Pith. sign in

REVIEW 3 major objections 4 minor 19 references

When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Reasoning LLMs that copy prompt tokens into their chain of thought can be steered by hidden triggers toward infinite loops, early termination, false refusals, and adversary-chosen vulnerability verdicts.

desk verdict A credible new attack taxonomy built on an unverified copying premise; the paper is honest about its limits but the abstract oversells the evidence. read the letter →

arxiv 2507.16773 v1 pith:RJ6TBSBT submitted 2025-07-22 cs.CR

Yue Li , Xiao Li , Hao Wu , Yue Zhang , Fengyuan Xu , Xiuzhen Cheng , Sheng Zhong This is my paper · ORCID
classification cs.CR
keywords copy-guidedattacksreasoningLLMschain-of-thoughtpromptinjectionvulnerabilitydetectionGreedyCoordinateGradientinferencemanipulationLLMsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a behavior normally seen as harmless, a reasoning LLM copying tokens from the prompt into its chain-of-thought, is itself an attack surface. If an adversary hides a crafted trigger inside an external code snippet, the model will likely reproduce that trigger during reasoning, and the copied tokens then act as anchors that bias all subsequent generation. The authors formalize trigger construction as an optimization problem, adapt the Greedy Coordinate Gradient method to solve relaxed versions of it, and show on DeepSeek-R1-Distill-Qwen-1.5B that the attack can produce infinite repetition, premature end-of-sequence, false refusal, premature end-of-thought, and flipped vulnerability judgments. The reported success is confined to a targeted, single-instruction setting; generalizing across prompts is left as an open research problem because the multi-prompt objectives are estimated to require 80 to more than 8,000 days of computation with current methods. This matters because LLM-based code auditors are entering development pipelines, where a malicious code snippet could turn the auditor into a denial-of-service source or a tool that returns adversary-chosen verdicts.

What carries the argument

The load-bearing mechanism is the copied trigger as an autoregressive anchor: an adversarial string $t$ placed in the payload is selected so that, once the model echoes $t$ in its reasoning prefix $p$, the conditional probability of the attacker's target sequence $y$ rises. To find such triggers the paper defines a ladder of relaxed objectives: the original loss sums over all instructions $i$ and decoding prefixes $p$; RO(IV) restricts those sets; RO(III) fixes one instruction; RO(II) fixes one prefix and forces the same trigger into prompt and output; RO(I) drops the dependence of decoding on the prompt and trigger. The optimization machinery is Greedy Coordinate Gradient (GCG), extended to Multi-Position GCG to co-optimize both occurrences of the trigger, and combined with Universal Prompt Optimization for the multi-prompt objectives.

What would settle it

Run the Table II triggers through the same model with ordinary user instructions on the same Solidity contract and count how often the trigger appears in the reasoning prefix before the claimed behavior. If the copy rate is near zero, or if the target behavior occurs at the same rate with a random trigger in place of the optimized one, the copy-guided mechanism is not what produces the effect.

Watch

Extended reading notes

Core claim

The paper's central claim is that a reasoning LLM's tendency to copy prompt tokens into its rationale is a distinct and exploitable vulnerability, separate from instruction hijacking. The attacker decomposes the adversarial payload into before-trigger, trigger, and after-trigger parts; when the model copies the trigger into its reasoning prefix, the recent-token bias of autoregressive decoding makes that trigger steer the next tokens. The authors demonstrate five manifestations: token repetition until the maximum length is reached, early emission of the end-of-sequence token, false triggering of the safety refusal mechanism, early termination of the think block, and semantic distortion that flips vulnerability judgments. Their optimization results are mixed: all five targets are reachable under the simplest relaxed objective RO(I), three remain feasible when the same trigger must appear in both prompt and output, and none are feasible with current methods once multiple instructions or prefixes are required.

Load-bearing premise

The attack only exists if the model spontaneously copies the optimized trigger into its own reasoning during ordinary decoding, and the paper never measures how often that copy actually happens.

