4arXiv cs.CL (Computation and Language)·
TraceTarnish: Ablation study of text authorship anonymization against stylometric systems
A new arXiv preprint introduces TraceTarnish, a system for adversarial authorship anonymization designed to defeat stylometric identification systems. The paper conducts an ablation study across four modules — Translation, Obfuscation, Imitation, and Injection — finding that the Injection module (inserting zero-width Unicode characters, homoglyphs, and intentional misspellings) is most effective at confounding stylometric analysis. The work is relevant to AI safety and surveillance research as it operationalizes techniques for evading authorship attribution at scale.
Related guides (2)
Related events (8)
TRACE: Lightweight RAG corpus poisoning detection via token influence attribution
Researchers introduce TRACE, a detection framework for corpus poisoning attacks on Retrieval-Augmented Generation (RAG) systems that works by tracing answer-related tokens through token influence attribution rather than relying on auxiliary classifiers or LLM-based verification. The method identifies recurrent high-influence keywords across retrieved documents and performs secondary verification to confirm their effect on model predictions. Evaluated on three QA benchmarks and six LLMs, TRACE achieves strong detection performance while also exposing attacker-specified target answers, with lower computational overhead than prior approaches.
Reasoning graphs improve robustness of LLM authorship attribution against obfuscation
A new arXiv paper proposes using graph neural networks over argument-mining-derived reasoning graphs to attribute authorship of LLM-generated text, moving beyond surface-level linguistic features. The approach outperforms a Longformer baseline by up to 27 percentage points under paraphrasing and backtranslation obfuscation attacks, and by 19 points when generalizing to unseen model versions. The work addresses a practical gap in AI-generated text detection: robustness to adversarial rewriting and model version drift.
Unified defense framework detects and remediates data poisoning in text summarization fine-tuning
A new arXiv preprint introduces a post-hoc defense framework for detecting and recovering from training-time data poisoning in LLMs fine-tuned for abstractive summarization. The framework uses influence-function analysis in white-box settings and behavioral perturbation auditing in black-box settings, achieving 85-92% detection precision across nine architectures and six benchmarks. Gradient-ascent unlearning restores up to 96% of original model behavior with less than 0.6% ROUGE degradation. The authors also introduce novel attacks targeting factual distortion and representational bias that evade conventional evaluation metrics.
Structural out-of-distribution attacks bypass adversarially fine-tuned AI text detectors at ELOQUENT 2026
Researchers from UTS demonstrate that adversarial fine-tuning of AI text detectors, while closing 2025-era evasion methods, fails against a newly identified class of out-of-distribution attacks. Two novel attack families — cross-decade register shifts and modernist stream-of-consciousness form — achieve up to ~50x higher fool rates than prior methods while preserving text naturalness. The work reveals a fundamental asymmetry: pushing generated text out of a detector's training distribution reliably defeats detection, while pulling it toward human training data does not. These findings swept the top 5 positions on the ELOQUENT 2026 Voight-Kampff leaderboard and suggest persistent structural vulnerabilities in current detector families.
Adversarial robustness evaluation of Arabic language models across attack granularities
A new arXiv preprint evaluates five Arabic language models (including MARBERT and AraBERT) against adversarial attacks at character, word, and sentence levels, finding that diacritic insertion can reduce model accuracy by up to 92% and paraphrasing attacks degrade performance by an average of 76%. The study also tests adversarial training as a defense, finding MARBERT most robust and AraBERT showing the greatest relative gains. Results highlight particular challenges for morphologically rich languages where character-level noise remains difficult to defend against.
Structural role injection via Handlebars triple-brace interpolation in LLM prompts: empirical analysis across delimiter families and models
A new arXiv paper demonstrates that Handlebars templating's HTML auto-escaping—the default in Microsoft Semantic Kernel—provides uneven protection against structural role injection attacks, where attacker-controlled data carries chat role delimiters to forge higher-privilege turns. The authors conduct 5,760 trials across seven delimiter families, two attack objectives, and four models (GPT-3.5 Turbo, GPT-4o mini, GPT-4.1 mini, Claude Haiku 4.5), finding that HTML escaping neutralizes angle-bracket-based delimiters (ChatML, Llama-3, XML) but leaves colon- and Markdown-based families fully exposed. GPT-3.5 Turbo follows task-hijack instructions in 97% of raw and 91% of escaped trials; Claude Haiku 4.5 resists both objectives almost entirely. The paper concludes that HTML escaping cannot substitute for structural separation of instruction and data.
ToxGate: Conditional trust-fusion for multilingual and code-mixed abuse detection
A new arXiv preprint introduces ToxGate, a trust-fusion head that conditions external toxicity signals (English toxicity scores, Indic abuse priors, rule-based severity cues) on encoder representations before incorporating them into abuse detection predictions. The method is evaluated across three short-text abuse datasets, four transformer encoders, and five seeds, improving over baseline encoders in 10 of 12 in-domain and 7 of 8 transfer settings. The core finding is that external toxicity tools should be treated as conditional evidence rather than fixed features, with the largest gains in high-risk slices such as explicit slurs, violent threats, and cross-dataset transfer. The work targets a practical gap in content moderation for Indian multilingual and code-mixed text.
Training-free mechanistic defense against typographic attacks on CLIP-based vision encoders
Researchers propose a training-free method to defend CLIP-based vision encoders against typographic attacks, where irrelevant text embedded in images biases visual representations toward lexical rather than semantic meaning. The approach uses sampling-based mechanistic interpretability to identify specific Vision Transformer attention heads responsible for encoding lexical information, then applies targeted circuit-level interventions to suppress this behavior. Without any retraining, the method outperforms both supervised and training-free baselines on object classification and improves Visual Question Answering accuracy under typographic attack conditions on RIO-Bench across several state-of-the-art LVLMs.