Semantic-Preserving Adversarial Attacks on LLMs

Overview

This project explores the implementation of semantic-preserving adversarial attacks against Large Language Models (LLMs). The goal is to reproduce and experiment with attack techniques described in academic literature that are often theoretically documented but not fully disclosed at the source-code level.

Numerous papers discuss these methods; a representative example is this paper. However, practical and reusable implementations remain scarce. This repository aims to bridge that gap.

What it does ?

The core algorithm targets influential words within a prompt and applies controlled perturbations designed to degrade model behavior while preserving overall semantic meaning.

The workflow is roughly as follows:

1. Identify influential or high-impact words in the prompt using weighted natural language tables.
2. Apply a configurable number of character-level perturbations to those words.
3. Control the aggressiveness of the attack through tunable parameters such as edits and depth.

⚠️ Note: The word relevance tables used are inherently biased by their source data. They can (and should) be adjusted depending on the domain, model, or threat scenario being studied.

There is a direct trade-off between attack strength and semantic preservation. Increasing attack parameters may lead to greater model degradation, but also increases the risk of altering the original intent of the prompt.

Types of word attacks:

Implemented Word-Level Attacks

The following adversarial transformations are currently supported:

• Keyboard Proximity Errors
  Substitutions based on adjacent keys on a QWERTY keyboard.
• Keyboard Double-Typing Errors
  Accidental repeated keystrokes.
• Keyboard Omission Errors
  Missing characters due to skipped keystrokes.
• Extra Whitespace Errors
  Insertion of unintended spaces.

All attack implementations can be found in: typo.js

Usage

Requirements

• Node.js (with dependencies installed)
• A running Ollama instance

Dataset

This implementation uses the GSM8K training set by default. Many alternative datasets are available on Hugging Face and can be substituted depending on your experiment.

node llm_attack.js

Configuration

Attack behavior is controlled via the following options:

const OPTIONS = {
  edits: 4,
  depth: 0,
};

• edits Number of edits applied per prompt (linear scaling).
• depth Recursive depth of attacks applied to each word.
  Higher values increase attack intensity but reduce semantic fidelity.