Editorial extensions

If this is right

  • A user who asks an LLM to audit or summarize untrusted code can be forced into a repetition loop that consumes the model's maximum token budget, even though the payload contains no hidden instruction.
  • The same trigger can make the auditor stop before answering, refuse harmless requests, or terminate its reasoning early, degrading accuracy on code that needs multiple inference steps.
  • Semantic distortion lets the attacker choose the vulnerability verdict: safe code is reported as vulnerable, or flawed code as safe, creating false positives and false negatives in the pipeline.
  • Because the payload contains no readable instruction, CGA is stealthier than ordinary prompt injection: the user sees only code, and the model appears to be malfunctioning rather than obeying a hidden command.
  • Under current methods the attack is practical only for a fixed prompt; extending it across instructions or prefixes is computationally out of reach, so multi-prompt CGA remains an open problem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A cheap, testable defense follows from the paper's own mechanism: monitor the reasoning trace for verbatim echoes of payload tokens and flag them as potential anchors; the paper does not propose such a detector, but its mechanism implies it should work.
  • The failure of the end-of-sequence and end-of-thought targets under RO(II) suggests those two manifestations may depend less on copy-anchoring and more on direct pressure on special-token probabilities; comparing the probability of <eos> and </think> with and without a copied trigger would separate the two paths.
  • If the copying tendency is model-wide rather than task-specific, CGA should transfer to other code tasks that make the model echo identifiers, such as summarization or repair; the paper's three-instruction denial-of-service case study points in that direction but does not establish the boundary.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces Copy-Guided Attacks (CGA), a class of indirect prompt injection attacks that exploit the tendency of reasoning LLMs to copy tokens from the input into their rationale. The authors define five attack manifestations (repetition, premature end-of-sequence, false refusal, premature end-of-thought, and semantic distortion), formalize trigger construction as an optimization problem with four relaxations (RO(I) through RO(IV)), and adapt Greedy Coordinate Gradient (GCG) to synthesize triggers. Experiments on DeepSeek-R1-Distill-Qwen-1.5B with a single 35-line Solidity contract show that RO(I) can be optimized for all five manifestations, RO(II) succeeds only for three, and RO(III)/(IV) are estimated to be computationally infeasible. The paper claims this demonstrates a new vulnerability in LLM-powered code analysis, though the authors also acknowledge that generalization remains an open problem.

Significance. If the central premise were verified—that a trigger embedded in external code is spontaneously copied into the reasoning trace and then steers the model—the attack would be significant: it would enable denial-of-service, false refusals, and adversary-chosen vulnerability judgments in code-analysis pipelines. The taxonomy of five manifestations and the formal optimization framework are useful conceptual contributions, and the paper is commendably transparent about the RO(II) failures and the prohibitive estimated cost of RO(III)/(IV). The release of code (if made available) and the reproducible optimization setup are additional strengths. However, the current experiments support only a conditional statement—'when a trigger is already present in the decoding context, it can steer the output'—which is materially weaker than the paper's stated claim that embedded triggers are copied during normal decoding and thereby manipulate inference. The missing copy-rate measurement is the decisive gap.

major comments (3)
  1. [§IV-A, RO(I) and §V-B, Table II] The central claim of the paper is that an attacker who controls only the external code can induce the model to copy an embedded trigger and thereby steer the reasoning trace. This premise is not tested. The RO(I) objective is defined as LI(t) = -log P(y | i ⊕ bt ⊕ t* ⊕ at ⊕ p ⊕ t), so the optimized trigger t is already present in the conditioning context immediately before the target y; the model never has to copy it out of the payload during optimization or evaluation. Table II therefore demonstrates that an explicitly injected trigger can bias generation, not that a payload-only trigger will be spontaneously copied. No systematic copy-rate measurement for payload-only prompts is reported, and Figure 1 is a single hand-picked case. Without such a measurement, the threat model in §III-A is not realized, and the abstract's claim that CGA 'reliably induces' the listed failures is unsupported. The authors should add a copy-rate measurement (the fraction of runs in which the optimized trigger appears in the rationale under greedy decoding for prompts of the form i ⊕ bt ⊕ t ⊕ at) and report it per AM, or explicitly restrict the claims to the conditional setting.
  2. [§V-A, §V-B, Table II] The empirical evaluation is example-based rather than statistical. Only one model (DeepSeek-R1-Distill-Qwen-1.5B) and one 35-line Solidity contract are used, and each row of Table II shows a single selected output with no number of trials, success rate, variance, or error bars. The abstract's phrase 'reliably induces' is therefore not supported by the reported evidence. Please report success rates over multiple seeds and, ideally, over additional instructions, contracts, and model checkpoints; at a minimum, temper the abstract and Section I to say 'can induce' in the tested examples, with the explicit caveat that generalization was not measured.
  3. [§IV-A, RO(II) and §V-B, Table III] The relaxed objectives progressively build the copy event into the optimization. For RO(II), Multi-Pos GCG optimizes the same trigger tokens in both the prompt and the output positions, so the output occurrence is placed by the optimizer during training; the experiments do not measure whether the model would emit that trigger spontaneously from a payload-only prompt. RO(II) also fails for AM-2 and AM-4, and RO(III)/(IV) are estimated at 80 and 8,000 days and were not run. Consequently, the statement in Section VI that 'multi-prompt CGA is an observable phenomenon' rests on the single anecdotal example in Figure 1 rather than on a measured copy probability or a multi-prompt success rate. This should be either supported with data or removed.
minor comments (4)
  1. [§IV-A] The notation is inconsistent: RO(I) uses t* in the prompt and t as the optimized suffix, while Figure 2 labels both occurrences as t. Please define t* and clarify that the optimized variable in RO(I) is the suffix after p, not the payload trigger.
  2. [Table II] The caption should state the generation protocol: whether the trigger was appended after p (the RO(I) setup) and whether the displayed outputs were selected from multiple runs. Currently the reader cannot tell if these are successful examples or representative outcomes.
  3. [Figure 1] The figure is difficult to read, and the notation 'LOOPk' and the relation between the three task variants are not explained. Please enlarge and clarify.
  4. [Section I] The sentence 'We release our code and initial results' should include a repository link or be removed.

