Research map / Adversarial robustness and security / Attacks on text and graphs
Fast Adversarial Attacks on Language Models In One GPU Minute
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces BEAST, a gradient-free beam search attack that generates readable adversarial suffixes for LMs in about one GPU minute, applied to jailbreaking, hallucination elicitation, and membership inference.
Problem
Gradient-based adversarial attacks on language models are slow (over an hour per prompt) and produce gibberish, while faster black-box alternatives depend on expensive GPT-4 API access; the paper asks whether LMs can be attacked quickly and cheaply for jailbreaks, hallucinations, and privacy attacks
Approach
Beam search over adversarial suffix tokens, where candidate tokens are multinomially sampled from the target LM's own next-token distribution (so outputs stay readable) and beams are ranked by an adversarial objective; beam size k1 and per-beam sample count k2 trade off speed, success, and readability.
Key results
- On Vicuna-7B, BEAST reaches 89% ASR within one GPU minute versus 46% for the best baseline (PAIR) and 98% in 2.65 minutes on a single RTX A6000.
- Human study on Vicuna-7B-v1.5 shows BEAST's untargeted attack raises incorrect answers by 14.67 percentage points, and 22% of adversarial responses are irrelevant to the prompt.
- BEAST added to PPL raises average WikiMIA AUROC from 58.6 to 59.9, and added to Min-k% raises it from 56.4 to 59.1; OPT-2.7B Min-k% improves by 4.1 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BEAST instead of the strongest reported baseline within a one-GPU-minute budget | Vicuna-7B-v1.5 on AdvBench · AdvBench, one GPU minute | ASR (%): 89 vs 46 | Helped |
| Use BEAST instead of AutoDAN-2 within a one-GPU-minute budget | Mistral-7B-v0.2 on AdvBench · AdvBench, one GPU minute | ASR (%): 83 vs 68 | Helped |
| Increase universal-suffix beam size from 10 to 15 (ablation) | BEAST on Vicuna-7B-v1.5 · AdvBench universal suffix, train and test | ASR (%): 90 -> 95; 78.75 -> 84.38 | Helped |
| Increase universal-suffix beam size from 10 to 15 (ablation) | BEAST on Vicuna-13B-v1.5 · AdvBench universal suffix, train and test | ASR (%): 60 -> 80; 48.13 -> 68.13 | Helped |
| Add a PPL defense | BEAST on Vicuna-7B-v1.5 · AdvBench, one GPU minute | ASR (%): 89 -> 70 | Hurt |
| Add BEAST adversarial prompts to the PPL membership-inference method | PPL on WikiMIA · WikiMIA, average across models | AUROC: 58.6 -> 59.9 | Helped |
| Add BEAST adversarial prompts to the Min-k% membership-inference method | Min-k% on WikiMIA · WikiMIA, average across models | AUROC: 56.4 -> 59.1 | Helped |
| Add BEAST adversarial prompts to Min-k% | Min-k% on LLaMA-2-7B · WikiMIA | AUROC: 69.7 -> 58.3 | Hurt |
| Apply BEAST untargeted prompts instead of clean prompts | Vicuna-7B-v1.5 · TruthfulQA, human evaluation | Correct responses (%): 62.67 -> 48.00 | Hurt |
| Apply BEAST untargeted prompts instead of clean prompts | LLaMA-2-7B-Chat · TruthfulQA, human evaluation | Correct responses (%): 59.00 -> 47.00 | Hurt |
| Increase beam size k from 3 to 15 (ablation) | BEAST jailbreak attack on Vicuna-7B · AdvBench | ASR (%): 66% -> 98% | Helped |
Surprising findings
- BEAST fails to jailbreak the carefully fine-tuned LLaMA-2-7B-Chat (9% ASR in one minute), similar to other methods.
- Under no time budget, AutoDAN-1 slightly outperforms BEAST, but it requires GPT-4 API access.
Limitations
- Largely fails on the fine-tuned LLaMA-2-7B-Chat with low ASR.
- Hallucination evaluation relies on a small human study and GPT-4-Turbo judgments that partly disagree with humans.
- Attacks depend on a refusal-string matching metric and the perplexity objective; a no-budget comparison is not equitable against GPT-4-based baselines.
Experimental setup
Datasets: AdvBench Harmful Behaviors TruthfulQA WikiMIA
Benchmarks: AdvBench Harmful Behaviors TruthfulQA WikiMIA
Metrics: attack success rate AUROC human-judged inconsistency and advantage
Baselines: AutoDAN-1 AutoDAN-2 PAIR GCG Clean PPL Min-k%
Builds on: GCG AutoDAN PAIR Min-k% Prob
Closest papers by meaning
- LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs (NeurIPS 2025 · similarity 0.88)
- Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.88)
- Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.88)
- Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.87)
- GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (NeurIPS 2025 · similarity 0.87)
- Revisiting Character-level Adversarial Attacks for Language Models (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.