New Detector CPD Identifies Fluent Adversarial Prompts in LLMs via Entropy Changes

A team of researchers has rolled out CPD Online, a new tool designed to spot optimization-based adversarial suffixes in large language models (LLMs). Unlike older methods that rely on static or windowed perplexity, CPD treats detection as an online change-point problem by examining token-level next-token entropy streams. It uses the LLM system prompt to create a solid baseline, normalizes user-token entropies, and applies a one-sided CUSUM statistic. CPD is adaptable, doesn’t need prior training, and works in real-time to detect adversarial suffixes. In tests with 1,012 optimization-based suffix attacks and the same number of benign prompts, CPD surpassed the traditional windowed-perplexity method, achieving an AUROC of 0.88 on LLaMA-2-7B.