Towards Robust LLMs: an Adversarial Robustness Measurement Framework

2025-04-24

AI Summary

Quantifying adversarial robustness of large language models (LLMs) in black-box settings—where model parameters and gradients are inaccessible—remains challenging. Method: This paper introduces RoMA, the first parameter-free robustness evaluation framework for black-box LLMs. RoMA adapts robustness measurement to the black-box paradigm by estimating robustness via lightweight analysis of model responses to input perturbations—including synonym substitution, syntactic transformation, and logical interference—and calibrates estimates via formal verification. Contribution/Results: RoMA uncovers dual non-uniformity in LLM robustness—across tasks and perturbation types—enabling task- and perturbation-aware assessment. It supports systematic, cross-model, cross-task, and cross-perturbation comparisons. Experiments on mainstream LLMs show RoMA achieves <3.2% estimation error in robustness scores while reducing computational overhead by over 90%. Notably, RoMA reveals up to 47% robustness variation for the same model across different tasks.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

The rise of Large Language Models (LLMs) has revolutionized artificial intelligence, yet these models remain vulnerable to adversarial perturbations, undermining their reliability in high-stakes applications. While adversarial robustness in vision-based neural networks has been extensively studied, LLM robustness remains under-explored. We adapt the Robustness Measurement and Assessment (RoMA) framework to quantify LLM resilience against adversarial inputs without requiring access to model parameters. By comparing RoMA's estimates to those of formal verification methods, we demonstrate its accuracy with minimal error margins while maintaining computational efficiency. Our empirical evaluation reveals that robustness varies significantly not only between different models but also across categories within the same task and between various types of perturbations. This non-uniformity underscores the need for task-specific robustness evaluations, enabling practitioners to compare and select models based on application-specific robustness requirements. Our work provides a systematic methodology to assess LLM robustness, advancing the development of more reliable language models for real-world deployment.

Problem

• Measure LLM resilience to adversarial inputs without model access
• Compare robustness variations across models and perturbation types
• Enable task-specific robustness evaluations for model selection

Innovation

• Adapt RoMA framework for LLM robustness
• Compare RoMA with formal verification methods
• Evaluate task-specific robustness variations