Circularity Check

2 steps flagged · score 6.0 of 10

RO(I) conditions the target distribution on the trigger already sitting in the reasoning prefix, so Table II demonstrates context-injected steering rather than the copy-guided attack the paper claims; the copy event is assumed, not measured.

  1. self definitional [Section IV-A, 'Original Adversarial Objective and Relaxed Objectives' (RO(I), LI(t))]
    "During generation, suppose the model copies t into its output. Let p denote the prefix preceding the copied t during decoding. The probability of generating the target sequence y is then: P (y | i ⊕ bt ⊕ t ⊕ at ⊕ p ⊕ t) ... For RO(I), we directly apply GCG by treating i ⊕ bt ⊕ t∗ ⊕ at ⊕ p as the prompt prefix and optimizing the adversarial suffix t."

    The defining premise of CGA is that the model spontaneously copies the payload trigger into the rationale, after which the copied tokens steer generation. RO(I) instead conditions the target distribution on the trigger already being present in the context immediately before y (p ⊕ t), and GCG optimizes that post-copy suffix directly. The attacker's only controlled variable in Section III-A is the payload, but the optimized variable is the already-copied token stream. Table II therefore shows that a context-injected trigger can bias output, which is built into the loss, not that the payload trigger induces copying. No copy rate under greedy decoding is reported; Figure 1 is a hand-picked case explicitly conditioned on the model having copied the trigger.

  2. fitted input called prediction [Section IV-B 'Multi-Position Greedy Coordinate Gradient' and Section V-B (Table III)]
    "Specifically, we modify the algorithm to jointly optimize multiple positions under the constraint that the trigger token t remains consistent between the prompt and the output."

    For RO(II), the occurrence of t in the output is a trainable position; the optimizer writes the trigger into the reasoning stream, so the 'copy' is enforced by gradient descent rather than produced by the model's native copying behavior. The successful AM-1/AM-3/AM-5 rows in Table III are then reported as evidence of CGA feasibility, but they only demonstrate steering when the trigger is placed into the output by the optimization procedure. The threat model requires the model to emit that trigger spontaneously from a payload-only prompt, and this emission rate is never measured.

full rationale

The central circularity is in the bridge from the optimization objective to the attack claim. Section IV-A defines the loss conditioned on the trigger already appearing after the decoding prefix p, so the target probability is computed with the trigger in the immediate context. Optimizing under this conditioning and then reporting Table II as evidence that CGA 'reliably induces' infinite loops, premature termination, false refusals, and semantic distortions reduces the demonstration to context-injected steering: the attack's defining copy event is an input to the loss, not an outcome that is measured. The paper's own disclaimers lower the severity: RO(III)/RO(IV) are conceded infeasible, AM-2/AM-4 fail under RO(II), and the only direct illustration of copying is a hand-picked case study. These admissions are honest but do not repair the missing copy-rate measurement. No self-citation chain is load-bearing: the cited copying-behavior and GCG works are external and standard, and the authors' own prior papers contribute background rather than the load-bearing premise. The score reflects the one structural reduction—conditioning on the copy—rather than broader scientific weakness.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The central claim depends on a small number of chosen optimization hyperparameters and on domain assumptions about copying and gradient access, rather than on fitted physical parameters. The key unverified premise is that optimized triggers will be copied naturally at test time; the loss functions partly assume this by conditioning on the trigger after the prefix. No new explanatory entities are introduced: the trigger is the attack artifact itself, not a postulated mechanism.

