# Adversarial Robustness

Speech tokenizers compress continuous speech into discrete tokens and serve as the front end of ASR systems and large audio-language models. T-SemAttack skips the full recognition pipeline and instead jointly drifts the representation spaces of several semantic encoders, with a psychoacoustic masking constraint keeping the noise acceptable to listeners while pulling downstream semantic encoding off course. On bilingual multi-speaker data it raises word error rates on nine open-source and black-box ASR systems from about 1–4% on clean speech to 20.004–63.555%, and it introduces ROSETok, a tokenizer trained with noisy training and semantic distillation.

Speech tokenizers compress continuous speech into discrete tokens and serve as the front end of ASR systems and large audio-language models. T-SemAttack skips the full recognition pipeline and instead jointly drifts the representation spaces of several semantic encoders, with a psychoacoustic masking constraint keeping the noise acceptable to listeners while pulling downstream semantic encoding off course. On bilingual multi-speaker data it raises word error rates on nine open-source and black-box ASR systems from about 1–4% on clean speech to 20.004–63.555%, and it introduces ROSETok, a tokenizer trained with noisy training and semantic distillation.

The work decomposes an LLM's refusal behavior into a cross-layer pathway: harmful detection heads in early and middle layers pick out harmful tokens, safety neurons in mid-to-late layers carry and stabilize that signal in the residual stream, and refusal heads turn it into a refusal. Scaling the weights of these three component groups without changing architecture raised average safety under GCG attacks from 43.2% to 69.7% across six models, with a 1.7% average accuracy drop on four standard benchmarks.

The work decomposes an LLM's refusal behavior into a cross-layer pathway: harmful detection heads in early and middle layers pick out harmful tokens, safety neurons in mid-to-late layers carry and stabilize that signal in the residual stream, and refusal heads turn it into a refusal. Scaling the weights of these three component groups without changing architecture raised average safety under GCG attacks from 43.2% to 69.7% across six models, with a 1.7% average accuracy drop on four standard benchmarks.

DecisionRobust evaluates JEV-style decision models under text and image perturbations and prompt injection, and finds that 30 text models and 17 vision models take the same candidate set, with held-out models excluded from candidate selection also incurring errors while label-consistency checks sharply reduce apparent attack success.

DecisionRobust evaluates JEV-style decision models under text and image perturbations and prompt injection, and finds that 30 text models and 17 vision models take the same candidate set, with held-out models excluded from candidate selection also incurring errors while label-consistency checks sharply reduce apparent attack success.

A hybrid intrusion-detection framework that chains causal graph learning, entropy-guided compression, attention fusion, adversarial calibration and trust-weighted federated aggregation into one pipeline reaches 97.4% detection accuracy on CICIDS2017 while cutting the input from 78 features to 18.

A hybrid intrusion-detection framework that chains causal graph learning, entropy-guided compression, attention fusion, adversarial calibration and trust-weighted federated aggregation into one pipeline reaches 97.4% detection accuracy on CICIDS2017 while cutting the input from 78 features to 18.

Using a controlled two-stage PGD attack on 200 held-out COCO images with Qwen2.5-VL-7B-Instruct, the authors show that a targeted perturbation can drive teacher-forced training loss for a fixed target caption to near zero while free generation still produces the original correct description, localize this train/inference gap to a single autoregressive step (target-token rank fixed at exactly 3,488 of 152,064 vocabulary entries with zero variance), and trace all 28 decoder layers to show the visual encoder corrupts every image by a comparable margin while the language decoder amplifies the corrupted signal for susceptible images and actively suppresses it for resistant ones (p<0.001, rank-biserial r=0.579).

Using a controlled two-stage PGD attack on 200 held-out COCO images with Qwen2.5-VL-7B-Instruct, the authors show that a targeted perturbation can drive teacher-forced training loss for a fixed target caption to near zero while free generation still produces the original correct description, localize this train/inference gap to a single autoregressive step (target-token rank fixed at exactly 3,488 of 152,064 vocabulary entries with zero variance), and trace all 28 decoder layers to show the visual encoder corrupts every image by a comparable margin while the language decoder amplifies the corrupted signal for susceptible images and actively suppresses it for resistant ones (p<0.001, rank-biserial r=0.579).