PaperlayerView exact revision on arXiv

Source-linked AI summary

DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Vision

Yifan Lan, Zhongye Liu, Yurui Chang, Hanyu Wang, Yongkang Du, Lu Lin, Jinghui Chen

arXiv:2610.19118v1cs.CL

TL;DR

Decision models can make structured choices from inputs that are vulnerable to adversarial manipulation, and clean-input accuracy alone does not establish reliability. DecisionRobust benchmarks text and vision attacks with validity checks and cross-model evaluation. Its results show vulnerabilities beyond selection models, variable robustness across tasks and threats, and substantial reductions in measured attack success after label-consistency checks.

  • Problem

    Decision models rely on potentially attacker-controlled requests and observations, so clean-input accuracy alone does not establish reliability under manipulation.

    Source: §1 · p. 1

  • Method

    DecisionRobust evaluates application-grounded text and image tasks under diverse attacks, using validity checks and cross-model candidate selection.

    Source: §1 · pp. 1–2

  • Results

    Attacks expose vulnerabilities beyond selection models, robustness varies across tasks and attack types, and label-consistency checks substantially reduce measured attack success.

    Source: §1 · p. 2, §5 · p. 8

  • Takeaways & Limitations

    Prediction changes alone can overstate attack effectiveness, so DecisionRobust pairs attack evaluation with checks of attack validity across tasks, threats, and models.

    Source: §5 · p. 8

    The benchmark evaluates individual decisions rather than downstream effects in complete workflows.

    Source: Limitations · p. 8

Abstract

from arXiv · show

Emerging decision models such as JEV provide typed interfaces that map task instructions and observations directly to choices, judgments, and scores. As these models are increasingly used for automated decision-making, understanding their reliability under adversarial manipulation becomes critical. We introduce DecisionRobust, a benchmark for systematically evaluating the robustness of decision models across textual and visual inputs. Our benchmark covers practical decision-making scenarios and a diverse suite of attacks, including semantics-preserving text perturbations, image perturbations, and prompt injection in both modalities. We curate evaluation sets through external validity checks and cross-model candidate selection. We evaluate 30 model configurations on text tasks and 17 on vision tasks, including 24 and 12 held-out models, respectively, that are excluded from candidate selection. Our experiments reveal several key findings. First, attacks expose vulnerabilities beyond the models used for construction and selection, although optimized image perturbations transfer weakly to many targets even with multiple surrogates. Second, relative model robustness varies across tasks and attack types, and resistance to input perturbations does not necessarily imply resistance to prompt injection. Third, label-consistency checks substantially reduce measured attack success across text and image settings, highlighting the importance of validating apparent failures. The benchmark is available at https://yifan-lan.github.io/DecisionRobust/.

1 Introduction

Decision models make structured choices from instructions and observations, but those inputs can be manipulated in ways that clean-input accuracy does not capture. DecisionRobust evaluates attacks across practical text and image tasks, with checks intended to distinguish valid attacks from apparent failures.

1 Introduction

  • Attacker-controlled requests, retrieved content, tool outputs, or images can change a decision even when the response satisfies its output schema.A meaning-preserving edit can change tool selection, while an instruction in retrieved content can redirect a decision to an attacker-chosen label.Source: §1 · p. 1
  • DecisionRobust covers practical decision tasks and tests 10 text-based and 7 image-based attack strategies, including perturbations and prompt injection.Its evaluation retains native task interfaces and task-specific correctness criteria; Table 1 summarizes task coverage and representative sources.Source: §1 · p. 1, Table 1 · p. 2
  • DecisionRobust checks attack validity and selects candidates for cross-model evaluation, including models excluded from selection.External label-consistency, semantic, and visual-readability checks apply as appropriate; the benchmark also analyzes adversarial robustness and transfer.Source: §1 · pp. 1–2
  • Attacks expose vulnerabilities beyond selection models, optimized image perturbations transfer weakly to many targets, and robustness varies across tasks and attack types.Resistance to input perturbations need not extend to prompt injection; label-consistency checks substantially reduce measured attack success in both modalities.Source: §1 · p. 2

2 DecisionRobust

DecisionRobust builds application-grounded text and image tasks, defines attacks against clean-correct decisions, and constructs and curates candidates through validation and selection. Its design covers multiple attack strategies while distinguishing validity checks across perturbations and injection settings.

