Metraipolis › archive › dc_72dddf0ef7cc

JevBreak: Your Model, Their Decision — arXiv:2611.03759

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.03759
License (as archived): CC0-1.0
Archived: 2026-11-04T12:28:57.018Z
SHA-256 of the archived text: ea8caf9d9c6d7f949561c07876ea4908519c8b547a03febce82be9c9742ca2b5
Stable URL of this page: https://metraipolis.com/documento/dc_72dddf0ef7cc

How to cite

JevBreak: Your Model, Their Decision — arXiv:2611.03759 — arXiv (en), https://arxiv.org/abs/2611.03759 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_72dddf0ef7cc (Metraipolis archive dc_72dddf0ef7cc, sha256 ea8caf9d9c6d7f949561c07876ea4908519c8b547a03febce82be9c9742ca2b5)

BibTeX

@misc{dc72dddf0ef7cc,
  title = {JevBreak: Your Model, Their Decision — arXiv:2611.03759},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.03759},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_72dddf0ef7cc; sha256 ea8caf9d9c6d7f949561c07876ea4908519c8b547a03febce82be9c9742ca2b5},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.03759. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Restricting what a model can say is often mistaken for restricting an attacker's influence over its decision. An attacker can add text to the evidence and steer the model toward a wrong answer that still belongs to the allowed set. We evaluate seven decision models spanning hosted APIs, open-weight models and an encoder on 16 tasks in seven domains from Decision Bench, targeting every wrong option across 240 text examples (990 targets per model). We present Slot Attack, a black-box attack designed for decision models that appends text assembled from named components to steer predictions toward an attacker-selected incorrect option. The method relies solely on returned label probabilities, achieves success rates of 32--99\% on initially correct decisions, and identifies the effective component combinations with a median of 17--72 queries per successful attack. Accuracy and confidence do not reliably reveal this vulnerability. Models with near-identical accuracy on the sampled tasks differ by about 20\%age points in attack success. We demonstrate that an attacker can force not just one wrong answer but every available one: on about 20\% of correct decisions for the JEV models, 77\% for gpt-6-luna and 98\% for GLiNER2.5; a confidence threshold does not reliably screen the attack out. A fixed answer set constrains a decision's form, not its source; robustness must be measured per model, per task and per version rather than assumed from output format.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2611.03759 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-04T12:26:47.220Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).