Research map / Adversarial robustness and security / Attacks on text and graphs

AIA: Autoregression-Based Injection Attacks Against Text2SQL Models

AAAI 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: LLM jailbreak and injection defense · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AIA, a white-box autoregressive gradient-based injection attack that optimizes payload embeddings token-by-token so Text2SQL models emit SQL containing attacker payloads, showing high success on T5-based RESDSQL/TSSB and description-based attacks on LLM Text2SQL methods.

Problem

Text2SQL models may generate SQL that retains attacker-supplied payloads as values, creating SQL injection risks for web applications; it was unclear whether attack payloads can be reliably preserved in generated SQL.

Approach

Construct an injection point text ("Which AAA's BBB is CCC") with a selected column via a saliency-based search, then autoregressively optimize each payload token's embedding with a loss combining target-token logits, preservation of previously generated target tokens, and an L2 embedding-to-token mapping term, so the model generates the exact target SQL payload.

Key results

• On payloads of 10-20 characters, AIA achieves 37% ASR(T) and 77% ASR(E) on RESDSQL and 23% ASR(T) / 72% ASR(E) on TSSB, versus 16% and 23% for the original insertion baseline.
• Transferability of token-space adversarial payloads reaches 35.48% (RESDSQL to TSSB) and 44.07% (TSSB to RESDSQL).
• Description attacks reach 90% ASR on SQL Expert and 84% on SQL Generator, and AIA in embedding space gets 94-99% on DAIL-SQL with LLaMA3-8B for 10-30 character payloads.

Measured effects reported in the paper

Surprising findings

• Mapping adversarial embeddings back to tokens sharply lowers success, and the L2 mapping loss improves token-space ASR while reducing embedding-space ASR.
• Simple natural-language description attacks can make commercial LLM-based Text2SQL tools emit destructive SQL without any optimization.

Limitations

• Token-space ASR is low (1.2%-2.4% on full 500-sample set) because mapping embeddings back to tokens is hard.
• Attacks require white-box access; black-box transfer is only partially effective and was evaluated only among T5-based models.
• Success drops sharply as payload length increases (near 0 beyond 40-50 characters for some models).

Experimental setup

Datasets: Kaggle SQL injection dataset Spider

Benchmarks: Spider (singer database)

Metrics: attack success rate ASR(T) ASR(E) average target payload token length (TPTL) target EM target F1

Baselines: Seq2Sick TAA T3 Original insertion (Peng et al.)

Builds on: Seq2Sick Targeted Adversarial Attacks (TAA) RESDSQL TSSB

Closest papers by meaning

• Query-Based Adversarial Prompt Generation (NeurIPS 2024 · similarity 0.83)
• Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models (NeurIPS 2026 · similarity 0.82)
• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.81)
• On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains (ICML 2025 · similarity 0.81)
• Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.81)
• Virus Infection Attack on LLMs: Your Poisoning Can Spread "VIA" Synthetic Data (NeurIPS 2025 · similarity 0.81)