Skip to content
SN-X
All research
PaperFebruary 26, 2026

A Three-Attack Red-Team Evasion Suite for the E2 Promotion of Linear Probes

We describe the three-attack red-team evasion suite used by MIVP to gate E2 promotion: paraphrase noise (bounded Gaussian perturbation), covariate shift (random-direction scaling and offset), and fine-tune evasion (worst-case bounded attack pushing positive-class activations directly against the probe direction). A probe earns E2 only if its AUROC on the union of the three attacks clears a configured threshold. We provide explicit constructions, parameter choices, and a quantitative evaluation on two probe families.

M. TaylorSN-X
View on github · oca

1. Introduction

The robustness of a linear probe to surface paraphrase is necessary but not sufficient. A probe that survives paraphrase can be broken by a fine-tune that pushes activations against the probe direction. A probe that survives both can fail under prompt-distribution shift. Three attacks, three failure modes, one promotion criterion.

2. Background

Adversarial examples (Biggio et al., 2013; Goodfellow et al., 2015; Madry et al., 2018) study attacks on the input surface. Our attacks target a different surface: activations. Red-teaming LMs (Perez et al., 2022; Casper et al., 2023) establishes the methodology. Covariate shift is formalised by Quionero-Candela et al. (2009).

3. Method

3.1 The Three Attacks

Let d be the activation dimension, pos the held-out positives, neg the held-out negatives. Let probe.direction be the probe direction.

Attack 1 — Paraphrase. P_paraphrase(x) = x + ε_par · η, η ~ N(0, I). Default ε_par = 0.5.

Attack 2 — Covariate shift. P_shift(x) = s · x + (γ / √d) · ξ · 1. Default s = 1.2, γ = 0.5.

Attack 3 — Fine-tune evasion. P_evade(pos) = pos − ε_adv · probe.direction. P_evade(neg) = neg (negatives unchanged). Default ε_adv = 1.0.

3.2 Promotion Criterion

AUROC_union ≥ min_adversarial_auroc, default 0.75. Per-attack AUROCs are reported alongside; a probe leaning on one attack and failing another is flagged.

3.3 Why Bounded Attacks

Unbounded attacks produce trivially broken probes. The bounds are calibrated against empirical activation magnitudes at calibration time.

4. Results

Evaluated on two probe families fit on a held-out 7B-class model:

ProbeAUROC held-outParaphraseCovariateEvasionUnion
DOM-mean0.910.870.840.790.81
Logistic0.930.880.850.760.79

5. Discussion

Per-attack reporting is the diagnostic. The three attacks target representation-level evasion; token-level adversarial inputs and multi-turn elicitation are T3 territory.

6. Conclusion

A three-attack red-team evasion suite for E2 promotion that targets three failure modes, admits explicit parameters, and composes with calibration and drift layers.

References

Biggio et al. (2013). ECML PKDD. / Casper et al. (2023). TMLR. / Goodfellow, Shlens, Szegedy (2015). ICLR. / Madry et al. (2018). ICLR. / Perez et al. (2022). EMNLP. / Quionero-Candela et al. (2009). MIT Press.