Small Edits, Big Consequences: Telling Good from Bad Robustness in Large Language Models

• URL: http://arxiv.org/abs/2507.15868v1
• Date: Tue, 15 Jul 2025 03:22:07 GMT
• Title: Small Edits, Big Consequences: Telling Good from Bad Robustness in Large Language Models
• Abstract summary: Large language models (LLMs) now write code in settings where misreading a single word can break safety or cost money, yet we still expect them to overlook stray typos.<n>To probe where useful robustness ends and harmful insensitivity begins, we compile 50 LeetCode problems and craft three minimal prompt perturbations.<n>Six frontier models, including three "reasoning-tuned" versions, solve each mutated prompt.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models (LLMs) now write code in settings where misreading a single word can break safety or cost money, yet we still expect them to overlook stray typos. To probe where useful robustness ends and harmful insensitivity begins, we compile 50 LeetCode problems and craft three minimal prompt perturbations that should vary in importance: (i) progressive underspecification deleting 10 % of words per step; (ii) lexical flip swapping a pivotal quantifier ("max" to "min"); and (iii) jargon inflation replacing a common noun with an obscure technical synonym. Six frontier models, including three "reasoning-tuned" versions, solve each mutated prompt, and their Python outputs are checked against the original test suites to reveal whether they reused the baseline solution or adapted. Among 11 853 generations we observe a sharp double asymmetry. Models remain correct in 85 % of cases even after 90 % of the prompt is missing, showing over-robustness to underspecification, yet only 54 % react to a single quantifier flip that reverses the task, with reasoning-tuned variants even less sensitive than their bases. Jargon edits lie in between, passing through 56 %. Current LLMs thus blur the line between harmless noise and meaning - changing edits, often treating both as ignorable. Masking salient anchors such as function names can force re - evaluation. We advocate evaluation and training protocols that reward differential sensitivity: stay steady under benign noise but adapt - or refuse - when semantics truly change.

Related papers

• Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors [0.0]
  We show how to protect language models from prompt injection attacks.<n>We use a technique called Semantic Overlays to protect models.<n>An overlay which marks a span as "non-executable" defends against the broad class of prompt injections.
  arXiv  Detail & Related papers  (2026-08-24T22:26:58Z)
• Repair, Not Improvement: Decomposing Constrained Decoding in Tool-Call Abstention [0.0]
  We show how an enum leaves the wording of an answer alone and narrows the set of answers there are, and declining to call anything is the first it drops.<n>We evaluate open-weight models from 0.6B to 4B on matched English and Korean items, so the language comparison is made within item.<n>What it recovers is form: of 698 abstentions repaired, 545 had no readable answer and 0 were the scorer refused.
  arXiv  Detail & Related papers  (2026-08-14T04:58:01Z)
• Output Vector Editing for Memorization Mitigation in Large Language Models [68.30351930772788]
  Large language models memorize and reproduce sequences from their training data, creating privacy, copyright, and security risks.<n>Existing neuron-level mitigation methods equate editing with zeroing out neuron activations, but the activation only controls whether a neuron engages.<n>We propose output vector editing, a constrained-optimization edit that locates a small set of neurons responsible for a memorized continuation.
  arXiv  Detail & Related papers  (2026-06-17T07:29:18Z)
• Rethinking Dense Sequential Chains: Reasoning Language Models Can Extract Answers from Sparse, Order-Shuffling Chain-of-Thoughts [51.84894623128418]
  Modern reasoning language models generate dense, sequential chain-of-thought traces implicitly assuming that every token contributes and that steps must be consumed in order.<n>We challenge both assumptions through a systematic intervention pipeline--removal, masking, shuffling, and noise injection--applied to model-generated reasoning chains.<n>We find that answer extraction operates on a sparse, order-insensitive, and structurally robust informational substrate.