2.1 Task Coverage and Sources

  • Tasks draw on practical applications and established datasets, retain native Choice, Noul, and Score formats, and span text, serialized observations, and images.The benchmark adapts screenshot grounding to marked-element selection and renders FinQA tables as images; SST-2 and MMLU provide language diagnostics.Source: §2.1 · p. 2

2.2 Threat Model

  • Attacks target clean-correct decisions: perturbations seek any error, while injection targets a predefined incorrect answer.Text and sensor attacks alter designated observations under constraints; image perturbations retain the text request, while instruction injection assumes access to the task prompt.Source: §2.2 · p. 2

2.3.1 Text Attack Construction

  • Text attacks edit designated fields using character-, word-, sentence-, or sensor-level perturbations, while injection appends payloads to observations or question instructions.Injection uses four templates and a fixed incorrect target per question; sensor attacks update linked summaries consistently.Source: §2.3.1 · p. 3

2.3.2 Image Attack Construction

  • Image attacks combine five common corruptions at five severities, optimized perturbations, and prompt injection in images or question instructions.Optimized attacks use three surrogate models, momentum updates for 200 steps, and an ℓ∞ budget of 8/255; in-image injection uses 12 settings per template.Source: §2.3.2 · p. 3

2.3 Data Construction

  • Figure 1 summarizes construction, validation, and curation, with label-consistency checks applied to perturbations and in-image injection but not other injection settings.Transfer-based selection precedes semantic review of text edits or readability review of common image perturbations.Source: Figure 1 · p. 4

2.3.3 Data Validation and Curation

  • Curation checks label consistency where applicable, selects candidates for cross-model effects while balancing task coverage, then reviews text semantics or image readability.Text edits receive human review after semantic screening; a full version will include candidates retained after applicable label checks but before transfer selection and subsequent review.Source: §2.3.3 · pp. 3–4

3 Experiments

Curated attacks transfer to held-out text and vision models, but robustness varies by task and attack type. Label-consistency checks reduce measured attack success, while optimized image perturbations transfer unevenly.

3.1 Experimental Setup

  • ASR uses model-specific clean-correct samples with valid attack responses; sample-level ASR counts success by any candidate, while candidate-level ASR counts each variant.For label-consistent ASR, a successful candidate must pass the label check without changing the denominator; injection target ASR counts matches to the predefined target.Source: §3.1 · p. 4

3.2.1 Perturbation Attacks

  • Jev-built perturbations transfer to other models, but checked ASR generally falls; transfer targets fall to single digits on Arm Noul.OpenJEV ranks highest among transfer targets on PromptShield Noul but lowest on MMLU Noul, and most raw NevIR and Siim successes fail label checks.Source: §3.2.1 · p. 5
  • On Jev, combined attacks exceed clean reruns in raw ASR and paraphrasing in checked ASR across all 16 source groups.The pool covers 1,332 samples in 16 source groups before selection and semantic review.Source: §3.2.1 · pp. 4–5

3.2.2 Prompt Injection

  • No text-injection template dominates: repetition is strongest on KEV and Bosun, while Jev and OpenJEV respond most to different templates by location.Observation injection has higher flip and target ASR on Jev, KEV, AutoTrust, and Bosun; OpenJEV and Liquid D1 show the reverse, and target ASR is always below flip ASR.Source: §3.2.2 · p. 5

3.2.3 Curated-set Evaluation

  • All held-out text models incur errors; GLiNER2.5-Decide-340M has the lowest perturbation ASR (11.4%) but 55.3% injection target ASR.This illustrates that robustness to perturbations need not extend to injection.Source: §3.2.3 · p. 6, Figure 2 · p. 6

3.3.1 Image Perturbations

  • Label checks reduce common image-perturbation ASR on every dataset and model, while StandardOne-8B has the highest checked ASR on four datasets but the lowest on FinQA.The variation shows that aggregate ASR can hide task-specific robustness.Source: §3.3.1 · p. 6, Table 5 · p. 7
  • Three-surrogate optimized image perturbations transfer unevenly: OneJev-4B is most susceptible overall, while none of four targets is fooled on Geometry3K.StandardOne-3B and NeoHorse-Jev-4B have higher checked ASR on Multimodal-Mind2Web than the other targets.Source: §3.3.1 · p. 6, Table 6 · p. 7

