adversarial-training

Introduces Adversarial Causal Intervention Falsification (ACIF), a sequential game where a structural causal generator proposes observational and interventional distributions while an adversarial experimentalist selects interventions to falsify it. The paper provides theoretical guarantees, including finite-sample convergence and model-selection, bridging causal generative modeling, active discovery, and experimental design.

This paper proposes computation-efficient strategies for latent adversarial training (LAT) of LLMs, using low-rank representation fine-tuning and circuit-guided surrogate models to reduce per-step FLOPs by 48.1% while requiring only 0.0118% trainable parameters.

RAGuard is a layered defense framework for Retrieval-Augmented Generation (RAG) systems that uses adversarial fine-tuning of the retriever and a label-free filter (ZKIP) to achieve zero attack success against corpus poisoning, maintaining high retrieval accuracy.

This paper introduces GPT-Red, an automated red-teaming agent trained via self-play at scale to discover novel prompt injection attacks against frontier LLMs, and uses it to adversarially train GPT-5.6, achieving the largest documented LLM safety training run.

This paper proposes Merge-Adversarial Training to make text watermarks in open-source LLMs survive model merging, outperforming baselines while preserving downstream capabilities.

Fence proposes using Small Language Models trained on high-quality synthetic data as specialized guardrails for LLM applications, demonstrating performance gains over prompt-based LLM guardrails.

OpenAI introduces GPT-Red, an automated red-teaming model that finds prompt injection vulnerabilities at scale and is used to adversarially train models like GPT-5.6 Sol, achieving 6x fewer failures on hard prompt injection benchmarks.

Introduces Latent Personality Alignment (LPA), a lightweight adversarial training method that uses 66 psychometric personality statements to achieve near-zero attack success rates on jailbreak attacks without degrading utility, requiring only minutes on a single GPU.

This paper introduces Evidential Adversarial Training (EV-AT), a method that improves the robustness-uncertainty trade-off in classifiers by combining an evidence-based loss with robust evidence alignment, achieving state-of-the-art results on selective classification benchmarks.

This paper from MIT proposes an adversarial generator-discriminator framework that combines verifiable rewards with a learned signal from human demonstrations to address issues like diversity collapse, unnatural responses, and reward hacking in RLVR training of language models.

GRAPE is a training framework that progressively exposes parameter space during adversarial training, achieving higher robust accuracy with fewer parameters compared to fixed-structure methods on CIFAR-10.

This paper rethinks backdoor unlearning from a continual learning perspective, defining complete backdoor unlearning and proposing Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU) that integrates adversarial training into an EM algorithm to effectively eliminate backdoor effects across various attack types and modalities.

This thread presents a technique to encode a functional QR code into neural network weights using natural language text during training, enabling hidden information embedding in models trained on benign data.

This paper proposes SDBN, a framework combining adversarial training with parameter-efficient fine-tuning to improve robustness of foundation models under noise and limited data, demonstrating substantial improvements in low-resource settings.

CHASE introduces a co-evolutionary red-blue teaming framework that uses reinforcement learning to harden LLMs against adaptive black-box adversarial attacks, reducing jailbreak success by 43.2% on benchmarks while maintaining zero false refusals on benign prompts.

A research paper proves that various AI robustness techniques (PGD, RLHF, data augmentation) all estimate the same deployment nuisance covariance matrix. Applying a geometric penalty term reduces sycophancy in Qwen2.5-7B from 38.5% to 13.5% and improves adversarial robustness by 14.8% over standard PGD-AT.

This paper introduces ASAM (Adversarial Subspace Alignment for Multimodal Knowledge Editing), a method that improves the generality of intrinsic multimodal knowledge editing by generating adversarial yet semantically coherent variants and enforcing low-rank alignment of representations, addressing the limited generalization of existing methods.

Introduces PROWL, a prioritized regret-driven optimization framework that uses an adversarial curriculum to improve diffusion-based world model robustness by focusing on high-error trajectories, achieving better performance on out-of-distribution scenarios in MineRL.

The author trained Qwen3.5 to jailbreak itself with reinforcement learning, using diversity rewards to surface multiple attack strategies, then improved the defender's robustness from 64% to 92% defense rate with a slight drop in benign accuracy.

This paper presents a robust evaluation framework and training strategies for biomedical publication type and study design classification, using knowledge-guided perturbations to mitigate reliance on spurious features.