{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.31558", "title": "Diffusion Language Models for Perplexity-Aware Black-Box Attacks", "summary": "The method replaces the random Gaussian-to-text mapping with nearest-token lookup in continuous-space black-box attacks by coupling the same standard-Gaussian latent framework to a learned continuous diffusion language model, producing natural-looking adversarial prompts. It costs the training or deployment of a diffusion language model plus the existing sampling/optimization loop, which exceeds a trivial guardrail-testing budget and adds a generative component whose quality bounds attack realism. It can fail because perplexity-based undetectability does not guarantee prompts survive semantic or classifier-based input guardrails, risk estimates remain sensitive to the chosen mapping, and the approach was validated only on overthinking-style triggers (RareTrap, ThinkTrap), not general malicious behaviors.", "rationale": "This is offensive red-teaming methodology whose main actionable lesson for a constrained production team is that perplexity-based input guardrails can be bypassed by low-perplexity generated attacks, so it merits monitoring rather than adoption.", "technique": "Diffusion-LM latent space for natural black-box adversarial prompts", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-22", "as_of": "2026-10-23", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.31558", "independent_implementations": 0, "total_implementations": 1, "stars": 0, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces the random Gaussian-to-text mapping with nearest-token lookup in continuous-space black-box attacks by coupling the same standard-Gaussian latent framework to a learned continuous diffusion language model, producing natural-looking adversarial prompts. It costs the training or deployment of a diffusion language model plus the existing sampling/optimization loop, which exceeds a trivial guardrail-testing budget and adds a generative component whose quality bounds attack realism. It can fail because perplexity-based undetectability does not guarantee prompts survive semantic or classifier-based input guardrails, risk estimates remain sensitive to the chosen mapping, and the approach was validated only on overthinking-style triggers (RareTrap, ThinkTrap), not general malicious behaviors.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.31558", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Character-level perplexity of generated attack prompts drops from 10^3–10^7 to 3–5 (RareTrap) and from 20–28 to 4.3–5.4 (ThinkTrap), and model risk estimates can differ by an order of magnitude between the two latent mappings.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.31558", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }