Universal Adversarial Suffixes Using Calibrated Gumbel-Softmax Relaxation

TL;DR

This paper introduces universal adversarial suffixes for language models, which broadly reduce accuracy across tasks and models by appending short token sequences learned through a differentiable relaxation method.

Contribution

It proposes a novel method to learn transferable adversarial suffixes using Gumbel-Softmax relaxation, improving attack transferability across models and tasks.

Findings

Universal suffixes significantly reduce model accuracy.

Suffixes transfer effectively across different models.

Consistent attack success across multiple NLP tasks.

Abstract

Language models (LMs) are often used as zero-shot or few-shot classifiers by scoring label words, but they remain fragile to adversarial prompts. Prior work typically optimizes task- or model-specific triggers, making results difficult to compare and limiting transferability. We study universal adversarial suffixes: short token sequences (4-10 tokens) that, when appended to any input, broadly reduce accuracy across tasks and models. Our approach learns the suffix in a differentiable "soft" form using Gumbel-Softmax relaxation and then discretizes it for inference. Training maximizes calibrated cross-entropy on the label region while masking gold tokens to prevent trivial leakage, with entropy regularization to avoid collapse. A single suffix trained on one model transfers effectively to others, consistently lowering both accuracy and calibrated confidence. Experiments on sentiment analysis, natural language inference, paraphrase detection, commonsense QA, and physical reasoning with Qwen2-1.5B, Phi-1.5, and TinyLlama-1.1B demonstrate consistent attack effectiveness and transfer across tasks and model families.