  arXiv  Detail & Related papers  (2026-05-08T06:15:50Z)
• When Informal Text Breaks NLI: Tokenization Failure, Distribution Shift, and Targeted Mitigations [0.0]
  We study how informal surface forms degrade NLI accuracy across four transforms applied to SNLI and MultiNLI.<n>Emoji replaces content words with Unicode characters that ELECTRA's WordPiece tokenizer maps to [UNK], destroying the input signal before any learned parameters see it.<n>Noise tokens (no cap, deadass, tbh) are fully in-vocabulary but absent from NLI training data, consistent with the model assigning them inferential weight they do not carry.
  arXiv  Detail & Related papers  (2026-04-18T02:23:02Z)
• A Typologically Grounded Evaluation Framework for Word Order and Morphology Sensitivity in Multilingual Masked LMs [2.895343274331944]
  We evaluate mBERT and XLM-R on English, Chinese, German, Spanish, and Russian languages.<n>Full scrambling drives word-level reconstruction accuracy near zero in all languages.<n>Top-5 word accuracy shows the same pattern: under full scrambling, the gold word rarely appears among the five highest-ranked reconstructions.
  arXiv  Detail & Related papers  (2026-02-28T03:13:34Z)
• CORE: Context-Robust Remasking for Diffusion Language Models [51.59514489363897]
  We propose Context-Robust Remasking (CORE), a training-free framework for inference-time revision.<n>Rather than trusting static token probabilities, CORE identifies context-brittle tokens by probing their sensitivity to targeted masked-context perturbations.<n>On LLaDA-8B-Base, CORE delivers consistent improvements across reasoning and code benchmarks, outperforming compute-matched baselines and improving MBPP by up to 9.2 percentage points.
  arXiv  Detail & Related papers  (2026-02-04T00:12:30Z)
• Universal Adversarial Suffixes Using Calibrated Gumbel-Softmax Relaxation [9.099589602551573]
  We study universal adversarial suffixes that, when appended to any input, broadly reduce accuracy across tasks and models.<n>Our approach learns the suffix in a differentiable "soft" form using Gumbel-Softmax relaxation and then discretizes it for inference.<n>A single suffix trained on one model transfers effectively to others, consistently lowering both accuracy and calibrated confidence.
  arXiv  Detail & Related papers  (2025-12-09T00:03:39Z)
• TimeStampEval: A Simple LLM Eval and a Little Fuzzy Matching Trick to Improve Search Accuracy [0.0]
  TimeStampEval is a benchmark for retrieving precise millisecond timestamps from long transcripts given non-verbatim quotes.<n>Our simple two-stage method dramatically improves retrieval accuracy while cutting inference costs by over 90%.<n>The motivating use case is an automated long-form podcast that assembles Congressional Record clips into AI-hosted verbatim narration.
  arXiv  Detail & Related papers  (2025-10-27T21:54:56Z)
• Beyond Magic Words: Sharpness-Aware Prompt Evolving for Robust Large Language Models with TARE [57.67972800581953]
  We introduce TARE, a derivative-free framework that alternates between an inner, sampling-based adversarial search that stresses a prompt with hard paraphrases.<n>We also propose ATARE, which learns anisotropic weights to shape the semantic neighborhood and adapts its radius over time to balance exploration and fidelity.
  arXiv  Detail & Related papers  (2025-09-28T23:57:05Z)
• Trick or Neat: Adversarial Ambiguity and Language Model Evaluation [42.62991342963119]
  We assess language models' sensitivity to ambiguity by introducing an adversarial ambiguity dataset.<n>Our findings show that direct prompting fails to robustly identify ambiguity, while linear probes trained on model representations can decode ambiguity with high accuracy.
  arXiv  Detail & Related papers  (2025-06-01T22:50:06Z)
• Are Large Language Models Robust in Understanding Code Against Semantics-Preserving Mutations? [18.52519530244078]
  We evaluate whether state-of-the-art Large Language Models (LLMs) with up to 8B parameters can reason about Python programs or are simply guessing.<n>We apply five semantics-preserving code mutations: renaming variables, mirroring comparison expressions, swapping if-else branches, converting for loops to while, and loop unrolling.<n>We show that some LLMs, such as Llama3.2, produce correct predictions based on flawed reasoning in up to 61% of cases.
