A Three-Attack Red-Team Evasion Suite for the E2 Promotion of Linear Probes
We describe the three-attack red-team evasion suite used by MIVP to gate E2 promotion: paraphrase noise (bounded Gaussian perturbation), covariate shift (random-direction scaling and offset), and fine-tune evasion (worst-case bounded attack pushing positive-class activations directly against the probe direction). A probe earns E2 only if its AUROC on the union of the three attacks clears a configured threshold. We provide explicit constructions, parameter choices, and a quantitative evaluation on two probe families.
1. Introduction
The robustness of a linear probe to surface paraphrase is necessary but not sufficient. A probe that survives paraphrase can be broken by a fine-tune that pushes activations against the probe direction. A probe that survives both can fail under prompt-distribution shift. Three attacks, three failure modes, one promotion criterion.
2. Background
Adversarial examples (Biggio et al., 2013; Goodfellow et al., 2015; Madry et al., 2018) study attacks on the input surface. Our attacks target a different surface: activations. Red-teaming LMs (Perez et al., 2022; Casper et al., 2023) establishes the methodology. Covariate shift is formalised by Quionero-Candela et al. (2009).
3. Method
3.1 The Three Attacks
Let d be the activation dimension, pos the held-out positives, neg the held-out negatives. Let probe.direction be the probe direction.
Attack 1 — Paraphrase. P_paraphrase(x) = x + ε_par · η, η ~ N(0, I). Default ε_par = 0.5.
Attack 2 — Covariate shift. P_shift(x) = s · x + (γ / √d) · ξ · 1. Default s = 1.2, γ = 0.5.
Attack 3 — Fine-tune evasion. P_evade(pos) = pos − ε_adv · probe.direction. P_evade(neg) = neg (negatives unchanged). Default ε_adv = 1.0.
3.2 Promotion Criterion
AUROC_union ≥ min_adversarial_auroc, default 0.75. Per-attack AUROCs are reported alongside; a probe leaning on one attack and failing another is flagged.
3.3 Why Bounded Attacks
Unbounded attacks produce trivially broken probes. The bounds are calibrated against empirical activation magnitudes at calibration time.
4. Results
Evaluated on two probe families fit on a held-out 7B-class model:
| Probe | AUROC held-out | Paraphrase | Covariate | Evasion | Union |
|---|---|---|---|---|---|
| DOM-mean | 0.91 | 0.87 | 0.84 | 0.79 | 0.81 |
| Logistic | 0.93 | 0.88 | 0.85 | 0.76 | 0.79 |
5. Discussion
Per-attack reporting is the diagnostic. The three attacks target representation-level evasion; token-level adversarial inputs and multi-turn elicitation are T3 territory.
6. Conclusion
A three-attack red-team evasion suite for E2 promotion that targets three failure modes, admits explicit parameters, and composes with calibration and drift layers.
References
Biggio et al. (2013). ECML PKDD. / Casper et al. (2023). TMLR. / Goodfellow, Shlens, Szegedy (2015). ICLR. / Madry et al. (2018). ICLR. / Perez et al. (2022). EMNLP. / Quionero-Candela et al. (2009). MIT Press.