Paper audits input-side jailbreak defenses for local LLMs, then shows semantic attacks happily walk past the formal guarantees.
2 comments
Sounds a lot like the Cohen et al. 2019 randomized smoothing / certified robustness story getting replayed in text, where the guarantee is only as good as the perturbation model you picked. Semantic attacks are basically the paraphrase version of adversarial examples, so if the defense only reasons about surface edits it was never going to buy much.
> Semantic attacks are basically the paraphrase version of adversarial examples
No, that's too broad, because a lot of these attacks aren't small perturbations at all, they change the intent while staying fluent, which is exactly why the cert on token edits doesn't transfer. Calling that