3.3.3 Curated-set Evaluation

  • All three curated vision sets transfer beyond selection models, though image perturbation ASR is low on several held-out models and the stronger injection location varies by model.Strands Decider-2B has the highest held-out perturbation ASR (31.8%) and in-image target ASR (81.2%); Perplexity Decider v1.1-27B has the lowest perturbation ASR (3.2%) yet 45.7% instruction-injection target ASR.Source: §3.3.3 · p. 7

4 Related Work

Related work covers decision-model interfaces and benchmarks, alongside research on adversarial perturbations and prompt injection. This paper evaluates task-label correctness under textual and visual attacks and tests transfer to models excluded from candidate selection.

4.1 Decision Models and Benchmarks

  • Jev accepts instructions, options, or scoring rubrics at inference time and returns choices, truth probabilities, and scores, unlike BERT classifiers with task-specific output layers and fixed labels.WorkflowEvals examines application workflows, Deußer et al. (2026) study accuracy and calibration, and JevAdvBench measures adversarial changes relative to clean decisions and identical-request rerun variation.Source: §4.1 · pp. 7–8

4.2 Robustness and Prompt Injection

  • Prior work studies adversarial text and image perturbations, prompt robustness, and malicious instructions in external content and tool workflows.AdvGLUE and RobustBench evaluate text and image perturbations, respectively; PromptRobust assesses LLM robustness to adversarial prompt perturbations.Source: §4.2 · p. 8

5 Conclusion

DecisionRobust evaluates decision models under text and image perturbations and prompt injection in application tasks. Its findings show vulnerabilities beyond selected models, variable robustness, and the value of checking attack validity.

5 Conclusion

  • Attacks expose vulnerabilities beyond construction and selection models, while optimized image perturbations transfer unevenly.Performance in one setting does not establish broader resistance.Source: §5 · p. 8
  • Robustness varies across tasks and attack types, so resistance in one setting does not establish broader resistance.Source: §5 · p. 8
  • Label checks exclude many apparent attack successes, underscoring the need to verify attack validity.DecisionRobust combines these checks with evaluation across tasks, threats, and models.Source: §5 · p. 8

Limitations

The benchmark evaluates individual decisions rather than downstream effects in complete workflows, and its attack coverage is constrained by computational limits.

Limitations

  • The benchmark tests individual decisions, not their downstream effects in complete workflows.Source: Limitations · p. 8
  • Optimized image perturbations have limited transfer to some held-out models, and multiple surrogates do not ensure broad transfer.Source: Limitations · p. 8
  • Computational constraints limit evaluated attack methods and configurations, as well as coverage across tasks.The authors suggest exploring more transferable image attacks and extending the attack suite.Source: Limitations · p. 8

A.1 Text Perturbations and Baselines

Text attack results show that label checking changes measured success, while different methods expose partly distinct failures and vary in query cost. The appendix also describes baseline and candidate-evaluation procedures.

A.1 Text Perturbations and Baselines

  • Repeat@8 reruns unchanged requests eight times, while Paraphrase@4 makes four independent paraphrase attempts without reference answers or Jev feedback.Both use sample-level aggregation over fixed attempts, and rejected paraphrases consume an attempt without replacement.Source: §A.1 · p. 12
  • Table A1 combines attack successes across methods on 16 text source groups, with some methods omitted for computational reasons.Sensor contributes six variants per Arm input and three per FSD input; most methods generate one final candidate per sample.Source: §A.1 · p. 12
  • Combined attacks exceed paraphrasing in label-consistent ASR in every source group, while repeated-request failures remain below combined raw ASR.Source: §A.1 · p. 12
  • Charmer leads raw and label-consistent ASR on all four groups covered by eight text-editing methods, but has the highest average query cost.Combining methods further increases label-consistent ASR; Charmer's advantage comes with substantially greater search cost.Source: §A.1 · p. 12
  • Raw ASR can overstate errors on inputs retaining the reference label, and label checking can reverse method rankings.On Arm, TextFooler has higher raw ASR than DeepWordBug but substantially lower label-consistent ASR.Source: §A.1 · p. 12
  • Sensor uses six candidate evaluations per Arm sample and three per FSD sample, while text injection tests up to eight candidates per sample.These evaluation counts are separate from adaptive search queries in Table A2.Source: §A.1 · p. 12

A.2 Transfer by Perturbation Method

A transfer analysis compares attack methods on identical candidates across six models. Charmer's lead shrinks in transfer, and construction-model effectiveness does not fully predict effects on other models.

