Slot Attack causes incorrect answers in 32 to 99% of correct decisions

Researchers made Slot Attack, an attack on decision models. A decision model selects one answer from a set of answers. Slot Attack adds text to the data that the model reads, to send it to an incorrect answer that the attacker selects. It uses only the label probabilities that the model gives. It had success on 32 to 99% of decisions that were first correct, on 7 models.

How it works

The attacker adds text made of parts with names. This is a black box attack: it has no access to the inner parts of the model. A median of 17 to 72 queries found a combination of parts that works.

The numbers

• Success: 32 to 99% on decisions that were first correct.
• Queries: a median of 17 to 72 for each success.
• Accuracy does not show the risk: the difference was about 20 points.
• All incorrect answers can be caused on about 20% to 98% of correct decisions, by model.

What is not known

A confidence threshold does not stop the attack in each test. The source gives no repair. The authors tell that robustness must be measured for each model, task and version.

Insight: A fast decision model is not shown to be safe

In October 2026, Microsoft released Decision-1 and told that it is 2.8 times as fast as Jev. Other researchers found that attacks change 46.3% of the correct answers of Jev. This paper finds that accuracy does not show attack success, and a fast model can have the same weak point. This reads as a task for the buyer, not the vendor: operate the attack test.