On Adversarial Robustness and Out-of-Distribution Robustness of Large Language Models

TL;DR

This work probes the relationship between adversarial robustness and out-of-distribution robustness in large language models by evaluating three diverse models (Llama2-7b, Llama2-13b, Mixtral-8x7b) across four benchmarks with two robustness strategies (AHP and ICR). It reveals model- and benchmark-dependent correlations: a neutral link for smaller LLaMA-7b, a negative link for LLaMA-13b, and a positive link for Mixtral-8x7b, suggesting that scaling alone does not guarantee consistent cross-context robustness gains. The study demonstrates limited transferability between robustness types and highlights the need for hybrid, model- and domain-tailored robustness frameworks. It also identifies methodological sensitivities to prompting and data selection, calling for broader benchmarks and larger-scale evaluations to generalize findings across architectures and tasks.

Abstract

The increasing reliance on large language models (LLMs) for diverse applications necessitates a thorough understanding of their robustness to adversarial perturbations and out-of-distribution (OOD) inputs. In this study, we investigate the correlation between adversarial robustness and OOD robustness in LLMs, addressing a critical gap in robustness evaluation. By applying methods originally designed to improve one robustness type across both contexts, we analyze their performance on adversarial and out-of-distribution benchmark datasets. The input of the model consists of text samples, with the output prediction evaluated in terms of accuracy, precision, recall, and F1 scores in various natural language inference tasks. Our findings highlight nuanced interactions between adversarial robustness and OOD robustness, with results indicating limited transferability between the two robustness types. Through targeted ablations, we evaluate how these correlations evolve with different model sizes and architectures, uncovering model-specific trends: smaller models like LLaMA2-7b exhibit neutral correlations, larger models like LLaMA2-13b show negative correlations, and Mixtral demonstrates positive correlations, potentially due to domain-specific alignment. These results underscore the importance of hybrid robustness frameworks that integrate adversarial and OOD strategies tailored to specific models and domains. Further research is needed to evaluate these interactions across larger models and varied architectures, offering a pathway to more reliable and generalizable LLMs.

Figures (7)

• Figure 1: Entire Experiment Workflow
• Figure 2: Overview of AHP framework. The framework consists of two key components: (1) Safety and Validity Assessment, which iteratively refines input through inspection, refinement, and evaluation cycles guided by internal and external feedback; and (2) Secure Response Synthesis, which generates and verifies appropriate model outputs.
• Figure 3: LLM-TTA Prompts. We leverage LLM-TTA with two prompting methods. The placeholder "style_input" is replaced with the test input. To experiment with out-of-distribution (OOD) and adversarial inputs, "style_transfer_exemplars" is replaced with the ID or adversarial examples during the ICR task.
• Figure 4: Correlation of Adversarial and OOD Robustness for LLaMA2:7B
• Figure 5: Correlation of Adversarial and OOD Robustness for LLaMA2:13B