{"id":"e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0","title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","argument":"In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it.\n\nAcross 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems.\n\nHow would the reported attack perform on typed decision models beyond Jev?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here. The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.”","speaker":{"name":"Liu, Xiaogeng, Wang, Xinyan, Xiao, Chaowei","roleAtSource":"Article author"},"source":{"title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38895","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors present a black-box, query-based attack on Jev that does not use an attacker language model.","excerpt":"a quick black-box query-based attack that calls no attacker language model","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests.","excerpt":"no strategy changes a correct answer in 10,240 paired tests","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"The authors report that one suffix per dataset flipped 43% of unseen documents.","excerpt":"one suffix per dataset flips 43% of unseen documents","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks.","excerpt":"one suffix generated from one task can flip 90-100% of the samples in other tasks","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38895","checkedAt":"2026-11-11T10:42:09.293Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported attack perform on typed decision models beyond Jev?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","summary":"In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it.\n\nAcross 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems.\n\nHow would the reported attack perform on typed decision models beyond Jev?","question":"How would the reported attack perform on typed decision models beyond Jev?","claims":[{"text":"The authors present a black-box, query-based attack on Jev that does not use an attacker language model.","excerpt":"a quick black-box query-based attack that calls no attacker language model","support":"source-stated"},{"text":"Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests.","excerpt":"no strategy changes a correct answer in 10,240 paired tests","support":"source-stated"},{"text":"The authors report that one suffix per dataset flipped 43% of unseen documents.","excerpt":"one suffix per dataset flips 43% of unseen documents","support":"source-stated"},{"text":"The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks.","excerpt":"one suffix generated from one task can flip 90-100% of the samples in other tasks","support":"source-stated"}],"limitations":["This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here.","The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.”"],"mediaId":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","correctionReason":null,"id":"e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0","publicationId":"1431193f-c21e-43d9-8618-335ebc8d3044","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38895","sourceTitle":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:42:53.277Z","createdAt":"2026-11-11T09:39:37.737Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","kind":"article","url":"https://arxiv.org/abs/2610.38895","sourceUrl":"https://arxiv.org/abs/2610.38895","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T11:47:45.621Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38895","checkedAt":"2026-11-11T10:42:09.293Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","confidence":0.85,"provider":"typesafe","model":"jev-1.13.0","inputHash":"4c0f2d64febe8c1fb6c2ca98f709534941f40f5db176af0f6990a3a6a6fefb5f","decidedAt":"2026-10-31T11:47:47.321Z"},"provenance":{"textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observationId":"b7959c3f05a980baf5ca9922ed82e42d54d2be2b64c461cebb1326c5f9ce5f9e","retrievedAt":"2026-10-31T11:47:45.377Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"4eb368e6-9aad-4282-8994-314c9f5f6631"},"reviewer":{"model":"gpt-6-luna","runId":"180e61cc-ff4a-4466-82af-f40dda66a39c"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-11T09:39:37.737Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Liu, Xiaogeng","url":null,"kind":"unknown"},{"name":"Wang, Xinyan","url":null,"kind":"unknown"},{"name":"Xiao, Chaowei","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Liu, Xiaogeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Xiaogeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}},{"actor":{"name":"Wang, Xinyan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Xinyan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}},{"actor":{"name":"Xiao, Chaowei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiao, Chaowei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38895","snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0/source"}},"canonicalUrl":"https://escapemeridian.com/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382","formats":{"html":"/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382","markdown":"/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382.md","json":"/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-red-teaming","name":"Red-teaming","explanation":"Deliberately attacking or tricking a system to find its weaknesses before others do.","referenceUrl":"https://en.wikipedia.org/wiki/Red_team"},{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"},{"id":"jev","name":"Jev","kind":"model","context":"Jev is TypeSafe AI’s model for fast evaluation and routing decisions inside AI systems.","referenceUrls":["https://typesafe.ai/blog/introducing-system-one-models-and-jev","https://typesafe.ai/"],"path":"/entities/jev","json":"/entities/jev.json","markdown":"/entities/jev.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0","revision":"1431193f-c21e-43d9-8618-335ebc8d3044","revisionKind":"publication-id","title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","url":"https://escapemeridian.com/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.38895","revision":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","revisionKind":"sha256-source-text","title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","url":"https://arxiv.org/abs/2610.38895"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0","title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","argument":"In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it.\n\nAcross 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems.\n\nHow would the reported attack perform on typed decision models beyond Jev?