💬 NLP

Hybrid Adversarial Defence for Natural Language Understanding Tasks

This paper proposes a hybrid adversarial defence framework that integrates entropy, uncertainty, and geometric features to simultaneously enhance Large Language Models' robustness against hallucinations and adversarial attacks, demonstrating significant improvements in both clean-task performance and security across diverse in-domain and out-of-distribution Natural Language Understanding datasets.

Original authors: Manar Abouzaid, Yang Wang, Chenghua Lin, Stuart E. Middleton

Published 2026-06-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Manar Abouzaid, Yang Wang, Chenghua Lin, Stuart E. Middleton

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine Large Language Models (LLMs) as incredibly smart, fast-talking interns. They are great at answering questions, but they have two major flaws:

Hallucinations: Sometimes, they are so confident that they make up facts that sound real but are completely wrong.
Adversarial Attacks: Sometimes, a "hacker" can trick them with a sneaky, confusing question (like a riddle or a typo-ridden sentence) to make them say something they shouldn't.

Usually, researchers build one shield to stop the lying and a different shield to stop the hacking. This paper asks: What if we combined them into one super-shield?

The authors built a "Hybrid Adversarial Defence" system. Think of it as a high-tech security checkpoint with three different security guards and a smart manager who decides which guard gets to check your ID.

The Three Security Guards

The "Confusion Detector" (Entropy-Based):
- How it works: This guard watches how confused the model gets when it tries to answer. If the model starts sounding very unsure (high "entropy" or chaos in its thoughts), this guard assumes something is fishy.
- The Analogy: Imagine a suspect who starts stuttering and changing their story too much. This guard says, "Stop! You're too confused to be telling the truth. I'm not letting you pass."
The "Know-Your-Limits" Guard (Uncertainty-Based):
- How it works: This guard is trained to say, "I don't know." It checks if the question is outside the model's actual knowledge. If the model is guessing, this guard steps in to stop it from making up an answer.
- The Analogy: Think of a librarian who refuses to guess the ending of a book they haven't read. Instead of making up a fake ending, they say, "I'm not sure, so I won't answer." This stops the model from lying (hallucinating).
The "Shape-Shifter" (Geometric-Based):
- How it works: This guard looks at the mathematical "shape" of the model's thoughts. Hackers often try to push the model's thoughts into a weird, unnatural shape. This guard smoothes out those weird shapes, making the model's thinking more stable and harder to trick.
- The Analogy: Imagine a hacker trying to push a boulder up a hill by pushing it in a weird, jagged direction. This guard flattens the hill, making the path smooth so the hacker can't push the boulder off course.

The Smart Manager (The Routing Network)

Instead of letting all three guards argue over every question, the paper introduces a Manager.

The Job: The Manager looks at the incoming question and the "vibe" of the situation.
The Decision:
- If the question looks like a tricky riddle, the Manager sends it to the Shape-Shifter.
- If the question looks like something the model might not know, the Manager sends it to the Know-Your-Limits guard.
- If the question looks chaotic, the Manager sends it to the Confusion Detector.
The Result: The Manager learns to pick the best guard for the specific job, rather than using a "one-size-fits-all" approach.

What Did They Find?

The authors tested this system on various tasks, from fact-checking to answering common sense questions. Here is what happened:

Better at the Basics: Even when no one was trying to hack the model, this hybrid system made the model answer questions more accurately. It reduced the number of times the model made things up.
Stronger Against Attacks: When hackers tried to trick the model, the hybrid system was much better at spotting the tricks.
- In some tests, it improved accuracy by nearly 43% compared to the unguarded model.
- It reduced the success rate of hackers by up to 64%.
Good at New Things: Even when they tested it on topics it hadn't seen before (like aerospace engineering or climate science), it still did a great job stopping the hackers.
Stopping Jailbreaks: They also tested it against "jailbreak" attempts (tricks to make the model ignore safety rules). The hybrid system was very effective at saying "No" to these dangerous requests.

The Bottom Line

The paper concludes that you don't have to choose between stopping lies and stopping hackers. By combining confusion detection, honesty training, and mathematical smoothing, and letting a smart manager pick the right tool for the job, you get a much safer and smarter AI.

The authors note that while this works well now, the next challenge will be seeing if hackers can trick the Manager itself, and they suggest future work could combine these guards into a single, even more efficient brain.

Technical Summary: Hybrid Adversarial Defence for Natural Language Understanding Tasks

Problem Statement

Large Language Models (LLMs) face two critical, yet often treated separately, vulnerabilities: hallucination (generating confident but factually incorrect or nonsensical responses) and adversarial vulnerability (susceptibility to malicious input perturbations, prompt injections, and jailbreaks). Existing defense mechanisms typically address these issues in isolation. Furthermore, different defense classes (e.g., entropy-based, uncertainty-based, geometric) possess distinct error distributions. The authors posit that a unified framework capable of dynamically selecting or aggregating these diverse defense strategies could offer superior robustness for Natural Language Understanding (NLU) tasks compared to single-feature approaches.

