mlsanityData to 14 Oct 2026

Universal Adversarial Suffixes Using Calibrated Gumbel-Softmax Relaxation

arXiv 2512.08123 ↗First posted 9 Dec 2025cs.CLcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Language models (LMs) are often used as zero-shot or few-shot classifiers by scoring label words, but they remain fragile to adversarial prompts. Prior work typically optimizes task- or model-specific triggers, making results difficult to compare and limiting transferability. We study universal adversarial suffixes: short token sequences (4-10 tokens) that, when appended to any input, broadly reduce accuracy across tasks and models. Our approach learns the suffix in a differentiable "soft" form using Gumbel-Softmax relaxation and then discretizes it for inference. Training maximizes calibrated cross-entropy on the label region while masking gold tokens to prevent trivial leakage, with entropy regularization to avoid collapse. A single suffix trained on one model transfers effectively to others, consistently lowering both accuracy and calibrated confidence. Experiments on sentiment analysis, natural language inference, paraphrase detection, commonsense QA, and physical reasoning with Qwen2-1.5B, Phi-1.5, and TinyLlama-1.1B demonstrate consistent attack effectiveness and transfer across tasks and model families.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 12 of its 19 references that are in the map. First posted on arXiv 9 Dec 2025.

Builds on

12 of 19 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 11

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  3. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  4. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,739
  5. 2021Calibrate Before Use: Improving Few-Shot Performance of Language Modelscited by 1,392
  6. 2016The Concrete Distribution: A Continuous Relaxation of Discrete Random Variablescited by 1,148
  7. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  8. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
  9. 2018Generating Natural Language Adversarial Examplescited by 424
  10. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  11. 2021Surface Form Competition: Why the Highest Probability Answer Isn't Always Rightcited by 263

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Universal Adversarial Suffixes for Language Models Using Reinforcement Learning with Calibrated Reward
  2. 2026Detecting Fluent Optimization-Based Adversarial Prompts via Sequential Entropy Changes
  3. 2024Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models
  4. 2025Adversarial Suffix Filtering: a Defense Pipeline for LLMs
  5. 2024Adversarial Attacks on Large Language Models Using Regularized Relaxation
  6. 2025Universal and Transferable Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent
  7. 2024Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models
  8. 2024ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddings