aiqbench analysis
AnchorRep addresses the critical threat of cross-model adversarial transfer by leveraging shared internal representation geometry to defend LLMs against jailbreak attempts originating from different architectures. This approach utilizes a lightweight LoRA adapter to push harmful prompt representations away from benign ones, significantly reducing attack success rates without inducing the degenerate outputs or excessive over-refusal common in existing defenses. The study also introduces the Benign Garble Rate metric to better quantify these previously overlooked failure modes in standard evaluation frameworks.
AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion
arXiv:2609.32602v1 Announce Type: new Abstract: Adversarial attacks optimized on a single open-weight LLM can transfer to and jailbreak architecturally different models, allowing an attacker with white-box access to one model to compromise independently deployed systems. This creates a shared vulnerability across models, yet existing defenses are not designed for this cross-model threat. We find that cross-model transfer aligns with shared internal representation geometry, making it a natural defense target. AnchorRep targets this geometry directly with a lightweight LoRA adapter that pushes the defended model's internal representations of harmful prompts away from those of a frozen anchor model on the same prompts. Training uses a small set of harmful prompts and no adversarial examples. Across five models and four architectural families, AnchorRep reduces cross-model attack success rate to 1.1%). Existing defenses can reduce transfer, but only at high cost either inducing up to 77% degenerate benign output or increasing over-refusal by up to 18%. Because such degenerate benign outputs are not captured by standard refusal-based metrics, we introduce the Benign Garble Rate to quantify them. Our results suggest that cross-model robustness can be achieved by shaping representation geometry, without requiring attack-specific training
Abstract:Adversarial attacks optimized on a single open-weight LLM can transfer to and jailbreak architecturally different models, allowing an attacker with white-box access to one model to compromise independently deployed systems. This creates a shared vulnerability across models, yet existing defenses are not designed for this cross-model threat. We find that cross-model transfer aligns with shared internal representation geometry, making it a natural defense target. AnchorRep targets this geometry directly with a lightweight LoRA adapter that pushes the defended model's internal representations of harmful prompts away from those of a frozen anchor model on the same prompts. Training uses a small set of harmful prompts and no adversarial examples. Across five models and four architectural families, AnchorRep reduces cross-model attack success rate to <=1.1% on 2,000 transferred attacks (0% on two), including the largest drop on Mistral (36% -> 1.1%). Existing defenses can reduce transfer, but only at high cost either inducing up to 77% degenerate benign output or increasing over-refusal by up to 18%. Because such degenerate benign outputs are not captured by standard refusal-based metrics, we introduce the Benign Garble Rate to quantify them. Our results suggest that cross-model robustness can be achieved by shaping representation geometry, without requiring attack-specific training
Machine Learning (cs.LG); Artificial Intelligence (cs.AI)
arXiv:2609.32602 [cs.LG]
(or arXiv:2609.32602v1 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2609.32602 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 299 words
Related coverage
Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
arXiv · Jun 5, 2026
Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
arXiv · Jun 3, 2026
Information-Geometric Inverse Distillation for Enhancing Adversarial Transferability
arXiv · Sep 18, 2026
Defending Against Malicious Finetuning by Scaling Train-time Adversarial Attacks
arXiv · Jun 9, 2026