore partly a mathematical consequence of the aggregation rule in Section 2.2, not an independent property of the factors.

full rationale

The paper's CVE validation (Table 1) is an external check of the LLM-scoring procedure and is not self-citational; it supports the general reliability of the judges. There is no load-bearing self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via citation. However, the central 'minimal variation' finding is not fully independent: Section 2.2 defines the score as the rounded mean of three LLM ratings, and Section 7 interprets COV/entropy computed on those averaged, rounded values. Because averaging reduces variance by construction, the conclusion that metric factors are inadequate is partly an artifact of the chosen aggregation, not a pure measurement of the official metrics. Also, the abstract speaks of variation of vulnerability scores across the 56 attacks, but Section 2.3 and Section 7 actually report per-factor COV/entropy; the variation of final composite scores (e.g., CVSS 5.4-9.3, OWASP 1.9-4.9) is never tabulated. That is a reporting gap, not itself a circular step, but it reinforces that the paper's headline claim is one step removed from what is computed. Score 6 reflects partial construction: part of the low-variation result is forced by the averaging definition, while part (e.g., Attack Vector = Network for 55/56 attacks) comes from the raw LLM judgments.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The analysis rests on several unvalidated choices: the numeric encoding and rounding used to average LLM scores, the ad hoc human revisions, and the assumption that eight attacks per category are representative. These are free choices, not derived from first principles, and they directly shape the reported variability. The use of standard statistical tools (CV, entropy) is uncontroversial, but the validity of the input scores is not established.

free parameters (4)
  • Numeric encoding for categorical CVSS/SSVC factors = Not published; the spider-plot in Section 6 maps four-value factors to 1-4, three-value to 1-3, two-value to 2 and 4
    The averaging of LLM categorical scores (Section 2.2) requires such an encoding, and the choice affects every consensus vector and base score.
  • Rounding rule for averages = Round to closest unit
    Section 2.2: 'we calculated the average score provided by the three LLMs, rounded to the closest unit'. This loses information and can change a 'Low' average into a 'High' category.
  • Human-in-the-loop revision criteria = Unspecified
    Section 2.2 and Section 6 describe ad hoc corrections, e.g., GPT-4o changed DREAD Discoverability from 8 to 5 and OWASP ED from 6 to 5; without a fixed protocol, the scores are not uniquely determined.
  • Attack selection per type = 8 per type, 7 types
    Section 2.1: 'for each type, we selected eight representative attacks'; the representativeness of this sample is assumed, and different choices would likely change the CV and entropy results.
assumptions (4)
  • ad hoc to paper LLM-provided scores, after human-in-the-loop revision, are a valid proxy for expert vulnerability assessments
    Section 2.2 states this to justify the approach; validated only on 9 CVEs for CVSS/SSVC, not for DREAD/OWASP, and not for the 56 LLM attacks.
  • domain assumption The 56 selected attacks are representative of all adversarial attacks on LLMs
    Section 2.1: 'we selected eight representative attacks' per type, but no sampling frame is given.
  • standard math Standard CVSS/SSVC calculators and decision trees are the correct ground truth for scoring
    Paper relies on the official equations (Section 5.2) and SSVC decision tree (Figure 4).
  • standard math Coefficient of variation and Shannon entropy are appropriate statistics for comparing metric discrimination
    Section 2.3: results interpretation uses CV for numeric metrics and entropy for qualitative metrics.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs." pith.science (2026). https://pith.science/paper/6TGOMDND

@misc{pith2026241220087,
  author       = {Pith},
  title        = {Pith review of: On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6TGOMDND}},
  note         = {Machine review of arXiv:2412.20087}
}
read the original abstract

This research investigates the effectiveness of established vulnerability metrics, such as the Common Vulnerability Scoring System (CVSS), in evaluating attacks against Large Language Models (LLMs), with a focus on Adversarial Attacks (AAs). The study explores the influence of both general and specific metric factors in determining vulnerability scores, providing new perspectives on potential enhancements to these metrics. This study adopts a quantitative approach, calculating and comparing the coefficient of variation of vulnerability scores across 56 adversarial attacks on LLMs. The attacks, sourced from various research papers, and obtained through online databases, were evaluated using multiple vulnerability metrics. Scores were determined by averaging the values assessed by three distinct LLMs. The results indicate that existing scoring-systems yield vulnerability scores with minimal variation across different attacks, suggesting that many of the metric factors are inadequate for assessing adversarial attacks on LLMs. This is particularly true for context-specific factors or those with predefined value sets, such as those in CVSS. These findings support the hypothesis that current vulnerability metrics, especially those with rigid values, are limited in evaluating AAs on LLMs, highlighting the need for the development of more flexible, generalized metrics tailored to such attacks. This research offers a fresh analysis of the effectiveness and applicability of established vulnerability metrics, particularly in the context of Adversarial Attacks on Large Language Models, both of which have gained significant attention in recent years. Through extensive testing and calculations, the study underscores the limitations of these metrics and opens up new avenues for improving and refining vulnerability assessment frameworks specifically tailored for LLMs.

Figures

Figures reproduced from arXiv: 2412.20087 by the authors.

Figure 1
Figure 1. Research process 3 [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Taxonomy of the classification criterias of Adversarial Attacks [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Examples of known vulnerability assessment metrics [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Decision Tree for Suppliers in SSVC (Spring et al., 2021) 69 [PITH_FULL_IMAGE:figures/full_fig_p070_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. How Well Do AI Systems Solve AP Physics? A Comparative Evaluation of Large Language Models on Algebra-Based Free Response Questions

    physics.ed-ph 2026-03 unverdicted novelty 5.0 of 10

    ChatGPT 4.1 mini, Gemini 2.5 Flash, Claude 4.0 Sonnet, and DeepSeek R1 average 82–92% on AP Physics 1/2 free-response questions but systematically fail spatial, visual, and conceptual tasks.

Reference graph

Works this paper leans on

165 extracted references · 9 canonical work pages · cited by 1 Pith paper

  1. [1]

    , author Anarfi, R

    author Abdali, S. , author Anarfi, R. , author Barberan, C. , author He, J. , year 2024 . title Securing large language models: Threats, vulnerabilities and responsible practices . journal arXiv preprint arXiv:2403.12503

    arXiv 2024

  2. [2]

    , author Croce, F

    author Andriushchenko, M. , author Croce, F. , author Flammarion, N. , year 2024 . title Jailbreaking leading safety-aligned llms with simple adaptive attacks . https://arxiv.org/abs/2404.02151, http://arxiv.org/abs/2404.02151 arXiv:2404.02151

    arXiv 2024

  3. [3]

    , author Johnson, W.A

    author Ayub, M.A. , author Johnson, W.A. , author Talbert, D.A. , author Siraj, A. , year 2020 . title Model evasion attack on intrusion detection systems using adversarial machine learning , in: booktitle 2020 54th annual conference on information sciences and systems (CISS) , organization IEEE . pp. pages 1--6

    2020

  4. [4]

    , author Mahmoud, M.M

    author Badr, M.M. , author Mahmoud, M.M. , author Abdulaal, M. , author Aljohani, A.J. , author Alsolami, F. , author Balamsh, A. , year 2023 . title A novel evasion attack against global electricity theft detectors and a countermeasure . journal IEEE Internet of Things Journal volume 10 , pages 11038--11053

    2023

  5. [5]

