mlsanityData to 7 Oct 2026

On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs

arXiv 2412.20087 ↗First posted 28 Dec 2024cs.CR cs.AIcited by 2

Not on the map. Why?

Abstract (arXiv)

This research investigates the effectiveness of established vulnerability metrics, such as the Common Vulnerability Scoring System (CVSS), in evaluating attacks against Large Language Models (LLMs), with a focus on Adversarial Attacks (AAs). The study explores the influence of both general and specific metric factors in determining vulnerability scores, providing new perspectives on potential enhancements to these metrics. This study adopts a quantitative approach, calculating and comparing the coefficient of variation of vulnerability scores across 56 adversarial attacks on LLMs. The attacks, sourced from various research papers, and obtained through online databases, were evaluated using multiple vulnerability metrics. Scores were determined by averaging the values assessed by three distinct LLMs. The results indicate that existing scoring-systems yield vulnerability scores with minimal variation across different attacks, suggesting that many of the metric factors are inadequate for assessing adversarial attacks on LLMs. This is particularly true for context-specific factors or those with predefined value sets, such as those in CVSS. These findings support the hypothesis that current vulnerability metrics, especially those with rigid values, are limited in evaluating AAs on LLMs, highlighting the need for the development of more flexible, generalized metrics tailored to such attacks. This research offers a fresh analysis of the effectiveness and applicability of established vulnerability metrics, particularly in the context of Adversarial Attacks on Large Language Models, both of which have gained significant attention in recent years. Through extensive testing and calculations, the study underscores the limitations of these metrics and opens up new avenues for improving and refining vulnerability assessment frameworks specifically tailored for LLMs.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 86 of its 157 references that are in the map. First posted on arXiv 28 Dec 2024.

Builds on

86 of 157 references.

References · 86

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2020Extracting Training Data from Large Language Modelscited by 2,144
  9. 2016Adversarial examples in the physical worldcited by 1,762
  10. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  12. 2020Beyond Accuracy: Behavioral Testing of NLP models with CheckListcited by 979
38 more
  1. 2021Membership Inference Attacks From First Principlescited by 839
  2. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  3. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  4. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  5. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  8. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  9. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  10. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  11. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  12. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  13. 2019Hidden Trigger Backdoor Attackscited by 359
  14. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  15. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  16. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  17. 2018Adversarial Attack on Graph Structured Datacited by 300
  18. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  19. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 278
  20. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  21. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  22. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  23. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  24. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  25. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  26. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  27. 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 162
  28. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  29. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  30. 2023ProPILE: Probing Privacy Leakage in Large Language Modelscited by 127
  31. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  32. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
  33. 2024Automatic and Universal Prompt Injection Attacks against Large Language Modelscited by 112
  34. 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
  35. 2019Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systemscited by 99
  36. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 95
  37. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakerscited by 91
  38. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90

50 most cited of 86 All 86 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Where Do LLM-based Systems Break? A System-Level Security Framework for Risk Assessment and Treatmentcited by 0
  2. 2026Bridging the Gap Between Security Metrics and Key Risk Indicators: An Empirical Framework for Vulnerability Prioritizationcited by 0