Mitigating Adversarial Attacks in LLMs through Defensive Suffix Generation
AI Safety;Large Language Models;Defensive Suffix;Adversarial Attacks
The paper includes funding acknowledgements, including a specific grant number that can be used to identify the authors. The authors certified that there is "no acknowledgement section in this submission for double blind review." The submission is not double blind, causing desk rejection.
Submission Desk Rejected by Program Chairs
A gradient-based defensive suffix algorithm with an improved loss function strengthens LLMs against adversarial attacks while maintaining utility without retraining.
@misc{
kim2024mitigating,
title={Mitigating Adversarial Attacks in {LLM}s through Defensive Suffix Generation},
author={Minkyoung Kim and Yunha Kim and Hyeram Seo and Heejung Choi and JiYe Han and Gaeun Kee and Soyoung Ko and HyoJe Jung and Byeolhee Kim and Young-Hak Kim and Sanghyun park and Tae Joon Jun},
year={2024},
url={https://openreview.net/forum?id=ReKrTbRfJt}
}
Large language models (LLMs) have exhibited outstanding performance in natural language processing tasks. However, these models remain susceptible to adversarial attacks in which slight input perturbations can lead to harmful or misleading outputs. A gradient-based defensive suffix generation algorithm is designed to bolster the robustness of LLMs. By appending carefully optimized defensive suffixes to input prompts, the algorithm mitigates adversarial influences while preserving the models' utility. To enhance adversarial understanding, a novel total loss function ($L_{\text{total}}$) combining defensive loss ($L_{\text{def}}$) and adversarial loss ($L_{\text{adv}}$) generates defensive suffixes more effectively. Experimental evaluations show that applying this method to open-source LLMs such as gemma-7B and mistral-7B results in an average 19\% reduction in attack success rates (ASR) compared to models without defensive suffixes. This approach reduces the perplexity score of the Gemma-7B base model from 4.59 to 2.90 when applying the defensive suffix generated by Llama3.2-1B. This significantly enhances the security of LLMs in critical applications without requiring extensive retraining.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
~Minkyoung_Kim1 ~Yunha_Kim1 ~Hyeram_Seo1 ~Heejung_Choi1 ~JiYe_Han1 ~Gaeun_Kee1 ~Soyoung_Ko2 ~HyoJe_Jung2 ~Byeolhee_Kim1 ~Young-Hak_Kim1 ~Sanghyun_park2 ~Tae_Joon_Jun1
Minkyoung Kim Yunha Kim Hyeram Seo Heejung Choi JiYe Han Gaeun Kee Soyoung Ko HyoJe Jung Byeolhee Kim Young-Hak Kim Sanghyun park Tae Joon Jun
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
AI Safety Large Language Models Defensive Suffix Adversarial Attacks
I certify that there is no acknowledgement section in this submission for double blind review.
kim|mitigating_adversarial_attacks_in_llms_through_defensive_suffix_generation
/pdf/66a96970066655fe7d3d4ec484a2d675212bec8b.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Mitigating Adversarial Attacks in LLMs through Defensive Suffix Generation
ICLR 2025 Conference Desk Rejected Submission
ICLR.cc/2025/Conference/Desk_Rejected_Submission