Jun 2026· arXiv.org· Vol abs/2606.27215· 0 citations· 48 references
Computer Science
TL;DR
GAversary is proposed, a hybrid Genetic Algorithm to generate adversarial attacks on natural language models by using GloVe embeddings to propose word replacements (the mutation operator) to improve the semantic similarity of the adversarial examples.
Abstract
Deep learning models have achieved impressive performance across various fields but remain vulnerable to adversarial inputs, particularly in NLP, where such attacks can have significant real-world consequences. Adversarial attacks often involve small, semantically similar token replacements to fool NLP models, and recent methods have become more precise by targeting specific vulnerable words, often by exploiting some level of access to the model's internal structure. This paper proposes GAversary, a hybrid Genetic Algorithm (GA) to generate adversarial attacks on natural language models. The GA is able to treat the target model as a black box, requiring only the logit value output by the model to guide the search. GAversary differs from GAs previously proposed for this problem by using GloVe embeddings to propose word replacements (the mutation operator) to improve the semantic similarity of the adversarial examples. GAversary is applied to several benchmark data sets and well-known target models. GAversary is able to substantially reduce the target model's accuracy on test data compared to the BAE and A2T attacks compared against (in the best case, reducing a 76.8% accuracy to 5.8%, compared to BAE's 27.6%). The trade-off is that GAversary perturbs just under twice as many words as the other two methods, with a slightly lower semantic similarity to the original text and around a 5% increase in run-time.
This paper proposes a novel LVLM attack method, called BadPhase with further backdoor designs, to implant adversarial phase as triggers into any image inputs via data poisoning so as to control the LVLMs’ predictions and finds that LVLMs are sensitive to the phase-aware image structure.
Daizong Liu, Junhao Dong, Xiang Fang et al.· 0 citations
Trained on large corpora of image-text pairs, vision-language models (VLMs) have proven broadly useful across many applications. However, they can still make errors that humans rarely do, particularly when exposed to adversarial inputs crafted to mislead them. Traditional approaches to uncovering such vulnerabilities typically optimize a single input, such as a text prompt, to induce incorrect predictions while remaining plausible to human readers. These methods tend to identify only one or a few high-impact adversarial examples, offering a narrow view of model weaknesses. In contrast, we argue that a Quality-Diversity (QD) perspective is more informative. Rather than searching for a single best attack, QD explicitly aims to generate many high-quality adversarial prompts spanning diverse behaviors and characteristics. This allows us not only to diagnose model weaknesses, but also to characterize which prompts are robust and which are especially fragile. Our experiments show that CVT-MAP-Elites, a QD method integrated into our pipeline, discovers a richer and more diverse set of meaningful adversarial samples than quality-only optimization. Consequently, our approach achieves broader search-space coverage and provides deeper insight into VLM failure modes on text-to-image retrieval tasks in both general and medical domains.
Thai Huy Nguyen, Khoa Tran, Quan Minh Phan et al.· Annual Conference on Genetic...· 0 citations
The rapid advancement of Large Language Models (LLMs) such as GPT-4 and Bard has transformed text generation, yet it has also introduced challenges in distinguishing AI-generated content from human-written text. Ensuring authenticity in textual data is crucial in various domains, including academia, journalism, and content moderation. Traditional detection methods often struggle with adversarially manipulated text and paraphrased AI-generated content, limiting their effectiveness in real-world applications. This study proposes a hybrid detection model that integrates DistilBERT and RoBERTa to improve the identification of AI-generated text. The model is evaluated on two publicly available datasets, LLM-Detect AI Generated Text and DAIGT-V3 Train Dataset, achieving accuracy between 94.2% and 96.1%. By incorporating advanced attention mechanisms, multi-task learning, and adversarial training, the model enhances robustness against paraphrased and adversarially manipulated text, improving detection reliability. Additionally, adversarial data augmentation and FGSM-based adversarial training are employed to strengthen the model’s ability to classify text under real-world perturbations. The findings highlight the effectiveness of the proposed approach in mitigating the risks associated with AI-generated content. By leveraging a hybrid transformer-based architecture, the model provides a scalable, adaptable, and efficient solution for detecting AI-generated text across different linguistic and domain-specific contexts.
Nouman Ahmad, Anam Nasir, Haris Khan et al.· International Joint Conferen...· 0 citations
A new perspective of information theory is introduced to investigate LVLMs’ transferable characteristics by exploring the relative dependence between outputs of the LVLM model and input adversarial samples and formulate the complicated calculation of information gain as an estimation problem and incorporate such informative constraints into the adversarial learning process.
Xiaowen Cai, Daizong Liu, Xiaoye Qu et al.· Neural Information Processin...· 7 citations
Language models suffer from adversarial vulnerability, where imperceptible perturbations in inputs can mislead model predictions. Existing adversarial training methods enhance model robustness by augmenting training data with worst-case adversarial perturbations for each input. However, these approaches overlook the intrinsic causal relationships within data. We construct causal graphs to model the behavior of encoder-based language models under adversarial inputs, suggesting that adversarial vulnerability is often associated with the model’s overfitting to spurious correlations. Within the adversarial training framework, we formulate expressions for Total Effect (TE) and Natural Direct Effect (NDE), and propose a causal regularization objective based on TE-NDE alignment. Experiments on five benchmark datasets show that this causal adversarial training framework improves adversarial robustness across different settings. We further evaluate the model behavior in a controlled sentiment analysis setting, where the quantitative results provide additional evidence for the effectiveness of our method.
Bin Zhu, Yi Xie, Yanxia Feng et al.· Computational Linguistics· 0 citations
Natural Language Processing models are vulnerable to adversarial perturbations which can derail the model’s classification ability. Existing works focus on correcting the training data in order to be resilient to these attacks. In this paper, we propose the idea of multi label classification for adversarial attacks. First, we introduce a new anagram based attack into the literature and second, we train our model to learn these representations by adding a novel label to the dataset which is used as a feature for training the model. Our results show that our method succeeds in separating clean samples from adversarial ones without changing the actual data in the process. We conducted our experiments on the internet movie database dataset. Results show that our method makes a model reliable and robust against character-level perturbations.
Sai Reethi, Sudha Pydi, Pelluri· Journal of Intelligent Decis...· 0 citations