Search papers, labs, and topics across Lattice.
This paper reveals vulnerabilities in the SAGE self-check defense, which reportedly has a 99% success rate, by demonstrating that a composite attack using a code-completion encoding and best-of-N search can significantly breach its defenses, achieving success rates of 67%, 22%, and 15% across three target models. The authors explain that the effectiveness of the attack is contingent on the type of defense employed, with different defenses exhibiting varying susceptibility to the attacks. Additionally, they identify and correct a flaw in their methodology concerning deterministic attacks, underscoring the importance of rigorous validation in defense mechanisms.
A composite attack can breach a supposedly robust self-check defense, achieving up to 67% success where individual methods fail.
A self-check defense asks the target model to assess a request before answering it; SAGE, the strongest published instance, reports an average 99% defense success rate. We show it can be breached by composing two attacks that are individually harmless against it: an established code-completion encoding and an established best-of-N search, neither of which exceeds 4.7% of behaviors alone. Composed, with the search budget spent on the encoding, they reach 67/22/15% across three open targets, and the effect persists on a 70B target. We then explain the composition rather than only reporting it. First, a self-check defense borrows its strength from the target: SAGE does not detect the attack, it asks the model to, and the four targets convert that request into an explicit refusal between 32% and 97% of the time, which orders the spread in defended coverage even though undefended reach is near-identical. Second, which attack survives is decided by the type of defense, and it inverts: against transform defenses the code encoding retains far more of its undefended reach than the character search, while against gate defenses the ordering flips. We account for this with the number of independent probes an attack delivers to a defense's decision boundary. Finally, we report a validity defect we found and repaired in our own pipeline, a deterministic attack under greedy decoding has no best-of-N variation channel at all, and give the one-line diagnostic that detects it. All claims rest on 310,000 generations scored by a human-validated judge.