    , author Hsieh, T.Y

    author Bagdasaryan, E. , author Hsieh, T.Y. , author Nassi, B. , author Shmatikov, V. , year 2023 . title Abusing images and sounds for indirect instruction injection in multi-modal llms . https://arxiv.org/abs/2307.10490, http://arxiv.org/abs/2307.10490 arXiv:2307.10490

    arXiv 2023

  6. [6]

    , author Wu, B

    author Bai, J. , author Wu, B. , author Zhang, Y. , author Li, Y. , author Li, Z. , author Xia, S.T. , year 2021 . title Targeted attack against deep neural networks via flipping limited weight bits . https://arxiv.org/abs/2102.10496, http://arxiv.org/abs/2102.10496 arXiv:2102.10496

    arXiv 2021

  7. [7]

    , author Gao, Y

    author Baumgärtner, T. , author Gao, Y. , author Alon, D. , author Metzler, D. , year 2024 . title Best-of-venom: Attacking rlhf by injecting poisoned preference data . https://arxiv.org/abs/2404.05530, http://arxiv.org/abs/2404.05530 arXiv:2404.05530

    arXiv 2024

  8. [8]

    , author Nelson, B

    author Biggio, B. , author Nelson, B. , author Laskov, P. , year 2013 . title Poisoning attacks against support vector machines . https://arxiv.org/help/api/index, http://arxiv.org/abs/1206.6389 arXiv:1206.6389

    arXiv 2013

Show all 165 references
  1. [9]

    , year 2023

    author Boesch, G. , year 2023 . title W hat I s A dversarial M achine L earning? A ttack M ethods in 2024 - viso.ai --- viso.ai . howpublished https://viso.ai/deep-learning/adversarial-machine-learning/ . note [Accessed 27-11-2024]

    2023

  2. [10]

    , author Mann, B

    author Brown, T. , author Mann, B. , author Ryder, N. , author Subbiah, M. , author Kaplan, J. , author Dhariwal, P. , author Neelakantan, A. , author Shyam, P. , author Sastry, G. , author Askell, A. , et al., year 2020 . title Language models are few-shot learners advances i...

    2020

  3. [11]

    , author Chien, S

    author Carlini, N. , author Chien, S. , author Nasr, M. , author Song, S. , author Terzis, A. , author Tramer, F. , year 2022 . title Membership inference attacks from first principles . https://arxiv.org/abs/2112.03570, http://arxiv.org/abs/2112.03570 arXiv:2112.03570

    2022 arXiv

  4. [12]

    , author Tram \`e r, F

    author Carlini, N. , author Tram \`e r, F. , author Wallace, E. , author Jagielski, M. , author Herbert-Voss, A. , author Lee, K. , author Roberts, A. , author Brown, T. , author Song, D. , author Erlingsson, \'U . , author Oprea, A. , author Raffel, C. , year 2021 . title Ext...

    2021

  5. [13]

    , author Wagner, D

    author Carlini, N. , author Wagner, D. , year 2017 a. title Adversarial examples are not easily detected: Bypassing ten detection methods , in: booktitle Proceedings of the 10th ACM workshop on artificial intelligence and security , pp. pages 3--14

    2017

  6. [14]

    , author Wagner, D

    author Carlini, N. , author Wagner, D. , year 2017 b. title Towards evaluating the robustness of neural networks , in: booktitle 2017 ieee symposium on security and privacy (sp) , organization Ieee . pp. pages 39--57

    2017

  7. [15]

    , author Wagner, D

    author Carlini, N. , author Wagner, D. , year 2018 a. title Audio adversarial examples: Targeted attacks on speech-to-text , in: booktitle 2018 IEEE security and privacy workshops (SPW) , organization IEEE . pp. pages 1--7

    2018

  8. [16]

    , author Wagner, D

    author Carlini, N. , author Wagner, D. , year 2018 b. title Audio adversarial examples: Targeted attacks on speech-to-text , in: booktitle 2018 IEEE Security and Privacy Workshops (SPW) , pp. pages 1--7 . :10.1109/SPW.2018.00009

    2018

  9. [17]

    , author Anunciacao, O

    author Cartella, F. , author Anunciacao, O. , author Funabiki, Y. , author Yamaguchi, D. , author Akishita, T. , author Elshocht, O. , year 2021 . title Adversarial attacks for tabular data: Application to fraud detection and imbalanced data . https://arxiv.org/abs/2101.08030,...

    2021 arXiv

  10. [18]

    , author Danger, J.L

    author Chabanne, H. , author Danger, J.L. , author Guiga, L. , author Kühne, U. , year 2021 . title Side channel attacks for architecture extraction of neural networks . journal CAAI Transactions on Intelligence Technology volume 6 , pages 3--16 . https://ietresearch.onlinelib...

    2021 doi

  11. [19]

    , author Robey, A

    author Chao, P. , author Robey, A. , author Dobriban, E. , author Hassani, H. , author Pappas, G.J. , author Wong, E. , year 2024 . title Jailbreaking black box large language models in twenty queries . https://arxiv.org/abs/2310.08419, http://arxiv.org/abs/2310.08419 arXiv:2310.08419

    2024 arXiv

  12. [20]

    , author Fu, C

    author Chen, H. , author Fu, C. , author Zhao, J. , author Koushanfar, F. , year 2021 . title Proflip: Targeted trojan attack with progressive bit flips , in: booktitle Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pp. pages 7718--7727

    2021

  13. [21]

    , author Zeng, Y

    author Chen, W. , author Zeng, Y. , author Qiu, M. , year 2019 . title Using adversarial examples to bypass deep learning based url detection system , in: booktitle 2019 IEEE International Conference on Smart Cloud (SmartCloud) , organization IEEE . pp. pages 128--130

    2019

  14. [22]

    , author Barron, T.M

    author Chiang, R.H. , author Barron, T.M. , author Storey, V.C. , year 1994 . title Reverse engineering of relational databases: Extraction of an eer model from a relational database . journal Data & Knowledge Engineering volume 12 , pages 107--142 . https://www.sciencedirect....

    1994

  15. [23]

    , author Ahmad, H

    author Chopra, S. , author Ahmad, H. , author Goel, D. , author Szabo, C. , year 2024 . title Chatnvd: Advancing cybersecurity vulnerability assessment with large language models . https://arxiv.org/abs/2412.04756, http://arxiv.org/abs/2412.04756 arXiv:2412.04756

    2024 arXiv

  16. [24]

    , author Liu, Y

    author Chu, J. , author Liu, Y. , author Yang, Z. , author Shen, X. , author Backes, M. , author Zhang, Y. , year 2024 . title Comprehensive assessment of jailbreak attacks against llms . journal arXiv preprint arXiv:2402.05668

    2024 arXiv

  17. [25]

    , author Li, H

    author Dai, H. , author Li, H. , author Tian, T. , author Huang, X. , author Wang, L. , author Zhu, J. , author Song, L. , year 2018 . title Adversarial attack on graph structured data , in: editor Dy, J. , editor Krause, A. (Eds.), booktitle Proceedings of the 35th Internatio...

    2018

  18. [26]

    , author Tariq, A

    author Das, A. , author Tariq, A. , author Batalini, F. , author Dhara, B. , author Banerjee, I. , year 2024 . title Exposing vulnerabilities in clinical llms through data poisoning attacks: Case study in breast cancer . journal medRxiv https://www.medrxiv.org/content/early/20...

