Attacks change 46.3% of correct answers by the Jev decision model

Researchers made JevAdvBench, a test with 862 questions and 12 attack methods for typed decision models. These models answer a question with a risk number, an alternative or a level. Web services do the task if the confidence is above a limit. An attacker who writes part of the input can change the answer. The attacks change 46.3% of correct answers by Jev. The same re-runs change 0.17%.

How it works

The attacks are black-box. This means they have no access to the model. They change the input or the alternatives and use adaptive search to find a change that works. An inspection kept only variants that have the same correct answer.

The numbers

• Attacks change 46.3% of correct answers. The same re-runs change 0.17%.
• A flawed argument changes 77.2%. Direct prompt injection changes 92.0%.
• At a limit of 0.8, 23.5% of the answers that the service does are incorrect.

What is not known

The Jev guardrail on Agentgateway rejects a jailbreak message. It accepts the same message with an added argument. The authors say services must treat the input as not safe and not do tasks on confidence only. They give no tested fix.

Insight: Speed is the contest, but confidence is the target

HiddenLayer says Jev is more open to attacks than large language models. Microsoft says its Decision-1 model is 2.8 times as fast as Jev. Makers compete on speed, but the confidence number that starts a task is what an attacker moves. It seems that an attack test will join the speed test. Before you set an automatic limit, tell the vendor to give attack results.