Causal value of request matching

Determine the causal value of conditioning generated attack prefixes on the victim request for degrading benign task utility, relative to matched controls that alter request–prefix assignment while holding the learned generator fixed.

Background

ENDOPROMPT generates a prefix from the request text, but the reported experiments do not establish that request conditioning itself improves degradation. The paper distinguishes retraining ablations, which modify the training signal, from fixed-generator controls, which modify only the assignment between requests and prefixes.

The matched-minus-shuffled and matched-minus-empty controls produce confidence intervals overlapping zero, so the experiments leave unresolved whether request matching has a causal advantage for utility degradation. The authors note that an unconditional-generator comparison is needed to isolate this effect.