free parameters (2)
  • Optimization set sizes |I*| and |P*| = 25 each
    Set to 25 following [19]; these hyperparameters determine how many instructions and prefixes the trigger is optimized over, and are not derived from the problem.
  • Trigger length k = Not reported
    The trigger t is constrained to V^k, but the paper does not state the value used in experiments, leaving an unspecified degree of freedom in reproducing the triggers.
assumptions (6)
  • standard math Autoregressive next-token prediction factorizes the output probability as a product of conditional token probabilities.
    Used in Section II-A as the basis of all loss definitions; standard background.
  • domain assumption Recent tokens have stronger influence than distant tokens in transformer inference.
    Cited to [15] in Section II-A and used in Section III-B to justify trigger placement; not re-verified for the tested models.
  • domain assumption Reasoning LLMs copy key tokens from the prompt into their rationale during decoding.
    Central premise of CGA; illustrated in Figure 1 but not measured systematically in Section V.
  • domain assumption At test time, the optimized trigger will be copied into the reasoning prefix p so that the trigger appears immediately before the target generation.
    All loss definitions in Section IV-A condition on p followed by t; without natural copying, the objectives do not model the real attack.
  • domain assumption The attacker has white-box access to the target model, including gradients.
    Stated in the threat model in Section III-A; limits practical applicability and is acknowledged in Section VI.
  • domain assumption Triggers optimized on a small prompt set can transfer to other prompts (GCG/UPO transferability).
    Borrowed from [19] in Section IV-A to justify RO(IV); not tested because of estimated 8,000 day cost.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs." pith.science (2026). https://pith.science/paper/RJ6TBSBT

@misc{pith2026250716773,
  author       = {Pith},
  title        = {Pith review of: When LLMs Copy to Think: Uncovering Copy-Guided Attacks in Reasoning LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RJ6TBSBT}},
  note         = {Machine review of arXiv:2507.16773}
}
read the original abstract

Large Language Models (LLMs) have become integral to automated code analysis, enabling tasks such as vulnerability detection and code comprehension. However, their integration introduces novel attack surfaces. In this paper, we identify and investigate a new class of prompt-based attacks, termed Copy-Guided Attacks (CGA), which exploit the inherent copying tendencies of reasoning-capable LLMs. By injecting carefully crafted triggers into external code snippets, adversaries can induce the model to replicate malicious content during inference. This behavior enables two classes of vulnerabilities: inference length manipulation, where the model generates abnormally short or excessively long reasoning traces; and inference result manipulation, where the model produces misleading or incorrect conclusions. We formalize CGA as an optimization problem and propose a gradient-based approach to synthesize effective triggers. Empirical evaluation on state-of-the-art reasoning LLMs shows that CGA reliably induces infinite loops, premature termination, false refusals, and semantic distortions in code analysis tasks. While highly effective in targeted settings, we observe challenges in generalizing CGA across diverse prompts due to computational constraints, posing an open question for future research. Our findings expose a critical yet underexplored vulnerability in LLM-powered development pipelines and call for urgent advances in prompt-level defense mechanisms.

Figures

Figures reproduced from arXiv: 2507.16773 by the authors.

Figure 1
Figure 1. A case study on deepseek-r1-distill-llama-8b. When the model copies the trigger $name in the rationale, it activates the attack logic, causing an infinite loop until the maximum token limit is reached. This attack case demonstrates strong robustness and can generalize across various instructions. decoding settings, this repetitive behavior persists until the maximum token limit is reached, effectively exhausting the… view at source ↗
Figure 2
Figure 2. The input structure used during CGA optimization. • RO(IV): We relax the constraints on i ∈ I and p ∈ P, since enumerating all possible instructions and prefixes is infeasible. As shown in [19], targets learned via GCG on a limited prompt set can generalize to other prompts. Therefore, we constrain I ∗ ⊂ I and P ∗ ⊂ P, where |I∗ | and |P∗ | are treated as hyperparameters. The objective becomes: LIV(t) = X i∈I∗, p∈P∗… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

19 extracted references · 7 canonical work pages

  1. [1]

    A survey on evaluation of large language models

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al. A survey on evaluation of large language models. ACM transactions on intelligent systems and technology , 15(3):1–45, 2024

    2024

  2. [2]

    Cursor, 2025

    Cursor. Cursor, 2025. TABLE II EXAMPLES OF ADVERSARIAL MANIFESTATIONS (AM) UNDER RO(I) AM Trigger and Subsequent Output Description AM-1 chartmdatwhelAuthorajaranprofLoopLOOPLOOPMODELLOOPLOOPLOOP... Token repetition until reaching the model’s maximum output length. AM-2 acadcompilerhistoirehostleshootingabcdefcvbrands triangle the<eos> Early stop triggere...

