Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Was it Slander? Towards Exact Inversion of Generative Language Models

Adrians Skapars, Edoardo Manino, Youcheng Sun, Lucas C. Cordeiro

TL;DR

Was it Slander? Towards Exact Inversion of Generative Language Models analyzes defenses against slander attacks on LLMs by attempting to reconstruct the secret input from a reported harmful output. It formalizes exact inversion and a weaker notion, weak inversion, and evaluates search-based adversarial-input methods—text-based genetic algorithms and embedding-based particle swarm optimization—with progressive search to reduce computation. Empirically, exact inversion is rarely achievable, while weak inversion yields limited gains and is not a reliable surrogate for exact inversion. The work highlights the vulnerability of LLMs to input-recovery attacks and motivates the development of more informative surrogate objectives for robust, scalable defenses.

Abstract

Training large language models (LLMs) requires a substantial investment of time and money. To get a good return on investment, the developers spend considerable effort ensuring that the model never produces harmful and offensive outputs. However, bad-faith actors may still try to slander the reputation of an LLM by publicly reporting a forged output. In this paper, we show that defending against such slander attacks requires reconstructing the input of the forged output or proving that it does not exist. To do so, we propose and evaluate a search based approach for targeted adversarial attacks for LLMs. Our experiments show that we are rarely able to reconstruct the exact input of an arbitrary output, thus demonstrating that LLMs are still vulnerable to slander attacks.

Was it Slander? Towards Exact Inversion of Generative Language Models

TL;DR

Was it Slander? Towards Exact Inversion of Generative Language Models analyzes defenses against slander attacks on LLMs by attempting to reconstruct the secret input from a reported harmful output. It formalizes exact inversion and a weaker notion, weak inversion, and evaluates search-based adversarial-input methods—text-based genetic algorithms and embedding-based particle swarm optimization—with progressive search to reduce computation. Empirically, exact inversion is rarely achievable, while weak inversion yields limited gains and is not a reliable surrogate for exact inversion. The work highlights the vulnerability of LLMs to input-recovery attacks and motivates the development of more informative surrogate objectives for robust, scalable defenses.

Abstract

Training large language models (LLMs) requires a substantial investment of time and money. To get a good return on investment, the developers spend considerable effort ensuring that the model never produces harmful and offensive outputs. However, bad-faith actors may still try to slander the reputation of an LLM by publicly reporting a forged output. In this paper, we show that defending against such slander attacks requires reconstructing the input of the forged output or proving that it does not exist. To do so, we propose and evaluate a search based approach for targeted adversarial attacks for LLMs. Our experiments show that we are rarely able to reconstruct the exact input of an arbitrary output, thus demonstrating that LLMs are still vulnerable to slander attacks.
Paper Structure (20 sections, 1 equation, 3 figures, 4 tables, 1 algorithm)

This paper contains 20 sections, 1 equation, 3 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Warning:
  2. Introduction
  3. Problem Setting
  4. Illustrative Examples
  5. Generating Adversarial Inputs
  6. Progressive Search
  7. Search Initialisation
  8. Preliminary Experiments
  9. Experimental Setup
  10. Computational Infrastructure.
  11. Language Models.
  12. Datasets.
  13. Metrics.
  14. Search Algorithm Comparison
  15. Initialisation Comparison
  16. ...and 5 more sections

Figures (3)

  • Figure 1: Attackers can make arbitrary claims about the LLM output.
  • Figure 2: Comparison between baseline and optimal GA search on different LLMs. The maximum possible weak inversion score is 50.
  • Figure 3: Inversion scores for different search algorithms and initialisations, using the full objective function.

Theorems & Definitions (2)

  • Definition 1: Exact Inversion
  • Definition 2: Weak Inversion