---
title: "Adversarial Decoding — paper by Zhang et al. (2026)"
description: "They then propose adversarial decoding (AdvDec), which runs beam search guided by… 29 references, cited by 1 paper here."
authors: ["Collin Zhang", "Tingwei Zhang", "Vitaly Shmatikov"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: EACL 2026"
source: "https://aclanthology.org/2026.findings-eacl.108/"
doi: "10.18653/v1/2026.findings-eacl.108"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhang-2026-adversarial-decoding-generating-readable-documents/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhang-2026-adversarial-decoding-generating-readable-documents/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/9/) / Adversarial Decoding: Generating Readable Documents for Adversarial Objectives

# Adversarial Decoding: Generating Readable Documents for Adversarial Objectives

**Authors:** Collin Zhang, Tingwei Zhang and [Vitaly Shmatikov](https://md.research.elamur.ai/free/en/authors/vitaly-shmatikov/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: EACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-eacl.108/) · [PDF](https://aclanthology.org/2026.findings-eacl.108.pdf) · [DOI 10.18653/v1/2026.findings-eacl.108](https://doi.org/10.18653/v1/2026.findings-eacl.108) · [OpenAlex](https://openalex.org/W7140117835)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · [1](https://md.research.elamur.ai/free/en/papers/zhang-2026-adversarial-decoding-generating-readable-documents/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
LLM systems that process untrusted content can be attacked with crafted inputs. Existing generators of such inputs either output high-perplexity gibberish, as GCG does, or produce low-perplexity text that is still unnatural, as BEAST does. Both kinds are easy to filter. Gradient-based and oracle-based methods also struggle when objectives span models with different tokenizers or require embedding similarity to many queries.

The authors first show that a simple LLM-based check can flag "fluent" BEAST outputs. They then propose adversarial decoding (AdvDec), which runs beam search guided by objective-specific scorers. A soft readability score, derived from the logits of an open-source LLM, keeps the text natural. RAG attacks need only black-box access to the embedding encoder, and the defensive LLM is never queried.

A single AdvDec document can both get retrieved for whole classes of queries and steer the generated answer. AdvDec also handles jailbreaking and Llama Guard evasion, and its outputs pass readability filters. This matters because it shows that perplexity- or fluency-based filtering is not a reliable defense.

## Key points
- AdvDec is reported as the first method that both bypasses Llama-Guard-3-8B and actually jailbreaks the target model, Llama-3.1-8B-Instruct, as judged on HarmBench. Its overall success rate is 30%: 70% evasion and 35% jailbreak.
- Optimizing only for the guard yields 79% evasion but just 3.5% overall success. This reflects a "jailbreak tax," where evasive suffixes stop serving the harmful goal.
- In jailbreaking, AdvDec reaches 73.5% ASR on Llama and 66.5% on Qwen.
- Adversarial suffixes raise retrieval of misinformation documents for all three encoders tested:
  - contriever top-1 rises from 0.5% to 23.5%;
  - qwen top-10 rises from 18% to 48.5%;
  - gte top-10 rises from 18% to 42.5%.
- Settings were a beam width of 10 (30 for evasion), a document length of 30, and top-k of 10. The method requires logits access for jailbreaking and evasion, which limits its use against fully closed systems.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Cornell University](https://md.research.elamur.ai/free/en/universities/cornell-university/) — University, Ithaca, United States · 120 works · 59,940 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works

