FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models

FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models

In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it. Across 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems. How would the reported attack perform on typed decision models beyond Jev?

Publication: 1431193f-c21e-43d9-8618-335ebc8d3044

attribution — pass: The draft correctly attributes the work to Xiaogeng Liu, Xinyan Wang and Chaowei Xiao. It keeps findings and the call for strict adaptive attacks framed as the authors' reports and arguments in a pre-print.

Authors:Xiaogeng Liu, Xinyan Wang, Chaowei Xiao

summary — uncertain: The draft is faithful, but it omits the stated stake: these models are increasingly used, including in security-sensitive tasks. Without that, a general reader cannot see why flipped answers matter. It also omits 'within minutes' and leaves central jargon unexplained: red teaming, black-box, adaptive attacks, prompt injection, and adversarial suffix (text appended to an input). Smallest repair: add the security-sensitive-use clause, the minutes timing, and term-library tooltips for these terms. The draft's own limitation already suggests a 'typed decision models' entry.

They answer in a single fast and cheap query and are increasingly used, including in security-sensitive tasks.

date — pass: The originalPublished date of 2026-10-28 matches the arXiv v1 submission date. The later feed date was not used.

[Submitted on 28 Oct 2026]

support — pass: Each claim is supported by the abstract: the attack uses no attacker language model, 10,240 paired tests, 43% on unseen documents, and 90-100% cross-task transfer. The question and limitations stay appropriately within scope without adding unsupported benefits or costs. This grounding does not independently verify the results.

one suffix generated from one task can flip 90-100% of the samples in other tasks

media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.