    work page 2025

  3. [3]

    Impact of non-standard unicode characters on security and comprehension in large language models

    Johan S Daniel and Anand Pal. Impact of non-standard unicode characters on security and comprehension in large language models. arXiv preprint arXiv:2405.14490 , 2024

    arXiv 2024

  4. [4]

    How to think step-by-step: A mechanistic understanding of chain-of-thought reasoning

    Subhabrata Dutta, Joykirat Singh, Soumen Chakrabarti, and Tanmoy Chakraborty. How to think step-by-step: A mechanistic understanding of chain-of-thought reasoning. arXiv preprint arXiv:2402.18312 , 2024

    arXiv 2024

  5. [5]

    Missing premise exacerbates overthinking: Are reasoning models losing critical thinking skill? arXiv preprint arXiv:2504.06514 , 2025

    Chenrui Fan, Ming Li, Lichao Sun, and Tianyi Zhou. Missing premise exacerbates overthinking: Are reasoning models losing critical thinking skill? arXiv preprint arXiv:2504.06514 , 2025

    arXiv 2025

  6. [6]

    Github copilot, 2025

    Github. Github copilot, 2025

    work page 2025

  7. [7]

    Not what you’ve signed up for: Com- promising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Com- promising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , pages 79–90, 2023

    work page 2023

  8. [8]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforce- ment learning

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforce- ment learning. arXiv preprint arXiv:2501.12948 , 2025

    arXiv 2025

Show all 19 references
  1. [9]

    Teaching large lan- guage models to reason with reinforcement learning

    Alex Havrilla, Yuqing Du, Sharath Chandra Raparthy, Christoforos Nalmpantis, Jane Dwivedi-Yu, Maksym Zhuravinskyi, Eric Hambro, Sainbayar Sukhbaatar, and Roberta Raileanu. Teaching large lan- guage models to reason with reinforcement learning. arXiv preprint arXiv:2403.04642, 2024

    2024 arXiv

  2. [10]

    Make a feint to the east while attacking in the west: Blinding llm-based code auditors with flashboom attacks

    Xiao Li, Yue Li, Hao Wu, Yue Zhang, Kaidi Xu, Xiuzhen Cheng, Sheng Zhong, and Fengyuan Xu. Make a feint to the east while attacking in the west: Blinding llm-based code auditors with flashboom attacks. In 2025 IEEE Symposium on Security and Privacy (SP) , pages 576–594. IEEE, 2025

    2025

  3. [11]

    Everything you wanted to know about llm-based vulnerability detection but were afraid to ask

    Yue Li, Xiao Li, Hao Wu, Minghui Xu, Yue Zhang, Xiuzhen Cheng, Fengyuan Xu, and Sheng Zhong. Everything you wanted to know about llm-based vulnerability detection but were afraid to ask. arXiv preprint arXiv:2504.13474, 2025

    2025 arXiv

  4. [12]

    Attention is all you need for llm-based code vulnerability localization

    Yue Li, Xiao Li, Hao Wu, Yue Zhang, Xiuzhen Cheng, Sheng Zhong, and Fengyuan Xu. Attention is all you need for llm-based code vulnerability localization. arXiv preprint arXiv:2410.15288 , 2024

    2024 arXiv

  5. [13]

    Formalizing and benchmarking prompt injection attacks and defenses

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 1831–1847, 2024

    2024

  6. [14]

    o4-mini system card, 2025

    OpenAI. o4-mini system card, 2025

    2025

  7. [15]

    On the importance of local information in transformer based models

    Madhura Pande, Aakriti Budhraja, Preksha Nema, Pratyush Kumar, and Mitesh M Khapra. On the importance of local information in transformer based models. arXiv preprint arXiv:2008.05828 , 2020

    2008 arXiv

  8. [16]

    Invisible prompts, visible threats: Malicious font injection in external resources for large language models

    Junjie Xiong, Changjia Zhu, Shuhang Lin, Chong Zhang, Yongfeng Zhang, Yao Liu, and Lingyao Li. Invisible prompts, visible threats: Malicious font injection in external resources for large language models. arXiv preprint arXiv:2505.16957 , 2025

    2025 arXiv

  9. [17]

    A survey on large language model (llm) security and privacy: The good, the bad, and the ugly

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing , page 100211, 2024

    2024

  10. [18]

    On large language models’ resilience to coercive interro- gation

    Zhuo Zhang, Guangyu Shen, Guanhong Tao, Siyuan Cheng, and Xi- angyu Zhang. On large language models’ resilience to coercive interro- gation. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 826–844. IEEE, 2024

    2024

  11. [19]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 , 2023

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.