Methodology

The paper proposes a Hybrid Adversarial Defence Framework that integrates three distinct expert models with a trainable routing mechanism. The architecture consists of:

Three Expert Defense Models:
- Entropy-Based Model: Motivated by Yao et al. (2023), this model detects adversarial inputs by monitoring the entropy of the first predicted token's softmax distribution. High entropy indicates uncertainty or adversarial perturbation, triggering a refusal to answer. Unlike universal thresholds, this implementation uses dataset-specific thresholds.
- Uncertainty-Based Model: Inspired by Zhang et al. (2024) and R-Tuning, this model is fine-tuned to recognize knowledge boundaries. It classifies inputs as "certain" (within the intersection of pre-trained and instruction-tuned knowledge) or "uncertain" (outside this intersection). During inference, it appends an uncertainty assessment prompt to generate a calibrated confidence score, allowing the model to refuse answers when unsure.
- Geometric-Based Model: Based on the PURE algorithm (Wang et al., 2025), this model enhances robustness by transforming the embedding space. It employs Principal Component Removal (PCR) via Singular Value Decomposition (SVD) to discard the top principal component, thereby eliminating dominant directions often exploited by adversaries. It utilizes randomized SVD for efficiency and mean pooling for sentence representation.
Aggregation Mechanisms:
The framework employs a Selector Network that routes inputs to the experts based on 31 extracted features (covering textual statistics, entropy, uncertainty, geometric properties, domain encoding, and cross-expert patterns). Two aggregation strategies are evaluated:
- ML Routing (Hard Selection): A feed-forward network selects a single expert ( $k \in \{rt, llm, pure\}$ ) per input instance.
- LWV Fusion (Soft Aggregation): A feed-forward network generates a probability distribution over experts, and the final prediction is a weighted sum of the experts' outputs.

Key Contributions

First Hybrid Framework: This work presents the first approach to combine entropy-based, uncertainty-based, and geometric-based features to select or aggregate adversarial defense models, bridging the gap between hallucination reduction and adversarial defense.
Comprehensive Evaluation: The study provides a rigorous analysis across:
- In-Domain NLU Tasks: FEVER, HotpotQA, CSQA, and SIQA.
- Out-of-Distribution (OOD) Tasks: AeroEngQA and CPIQA.
- Sequence-Based Attacks: Prompt injection (SafeGuard) and jailbreak attempts (AdvBench, DAN).
Open Source Release: The models and code are released to ensure reproducibility.

Results

In-Domain Performance

Clean Task Performance: The hybrid models significantly improved accuracy on clean data compared to the base LLaMa3-8B model. The ML Routing approach achieved the highest gains, with accuracy increases of up to 43.34% (e.g., on CSQA).
Adversarial Robustness: Under adversarial attacks (TextAttack framework), the hybrid models outperformed single-defense baselines (FreeLB, individual experts).
- Accuracy Improvement: Up to 64.92% improvement over baseline models.
- Attack Success Rate (ASR) Reduction: Up to 62.27% reduction in ASR.
- Comparison: ML Routing generally outperformed LWV Fusion, particularly when geometric features were strong, as hard selection prevented the dilution of informative features.

Out-of-Distribution (OOD) Performance

The hybrid model demonstrated strong generalization to OOD datasets (AeroEngQA, CPIQA).
Accuracy Improvement: Up to 57.14% improvement in accuracy under attack compared to baselines.
ASR Reduction: ML Routing reduced attack success rates to 33.00% on AeroEngQA and 25.89% on CPIQA.

Prompt Injection and Jailbreak Detection

Prompt Injection (SafeGuard): ML Routing achieved an 82.65% accuracy and a 90.38% refusal rate, significantly outperforming specialized baselines like ProtectAI v1 (which suffered from low recall) and NeMoGuard (low precision).
Jailbreaks (AdvBench, DAN): The hybrid model showed robust performance, reducing ASR by up to 51% compared to state-of-the-art baselines.
- On AdvBench, ML Routing achieved a 2.69% ASR.
- On DAN, NeMoGuard (specifically optimized for this dataset) performed best, but the hybrid model remained competitive.

Significance and Claims

The authors claim that combining entropy, uncertainty, and geometric features provides a more effective defense strategy than relying on any single feature alone. The hybrid approach is significant because:

It improves clean-task performance (reducing hallucinations) while simultaneously enhancing adversarial robustness.
It generalizes effectively across in-domain, out-of-distribution, and sequence-based attack scenarios.
It leverages complementary mechanisms: Entropy and uncertainty models allow for selective refusal (handling hallucinations and unknowns), while the geometric model transforms the representation space to resist perturbations without necessarily altering confidence scores.

The paper concludes that while the current framework uses a "black-box" router, the integration of these diverse features offers a robust, domain-invariant approach to securing LLMs. Future work is suggested to explore adaptive attacks against the hybrid pipeline and unified multi-head defense architectures.