    2024 doi

  19. [27]

    , author Liu, Y

    author Deng, G. , author Liu, Y. , author Li, Y. , author Wang, K. , author Zhang, Y. , author Li, Z. , author Wang, H. , author Zhang, T. , author Liu, Y. , year 2023 . title Jailbreaker: Automated jailbreak across multiple large language model chatbots . journal arXiv prepri...

    2023 arXiv

  20. [28]

    , author Liu, Y

    author Deng, G. , author Liu, Y. , author Li, Y. , author Wang, K. , author Zhang, Y. , author Li, Z. , author Wang, H. , author Zhang, T. , author Liu, Y. , year 2024 . title Masterkey: Automated jailbreaking of large language model chatbots , in: booktitle Proc. ISOC NDSS

    2024

  21. [29]

    , year 2018

    author Devlin, J. , year 2018 . title Bert: Pre-training of deep bidirectional transformers for language understanding . journal arXiv preprint arXiv:1810.04805

    2018 arXiv

  22. [30]

    , author Kuang, J

    author Ding, P. , author Kuang, J. , author Ma, D. , author Cao, X. , author Xian, Y. , author Chen, J. , author Huang, S. , year 2024 . title A wolf in sheep's clothing: Generalized nested jailbreak prompts can fool large language models easily . https://arxiv.org/abs/2311.08...

    2024 arXiv

  23. [31]

    , author Tian, Y

    author Ding, S. , author Tian, Y. , author Xu, F. , author Li, Q. , author Zhong, S. , year 2019 . title Trojan attack on deep generative models in autonomous driving , in: booktitle Security and Privacy in Communication Networks: 15th EAI International Conference, SecureComm ...

    2019

  24. [32]

    , author Dong, J

    author Dong, H. , author Dong, J. , author Yuan, S. , author Guan, Z. , year 2022 . title Adversarial attack and defense on natural language processing in deep learning: A survey and perspective , in: booktitle International conference on machine learning for cyber security , ...

    2022

  25. [33]

    , author Liao, F

    author Dong, Y. , author Liao, F. , author Pang, T. , author Su, H. , author Zhu, J. , author Hu, X. , author Li, J. , year 2018 . title Boosting adversarial attacks with momentum , in: booktitle Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  26. [34]

    , author Zhao, Y

    author Du, W. , author Zhao, Y. , author Li, B. , author Liu, G. , author Wang, S. , year 2022 . title Ppt: Backdoor attacks on pre-trained models via poisoned prompt tuning. , in: booktitle IJCAI , pp. pages 680--686

    2022

  27. [35]

    , author Zhao, S

    author Du, Y. , author Zhao, S. , author Ma, M. , author Chen, Y. , author Qin, B. , year 2024 . title Analyzing the inherent response tendency of llms: Real-world instructions-driven jailbreak . https://arxiv.org/abs/2312.04127, http://arxiv.org/abs/2312.04127 arXiv:2312.04127

    2024 arXiv

  28. [36]

    , author Zhao, X

    author Duarte, A.V. , author Zhao, X. , author Oliveira, A.L. , author Li, L. , year 2024 . title De-cop: Detecting copyrighted content in language models training data . https://arxiv.org/abs/2402.09910, http://arxiv.org/abs/2402.09910 arXiv:2402.09910

    2024 arXiv

  29. [37]

    , author Jauhri, A

    author Dubey, A. , author Jauhri, A. , author Pandey, A. , author Kadian, A. , author Al-Dahle, A. , author Letman, A. , author Mathur, A. , author Schelten, A. , author Yang, A. , author Fan, A. , et al., year 2024 . title The llama 3 herd of models . journal arXiv preprint a...

    2024 arXiv

  30. [38]

    , author Rao, A

    author Ebrahimi, J. , author Rao, A. , author Lowd, D. , author Dou, D. , year 2018 . title Hotflip: White-box adversarial examples for text classification . https://arxiv.org/abs/1712.06751, http://arxiv.org/abs/1712.06751 arXiv:1712.06751

    2018 arXiv

  31. [39]

    , author Şahin, G.G

    author Eger, S. , author Şahin, G.G. , author Rücklé, A. , author Lee, J.U. , author Schulz, C. , author Mesgar, M. , author Swarnkar, K. , author Simpson, E. , author Gurevych, I. , year 2020 . title Text processing like humans do: Visually attacking and shielding nlp systems...

    2020 arXiv

  32. [40]

    , author Evtimov, I

    author Eykholt, K. , author Evtimov, I. , author Fernandes, E. , author Li, B. , author Rahmati, A. , author Xiao, C. , author Prakash, A. , author Kohno, T. , author Song, D. , year 2018 . title Robust physical-world attacks on deep learning visual classification , in: bookti...

    2018

  33. [41]

    , author Wang, B

    author Fan, H. , author Wang, B. , author Zhou, P. , author Li, A. , author Xu, Z. , author Fu, C. , author Li, H. , author Chen, Y. , year 2021 . title Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs , in: booktitle 2021 IEEE 23rd I...

    2021

  34. [42]

    , author Bowers, J.D

    author Finlayson, S.G. , author Bowers, J.D. , author Ito, J. , author Zittrain, J.L. , author Beam, A.L. , author Kohane, I.S. , year 2019 . title Adversarial attacks on medical machine learning . journal Science volume 363 , pages 1287--1289

    2019

  35. [43]

    title C V S S v3.1 U ser G uide --- first.org

    author First , year 2016 . title C V S S v3.1 U ser G uide --- first.org . howpublished https://www.first.org/cvss/v3.1/user-guide

    2016

  36. [44]

    , author Wang, H

    author Fu, W. , author Wang, H. , author Gao, C. , author Liu, G. , author Li, Y. , author Jiang, T. , year 2024 . title Practical membership inference attacks against fine-tuned large language models via self-prompt calibration . https://arxiv.org/abs/2311.06062, http://arxiv...

    2024 arXiv

  37. [45]

    , author Ramakrishnan, G

    author Garg, S. , author Ramakrishnan, G. , year 2020 . title Bae: Bert-based adversarial examples for text classification , in: booktitle Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) , publisher Association for Computational L...

    2020 doi

  38. [46]

    , author Fowl, L

    author Geiping, J. , author Fowl, L. , author Huang, W.R. , author Czaja, W. , author Taylor, G. , author Moeller, M. , author Goldstein, T. , year 2021 . title Witches' brew: Industrial scale data poisoning via gradient matching . https://arxiv.org/abs/2009.02276, http://arxi...

    2021 arXiv

  39. [47]

    , author Wollschläger, T

    author Geisler, S. , author Wollschläger, T. , author Abdalla, M.H.I. , author Gasteiger, J. , author Günnemann, S. , year 2024 . title Attacking large language models with projected gradient descent . https://arxiv.org/abs/2402.09154, http://arxiv.org/abs/2402.09154 arXiv:2402.09154

    2024 arXiv

  40. [48]

    , author \"O zuysal, M

    author Gen c , D. , author \"O zuysal, M. , author Tomur, E. , year 2023 . title A taxonomic survey of model extraction attacks , in: booktitle 2023 IEEE International Conference on Cyber Security and Resilience (CSR) , organization IEEE . pp. pages 200--205

    2023

  41. [49]

    , author Shlens, J

    author Goodfellow, I.J. , author Shlens, J. , author Szegedy, C. , year 2014 . title Explaining and harnessing adversarial examples . journal arXiv preprint arXiv:1412.6572

    2014 arXiv

  42. [51]

    , author Abdelnabi, S

    author Greshake, K. , author Abdelnabi, S. , author Mishra, S. , author Endres, C. , author Holz, T. , author Fritz, M. , year 2023 b. title Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection . https://arxiv.org/ab...

    2023 arXiv

  43. [52]

    , author Liu, K

    author Gu, T. , author Liu, K. , author Dolan-Gavitt, B. , author Garg, S. , year 2019 . title Badnets: Evaluating backdooring attacks on deep neural networks . journal IEEE Access volume 7 , pages 47230--47244 . :10.1109/ACCESS.2019.2909068

    2019

  44. [54]

    , author Sablayrolles, A

    author Guo, C. , author Sablayrolles, A. , author Jégou, H. , author Kiela, D. , year 2021 b. title Gradient-based adversarial attacks against text transformers . https://arxiv.org/abs/2104.13733, http://arxiv.org/abs/2104.13733 arXiv:2104.13733

    2021 arXiv

  45. [55]

    , author Borevkovic, E

    author Hayase, J. , author Borevkovic, E. , author Carlini, N. , author Tramèr, F. , author Nasr, M. , year 2024 . title Query-based adversarial prompt generation . https://arxiv.org/abs/2402.12329, http://arxiv.org/abs/2402.12329 arXiv:2402.12329

    2024 arXiv

  46. [56]

    , author Salcic, Z

    author Hu, H. , author Salcic, Z. , author Sun, L. , author Dobbie, G. , author Yu, P.S. , author Zhang, X. , year 2022 . title Membership inference attacks on machine learning: A survey . journal ACM Computing Surveys (CSUR) volume 54 , pages 1--37

    2022

  47. [57]

    , author Zhao, Z

    author Huang, H. , author Zhao, Z. , author Backes, M. , author Shen, Y. , author Zhang, Y. , year 2024 . title Composite backdoor attacks against large language models . https://arxiv.org/abs/2310.07676, http://arxiv.org/abs/2310.07676 arXiv:2310.07676

    2024 arXiv

  48. [58]

    , author Geiping, J

    author Huang, W.R. , author Geiping, J. , author Fowl, L. , author Taylor, G. , author Goldstein, T. , year 2020 . title Metapoison: Practical general-purpose clean-label data poisoning , in: editor Larochelle, H. , editor Ranzato, M. , editor Hadsell, R. , editor Balcan, M. ,...

    2020

  49. [59]

    , author Zhang, T

    author Huang, Z. , author Zhang, T. , year 2019 . title Black-box adversarial attack with transferable model-based embedding . journal arXiv preprint arXiv:1911.07140

    2019 arXiv

  50. [60]

    , author Abou-Khamis, R

    author Ibitoye, O. , author Abou-Khamis, R. , author Shehaby, M.e. , author Matrawy, A. , author Shafiq, M.O. , year 2019 . title The threat of adversarial attacks on machine learning in network security--a survey . journal arXiv preprint arXiv:1911.02621

    2019 arXiv

  51. [61]

    , year 2022

    author Inc., P.A. , year 2022 . title P erplexity A i . howpublished https://www.perplexity.ai/ . note [Accessed 27-11-2024]

    2022

  52. [62]

    , author Carlini, N

    author Jagielski, M. , author Carlini, N. , author Berthelot, D. , author Kurakin, A. , author Papernot, N. , year 2020 . title High accuracy and high fidelity extraction of neural networks , in: booktitle 29th USENIX Security Symposium (USENIX Security 20) , publisher USENIX ...

    2020

  53. [63]

    , author Mahmoud, O

    author Kassem, A.M. , author Mahmoud, O. , author Mireshghallah, N. , author Kim, H. , author Tsvetkov, Y. , author Choi, Y. , author Saad, S. , author Rana, S. , year 2024 . title Alpaca against vicuna: Using llms to uncover memorization of llms . https://arxiv.org/abs/2403.0...

    2024 arXiv

  54. [64]

    , author Yun, S

    author Kim, S. , author Yun, S. , author Lee, H. , author Gubri, M. , author Yoon, S. , author Oh, S.J. , year 2023 . title Propile: Probing privacy leakage in large language models . https://arxiv.org/abs/2307.01881, http://arxiv.org/abs/2307.01881 arXiv:2307.01881

    2023 arXiv

  55. [65]

    , author Agarwal, C

    author Kumar, A. , author Agarwal, C. , author Srinivas, S. , author Li, A.J. , author Feizi, S. , author Lakkaraju, H. , year 2023 a. title Certifying llm safety against adversarial prompting . journal arXiv preprint arXiv:2309.02705

    2023 arXiv

  56. [66]

    , author Mohan, C.K

    author Kumar, K.N. , author Mohan, C.K. , author Cenkeramaddi, L.R. , year 2023 b. title The impact of adversarial attacks on federated learning: A survey . journal IEEE Transactions on Pattern Analysis and Machine Intelligence volume 46 , pages 2672--2691

    2023

  57. [67]

    , year 2024

    author Kumar, P. , year 2024 . title Adversarial attacks and defenses for large language models (llms): methods, frameworks & challenges . journal International Journal of Multimedia Information Retrieval volume 13 , pages 26

    2024

  58. [68]

    , author Goodfellow, I

    author Kurakin, A. , author Goodfellow, I. , author Bengio, S. , year 2017 . title Adversarial examples in the physical world . journal ICLR Workshop https://arxiv.org/abs/1607.02533

    2017 arXiv

  59. [69]

    , author Tiwari, M

    author Lee, D. , author Tiwari, M. , year 2024 . title Prompt infection: Llm-to-llm prompt injection within multi-agent systems . journal arXiv preprint arXiv:2410.07283

    2024 arXiv

  60. [70]

    , author Guo, D

    author Li, H. , author Guo, D. , author Fan, W. , author Xu, M. , author Huang, J. , author Meng, F. , author Song, Y. , year 2023 . title Multi-step jailbreaking privacy attacks on chatgpt . https://arxiv.org/abs/2304.05197, http://arxiv.org/abs/2304.05197 arXiv:2304.05197

    2023 arXiv

  61. [71]

    , author Ma, R

    author Li, L. , author Ma, R. , author Guo, Q. , author Xue, X. , author Qiu, X. , year 2020 a. title BERT - ATTACK : Adversarial attack against BERT using BERT , in: editor Webber, B. , editor Cohn, T. , editor He, Y. , editor Liu, Y. (Eds.), booktitle Proceedings of the 2020...

    2020

  62. [72]

    , author Xue, M

    author Li, S. , author Xue, M. , author Zhao, B.Z.H. , author Zhu, H. , author Zhang, X. , year 2020 b. title Invisible backdoor attacks on deep neural networks via steganography and regularization . journal IEEE Transactions on Dependable and Secure Computing volume 18 , page...

    2020

  63. [73]

    , author Wang, R

    author Li, X. , author Wang, R. , author Cheng, M. , author Zhou, T. , author Hsieh, C.J. , year 2024 a. title Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers . https://arxiv.org/abs/2402.16914, http://arxiv.org/abs/2402.16914 arXiv:2402.16914

    2024 arXiv

  64. [74]

    , author Huang, H

    author Li, Y. , author Huang, H. , author Zhao, Y. , author Ma, X. , author Sun, J. , year 2024 b. title Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models . https://arxiv.org/abs/2408.12798, http://arxiv.org/abs/2408.12798 arXiv:2408.12798

    2024 arXiv

  65. [75]

    , author Zhai, T

    author Li, Y. , author Zhai, T. , author Jiang, Y. , author Li, Z. , author Xia, S.T. , year 2021 . title Backdoor attack in the physical world . journal arXiv preprint arXiv:2104.02361

    2021 arXiv

  66. [76]

    , author Chen, K

    author Li, Z. , author Chen, K. , author Liu, L. , author Bai, X. , author Yang, M. , author Xiang, Y. , author Zhang, M. , year 2024 c. title Tf-attack: Transferable and fast adversarial attacks on large language models . https://arxiv.org/abs/2408.13985, http://arxiv.org/abs...

    2024 arXiv

  67. [77]

    , author Shi, C

    author Li, Z. , author Shi, C. , author Xie, Y. , author Liu, J. , author Yuan, B. , author Chen, Y. , year 2020 c. title Practical adversarial attacks against speaker recognition systems , in: booktitle Proceedings of the 21st International Workshop on Mobile Computing System...

    2020

  68. [78]

    , author Hu, C

    author Liu, F.W. , author Hu, C. , year 2024 . title Exploring vulnerabilities and protections in large language models: A survey . journal arXiv preprint arXiv:2406.00240

    2024 arXiv

  69. [79]

    , author Jia, J

    author Liu, H. , author Jia, J. , author Gong, N.Z. , year 2022 . title \ PoisonedEncoder \ : Poisoning the unlabeled pre-training data in contrastive learning , in: booktitle 31st USENIX Security Symposium (USENIX Security 22) , pp. pages 3629--3645

    2022

  70. [80]

    , author Zhou, Z

    author Liu, H. , author Zhou, Z. , author Shang, F. , author Qi, X. , author Liu, Y. , author Jiao, L. , year 2020 a. title Boosting gradient for white-box adversarial attacks . journal arXiv preprint arXiv:2010.10712

    2020 arXiv

  71. [81]

    , author Yu, Z

    author Liu, X. , author Yu, Z. , author Zhang, Y. , author Zhang, N. , author Xiao, C. , year 2024 a. title Automatic and universal prompt injection attacks against large language models . https://arxiv.org/abs/2403.04957, http://arxiv.org/abs/2403.04957 arXiv:2403.04957

    2024 arXiv

  72. [82]

    , author Chen, X

    author Liu, Y. , author Chen, X. , author Liu, C. , author Song, D. , year 2016 . title Delving into transferable adversarial examples and black-box attacks . journal arXiv preprint arXiv:1611.02770

    2016 arXiv

  73. [83]

    , author Deng, G

    author Liu, Y. , author Deng, G. , author Li, Y. , author Wang, K. , author Wang, Z. , author Wang, X. , author Zhang, T. , author Liu, Y. , author Wang, H. , author Zheng, Y. , et al., year 2023 a. title Prompt injection attack against llm-integrated applications . journal ar...

    2023 arXiv

  74. [84]

    , author Jia, Y

    author Liu, Y. , author Jia, Y. , author Geng, R. , author Jia, J. , author Gong, N.Z. , year 2024 b. title Formalizing and benchmarking prompt injection attacks and defenses , in: booktitle 33rd USENIX Security Symposium (USENIX Security 24) , pp. pages 1831--1847

    2024

  75. [85]

    , author Jia, Y

    author Liu, Y. , author Jia, Y. , author Geng, R. , author Jia, J. , author Gong, N.Z. , year 2024 c. title Formalizing and benchmarking prompt injection attacks and defenses . https://arxiv.org/abs/2310.12815, http://arxiv.org/abs/2310.12815 arXiv:2310.12815

    2024

  76. [86]

    , author Jia, Y

    author Liu, Y. , author Jia, Y. , author Geng, R. , author Jia, J. , author Zhenqiang Gong, N. , year 2023 b. title Prompt injection attacks and defenses in llm-integrated applications . journal arXiv e-prints , pages arXiv--2310

    2023

  77. [87]

    , author Mondal, A

    author Liu, Y. , author Mondal, A. , author Chakraborty, A. , author Zuzak, M. , author Jacobsen, N. , author Xing, D. , author Srivastava, A. , year 2020 b. title A survey on neural trojans , in: booktitle 2020 21st International Symposium on Quality Electronic Design (ISQED)...

    2020

  78. [88]

    , author Salem, A

    author Lukas, N. , author Salem, A. , author Sim, R. , author Tople, S. , author Wutschitz, L. , author Zanella-Béguelin, S. , year 2023 . title Analyzing leakage of personally identifiable information in language models . https://arxiv.org/abs/2302.00539, http://arxiv.org/abs...

    2023 arXiv

  79. [89]

    , author Li, W.J

    author Ma, X. , author Li, W.J. , year 2023 . title Grey-box adversarial attack on communication in multi-agent reinforcement learning , in: booktitle Proceedings of the 2023 International Conference on Autonomous Agents and Multiagent Systems , pp. pages 2448--2450

    2023

  80. [90]

    , author Mireshghallah, F

    author Mattern, J. , author Mireshghallah, F. , author Jin, Z. , author Schölkopf, B. , author Sachan, M. , author Berg-Kirkpatrick, T. , year 2023 . title Membership inference attacks against language models via neighbourhood comparison . https://arxiv.org/abs/2305.18462, htt...

    2023 arXiv

  81. [91]

    , author Steve, L

    author Michael, H. , author Steve, L. , year 2006 . title The security development lifecycle: Sdl: A process for developing demonstrably more secure software

    2006

  82. [92]

    , year 2023

    author de Morais, A.M. , year 2023 . title Threats to machine learning-based systems; part 1 of 5 . howpublished https://www.sidechannel.blog/en/threats-to-machine-learning-based-systems-part-1-of-5/ . note [Accessed 27-11-2024]

    2023

  83. [93]

    , author Wang, B

    author Mu, J. , author Wang, B. , author Li, Q. , author Sun, K. , author Xu, M. , author Liu, Z. , year 2021 . title A hard label black-box adversarial attack against graph neural networks , in: booktitle Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communica...

    2021

  84. [94]

    , author Frikha, A

    author Nakka, K.K. , author Frikha, A. , author Mendes, R. , author Jiang, X. , author Zhou, X. , year 2024 . title Pii-compass: Guiding llm training data extraction prompts towards the target pii via grounding . https://arxiv.org/abs/2407.02943, http://arxiv.org/abs/2407.0294...

    2024 arXiv

  85. [95]

    , author Carlini, N

    author Nasr, M. , author Carlini, N. , author Hayase, J. , author Jagielski, M. , author Cooper, A.F. , author Ippolito, D. , author Choquette-Choo, C.A. , author Wallace, E. , author Tramèr, F. , author Lee, K. , year 2023 . title Scalable extraction of training data from (pr...

    2023 arXiv

  86. [96]

    , author Sun, Y

    author Niu, Z. , author Sun, Y. , author Ren, H. , author Ji, H. , author Wang, Q. , author Ma, X. , author Hua, G. , author Jin, R. , year 2024 . title Efficient llm-jailbreaking by introducing visual modality . https://arxiv.org/abs/2405.20015, http://arxiv.org/abs/2405.2001...

