This is a model adapter for
meta-llama/Meta-Llama-3-8B-Instruct, fine-tuned using the MixAT+GCG method. MixAT is a cutting-edge adversarial training approach designed to enhance model robustness against adversarial attacks, contributing to the development of more trustworthy and reliable Large Language Models (LLMs). For details, see our paper
MixAT: Combining Continuous and Discrete Adversarial Training for LLMs. Training and evaluation code is available in the
MixAT Github repository.
Then, load the base model (4bit quantized) using transformers and apply the adapter using peft:
1from peft import PeftModel
2from transformers import AutoModelForCausalLM, BitsAndBytesConfig
3import torch
4
5bnb_config = BitsAndBytesConfig(
6 load_in_4bit=True,
7 bnb_4bit_use_double_quant=False,
8 bnb_4bit_quant_type="nf4",
9 bnb_4bit_compute_dtype="bfloat16"
10)
11
12base_model = AutoModelForCausalLM.from_pretrained(
13 "meta-llama/Meta-Llama-3-8B-Instruct",
14 torch_dtype=torch.bfloat16,
15 device_map="auto",
16 quantization_config=bnb_config
17)
18
19model = PeftModel.from_pretrained(base_model, "INSAIT-Institute/Llama3-8B-MixAT-GCG")
MixAT has been evaluated against a broad range of state-of-the-art adversarial attacks, introducing the At Least One Attack Success Rate (ALO-ASR) metric to assess worst-case model vulnerability. Our results show that MixAT achieves significantly improved robustness (ALO-ASR < 20%) compared to prior defenses (ALO-ASR > 50%), while maintaining good utility scores and a runtime comparable to continuous relaxation-based methods.
1@article{dekany2025mixat,
2 title={MixAT: Combining Continuous and Discrete Adversarial Training for LLMs},
3 author={D{\'e}k{\'a}ny, Csaba and Balauca, Stefan and Staab, Robin and Dimitrov, Dimitar I and Vechev, Martin},
4 journal={arXiv preprint arXiv:2505.16947},
5 year={2025}
6}