A.2 Transfer by Perturbation Method

  • All six models receive the same 3,932 label-checked candidates without further optimization.The candidates are a subset of the full pool reported in Table 3.Source: §A.2 · p. 12
  • Charmer has the highest ASR on every model, but its advantage is much smaller in transfer.SCPN and StressTest have higher ASR on Bosun than on Jev.Source: §A.2 · p. 12

A.3 Prompt Injection by Dataset

Prompt-injection outcomes vary by dataset and model, common image perturbations differ in disruption, and optimized image attacks transfer unevenly to held-out targets. The appendix also reports construction-pool and search-cost scopes.

A.3 Prompt Injection by Dataset

  • Table A4 breaks down the construction pool by dataset and decision format, combining four templates and separately tested locations.The final three table rows summarize results by location across datasets and formats.Source: §A.3 · p. 12
  • OpenJEV has the highest overall target ASR and KEV the lowest, but task patterns vary; Score tasks show a pronounced gap between flip and target ASR.OpenJEV and AutoTrust are frequently redirected on SST-2, MMLU, and BFCL, while KEV has low target ASR on SST-2 and BFCL.Source: §A.3 · p. 12
  • Table A1 reports raw and label-consistent sample-level ASR across 16 text source groups before transfer selection and final semantic review.Combined includes attacks only; Repeat@8 reports raw errors on unchanged inputs.Source: Table A1 · p. 13
  • Table A2 measures mean Jev search queries per clean-correct sample on four datasets shared by all eight text-editing methods.Counts include cache reuse and measure request evaluations, not billable calls or total computation.Source: Table A2 · p. 13

A.4 Common Image Perturbations

  • Defocus blur remains the most disruptive common image perturbation after label checks, while combining perturbation types raises label-consistent ASR on all five models.Resolution reduction ranks second by raw ASR on every model but falls below Gaussian noise on Jev-Omni and StandardOne-8B after label checks.Source: §A.4 · p. 13

A.5 Optimized Image Perturbation Transfer

  • Table A3 covers sample-level ASR on the externally checked pool before transfer-based selection and final semantic review.Its denominators include only samples with eligible candidates in the pool.Source: Table A3 · p. 13
  • Label-consistent ASR stays below 10% on seven of ten targets, and transfer is strongest on OneJev-4B and Strands Decider-2B.The same 160 exported image pairs in Choice format were evaluated on all ten targets outside the surrogate ensemble.Source: §A.5 · p. 13

B.1 Text Perturbations

Across the evaluated text and image sets, attacks reduce performance, but their effects depend on decision format, model, dataset, and attack type. Case studies illustrate both changed decisions and confidence declines when predictions remain unchanged.

B.1 Text Perturbations

  • Switching decision formats reduces text-perturbation ASR in both directions but leaves nonzero errors; candidate pools differ, so directional gaps do not rank intrinsic format robustness.PromptShield shows the largest reduction in either direction and SST-2 the smallest; source-format label checks do not establish destination-format consistency.Source: §B.1 · pp. 14–15

B.2 Optimized Image Perturbations

  • Noul ASR is highest on Imajev-4B and Jev-Omni but much lower on ensemble member Visual-Jev-4B; transfer is stronger to OneJev-4B than StandardOne-8B.Dataset effects vary: Visual-Jev-4B is most affected on FinQA, while OneJev-4B is most affected on ImajevBench.Source: §B.2 · p. 15

C Clean and Adversarial Performance

  • The clean–adversarial comparison pairs each candidate on both sides; reference-answer probability change is reported as ∆p = adversarial minus clean, in percentage points.Accuracy includes all valid pairs, while probability statistics use paired outputs with recorded probabilities; Score samples contribute only to accuracy.Source: C Clean and Adversarial Performance · p. 15

C.1 Text / C.2 Image

  • Text accuracy and reference-answer probability decline for every evaluated model, while image probability declines throughout and image accuracy nearly always declines.For image perturbations, GEV-26B has a small net accuracy gain despite a slight probability decline; injection probability drops most for Visual-Jev-4B in-image and Jev-Omni on instruction injection.Source: §C.1 · p. 15, §C.2 · p. 15

D.1 A Single-Character Perturbation

  • A single-character edit changes the prediction to positive for Jev, KEV, Bosun, Liquid D1, and held-out NeoHorse-4B, while AutoTrust, OpenJEV, and Vega-27B stay correct.The reference label remains negative.Source: §D.1 · p. 18

D.2 Redirecting Tool Selection

  • In tool selection, Jev, AutoTrust, OpenJEV, and Liquid D1 follow the injected target, while KEV, Bosun, NeoHorse-4B, and Vega-27B retain the reference function.OpenJEV and AutoTrust were correct on the preceding character edit, whereas NeoHorse-4B showed the reverse pattern.Source: §D.2 · p. 18

D.3 In-Image Instructions on a Financial Table

  • On the financial-table injection, OneJev-4B, StandardOne-8B, and held-out NeoHorse-4B switch to target 6891.39, while Jev-Omni flips to a different incorrect answer.Imajev-4B and GEV-26B remain correct.Source: §D.3 · p. 18

D.4 Blur in a Parcel-Eligibility Decision

  • Under parcel-label blur, two models change the correct count from 1 to 0, while OneJev-4B stays correct as its reference-answer probability falls from 98.7% to 68.5%.The two prediction changes occur on Imajev-4B and Visual-Jev-4B.Source: §D.4 · p. 18

E Implementation Details

The implementation constructs attacks at several text granularities and through image overlays or appended instructions, then evaluates a held-out model set. Examples and tables document the attack variants and case-study predictions.

E.1 Attack Construction Details

  • Text perturbations are restricted to editable task fields and span character-, word-, and sentence-level edits, with Jev feedback guiding candidate search.Methods include DeepWordBug, Charmer, TextFooler, SememePSO, SCPN, PromptAttack variants, and StressTest.Source: §E.1 · pp. 18–19
  • The FinQA injection example contrasts the correct three-year average, 7657.1, with the overlaid target 6891.39.The table’s three yearly net-sales values support the stated average.Source: Figure 4 · p. 19
  • The parcel example’s 0.7 kg limit admits the 0.5 kg parcel but not the 4.9 kg parcel.The figure shows the clean and evaluated adversarial images with enlarged parcel labels.Source: Figure 5 · p. 19
  • Sensor perturbations alter numerical observations within field-specific bounds or designated categorical fields, update linked summaries consistently, and are checked against the reference decision.These edits are among the numerical and sensor perturbations described in the construction procedure.Source: §E.1 · pp. 19–20
  • Table A11 reports case-study predictions and reference-answer probabilities; displayed models answer clean inputs correctly, and held-out models are marked.FinQA predictions are shown as answer values rather than option IDs.Source: Table A11 · p. 20
  • In-image injection varies four overlay positions and three nominal font sizes per template, while instruction injection appends the same payload after two newlines and retains the clean image.The image dimensions and accompanying question remain unchanged for in-image injection.Source: §E.1 · p. 20

E.2 Held-out Text Models

  • The held-out evaluation set includes models and configurations such as Vega-27B, NeoHorse-Jev-4B, GEV-26B, OneJev, and StandardOne variants.The listed held-out models also include Mica-4B, Strands Decider 2B, KEV-27B, and others.Source: §E.2 · pp. 20–21

E.1 Attack Construction Details

  • Figure 6 contrasts Gaussian noise, an optimized perturbation, in-image injection, and instruction injection using specified severity, budget, template, placement, and payload settings.The optimized perturbation uses ϵ = 8/255; the instruction injection appends the same payload used in the image overlay.Source: Figure 6 · p. 21

Related papers

Loading 2610.19118v1…