Mitigating Adversarial Attacks in LLMs through Defensive Suffix Generation

Authors: Minkyoung Kim, Yunha Kim, Hyeram Seo, Heejung Choi, JiYe Han, Gaeun Kee, Soyoung Ko, HyoJe Jung, Byeolhee Kim, Young-Hak Kim, Sanghyun park, Tae Joon Jun
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: AI Safety, Large Language Models, Defensive Suffix, Adversarial Attacks

Abstract:
Large language models (LLMs) have exhibited outstanding performance in natural language processing tasks. However, these models remain susceptible to adversarial attacks in which slight input perturbations can lead to harmful or misleading outputs. A gradient-based defensive suffix generation algorithm is designed to bolster the robustness of LLMs. By appending carefully optimized defensive suffixes to input prompts, the algorithm mitigates adversarial influences while preserving the models' utility. To enhance adversarial understanding, a novel total loss function ($L_{\text{total}}$) combining defensive loss ($L_{\text{def}}$) and adversarial loss ($L_{\text{adv}}$) generates defensive suffixes more effectively. Experimental evaluations show that applying this method to open-source LLMs such as gemma-7B and mistral-7B results in an average 19\% reduction in attack success rates (ASR) compared to models without defensive suffixes. This approach reduces the perplexity score of the Gemma-7B base model from 4.59 to 2.90 when applying the defensive suffix generated by Llama3.2-1B. This significantly enhances the security of LLMs in critical applications without requiring extensive retraining.

Decision: desk reject

Reviews and discussion:

Metareview: