# Neighborhood Deviation Attack Against In-Context Learning
## 5 Experiments
### Ablation Experiments
#### 5.5.4 Attack Model  
The objective of this experiment is to evaluate the effectiveness of the Neighbor Deviation Attack using different attack models when targeting different LLMs, and to conduct tests on three datasets. The goal of the experiment is to determine which attack model (neural network, support vector machine, or logistic regression) performs better in Neighbor Deviation Attack. All three models take multiple metric deviations calculated from the deviation calculation as the input, and output the membership/non-membership (1/0) as the result. They are trained on 1000 randomly selected data points. The attack model plays a decisive role in the Neighbor Deviation Attack. Therefore, this experiment mainly focuses on how the architectures of different attack models affect the success rate of the attack. By comparing the experimental results, we can determine which attack model is suitable for the Neighbor Deviation Attack. Figure 7 illustrates the comparative analysis of the Neighbor Deviation Attack using neural network (NN), support vector machine (SVM), and logistic regression (Logistic) on LLaMA3, LLaMA2, and GPT2-XL, respectively. As shown in Figure 6(a), the performance of the Neighbor Deviation Attack using different attack models varies on different datasets. In AGNews and TREC datasets, the Neighbor Deviation Attack achieves a similar and much higher advantage using neural network and logistic regression than SVM, and in \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{2}{c}{**Number of**} & \multicolumn{2}{c}{**Dataset**} \\ \cline{3-4}  & **Replacement** & **AGNews** & **DBPedia** \\ \hline \multirow{3}{*}{LLaMA2} & 1 & 0.87 & 0.85 \\  & 2 & 0.8 & 0.72 \\  & 3 & 0.71 & 0.72 \\ \hline \multirow{3}{*}{LLaMA3} & 1 & 0.82 & 0.88 \\  & 2 & 0.9 & 0.85 \\ \cline{1-1}  & 3 & 0.86 & 0.84 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Influence of the number of replacements across two datasets and two language models. The table presents the impression of the method Advantage regarding the number of replacements on the LLaMA2 and LLaMA3 models and across the AGNews and DBPedia datasets. The number of replacements varies from 1 to 3.  
the DBPedia dataset, the Neighbor Deviation Attack achieves about 0.2 Advantage using neural network over SVM and logistic regression. As shown in Figure 6(b), the Neighbor Deviation Attack shows a large advantage using neural networks on the DBPedia dataset, but on the AGNews and TREC datasets, the performance of the three models is similar. In addition, the overall attack performance on LLaMA2 is slightly higher than that on LLaMA3, suggesting that LLaMA2 may be more vulnerable to attacks on these datasets. As shown in Figure 6(c), compared to the LLaMA model, the performance differences between the different attack structures are smaller on GPT2-XL. The Neighbor Deviation Attack performs almost the same on all the datasets using the different attack models, and all exhibit excellent attack performance, with dominance values greater than 0.8. This suggests that GPT2-XL has a balanced vulnerability in the face of the Neighbor Deviation Attack using different attack model architectures. According to the experimental results, compared with the other two models, the Neighbor Deviation Attack using neural networks as the attack model has superior performance. In most cases, the attack model using neural networks can achieve better results than the other two models. In a few cases, it is only slightly inferior to the best results, and the attack model using neural networks makes the method more portable, functioning normally in the presence of different LLMs and datasets. This might be because neural networks have better nonlinear expression capabilities.