adversarial-defense

Decoy Direction Optimization (DDO) is a fast, post-hoc defense method that protects open-weight LLMs from refusal feature ablation attacks by injecting decoy signals into the network, achieving high robustness at lower cost than trained defenses.

EvoSafeHarness optimizes deployable safety harnesses for LLM agents by jointly searching natural-language policies and executable logic, improving safety-utility trade-offs across agent benchmarks.

This paper introduces Semantic Overlays, a technique using learned adapters to annotate input spans for language models, effectively mitigating prompt injection attacks while maintaining utility. It demonstrates strong defense results on benchmarks like SEP and TensorTrust.

Thermo-FL is a federated LoRA fine-tuning framework for large language models on edge devices that uses device temperature to regulate training and transmission, paired with a robust aggregation method to defend against adversarial attacks, enhancing stability and performance.

This paper introduces Multi-Turn Certified Robustness (MTCR), a framework for certifying the safety of large language models against multi-turn jailbreak attacks by providing tighter bounds through compositional methods and safety persistence.

This paper introduces 'Fool's Gold', a defensive deception technique called decoy hardening that trains open-weight language models to generate falsified answers when safety alignment is removed, while preserving normal behavior, tested across multiple model families and sizes.

DiSCO is a training-free, black-box defense for text-to-image models that uses distribution-guided contrastive prompt optimization to prevent generation of Not-Safe-For-Work content, significantly reducing attack success rates.

This paper proposes GraphRP, a proactive defense framework using model reprogramming to protect GNNs from model extraction attacks, with a structure-aware gating mechanism that preserves benign utility while degrading adversarial queries.

This paper introduces Temporal Context Awareness (TCA), a defense framework that detects multi-turn manipulation attacks on LLMs by analyzing semantic drift, cross-turn intention consistency, and evolving conversational patterns to mitigate adversarial context-building across dialogues.

Researchers from Southampton and Manchester propose a hybrid adversarial defence framework for LLMs that combines entropy-based, uncertainty-based, and geometric-based models to simultaneously address hallucination and adversarial vulnerability in NLU tasks, achieving up to 64.92% improvement in adversarial robustness and 62.27% reduction in attack success rate.

This paper proposes methods for protecting large language models against unauthorized knowledge distillation by rewriting reasoning traces to degrade training usefulness while preserving correctness, and embedding verifiable watermarks in distilled student models. The approach uses instruction-based and gradient-based rewriting techniques to achieve anti-distillation effects without compromising teacher model performance.