|
|
<!DOCTYPE html> |
|
|
<html> |
|
|
<head> |
|
|
<meta charset="utf-8"> |
|
|
<meta name="description" |
|
|
content="SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucination"> |
|
|
<meta name="keywords" content="Large Language Models, LLMs, Adversarial Attacks, Red-Teaming, Robustness, Hallucination Elicitation, Hallucination, Semantic Equivalence, Semantic Coherence, Trustworthy AI, SECA"> |
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"> |
|
|
<title>SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucination</title> |
|
|
|
|
|
|
|
|
<script async src="https://www.googletagmanager.com/gtag/js?id=G-PYVRSFMDRL"></script> |
|
|
<script> |
|
|
window.dataLayer = window.dataLayer || []; |
|
|
|
|
|
function gtag() { |
|
|
dataLayer.push(arguments); |
|
|
} |
|
|
|
|
|
gtag('js', new Date()); |
|
|
|
|
|
gtag('config', 'G-PYVRSFMDRL'); |
|
|
</script> |
|
|
|
|
|
<link href="https://fonts.googleapis.com/css?family=Google+Sans|Noto+Sans|Castoro" |
|
|
rel="stylesheet"> |
|
|
|
|
|
<link rel="stylesheet" href="./static/css/bulma.min.css"> |
|
|
<link rel="stylesheet" href="./static/css/bulma-carousel.min.css"> |
|
|
<link rel="stylesheet" href="./static/css/bulma-slider.min.css"> |
|
|
<link rel="stylesheet" href="./static/css/fontawesome.all.min.css"> |
|
|
<link rel="stylesheet" |
|
|
href="https://cdn.jsdelivr.net/gh/jpswalsh/academicons@1/css/academicons.min.css"> |
|
|
<link rel="stylesheet" href="./static/css/index.css"> |
|
|
|
|
|
|
|
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script> |
|
|
<script defer src="./static/js/fontawesome.all.min.js"></script> |
|
|
<script src="./static/js/bulma-carousel.min.js"></script> |
|
|
<script src="./static/js/bulma-slider.min.js"></script> |
|
|
<script src="./static/js/index.js"></script> |
|
|
</head> |
|
|
<body> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<section class="hero"> |
|
|
<div class="hero-body"> |
|
|
<div class="container is-max-desktop"> |
|
|
<div class="columns is-centered"> |
|
|
<div class="column has-text-centered"> |
|
|
<h1 class="title is-1 publication-title"> |
|
|
<span class="seca_font">SECA</span>: |
|
|
<span class="penn-red">S</span>emantically |
|
|
<span class="penn-red">E</span>quivalent and |
|
|
<span class="penn-red">C</span>oherent |
|
|
<span class="penn-red">A</span>ttacks for Eliciting LLM Hallucinations |
|
|
</h1> |
|
|
<div style="margin-bottom: 2rem;"></div> |
|
|
<h2 class="subtitle is-4 publication-conference"><b>NeurIPS 2025</b></h2> |
|
|
<div class="is-size-5 publication-authors"> |
|
|
<span class="author-block"> |
|
|
<a href="https://buyunliang.org/" target="_blank">Buyun Liang</a><sup></sup>,</span> |
|
|
<span class="author-block"> |
|
|
<a href="https://liangzu.github.io/" target="_blank">Liangzu Peng</a><sup></sup>,</span> |
|
|
<span class="author-block"> |
|
|
<a href="https://peterljq.github.io/" target="_blank">Jinqi Luo</a><sup></sup>, |
|
|
</span> |
|
|
<span class="author-block"> |
|
|
<a href="https://darshanthaker.github.io/" target="_blank">Darshan Thaker</a><sup></sup>, |
|
|
</span> |
|
|
<span class="author-block"> |
|
|
<a href="https://ryanchankh.github.io/" target="_blank">Kwan Ho Ryan Chan</a><sup></sup>, |
|
|
</span> |
|
|
<span class="author-block"> |
|
|
<a href="https://www.grasp.upenn.edu/people/rene-vidal/" target="_blank">René Vidal</a><sup></sup>, |
|
|
</span> |
|
|
</div> |
|
|
|
|
|
<div class="is-size-5 publication-authors"> |
|
|
<span class="author-block"><sup></sup>University of Pennsylvania</span> |
|
|
</div> |
|
|
|
|
|
<div class="column has-text-centered"> |
|
|
<div class="publication-links"> |
|
|
|
|
|
<span class="link-block"> |
|
|
<a href="https://neurips.cc/virtual/2025/poster/119640" target="_blank" |
|
|
class="external-link button is-normal is-rounded is-dark"> |
|
|
<span class="icon"> |
|
|
<i class="fas fa-file-pdf"></i> |
|
|
</span> |
|
|
<span>NeurIPS Page</span> |
|
|
</a> |
|
|
</span> |
|
|
<span class="link-block"> |
|
|
<a href="https://www.arxiv.org/abs/2510.04398" target="_blank" |
|
|
class="external-link button is-normal is-rounded is-dark"> |
|
|
<span class="icon"> |
|
|
<i class="ai ai-arxiv"></i> |
|
|
</span> |
|
|
<span>arXiv</span> |
|
|
</a> |
|
|
</span> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="link-block"> |
|
|
<a href="https://github.com/Buyun-Liang/SECA" target="_blank" |
|
|
class="external-link button is-normal is-rounded is-dark"> |
|
|
<span class="icon"> |
|
|
<i class="fab fa-github"></i> |
|
|
</span> |
|
|
<span>Code</span> |
|
|
</a> |
|
|
</span> |
|
|
<span class="link-block"> |
|
|
<a href="https://buyunliang.org/images/posters/neurips_2025_seca_poster.png" target="_blank" |
|
|
class="external-link button is-normal is-rounded is-dark"> |
|
|
<span class="icon"> |
|
|
<i class="fas fa-image"></i> |
|
|
</span> |
|
|
<span>Poster</span> |
|
|
</a> |
