對抗性後綴生成

# Core GCG gradient computation
suffix_embeds = embed_layer(input_ids[:, suffix_slice]).requires_grad_(True)
outputs = model(inputs_embeds=full_embeds)
loss = F.cross_entropy(shift_logits.view(-1, V), shift_labels.view(-1))
loss.backward()
 
# Project gradient into token space (negative = tokens that DECREASE loss)
token_grads = -torch.matmul(suffix_embeds.grad, embed_weights.T)
top_substitutions = torch.topk(token_grads, k=256, dim=-1).indices

# Universal trigger: average gradients across multiple prompts
all_grads = None
for prompt, target in prompt_target_pairs:
    grads = compute_token_gradients(prompt, suffix, target)
    all_grads = grads if all_grads is None else all_grads + grads
all_grads /= len(prompt_target_pairs)
# Use averaged gradients for candidate selection

# Soft prompt: optimize continuous vectors prepended to input
soft_prompt = torch.randn(1, num_tokens, d_model, requires_grad=True)
optimizer = torch.optim.Adam([soft_prompt], lr=0.01)
 
for step in range(num_steps):
    full_embeds = torch.cat([soft_prompt, prompt_embeds, target_embeds], dim=1)
    loss = compute_target_loss(model(inputs_embeds=full_embeds), target_ids)
    loss.backward()
    optimizer.step()

# Detect high-perplexity regions that may be adversarial suffixes
per_token_loss = F.cross_entropy(shift_logits, shift_labels, reduction="none")
per_token_ppl = torch.exp(per_token_loss)
# Flag any 10-token window with mean PPL > threshold
for i in range(len(tokens) - window_size):
    if per_token_ppl[0, i:i+window_size].mean() > 100.0:
        print(f"Suspicious region at tokens {i}-{i+window_size}")