Research question
Do robustness evaluations that ignore sampling underestimate attack success?
Key findings
- Attacks that account for stochastic decoding succeed far more often than greedy-decoding evaluations suggest - Proposes sampling-aware evaluation as standard