    2024

  87. [97]

    title H ello G P T -4o

    author OpenAI , year 2024 . title H ello G P T -4o . howpublished https://openai.com/index/hello-gpt-4o/ . note [Accessed 27-11-2024]

    2024

  88. [98]

    , author Vassilev, A

    author Oprea, A. , author Vassilev, A. , year 2023 . title Adversarial machine learning: A taxonomy and terminology of attacks and mitigations . type Technical Report . National Institute of Standards and Technology

    2023

  89. [99]

    title O W A S P T op 10 for L arge L anguage M odel A pplications | O W A S P F oundation --- owasp.org

    author OWASP , year 2023 . title O W A S P T op 10 for L arge L anguage M odel A pplications | O W A S P F oundation --- owasp.org . howpublished https://owasp.org/www-project-top-10-for-large-language-model-applications/

    2023

  90. [100]

    , author McDaniel, P

    author Papernot, N. , author McDaniel, P. , author Jha, S. , author Fredrikson, M. , author Celik, Z.B. , author Swami, A. , year 2016 . title The limitations of deep learning in adversarial settings , in: booktitle 2016 IEEE European symposium on security and privacy (EuroS&P...

    2016

  91. [101]

    , author Bi, Z

    author Peng, B. , author Bi, Z. , author Niu, Q. , author Liu, M. , author Feng, P. , author Wang, T. , author Yan, L.K. , author Wen, Y. , author Zhang, Y. , author Yin, C.H. , year 2024 . title Jailbreaking and mitigation of vulnerabilities in large language models . journal...

    2024 arXiv

  92. [102]

    , author Ribeiro, I

    author Perez, F. , author Ribeiro, I. , year 2022 . title Ignore previous prompt: Attack techniques for language models . https://arxiv.org/abs/2211.09527, http://arxiv.org/abs/2211.09527 arXiv:2211.09527

    2022 arXiv

  93. [103]

    , author Dhingra, B

    author Pruthi, D. , author Dhingra, B. , author Lipton, Z.C. , year 2019 . title Combating adversarial misspellings with robust word recognition . https://arxiv.org/abs/1905.11268, http://arxiv.org/abs/1905.11268 arXiv:1905.11268

    2019 arXiv

  94. [104]

    , author Zhu, J

    author Qi, X. , author Zhu, J. , author Xie, C. , author Yang, Y. , year 2021 . title Subnet replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting . journal arXiv preprint arXiv:2107.07240

    2021 arXiv

  95. [105]

    , author Liu, Q

    author Qiu, S. , author Liu, Q. , author Zhou, S. , author Huang, W. , year 2022 . title Adversarial attack and defense technologies in natural language processing: A survey . journal Neurocomputing volume 492 , pages 278--307

    2022

  96. [106]

    , year 2018

    author Radford, A. , year 2018 . title Improving language understanding by generative pre-training

    2018

  97. [107]

    , author Rahman, T

    author Rahman, M.A. , author Rahman, T. , author Lagani \`e re, R. , author Mohammed, N. , author Wang, Y. , year 2018 . title Membership inference attack against differentially private deep learning model. journal Trans. Data Priv. volume 11 , pages 61--79

    2018

  98. [108]

    , author Dou, Y

    author Ramesh, G. , author Dou, Y. , author Xu, W. , year 2024 . title Gpt-4 jailbreaks itself with near-perfect success using self-explanation . https://arxiv.org/abs/2405.13077, http://arxiv.org/abs/2405.13077 arXiv:2405.13077

    2024 arXiv

  99. [109]

    , author Deng, Y

    author Ren, S. , author Deng, Y. , author He, K. , author Che, W. , year 2019 . title Generating natural language adversarial examples through probability weighted word saliency , in: editor Korhonen, A. , editor Traum, D. , editor M \`a rquez, L. (Eds.), booktitle Proceedings...

    2019

  100. [110]

    , author Wu, T

    author Ribeiro, M.T. , author Wu, T. , author Guestrin, C. , author Singh, S. , year 2020 . title Beyond accuracy: Behavioral testing of NLP models with C heck L ist , in: editor Jurafsky, D. , editor Chai, J. , editor Schluter, N. , editor Tetreault, J. (Eds.), booktitle Proc...

    2020

  101. [111]

    , author Salem, A

    author Russinovich, M. , author Salem, A. , author Eldan, R. , year 2024 . title Great, now write an article about that: The crescendo multi-turn llm jailbreak attack . https://arxiv.org/abs/2404.01833, http://arxiv.org/abs/2404.01833 arXiv:2404.01833

    2024 arXiv

  102. [112]

    , author Banerjee, A

    author Sadeghi, K. , author Banerjee, A. , author Gupta, S.K.S. , year 2020 . title A system-driven taxonomy of attacks and defenses in adversarial machine learning . journal IEEE Transactions on Emerging Topics in Computational Intelligence volume 4 , pages 450--467 . :10.110...

    2020

  103. [113]

    , author Subramanya, A

    author Saha, A. , author Subramanya, A. , author Pirsiavash, H. , year 2020 . title Hidden trigger backdoor attacks . journal Proceedings of the AAAI Conference on Artificial Intelligence volume 34 , pages 11957--11965 . https://ojs.aaai.org/index.php/AAAI/article/view/6871, :...

    2020 doi

  104. [114]

    , author Cisco, C

    author Schiffman, M. , author Cisco, C. , year 2005 . title A complete guide to the common vulnerability scoring system (cvss) v1 archive

    2005

  105. [115]

    , author Dobre, D

    author Schwinn, L. , author Dobre, D. , author Xhonneux, S. , author Gidel, G. , author Gunnemann, S. , year 2024 . title Soft prompt threats: Attacking safety alignment and unlearning in open-source llms through the embedding space . https://arxiv.org/abs/2402.09063, http://a...

    2024 arXiv

  106. [116]

    , author Huang, W.R

    author Shafahi, A. , author Huang, W.R. , author Najibi, M. , author Suciu, O. , author Studer, C. , author Dumitras, T. , author Goldstein, T. , year 2018 . title Poison frogs! targeted clean-label poisoning attacks on neural networks , in: editor Bengio, S. , editor Wallach,...

    2018

  107. [117]

    , author Mehtre, B.M

    author Shah, S. , author Mehtre, B.M. , year 2015 . title An overview of vulnerability assessment and penetration testing techniques . journal Journal of Computer Virology and Hacking Techniques volume 11 , pages 27--49 . https://doi.org/10.1007/s11416-014-0231-x

    2015 doi

  108. [118]

    , year 1948

    author Shannon, C.E. , year 1948 . title A mathematical theory of communication . journal The Bell System Technical Journal volume 27 , pages 379--423 . :10.1002/j.1538-7305.1948.tb01338.x

    1948

  109. [119]

    , author Mamun, M.A.A

    author Shayegani, E. , author Mamun, M.A.A. , author Fu, Y. , author Zaree, P. , author Dong, Y. , author Abu-Ghazaleh, N. , year 2023 . title Survey of vulnerabilities in large language models revealed by adversarial attacks . journal arXiv preprint arXiv:2310.10844

    2023 arXiv

  110. [120]

    do anything now

    author Shen, X. , author Chen, Z. , author Backes, M. , author Shen, Y. , author Zhang, Y. , year 2024 . title "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models . https://arxiv.org/abs/2308.03825, http://arxiv.org/abs/2308....