|
|
</span> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div> |
|
|
|
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
</section> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<section class="section"> |
|
|
<div class="container is-max-desktop"> |
|
|
|
|
|
<div class="columns is-centered has-text-centered"> |
|
|
<div class="column is-four-fifths"> |
|
|
<h2 class="title is-3">Examples</h2> |
|
|
<div class="content has-text-justified"> |
|
|
SECA generates |
|
|
<span class="penn-red">S</span>emantically |
|
|
<span class="penn-red">E</span>quivalent and |
|
|
<span class="penn-red">C</span>oherent |
|
|
<span class="penn-red">A</span>ttacks that |
|
|
elicit hallucinations from SOTA LLMs. The examples below are SECA's illustrative results. |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
|
|
|
|
|
|
|
|
|
<iframe src="./chat.html" style="width:100%; border:none; height: auto; min-height: 600px;"></iframe> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<section class="section"> |
|
|
<div class="container is-max-desktop"> |
|
|
|
|
|
<div class="columns is-centered has-text-centered"> |
|
|
<div class="column is-four-fifths"> |
|
|
<h2 class="title is-3">Abstract</h2> |
|
|
<div class="content has-text-justified"> |
|
|
Large Language Models (LLMs) are increasingly deployed in high-risk domains. However, state-of-the-art LLMs often produce hallucinations, raising serious concerns about their reliability. Prior work has explored adversarial attacks for hallucination elicitation in LLMs, but it often produces unrealistic prompts, either by inserting gibberish tokens or by altering the original meaning. As a result, these approaches offer limited insight into how hallucinations may occur in practice. While adversarial attacks in computer vision often involve realistic modifications to input images, the problem of finding realistic adversarial prompts for eliciting LLM hallucinations has remained largely underexplored. To address this gap, we propose <span class="penn-red">S</span>emantically |
|
|
<span class="penn-red">E</span>quivalent and |
|
|
<span class="penn-red">C</span>oherent |
|
|
<span class="penn-red">A</span>ttacks (SECA) to elicit hallucinations via realistic modifications to the prompt that preserve its meaning while maintaining semantic coherence. Our contributions are threefold: (i) we formulate finding realistic attacks for hallucination elicitation as a constrained optimization problem over the input prompt space under semantic equivalence and coherence constraints; (ii) we introduce a constraint-preserving zeroth-order method to effectively search for adversarial yet feasible prompts; and (iii) we demonstrate through experiments on open-ended multiple-choice question answering tasks that SECA achieves higher attack success rates while incurring almost no semantic equivalence or semantic coherence errors compared to existing methods. SECA highlights the sensitivity of both open-source and commercial gradient-inaccessible LLMs to realistic and plausible prompt variations. |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</section> |
|
|
|
|
|
|
|
|
|
|
|
<section class="section" id="BibTeX"> |
|
|
<div class="container is-max-desktop content"> |
|
|
<h2 class="title">BibTeX</h2> |
|
|
<p>If you find our work useful, please consider citing our paper:</p> |
|
|
<pre><code>@inproceedings{liang2025seca, |
|
|
title={SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinations}, |
|
|
author={Liang, Buyun and Peng, Liangzu and Luo, Jinqi and Thaker, Darshan and Chan, Kwan Ho Ryan and Vidal, Ren{\'e}}, |
|
|
booktitle={Advances in Neural Information Processing Systems (NeurIPS)}, |
|
|
year={2025} |
|
|
}</code></pre> |
|
|
<p>For convenience, you may also cite the arXiv version:</p> |
|
|
<pre><code>@article{liang2025seca, |
|
|
title={SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinations}, |
|
|
author={Liang, Buyun and Peng, Liangzu and Luo, Jinqi and Thaker, Darshan and Chan, Kwan Ho Ryan and Vidal, Ren{\'e}}, |
|
|
journal={arXiv preprint arXiv:2510.04398}, |
|
|
year={2025} |
|
|
}</code></pre> |
|
|
</div> |
|
|
</section> |
|
|
|
|
|
|
|
|
|
|
|
<footer class="footer"> |
|
|
<div class="container"> |
|
|
<div class="columns is-centered"> |
|
|
<div class="column is-8"> |
|
|
<div class="content"> |
|
|
<p> |
|
|
This website is built on the template from |
|
|
<a href="https://github.com/nerfies/nerfies.github.io" target="_blank">Nerfies</a>, |
|
|
with design inspiration from |
|
|
[<a href="https://jailbreaking-llms.github.io/" target="_blank">1</a>, |
|
|
<a href="https://peterljq.github.io/project/pace/" target="_blank">2</a>, |
|
|
<a href="https://llm-attacks.org/" target="_blank">3</a>]. |
|
|
</p> |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
</div> |
|
|
</footer> |
|
|
|
|
|
</body> |
|
|
</html> |
|
|
|
