Research map / Adversarial robustness and security / Black-box and transfer attacks
BERT Lost Patience Won't Be Robust to Adversarial Slowdown
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply WAFFLE's uniform-output slowdown objective to adversarial text generation | DeeBERT, PABEE, and PastFuture · GLUE tasks | efficacy: DeeBERT 0.06--0.26; PABEE 0.07--0.29; PastFuture 0.13--0.45 reduction | Hurt |
| Use the standard TextFooler or A2T attack without the slowdown objective | Multi-exit language models · GLUE tasks | efficacy: DeeBERT changes -0.05--0.14 | No clear effect |
| Use WAFFLE against PastFuture rather than less complex exit mechanisms | Multi-exit language models · GLUE tasks | efficacy: 0.13--0.45 reduction | Hurt |
| Increase WAFFLE attack threshold α | DeeBERT, PABEE, and PastFuture · QNLI | efficacy | Hurt |
| Craft WAFFLE samples on a surrogate model and transfer them to the victim | Multi-exit language models · RTE and QQP | efficacy: Cross-seed reduction 0.25 and 0.18; cross-mechanism reduction 0.13 and 0.21 | Hurt |
| Transfer WAFFLE across BERT and ALBERT architectures | PABEE · RTE and QQP | efficacy: 0.01 in RTE and 0.02 in QQP | No clear effect |
| Append the universal trigger “unable” once to every sentence | BERT multi-exit model · SST-2 | efficacy: reduces efficacy by 9% | Hurt |
| Append “unable” three times to every sentence | BERT multi-exit model · SST-2 | efficacy: reduces efficacy by 18% | Hurt |
| Increase the percentage of words perturbed | PastFuture · MNLI and QQP | increase in exit layer | No clear effect |
| Adversarially train PABEE with A2T or WAFFLE-generated samples | PABEE · RTE and SST-2 | efficacy: models achieve ~0 efficacy | Hurt |
| Sanitize WAFFLE inputs with ChatGPT | PastFuture · MNLI | accuracy: 54%→66% | Helped |
| Sanitize WAFFLE inputs with ChatGPT | PastFuture · QQP | average exit number: 9.6→7.1 | Helped |
Closest papers by meaning
- Revisiting Character-level Adversarial Attacks for Language Models (ICML 2024 · similarity 0.88)
- An LLM can Fool Itself: A Prompt-Based Adversarial Attack (ICLR 2024 · similarity 0.86)
- Scaling Trends in Language Model Robustness (ICML 2025 · similarity 0.85)
- Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.85)
- One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · similarity 0.85)
- Fast Adversarial Attacks on Language Models In One GPU Minute (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.