## Cite

Cite as: Collin Zhang, Tingwei Zhang and Vitaly Shmatikov. 2026. Adversarial Decoding: Generating Readable Documents for Adversarial Objectives. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhang2026adversarial,
  title = {{Adversarial Decoding: Generating Readable Documents for Adversarial Objectives}},
  author = {Collin Zhang, Tingwei Zhang and Vitaly Shmatikov},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.108},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.108}
}
```

- [← previous Addressing the Ecological Fallacy in Larger LMs with Human Context](https://md.research.elamur.ai/free/en/papers/soni-2026-addressing-ecological-fallacy-larger-lms/)
- [next → ADVICE: Answer-Dependent Verbalized Confidence Estimation](https://md.research.elamur.ai/free/en/papers/seo-2026-advice-answer-dependent-verbalized-confidence/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/9/)

## References

29 references, 16 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2024. Jailbreaking leading safety-aligned LLMs with simple adaptive attacks. arXiv preprint arXiv:2404.02151. [find](https://scholar.google.com/scholar?q=Maksym+Andriushchenko%2C+Francesco+Croce%2C+and+Nicolas+Flammarion%2E+2024%2E+Jailbreaking+leading+safety%2Daligned+LLMs+with+simple+adaptive+attacks%2E+arXiv+preprint+arXiv%3A2404%2E02151%2E)
2. Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, and 1 others. 2016. [MS MARCO: A human generated machine reading comprehension dataset](https://md.research.elamur.ai/free/en/papers/bajaj-2016-ms-marco-human-generated/). In Proceedings of the Workshop on Cognitive Computation: Integrating neu…
3. Francesco Barbieri, Jose Camacho-Collados, Luis Espinosa Anke, and Leonardo Neves. 2020. [TweetEval: Unified benchmark and comparative evaluation for tweet classification](https://md.research.elamur.ai/free/en/papers/barbieri-2020-tweeteval-unified-benchmark-comparative-evaluation/). In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 1644–1650.
4. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
5. Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485. [find](https://scholar.google.com/scholar?q=Harsh+Chaudhari%2C+Giorgio+Severi%2C+John+Abascal%2C+Matthew+Jagielski%2C+Christopher+A+Choquette%2DChoo%2C+Milad+Nasr%2C+Cristina+Nita%2DRotaru%2C+and+Alina+Oprea%2E+2024%2E+Phantom%3A+General+trigger+attacks+on+retrieval+a)
6. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others. 2024. [The Llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
7. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. [HotFlip: White-box adversarial examples for text classification](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/). In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Short Papers), pages 31–36.
8. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+and+1+others%2E+2024%2E+Gemma+2%3A+Impr)
9. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In AISec.
10. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024. COLD-Attack: Jailbreaking LLMs with stealthiness and controllability. In Proceedings of the International Conference on Machine Learning (ICML). [find](https://scholar.google.com/scholar?q=Xingang+Guo%2C+Fangxu+Yu%2C+Huan+Zhang%2C+Lianhui+Qin%2C+and+Bin+Hu%2E+2024%2E+COLD%2DAttack%3A+Jailbreaking+LLMs+with+stealthiness+and+controllability%2E+In+Proceedings+of+the+International+Conference+on+Machine+Learn)
11. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. [Llama Guard: LLM-based input-output safeguard for human-AI conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
12. Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. 2022. [Unsupervised dense information retrieval with contrastive learning](https://md.research.elamur.ai/free/en/papers/izacard-2021-unsupervised-dense-information-retrieval-contrastive/). Transactions on Machine Learning Research.
13. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
14. Zehan Li, Xin Zhang, Yanzhao Zhang, Dingkun Long, Pengjun Xie, and Meishan Zhang. 2023. [Towards general text embeddings with multi-stage contrastive learning](https://md.research.elamur.ai/free/en/papers/li-2023-towards-general-text-embeddings-multi/). arXiv preprint arXiv:2308.03281.
15. Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick Mc-Daniel, Huan Sun, Bo Li, and Chaowei Xiao. 2024. AutoDAN-Turbo: A lifelong agent for strategy self-exploration to jailbreak llms. arXiv preprint arXiv:2410.05295. — [arXiv:2410.05295](https://arxiv.org/abs/2410.05295) [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Peiran+Li%2C+Edward+Suh%2C+Yevgeniy+Vorobeychik%2C+Zhuoqing+Mao%2C+Somesh+Jha%2C+Patrick+Mc%2DDaniel%2C+Huan+Sun%2C+Bo+Li%2C+and+Chaowei+Xiao%2E+2024%2E+AutoDAN%2DTurbo%3A+A+lifelong+agent+for+strategy+self%2Dexplo)
16. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [AutoDAN: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
17. Quanyu Long, Yue Deng, LeiLei Gan, Wenya Wang, and Sinno Jialin Pan. 2024. Backdoor attacks on dense passage retrievers for disseminating misinformation. arXiv e-prints, pages arXiv–2402. [find](https://scholar.google.com/scholar?q=Quanyu+Long%2C+Yue+Deng%2C+LeiLei+Gan%2C+Wenya+Wang%2C+and+Sinno+Jialin+Pan%2E+2024%2E+Backdoor+attacks+on+dense+passage+retrievers+for+disseminating+misinformation%2E+arXiv+e%2Dprints%2C+pages+arXiv%E2%80%932402%2E)
18. Ximing Lu, Peter West, Rowan Zellers, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. 2021. [Neurologic decoding: (un)supervised neural text generation with predicate logic constraints](https://md.research.elamur.ai/free/en/papers/lu-2021-neurologic-decoding-un-supervised-neural/). In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Lingui…
19. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. [Harm-Bench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249.
20. John X Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. 2020. [Reevaluating adversarial examples in natural language](https://md.research.elamur.ai/free/en/papers/morris-2020-reevaluating-adversarial-examples-natural-language/). In Findings of the Association for Computational Linguistics: EMNLP, pages 3829–3839.
21. Niklas Muennighoff, Nouamane Tazi, Loïc Magne, and Nils Reimers. 2022. [MTEB: Massive text embedding benchmark](https://md.research.elamur.ai/free/en/papers/muennighoff-2022-mteb-massive-text-embedding-benchmark/). arXiv preprint arXiv:2210.07316.
22. Kristina Nikolić, Luze Sun, Jie Zhang, and Florian Tramèr. 2025. The jailbreak tax: How useful are your jailbreak outputs? Preprint, arXiv:2504.10694. — [arXiv:2504.10694](https://arxiv.org/abs/2504.10694) [find](https://scholar.google.com/scholar?q=Kristina+Nikolic%CC%81%2C+Luze+Sun%2C+Jie+Zhang%2C+and+Florian+Tram%C3%A8r%2E+2025%2E+The+jailbreak+tax%3A+How+useful+are+your+jailbreak+outputs%3F+Preprint%2C+arXiv%3A2504%2E10694%2E+%E2%80%94+%5BarXiv%3A2504%2E10694%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2504%2E)
23. Steven Peutz. 2023. Misinformation fake news text dataset 79k. [https://www.kaggle.com/datasets/stevenpeutz/](https://www.kaggle.com/datasets/stevenpeutz/) misinformation-fake-news-text-dataset-79k. Accessed: March 04, 2025. [↗](https://www.kaggle.com/datasets/stevenpeutz/)
24. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) arXiv preprint arXiv:2310.03693.
25. Lianhui Qin, Sean Welleck, Daniel Khashabi, and Yejin Choi. 2022. COLD decoding: Energy-based constrained text generation with Langevin dynamics. In Proceedings of 36th Conference on Neural Information Processing Systems (NeurIPS), pages 9538– 9551. [find](https://scholar.google.com/scholar?q=Lianhui+Qin%2C+Sean+Welleck%2C+Daniel+Khashabi%2C+and+Yejin+Choi%2E+2022%2E+COLD+decoding%3A+Energy%2Dbased+constrained+text+generation+with+Langevin+dynamics%2E+In+Proceedings+of+36th+Conference+on+Neural+Informatio)
26. Vinu Sankar Sadasivan, Shoumik Saha, Gaurang Sriramanan, Priyatham Kattakinda, Atoosa Chegini, and Soheil Feizi. 2024. Fast adversarial attacks on language models in one GPU minute. In Proceedings of the International Conference on Machine Learning (ICML). [find](https://scholar.google.com/scholar?q=Vinu+Sankar+Sadasivan%2C+Shoumik+Saha%2C+Gaurang+Sriramanan%2C+Priyatham+Kattakinda%2C+Atoosa+Chegini%2C+and+Soheil+Feizi%2E+2024%2E+Fast+adversarial+attacks+on+language+models+in+one+GPU+minute%2E+In+Proceedings+of+)
27. Avital Shafran, Roei Schuster, and Vitaly Shmatikov. 2025. Machine against the RAG: Jamming retrieval-augmented generation with blocker documents. In USENIX Security. [find](https://scholar.google.com/scholar?q=Avital+Shafran%2C+Roei+Schuster%2C+and+Vitaly+Shmatikov%2E+2025%2E+Machine+against+the+RAG%3A+Jamming+retrieval%2Daugmented+generation+with+blocker+documents%2E+In+USENIX+Security%2E)
28. Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2024. Certifiably robust RAG against retrieval corruption. arXiv preprint arXiv:2405.15556. [find](https://scholar.google.com/scholar?q=Chong+Xiang%2C+Tong+Wu%2C+Zexuan+Zhong%2C+David+Wagner%2C+Danqi+Chen%2C+and+Prateek+Mittal%2E+2024%2E+Certifiably+robust+RAG+against+retrieval+corruption%2E+arXiv+preprint+arXiv%3A2405%2E15556%2E)
29. Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. BadRAG: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083. — [arXiv:2406.00083](https://arxiv.org/abs/2406.00083) [find](https://scholar.google.com/scholar?q=Jiaqi+Xue%2C+Mengxin+Zheng%2C+Yebowen+Hu%2C+Fei+Liu%2C+Xun+Chen%2C+and+Qian+Lou%2E+2024%2E+BadRAG%3A+Identifying+vulnerabilities+in+retrieval+augmented+generation+of+large+language+models%2E+arXiv+preprint+arXiv%3A2406%2E0)

*Updated 1 November 2026*