mlsanityData to 7 Oct 2026

Fast Proxies for LLM Robustness Evaluation

arXiv 2502.10487 ↗First posted 14 Feb 2025cs.CR cs.AIcited by 3

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Evaluating the robustness of LLMs to adversarial attacks is crucial for safe deployment, yet current red-teaming methods are often prohibitively expensive. We compare the ability of fast proxy metrics to predict the real-world robustness of an LLM against a simulated attacker ensemble. This allows us to estimate a model's robustness to computationally expensive attacks without requiring runs of the attacks themselves. Specifically, we consider gradient-descent-based embedding-space attacks, prefilling attacks, and direct prompting. Even though direct prompting in particular does not achieve high ASR, we find that it and embedding-space attacks can predict attack success rates well, achieving rp=0.87 (linear) and rs=0.94 (Spearman rank) correlations with the full attack ensemble while reducing computational cost by three orders of magnitude.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 22 of its 26 references that are in the map. First posted on arXiv 14 Feb 2025.

Builds on

22 of 26 references.

Closest ancestors · 11

Same direction, newest first

  1. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet27 Aug
  2. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs22 Jul
  3. 2024Efficient Adversarial Training in LLMs with Continuous Attacks24 May
  4. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs11 Apr
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  6. 2024Fast Adversarial Attacks on Language Models In One GPU Minute23 Feb
  7. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space14 Feb
  8. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attacks19 Dec
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  10. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 11

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2023Qwen Technical Reportcited by 3,273
  4. 2023Mistral 7Bcited by 3,065
  5. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
  6. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  7. 2024Phi-4 Technical Reportcited by 675
  8. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  9. 2024Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Promptscited by 189
  10. 2023Adversarial Attacks and Defenses in Large Language Models: Old and New Threatscited by 49
  11. 2024Hermes 3 Technical Reportcited by 33

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 1.

3 papers.

  1. 2025Benchmarking and Improving LLM Robustness for Personalized Generationcited by 4
  2. 2025Efficient Prompt Optimisation for Legal Text Classification with Proxy Prompt Evaluatorcited by 2
  3. 2026Closing the Distribution Gap in Adversarial Training for LLMscited by 0