# FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models [Canonical reading](https://escapemeridian.com/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382) In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it. Across 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems. How would the reported attack perform on typed decision models beyond Jev? Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T09:39:37.737Z. First observed: 2026-10-30T06:42:53.277Z. Retrieved: 2026-10-31T11:47:45.377Z. - [FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models](https://arxiv.org/abs/2610.38895) ## Limits This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here. The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.” ## Open question How would the reported attack perform on typed decision models beyond Jev? ## Source-stated The authors present a black-box, query-based attack on Jev that does not use an attacker language model. > a quick black-box query-based attack that calls no attacker language model - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests. > no strategy changes a correct answer in 10,240 paired tests - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated The authors report that one suffix per dataset flipped 43% of unseen documents. > one suffix per dataset flips 43% of unseen documents - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks. > one suffix generated from one task can flip 90-100% of the samples in other tasks - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source and contributor context Liu, Xiaogeng, Wang, Xinyan, Xiao, Chaowei · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Red-teaming Deliberately attacking or tricking a system to find its weaknesses before others do. - [Definition reference](https://en.wikipedia.org/wiki/Red_team) ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Jev Jev is TypeSafe AI’s model for fast evaluation and routing decisions inside AI systems. - [Explore this context](/entities/jev) - [Reference](https://typesafe.ai/blog/introducing-system-one-models-and-jev) - [Reference](https://typesafe.ai/) ## Editorial provenance Version 1. Publication ID: 1431193f-c21e-43d9-8618-335ebc8d3044. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T09:39:37.737Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: b7959c3f05a980baf5ca9922ed82e42d54d2be2b64c461cebb1326c5f9ce5f9e. Source text hash: dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de. ## Revision and source-check history ### Version 1 — 2026-11-11T09:39:37.737Z In a pre-print, Xiaogeng Liu, Xinyan Wang and Chaowei Xiao report that their black-box attack found short suffixes that changed confident answers from Jev, a representative typed decision model. The authors describe these models as making decisions in a single query rather than generating free-text responses, and say their speed has left a gap in red teaming: existing adaptive attacks do not use it. Across 12 datasets, the authors report that no common prompt injection strategy changed a correct answer in 10,240 paired tests. Their attack, by contrast, found universal suffixes: one suffix per dataset flipped 43% of unseen documents. They also report that a suffix generated for one task flipped 90–100% of samples in other tasks. The authors argue that evaluations of typed decision models must include strict adaptive attacks to assess robustness. These results concern the paper’s experiments; the abstract does not establish how the attack performs on other models or in deployed systems. How would the reported attack perform on typed decision models beyond Jev? ## Original source arXiv cs.AI · Article Original source date: Oct 28, 2026 (2026-10-28). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T09:39:37.737Z. First observed: 2026-10-30T06:42:53.277Z. Retrieved: 2026-10-31T11:47:45.377Z. - [FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models](https://arxiv.org/abs/2610.38895) ## Limits This is a pre-print, and the supplied evidence is its abstract rather than the full paper; details needed to assess experimental methods and scope are not available here. The abstract reports results on Jev, described as a representative typed decision model; it does not establish performance on other models or in deployed systems. The term library may need an entry for “typed decision models.” ## Open question How would the reported attack perform on typed decision models beyond Jev? ## Source-stated The authors present a black-box, query-based attack on Jev that does not use an attacker language model. > a quick black-box query-based attack that calls no attacker language model - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated Across 12 datasets, the authors report that no tested common prompt injection strategy changed a correct answer in 10,240 paired tests. > no strategy changes a correct answer in 10,240 paired tests - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated The authors report that one suffix per dataset flipped 43% of unseen documents. > one suffix per dataset flips 43% of unseen documents - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source-stated The authors report that a suffix generated from one task flipped 90–100% of samples in other tasks. > one suffix generated from one task can flip 90-100% of the samples in other tasks - [Supporting source](https://arxiv.org/abs/2610.38895) ## Source and contributor context Liu, Xiaogeng, Wang, Xinyan, Xiao, Chaowei · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Red-teaming Deliberately attacking or tricking a system to find its weaknesses before others do. - [Definition reference](https://en.wikipedia.org/wiki/Red_team) ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Jev Jev is TypeSafe AI’s model for fast evaluation and routing decisions inside AI systems. - [Explore this context](/entities/jev) - [Reference](https://typesafe.ai/blog/introducing-system-one-models-and-jev) - [Reference](https://typesafe.ai/) ## Editorial provenance Version 1. Publication ID: 1431193f-c21e-43d9-8618-335ebc8d3044. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T09:39:37.737Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: b7959c3f05a980baf5ca9922ed82e42d54d2be2b64c461cebb1326c5f9ce5f9e. Source text hash: dc4d610122855a067d928931eeca4db56c45338dba3ae3b07edff107ac7bd7de. ### uncertain — 2026-11-11T09:39:37.737Z — anthropic/claude-opus-5.5 Publication: 1431193f-c21e-43d9-8618-335ebc8d3044 attribution — pass: The draft correctly attributes the work to Xiaogeng Liu, Xinyan Wang and Chaowei Xiao. It keeps findings and the call for strict adaptive attacks framed as the authors' reports and arguments in a pre-print. > Authors:Xiaogeng Liu, Xinyan Wang, Chaowei Xiao summary — uncertain: The draft is faithful, but it omits the stated stake: these models are increasingly used, including in security-sensitive tasks. Without that, a general reader cannot see why flipped answers matter. It also omits 'within minutes' and leaves central jargon unexplained: red teaming, black-box, adaptive attacks, prompt injection, and adversarial suffix (text appended to an input). Smallest repair: add the security-sensitive-use clause, the minutes timing, and term-library tooltips for these terms. The draft's own limitation already suggests a 'typed decision models' entry. > They answer in a single fast and cheap query and are increasingly used, including in security-sensitive tasks. date — pass: The originalPublished date of 2026-10-28 matches the arXiv v1 submission date. The later feed date was not used. > \[Submitted on 28 Oct 2026\] support — pass: Each claim is supported by the abstract: the attack uses no attacker language model, 10,240 paired tests, 43% on unseen documents, and 90-100% cross-task transfer. The question and limitations stay appropriately within scope without adding unsupported benefits or costs. This grounding does not independently verify the results. > one suffix generated from one task can flip 90-100% of the samples in other tasks media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/e3313382e7889ca5d97cc7a555f3ebcc706fa3ae2a037338947afa1283159bd0/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/flipjev-fast-black-box-red-teaming-finds-universal-adversarial-e3313382.json)