Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations

What it is

A PhD thesis (Maloyan, advisor Namiot, arXiv 2610.02432v2, cs.CR) that bundles attacks and defenses for LLM-as-a-Judge, trojan detection and MCP agents. The page text available here is the abstract, the table of contents and the start of the introduction. The chapter-level methods and experiments are not in it, so the numbers below are the thesis's own headline claims.

Findings beyond the summary

• Committee defense for judges. Committees of 5-7 heterogeneous models cut ASR on Gemma-3-4B by 47-55 percentage points. With 7 models, ASR falls from 73.8% to 19.3%.
• Why committees work here. The Condorcet jury argument needs independent errors and members above 0.5 accuracy. Gemma-3-4B does not meet that condition, so the thesis attributes the gain to heterogeneity of the committee, not to voting math.
• Attack transfer. ASA transfers between open models at a 62.6% transfer success rate, so a black-box attacker does not need access to your exact judge.
• Layered filtering. Multi-layer defense reduces ASR from 90% to 15-25% (SaTML CTF 2024 setting). The thesis groups the bypasses of such stacks into four classes, but the page does not name them.
• Trojan detection asymmetry. On TDC2023 (Pythia-1.4B), surrogate triggers reach REASR of about 0.99. Recall of the true triggers is about 0.17 against a baseline of about 0.14. Behavioral detection can therefore look successful while the real trigger remains unrecovered.
• MCP. AttestMCP attests tool calls with HMAC-protected packets at under 0.1 ms overhead per call. Together with the Commit Boundary pattern it lowers average ASR on MCPBench (847 scenarios) from 53.7% to 12.4%.
• Theory. For localized attacks and a deterministic decision operator, vulnerability is bounded by non-robustness: V(h) ≤ 1 − R_class(h). For non-localized attacks the thesis offers only an empirical calibrated model.

What to do

• If you use an LLM judge for evals or gating, test it with black-box injection, not only static prompts. Consider a heterogeneous committee: different model families, not copies of one model.
• Do not rely on trigger reverse-engineering success (REASR) as evidence that a backdoor was found. Check recall against the true trigger.
• For MCP agents, the design to evaluate is HMAC attestation of tool calls plus a commit boundary. The cost is negligible at the stated overhead.
• JudgeGuard, TrojanArmor and MCPSec are described as "registered software suites". The page gives no repository or install instructions, so availability needs checking.

Caveats

• The results are the author's own, and the page does not say whether they have been independently reproduced.
• The committee numbers are for Gemma-3-4B as the judge. The page does not show that they generalize.
• The MCPBench result is an average across scenarios, and the page does not describe the attacker model. JudgeGuard is said to be deployed at Viasat, but no production results appear in the available text.
• The AttestMCP and Commit Boundary mechanisms are not detailed in the fetched portion (the text cuts off in the introduction).