Research question
Do simple defences from computer vision transfer to LLM adversarial attacks?
Key findings
- Perplexity filtering, paraphrasing and retokenisation block GCG suffixes cheaply - Adversarial training is far more expensive for LLMs than for vision models