    2024 arXiv

  111. [121]

    , author He, X

    author Shen, Y. , author He, X. , author Han, Y. , author Zhang, Y. , year 2022 . title Model stealing attacks against inductive graph neural networks , in: booktitle 2022 IEEE Symposium on Security and Privacy (SP) , organization IEEE . pp. pages 1175--1192

    2022

  112. [122]

    , author Yuan, Z

    author Shi, J. , author Yuan, Z. , author Liu, Y. , author Huang, Y. , author Zhou, P. , author Sun, L. , author Gong, N.Z. , year 2024 a. title Optimization-based prompt injection attack to llm-as-a-judge . https://arxiv.org/abs/2403.17710, http://arxiv.org/abs/2403.17710 arX...

    2024 arXiv

  113. [123]

    , author Ajith, A

    author Shi, W. , author Ajith, A. , author Xia, M. , author Huang, Y. , author Liu, D. , author Blevins, T. , author Chen, D. , author Zettlemoyer, L. , year 2024 b. title Detecting pretraining data from large language models . https://arxiv.org/abs/2310.16789, http://arxiv.or...

    2024 arXiv

  114. [124]

    , author Zhao, Y

    author Shumailov, I. , author Zhao, Y. , author Bates, D. , author Papernot, N. , author Mullins, R. , author Anderson, R. , year 2021 . title Sponge examples: Energy-latency attacks on neural networks , in: booktitle 2021 IEEE European Symposium on Security and Privacy (EuroS...

    2021

  115. [125]

    , year 2023

    author Sitawarin, C. , year 2023 . title llm-sp/ at main · chawins/llm-sp --- github.com . howpublished https://github.com/chawins/llm-sp?search=1

    2023

  116. [126]

    , author Mu, N

    author Sitawarin, C. , author Mu, N. , author Wagner, D. , author Araujo, A. , year 2024 . title Pal: Proxy-guided black-box attack on large language models . https://arxiv.org/abs/2402.09674, http://arxiv.org/abs/2402.09674 arXiv:2402.09674

    2024 arXiv

  117. [127]

    , author Shokri, R

    author Song, L. , author Shokri, R. , author Mittal, P. , year 2019 . title Membership inference attacks against adversarially robust deep learning models , in: booktitle 2019 IEEE Security and Privacy Workshops (SPW) , organization IEEE . pp. pages 50--56

    2019

  118. [128]

    , author Householder, A

    author Spring, J.M. , author Householder, A. , author Hatleback, E. , author Manion, A. , author Oliver, M. , author Sarvapalli, V. , author Tyzenhaus, L. , author Yarbrough, C. , year 2021 . title Prioritizing vulnerability response: A stakeholder-specific vulnerability categ...

    2021

  119. [129]

    , author Pillai, V

    author Subramanya, A. , author Pillai, V. , author Pirsiavash, H. , year 2019 . title Fooling network interpretation in image classification , in: booktitle Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    2019

  120. [130]

    , year 2013

    author Szegedy, C. , year 2013 . title Intriguing properties of neural networks . journal arXiv preprint arXiv:1312.6199

    2013 arXiv

  121. [131]

    , author Cui, L

    author Tian, Z. , author Cui, L. , author Liang, J. , author Yu, S. , year 2022 . title A comprehensive survey on poisoning attacks and countermeasures in machine learning . journal ACM Computing Surveys volume 55 , pages 1--35

    2022

  122. [132]

    , author Truex, S

    author Tolpegin, V. , author Truex, S. , author Gursoy, M.E. , author Liu, L. , year 2020 . title Data poisoning attacks against federated learning systems , in: booktitle Computer Security -- ESORICS 2020 , publisher Springer International Publishing , address Cham . pp. page...

    2020

  123. [133]

    , year 2017

    author Vaswani, A. , year 2017 . title Attention is all you need . journal Advances in Neural Information Processing Systems

    2017

  124. [134]

    , author Wang, Y

    author Wang, C. , author Wang, Y. , author Hooi, B. , author Cai, Y. , author Peng, N. , author Chang, K.W. , year 2024 . title Con-recall: Detecting pre-training data in llms via contrastive decoding . https://arxiv.org/abs/2409.03363, http://arxiv.org/abs/2409.03363 arXiv:2409.03363

    2024 arXiv

  125. [135]

    , author Zhang, D

    author Wang, C. , author Zhang, D. , author Huang, S. , author Li, X. , author Ding, L. , year 2021 . title Crafting adversarial email content against machine learning based spam email detection , in: booktitle Proceedings of the 2021 International Symposium on Advanced Securi...

    2021

  126. [136]

    , author Shu, K

    author Wang, H. , author Shu, K. , year 2024 . title Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment . https://arxiv.org/abs/2311.09433, http://arxiv.org/abs/2311.09433 arXiv:2311.09433

    2024 arXiv

  127. [137]

    , author Ko, R.K

    author Wang, S. , author Ko, R.K. , author Bai, G. , author Dong, N. , author Choi, T. , author Zhang, Y. , year 2023 . title Evasion attack and defense on machine learning models in cyber-physical systems: A survey . journal IEEE Communications Surveys & Tutorials

    2023

  128. [138]

    , author Chaudhuri, K

    author Wang, Y. , author Chaudhuri, K. , year 2018 . title Data poisoning attacks against online learning . https://arxiv.org/abs/1808.08994, http://arxiv.org/abs/1808.08994 arXiv:1808.08994

    2018 arXiv

  129. [139]

    , author Zhao, Y

    author Wei, C. , author Zhao, Y. , author Gong, Y. , author Chen, K. , author Xiang, L. , author Zhu, S. , year 2024 . title Hidden in plain sight: Exploring chat history tampering in interactive language models . https://arxiv.org/abs/2405.20234, http://arxiv.org/abs/2405.202...

    2024 arXiv

  130. [140]

    , year 2023

    author Williams, J. , year 2023 . title O W A S P R isk R ating M ethodology | O W A S P F oundation --- owasp.org . howpublished https://owasp.org/www-community/OWASP_Risk_Rating_Methodology . note [Accessed 27-11-2024]

    2023

  131. [141]

    , year 2024

    author Willison, S. , year 2024 . title P rompt injection and jailbreaking are not the same thing --- simonwillison.net . howpublished https://simonwillison.net/2024/Mar/5/prompt-injection-jailbreaking/ . note [Accessed 27-11-2024]

    2024

  132. [142]

    , year 2020

    author Wintel, F. , year 2020 . title W hen A I B ecomes an A ttack S urface: A dversarial A ttacks | C omputer S cience B log @ H d M S tuttgart --- blog.mi.hdm-stuttgart.de . howpublished https://blog.mi.hdm-stuttgart.de/index.php/2020/08/19/adversarial-attacks/ . note [Acce...

