Ai Security, Llm, Jailbreak, Adversarial Attack, Trustworthy Ai.
to solve this problem. However, since the output is also part of the optimization, the gradient behavior changes. If we approximate based on a single gradient, it only captures information about how likely subsequent tokens are generated from o_i, but ignores how o_i​ is generated from previous