Large language models (LLMs) are increasingly being used as automated judges for relevance evaluation in information retrieval, yet their robustness to adversarial manipulation remains insufficiently understood, particularly in multilingual settings. In this work, we investigate the impact of cross-lingual prompt injection attacks on LLM-based relevance judgments using TREC Deep Learning collections and two open-weight models under established prompting frameworks. We examine both instruction-based and content-based injection strategies in 8 languages spanning different resource levels. Our results demonstrate that multilingual query-based injections are highly effective in inflating relevance scores while simultaneously evading existing prompt-injection defenses. We further found that, although existing defense mechanisms can be modified to mitigate such attacks, these injections can be easily adapted to bypass them. These findings highlight a critical gap in current defense approaches and demonstrate that language generalization can act as an attack vector, underscoring the need for more robust and proactive evaluation frameworks for LLM-as-a-judge systems.
Large Language Models (LLMs) are increasingly used in settings where the original user prompt may be unavailable, redacted, or untrusted. This makes response-only adversarial detection an important but challenging problem, because the detector observes only the generated response while the label is determined by the originating prompt. In this study, we investigate response-only adversarial classification of LLM outputs through a comparative evaluation of lexical, contrastive, and contextual representations. Specifically, we compare TF-IDF features, triplet-loss-based metric embeddings, TF-IDF+triplet concatenation, and a Sentence-BERT contextual embedding baseline across three tasks: Prompt Type, Adversarial Type, and Adversarial Class. Experiments on 158 592 response records show that response-only detection is feasible but substantially more difficult than prompt-aware detection. Under stratified group 10-fold evaluation, the strongest TF-IDF+XGBoost baseline achieves 72.37% accuracy for Prompt Type, 82.06% for Adversarial Type, and 56.40% for Adversarial Class. Leave-one-LLM-out evaluation further shows that cross-model generalization remains challenging. Triplet-based metric learning provides model-dependent benefits, particularly for some Adversarial Type configurations, but it does not uniformly outperform strong lexical baselines. Low-dimensional embedding analysis shows that Insertion samples are relatively separable, whereas Prefix and Suffix samples substantially overlap. Overall, the findings provide a realistic benchmark for response-only adversarial detection and clarify the limits of contrastive representations when prompt information is absent.
A. Nasution, Ahmet Emre Ergün, Aytu˘g Onan et al.· IEEE Access· 0 citations
As Large Language Models (LLMs) become the mainstay for information retrieval and summarization tasks, ensuring that they are always non-partisan and invulnerable to political bias is a critical step towards safer and more trustworthy Artificial Intelligence (AI). Current model alignment paradigms, such as reinforcement learning from human feedback (RLHF), make LLMs follow overarching safety instructions. However, this instruction tuning can be exploited via adversarial prompt injection and be used to generate unsafe content. In particular, political bias has not been specifically targeted by modern alignment techniques as harmful and biased content. To address this vulnerability of LLMs, we propose mitigation strategies using Chain of Thought (CoT) prompting and Direct Preference Optimization (DPO). Using a public dataset of legislative videos, we generate summaries using LLMs, inject bias via adversarial prompting and evaluate their performance on a four axis scale designed for political summarization. In this paper, we present different methods to shield LLMs against the injection of political bias. Our results demonstrate that the proposed Recursive Self-Correction approach raises model performance from a Political Neutrality Likert scale baseline of 2.14 to 4.56, averaged across all models, demonstrating effective inference-time mitigation of political bias in LLM-generated summaries.
Tejaswi V. Panchagnula, Bruce Coburn, Bryce J. Dietrich et al.· 0 citations
It is found that, in this benchmark, supervised fine-tuning (SFT) provides a strong baseline, substantially improving argument language consistency and end-to-end function call accuracy and, under consistent model selection, SFT achieves performance comparable to, and sometimes exceeding more complex reinforcement learning (RL) approaches.
Siddharth Chauhan, Thomas Butler, Abhishek Singhania et al.· 0 citations
This work investigates cross-lingual safety transfer in four African languages, Twi, Hausa, Amharic, and Swahili, using LoDNA, a new safety dataset that pairs literal translations with culturally localized prompts to demonstrate superficial safety alignment.
Abigail Oppong, P SAM SAHIL, Tadesse Destaw Belay et al.· 0 citations
With the rapid development and widespread deployment of large language models (LLMs), the security and robustness of these models have emerged as critical research topics. Among various threats, jailbreak attacks, which aim to circumvent built‐in safety mechanisms, have garnered considerable attention as a key means of breaching model protections. However, existing jailbreak methods still face several limitations, such as excessive reliance on the model's internal capabilities, high attack costs and insufficiently comprehensive evaluation strategies. To address these challenges, we propose a novel jailbreak framework: YAE. This method enhances the model's dependency on external information by constructing a RAG‐based knowledge base containing harmful Q&A content. It also leverages Guide MoE, a routing‐inspired prompting strategy, to guide the model toward alternative reasoning trajectories through expert‐role prompting and domain‐specific perturbations, thereby inducing more deceptive responses. Furthermore, Adversarial Fine‐Tuning is employed to further optimize the performance of jailbreak attacks. We conduct extensive experiments under various settings, and the results demonstrate that YAE achieves state‐of‐the‐art performance in terms of both attack success rate (ASR) and efficiency, highlighting its strong overall effectiveness.
Large language models (LLMs) demonstrate impressive performance across a wide range of general NLP tasks; however, their effectiveness in sensitive domains, such as hate speech detection, remains less clear. Prior studies comparing prompted LLMs with state-of-the-art encoder-based models (e.g., BERT variants (Roy et al., 2023; D\"onmez et al., 2024)) have shown only marginal gains, suggesting that LLMs may not excel in hate speech detection or mitigation. In this work, we revisit this question through the lens of instruction tuning. By thoroughly unifying 36 English hate speech datasets spanning multiple labeling schemes, we fine-tune a generalist LLM, based on Qwen3 (Qwen Team, 2025), specifically for hate speech mitigation. Our results demonstrate not only state-of-the-art performance on in-domain benchmarks but also substantial improvements in cross-domain and cross-lingual generalization--areas where encoder-based specialist classifiers often struggle.
Lukas Edman, Daryna Dementieva, Alexander Fraser· 0 citations