{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/mixat-combining-continuous-and-discrete","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","arxiv_id":"2505.16947","date":"2025-05-22","proceeding":null,"authors":["Csaba Dékány","Stefan Balauca","Robin Staab","Dimitar I. Dimitrov","Martin Vechev"],"abstract":"Despite recent efforts in Large Language Models (LLMs) safety and alignment, current adversarial attacks on frontier LLMs are still able to force harmful generations consistently. Although adversarial training has been widely studied and shown to significantly improve the robustness of traditional machine learning models, its strengths and weaknesses in the context of LLMs are less understood. Specifically, while existing discrete adversarial attacks are effective at producing harmful content, training LLMs with concrete adversarial prompts is often computationally expensive, leading to reliance on continuous relaxations. As these relaxations do not correspond to discrete input tokens, such latent training methods often leave models vulnerable to a diverse set of discrete attacks. In this work, we aim to bridge this gap by introducing MixAT, a novel method that combines stronger discrete and faster continuous attacks during training. We rigorously evaluate MixAT across a wide spectrum of state-of-the-art attacks, proposing the At Least One Attack Success Rate (ALO-ASR) metric to capture the worst-case vulnerability of models. We show MixAT achieves substantially better robustness (ALO-ASR < 20%) compared to prior defenses (ALO-ASR > 50%), while maintaining a runtime comparable to methods based on continuous relaxations. We further analyze MixAT in realistic deployment settings, exploring how chat templates, quantization, low-rank adapters, and temperature affect both adversarial training and evaluation, revealing additional blind spots in current methodologies. Our results demonstrate that MixAT's discrete-continuous defense offers a principled and superior robustness-accuracy tradeoff with minimal computational overhead, highlighting its promise for building safer LLMs. We provide our code and models at https://github.com/insait-institute/MixAT.","url_abs":"https://arxiv.org/abs/2505.16947v1","url_pdf":"https://arxiv.org/pdf/2505.16947v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"mixat-combining-continuous-and-discrete","repo_url":"https://github.com/insait-institute/mixat","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[{"method_slug":"set","method_name":"SET"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2505.16947","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2505.16947"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/insait-institute/MixAT","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/insait-institute/mixat","reach":{"status":"ok"}}],"summary":{"ran":2,"unverified":5},"by_repo_kind":{"official":{"samples":7,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"ae2525dcaa96bdca","entry":"SignSGD","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ae2525dcaa96bdca"}},{"code_sha256_prefix":"6a54aacfed3ea348","entry":"init_method","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6a54aacfed3ea348"}},{"code_sha256_prefix":"6d1289ea3b720d55","entry":"EmbeddingSpaceAttack","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6d1289ea3b720d55"}},{"code_sha256_prefix":"76278add27ce94bb","entry":"MixedAttackPerturbedPAPGCG","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"76278add27ce94bb"}},{"code_sha256_prefix":"fc9f3839799621c1","entry":"_init_ray","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fc9f3839799621c1"}},{"code_sha256_prefix":"dfef7ce9fc6e4f99","entry":"acquireLock","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/run_experiments.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/run_experiments.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"dfef7ce9fc6e4f99"}},{"code_sha256_prefix":"5ee92d39906719a2","entry":"get_method_class","repo":"insait-institute/mixat","repo_kind":"official","path":"Continuous-AdvTrain/src/embedding_attack.py","file_url":"https://github.com/insait-institute/mixat/blob/HEAD/Continuous-AdvTrain/src/embedding_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5ee92d39906719a2"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}