    2020

  133. [143]

    , author Han, Y

    author Wu, A. , author Han, Y. , author Zhang, Q. , author Kuang, X. , year 2019 . title Untargeted adversarial attack via expanding the semantic gap , in: booktitle 2019 IEEE International Conference on Multimedia and Expo (ICME) , organization IEEE . pp. pages 514--519

    2019

  134. [144]

    , author Zhu, Z

    author Wu, B. , author Zhu, Z. , author Liu, L. , author Liu, Q. , author He, Z. , author Lyu, S. , year 2023 . title Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective . journal arXiv preprint arXiv:2302.09457

    2023 arXiv

  135. [145]

    , author Koh, J.Y

    author Wu, C.H. , author Koh, J.Y. , author Salakhutdinov, R. , author Fried, D. , author Raghunathan, A. , year 2024 . title Adversarial attacks on multimodal agents . https://arxiv.org/abs/2406.12814, http://arxiv.org/abs/2406.12814 arXiv:2406.12814

    2024 arXiv

  136. [146]

    , author Yang, Y

    author Xiao, Z. , author Yang, Y. , author Chen, G. , author Chen, Y. , year 2024 . title Distract large language models for automatic jailbreak attack . https://arxiv.org/abs/2403.08424, http://arxiv.org/abs/2403.08424 arXiv:2403.08424

    2024 arXiv

  137. [147]

    , author Huang, K

    author Xie, C. , author Huang, K. , author Chen, P.Y. , author Li, B. , year 2019 . title Dba: Distributed backdoor attacks against federated learning , in: booktitle International conference on learning representations

    2019

  138. [148]

    , author Zhong, X

    author Xu, Y. , author Zhong, X. , author Yepes, A.J. , author Lau, J.H. , year 2021 . title Grey-box adversarial attack and defence for sentiment classification . journal arXiv preprint arXiv:2103.11576

    2021 arXiv

  139. [149]

    , author Huang, R

    author Xu, Z. , author Huang, R. , author Chen, C. , author Wang, X. , year 2024 a. title Uncovering safety risks of large language models through concept activation vector . https://arxiv.org/abs/2404.12038, http://arxiv.org/abs/2404.12038 arXiv:2404.12038

    2024 arXiv

  140. [150]

    , author Liu, Y

    author Xu, Z. , author Liu, Y. , author Deng, G. , author Li, Y. , author Picek, S. , year 2024 b. title A comprehensive study of jailbreak attack versus defense for large language models , in: booktitle Findings of the Association for Computational Linguistics ACL 2024 , pp. ...

    2024

  141. [151]

    , author Zheng, M

    author Xue, J. , author Zheng, M. , author Hua, T. , author Shen, Y. , author Liu, Y. , author B\" o l\" o ni, L. , author Lou, Q. , year 2023 . title Trojllm: A black-box trojan prompt attack on large language models , in: editor Oh, A. , editor Naumann, T. , editor Globerson...

    2023

  142. [152]

    , author Yadav, V

    author Yan, J. , author Yadav, V. , author Li, S. , author Chen, L. , author Tang, Z. , author Wang, H. , author Srinivasan, V. , author Ren, X. , author Jin, H. , year 2024 a. title Backdooring instruction-tuned large language models with virtual prompt injection . https://ar...

    2024 arXiv

  143. [153]

    , author Wang, S

    author Yan, S. , author Wang, S. , author Duan, Y. , author Hong, H. , author Lee, K. , author Kim, D. , author Hong, Y. , year 2024 b. title An llm-assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection...

    2024 arXiv

  144. [154]

    , author Duan, J

    author Yao, Y. , author Duan, J. , author Xu, K. , author Cai, Y. , author Sun, Z. , author Zhang, Y. , year 2024 . title A survey on large language model (llm) security and privacy: The good, the bad, and the ugly . journal High-Confidence Computing volume 4 , pages 100211 . ...

    2024

  145. [155]

    , author Bahtiyar, S

    author Yerlikaya, F.A. , author Bahtiyar, S . , year 2022 . title Data poisoning attacks against machine learning algorithms . journal Expert Systems with Applications volume 208 , pages 118101

    2022

  146. [156]

    , author Pang, T

    author Yu, W. , author Pang, T. , author Liu, Q. , author Du, C. , author Kang, B. , author Huang, Y. , author Lin, M. , author Yan, S. , year 2023 . title Bag of tricks for training data extraction from language models . https://arxiv.org/abs/2302.04460, http://arxiv.org/abs/...

    2023 arXiv

  147. [157]

    , author Ding, L

    author Yuan, X. , author Ding, L. , author Zhang, L. , author Li, X. , author Wu, D.O. , year 2022 . title Es attack: Model stealing against deep neural networks without data hurdles . journal IEEE Transactions on Emerging Topics in Computational Intelligence volume 6 , pages ...

    2022

  148. [158]

    , author Morris, J.X

    author Zhang, C. , author Morris, J.X. , author Shmatikov, V. , year 2024 a. title Extracting prompts by inverting llm outputs . https://arxiv.org/abs/2405.15012, http://arxiv.org/abs/2405.15012 arXiv:2405.15012

    2024 arXiv

  149. [159]

    , author Lu, S

    author Zhang, H. , author Lu, S. , author Li, Z. , author Jin, Z. , author Ma, L. , author Liu, Y. , author Li, G. , year 2024 b. title Codebert-attack: Adversarial attack against source code deep learning models via pre-trained model . journal Journal of Software: Evolution a...

    2024 doi

  150. [160]

    , author Zeng, B

    author Zhang, Q. , author Zeng, B. , author Zhou, C. , author Go, G. , author Shi, H. , author Jiang, Y. , year 2024 c. title Human-imperceptible retrieval poisoning attacks in llm-powered applications . https://arxiv.org/abs/2404.17196, http://arxiv.org/abs/2404.17196 arXiv:2...

    2024 arXiv

  151. [161]

    , author Sheng, Q.Z

    author Zhang, W.E. , author Sheng, Q.Z. , author Alhazmi, A. , author Li, C. , year 2020 . title Adversarial attacks on deep-learning models in natural language processing: A survey . journal ACM Transactions on Intelligent Systems and Technology (TIST) volume 11 , pages 1--41

    2020

  152. [162]

    , author Wen, J

    author Zhang, Z. , author Wen, J. , author Huang, M. , year 2023 . title Ethicist: Targeted training data extraction through loss smoothed soft prompting and calibrated confidence estimation . https://arxiv.org/abs/2307.04401, http://arxiv.org/abs/2307.04401 arXiv:2307.04401

    2023 arXiv

  153. [163]

    , author Wang, S

    author Zhao, P. , author Wang, S. , author Gongye, C. , author Wang, Y. , author Fei, Y. , author Lin, X. , year 2019 . title Fault sneaking attack: A stealthy framework for misleading deep neural networks , in: booktitle Proceedings of the 56th Annual Design Automation Confer...

    2019

  154. [164]

    , author Pang, T

    author Zhao, Y. , author Pang, T. , author Du, C. , author Yang, X. , author Li, C. , author Cheung, N.M.M. , author Lin, M. , year 2024 . title On evaluating adversarial robustness of large vision-language models . journal Advances in Neural Information Processing Systems volume 36

    2024

  155. [165]

    , author Zhou, W

    author Zhou, M. , author Zhou, W. , author Huang, J. , author Yang, J. , author Du, M. , author Li, Q. , year 2024 . title Stealthy and effective physical adversarial attacks in autonomous driving . journal IEEE Transactions on Information Forensics and Security

    2024

  156. [166]

    , author Wang, Z

    author Zou, A. , author Wang, Z. , author Carlini, N. , author Nasr, M. , author Kolter, J.Z. , author Fredrikson, M. , year 2023 . title Universal and transferable adversarial attacks on aligned language models . https://arxiv.org/abs/2307.15043, http://arxiv.org/abs/2307.150...

    2023 arXiv

  157. [167]

    , author Zhang, S

    author Zou, J. , author Zhang, S. , author Qiu, M. , year 2024 . title Adversarial attacks on large language models , in: booktitle International Conference on Knowledge Science, Engineering and Management , organization Springer . pp. pages 85--96

    2024

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.