  arXiv  Detail & Related papers  (2025-05-15T16:04:25Z)
• Large Language Models Badly Generalize across Option Length, Problem Types, and Irrelevant Noun Replacements [6.216048301478171]
  We propose a Generalization Stress Test" to assess Large Language Models' (LLMs) generalization ability under slight perturbations.<n>We achieve novel and significant findings that, despite high benchmark scores, LLMs exhibit severe accuracy drops and unexpected biases when faced with minor but content-preserving modifications.
  arXiv  Detail & Related papers  (2025-02-18T02:42:53Z)
• Provably Secure Disambiguating Neural Linguistic Steganography [66.30965740387047]
  The segmentation ambiguity problem, which arises when using language models based on subwords, leads to occasional decoding failures.<n>We propose a novel secure disambiguation method named SyncPool, which effectively addresses the segmentation ambiguity problem.<n> SyncPool does not change the size of the candidate pool or the distribution of tokens and thus is applicable to provably secure language steganography methods.
  arXiv  Detail & Related papers  (2024-03-26T09:25:57Z)
• Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attacks [39.51297217854375]
  We propose Text-CRS, a certified robustness framework for natural language processing (NLP) based on randomized smoothing. We show that Text-CRS can address all four different word-level adversarial operations and achieve a significant accuracy improvement. We also provide the first benchmark on certified accuracy and radius of four word-level operations, besides outperforming the state-of-the-art certification against synonym substitution attacks.
  arXiv  Detail & Related papers  (2023-07-31T13:08:16Z)
• We're Afraid Language Models Aren't Modeling Ambiguity [136.8068419824318]
  Managing ambiguity is a key part of human language understanding. We characterize ambiguity in a sentence by its effect on entailment relations with another sentence. We show that a multilabel NLI model can flag political claims in the wild that are misleading due to ambiguity.
  arXiv  Detail & Related papers  (2023-04-27T17:57:58Z)
• Towards preserving word order importance through Forced Invalidation [80.33036864442182]
  We show that pre-trained language models are insensitive to word order. We propose Forced Invalidation to help preserve the importance of word order. Our experiments demonstrate that Forced Invalidation significantly improves the sensitivity of the models to word order.
  arXiv  Detail & Related papers  (2023-04-11T13:42:10Z)
• Semantic-Preserving Adversarial Text Attacks [85.32186121859321]
  We propose a Bigram and Unigram based adaptive Semantic Preservation Optimization (BU-SPO) method to examine the vulnerability of deep models. Our method achieves the highest attack success rates and semantics rates by changing the smallest number of words compared with existing methods.
  arXiv  Detail & Related papers  (2021-08-23T09:05:18Z)
• Fake it Till You Make it: Self-Supervised Semantic Shifts for Monolingual Word Embedding Tasks [58.87961226278285]
  We propose a self-supervised approach to model lexical semantic change. We show that our method can be used for the detection of semantic change with any alignment method. We illustrate the utility of our techniques using experimental results on three different datasets.
  arXiv  Detail & Related papers  (2021-01-30T18:59:43Z)
• MASKER: Masked Keyword Regularization for Reliable Text Classification [73.90326322794803]
  We propose a fine-tuning method, coined masked keyword regularization (MASKER), that facilitates context-based prediction. MASKER regularizes the model to reconstruct the keywords from the rest of the words and make low-confidence predictions without enough context. We demonstrate that MASKER improves OOD detection and cross-domain generalization without degrading classification accuracy.
  arXiv  Detail & Related papers  (2020-12-17T04:54:16Z)
• Reevaluating Adversarial Examples in Natural Language [20.14869834829091]
  We analyze the outputs of two state-of-the-art synonym substitution attacks. We find that their perturbations often do not preserve semantics, and 38% introduce grammatical errors. With constraints adjusted to better preserve semantics and grammaticality, the attack success rate drops by over 70 percentage points.
  arXiv  Detail & Related papers  (2020-04-25T03:09:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.