RESEARCH / WWNAssessing AI robustness
A research prototype for evaluating LLM attacks and verifying LoRA adapters, with measurements and defined limitations.
01 / PROBLEMModel behavior
needs verification
Adversarial inputs can change language-model behavior. Third-party LoRA adapters also require verification. Before adopting a defense, both robustness and its effect on answer quality need evaluation.
Dissertation research · AI security
02 / SOLUTIONTest the defense
in a controlled setting
The prototype combines session-based LoRA parameter shifts, attack simulation and computation auditing. It supports experimental comparison of model behavior and answer quality under different defense settings.
Research prototype · VRF + LoRA
03 / HOW IT WORKSAssess protection
and answer quality
The testbed simulates attacks and compares model behavior under different defense settings. A separate auditor verifies computations against a reference model. Evaluation covers both robustness and the cost of protection: changes in answers and computational overhead.
Python · PyTorch · Transformers · PEFT · LoRA
Implementation details+
The prototype derives a verifiable shift using Ed25519 and SHAKE-256. The inference server and auditor can run in separate processes: the auditor reproduces the shift on a reference model and compares logits. The protection module is registered as software under No. 2025665020.
A basis for pilots,
with measured limits
On 10 AdvBench prompts with TinyLlama-1.1B-Chat, transferred GCG suffixes and direct optimization with the shift produced 0 successful attacks. Long-answer diversity also decreased. These findings support further pilot evaluations, not a claim of universal LLM protection.
Limited sample · quality trade-off
- 2/10 → 0/10
- successful attacks in the testWithout shift → with VRF shift
- ×3.20
- mean ratio of GCG lossesSame budget: 500 optimization steps
Conditions and limitations+
Success was defined by a target affirmative phrase at the beginning of the response. Sample: 10 AdvBench prompts; LoRA r=8; shift amplitude 0.1. On 8 MT-Bench questions, long-answer diversity decreased (distinct-2: 0.91 → 0.62), so amplitude requires tuning. Auditor verification averaged 0.772 s on TinyLlama-1.1B-Chat, Apple MPS, across 10 control queries. These findings apply to the described testbed and do not establish universal protection against prompt injection. The approach requires access to model weights and the LoRA adapter. The dissertation recommends standardized ECVRF for industrial use instead of the experimental scheme. Small logit perturbations may remain undetected at the chosen threshold. Natural-language prompt injections require additional detection mechanisms and restrictions on agent permissions.