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here. The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.”","speaker":{"name":"Liu, Xiaogeng, Wang, Xinyan, Xiao, Chaowei","roleAtSource":"Article author"},"source":{"title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38895","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors present a black-box, query-based attack on Jev that does not use an attacker language model.","excerpt":"a quick black-box query-based attack that calls no attacker language model","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests.","excerpt":"no strategy changes a correct answer in 10,240 paired tests","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"The authors report that one suffix per dataset flipped 43% of unseen documents.","excerpt":"one suffix per dataset flips 43% of unseen documents","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"},{"text":"The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks.","excerpt":"one suffix generated from one task can flip 90-100% of the samples in other tasks","url":"https://arxiv.org/abs/2610.38895","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38895","checkedAt":"2026-11-11T10:42:09.293Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported attack perform on typed decision models beyond Jev?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","summary":"In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it.\n\nAcross 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems.\n\nHow would the reported attack perform on typed decision models beyond Jev?","question":"How would the reported attack perform on typed decision models beyond Jev?","claims":[{"text":"The authors present a black-box, query-based attack on Jev that does not use an attacker language model.","excerpt":"a quick black-box query-based attack that calls no attacker language model","support":"source-stated"},{"text":"Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests.","excerpt":"no strategy changes a correct answer in 10,240 paired tests","support":"source-stated"},{"text":"The authors report that one suffix per dataset flipped 43% of unseen documents.","excerpt":"one suffix per dataset flips 43% of unseen documents","support":"source-stated"},{"text":"The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks.","excerpt":"one suffix generated from one task can flip 90-100% of the samples in other tasks","support":"source-stated"}],"limitations":["This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here.","The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.”"],"mediaId":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","correctionReason":null,"id":"e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0","publicationId":"1431193f-c21e-43d9-8618-335ebc8d3044","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38895","sourceTitle":"FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:42:53.277Z","createdAt":"2026-11-11T09:39:37.737Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","kind":"article","url":"https://arxiv.org/abs/2610.38895","sourceUrl":"https://arxiv.org/abs/2610.38895","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T11:47:45.621Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38895","checkedAt":"2026-11-11T10:42:09.293Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"1b620cf3818c02ec084dd84aab7d8274efd13d0083469d1f88b71c5ab5cf980c","confidence":0.85,"provider":"typesafe","model":"jev-1.13.0","inputHash":"4c0f2d64febe8c1fb6c2ca98f709534941f40f5db176af0f6990a3a6a6fefb5f","decidedAt":"2026-10-31T11:47:47.321Z"},"provenance":{"textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observationId":"b7959c3f05a980baf5ca9922ed82e42d54d2be2b64c461cebb1326c5f9ce5f9e","retrievedAt":"2026-10-31T11:47:45.377Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"4eb368e6-9aad-4282-8994-314c9f5f6631"},"reviewer":{"model":"gpt-6-luna","runId":"180e61cc-ff4a-4466-82af-f40dda66a39c"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-11T09:39:37.737Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Liu, Xiaogeng","url":null,"kind":"unknown"},{"name":"Wang, Xinyan","url":null,"kind":"unknown"},{"name":"Xiao, Chaowei","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Liu, Xiaogeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Xiaogeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}},{"actor":{"name":"Wang, Xinyan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Xinyan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}},{"actor":{"name":"Xiao, Chaowei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xiao, Chaowei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38895","locator":"head/meta[name=author|citation_author]"},"assertionId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-11T10:42:09.293Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","sourceUrl":"https://arxiv.org/abs/2610.38895","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38895","snapshotId":"aa659a4b311ebb9c3e5fe1879df2746b25e60a1a9ede52ec317b20307dff1f2b","contentSha256":"527996f2c036c3810b1b0119ca9322441868e844e484763598593c7d35ec8faf","textHash":"dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de","observedAt":"2026-11-11T10:42:09.293Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0/source"}}}],"audits":[{"publicationId":"1431193f-c21e-43d9-8618-335ebc8d3044","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft correctly attributes the work to Xiaogeng Liu, Xinyan Wang and Chaowei Xiao. It keeps findings and the call for strict adaptive attacks framed as the authors' reports and arguments in a pre-print.","excerpt":"Authors:Xiaogeng Liu, Xinyan Wang, Chaowei Xiao"},{"dimension":"summary","status":"uncertain","explanation":"The draft is faithful, but it omits the stated stake: these models are increasingly used, including in security-sensitive tasks. Without that, a general reader cannot see why flipped answers matter. It also omits 'within minutes' and leaves central jargon unexplained: red teaming, black-box, adaptive attacks, prompt injection, and adversarial suffix (text appended to an input). Smallest repair: add the security-sensitive-use clause, the minutes timing, and term-library tooltips for these terms. The draft's own limitation already suggests a 'typed decision models' entry.","excerpt":"They answer in a single fast and cheap query and are increasingly used, including in security-sensitive tasks."},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-10-28 matches the arXiv v1 submission date. The later feed date was not used.","excerpt":"[Submitted on 28 Oct 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim is supported by the abstract: the attack uses no attacker language model, 10,240 paired tests, 43% on unseen documents, and 90-100% cross-task transfer. The question and limitations stay appropriately within scope without adding unsupported benefits or costs. This grounding does not independently verify the results.","excerpt":"one suffix generated from one task can flip 90-100% of the samples in other tasks"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-11T09:39:37.737Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}