REALISTA: Realistic Latent Adversarial Attack

• REALISTA is a framework that formulates hallucination elicitation as a constrained optimization problem in latent space while preserving semantic coherence.
• It utilizes an input-dependent dictionary of valid latent editing directions combined with a simplex constraint to maintain semantic equivalence during attack generation.
• Experimental results show REALISTA achieving higher attack success rates with minimal semantic errors compared to baseline approaches on multiple language models.

REALISTA, short for Realistic Latent Adversarial Attack, is a framework for eliciting hallucinations from LLMs by casting prompt manipulation as a constrained optimization problem in continuous latent space. The central objective is not merely to induce failure, but to do so with adversarial prompts that remain semantically equivalent and coherent relative to the original benign prompt. REALISTA accomplishes this by constructing an input-dependent dictionary of valid latent editing directions, each derived from a semantically equivalent rephrasing, and then optimizing continuous combinations of those directions under a simplex constraint. In this sense, it occupies an intermediate position between discrete rephrasing attacks, which preserve semantic realism but search a sparse space, and unconstrained latent perturbations, which offer richer optimization but often decode into invalid prompts (Liang et al., 12 May 2026).

1. Problem formulation

REALISTA formalizes hallucination elicitation as constrained optimization over prompts. Let the benign user prompt be $$\mathbf{x}_0 \in \mathcal{X} \subseteq \mathbb{R}^{L\times V}$$, where $L$ is the token length and $V$ is the vocabulary size after tokenization. The target LLM is denoted $f_{\mathcal{T}(\cdot)}$, producing a response $\mathbf{y}$. A hallucination objective $\mathcal{L}_{\mathrm{hall}}$ is defined so that it is low when the model hallucinates with respect to a desired target response $\mathbf{y}^*$ (Liang et al., 12 May 2026).

The attack seeks an adversarial prompt $\mathbf{x}$ minimizing the hallucination loss while satisfying two constraints: semantic equivalence to $\mathbf{x}_0$, and semantic coherence or fluency. This is written as

$$\begin{aligned} \min_{\mathbf{x}}\quad & \mathcal{L}_{\mathrm{hall}} \ \mathrm{s.t.}\quad & d(\mathbf{x},\mathbf{x}_0)\le \varepsilon,\quad \mathbf{x}\in \mathcal{X}_\mathrm{val}. \end{aligned}$$

Here, $L$0 enforces semantic equivalence, while $L$1 denotes the set of semantically coherent prompts. The framework is explicitly motivated by the limitations of direct discrete search over $L$2, which is constrained by the sparsity of candidate rephrasings.

A plausible implication is that REALISTA treats “realism” as a semantic constraint on attack generation rather than as perceptual realism in the sense used by LiDAR or image realness metrics. That distinction matters because the optimization target is hallucination elicitation under preserved prompt meaning, not the assessment of sensory fidelity.

2. Latent parameterization and edit dictionary

Instead of optimizing directly in the discrete prompt space, REALISTA introduces an encoder–decoder parameterization. An encoder $L$3 maps a prompt to latent activations, with $L$4, and a decoder $L$5 reconstructs a fluent prompt from latent activations (Liang et al., 12 May 2026).

The key structural assumption is that semantically equivalent edits form a low-dimensional subspace spanned by interpretable latent “concept” directions. REALISTA therefore constructs an input-dependent dictionary

$L$6

where each column is a latent difference between the original prompt and a semantically equivalent rephrasing: $L$7 The adversarial latent is then parameterized as

$L$8

with nonnegative coefficients $L$9. Decoding yields the adversarial prompt

$V$0

To limit total editing strength, REALISTA constrains $V$1 to the scaled simplex

$V$2

Under this change of variables, the attack becomes

$V$3

The paper characterizes this parameterization as factoring semantic realism into the dictionary and simplex constraint, while delegating the hallucination objective to the response generated by the target model.

3. Dictionary construction and semantic validity

The input-dependent dictionary is required to satisfy three desiderata: relevance, meaning each concept is related to $V$4; validity, meaning each rephrasing is semantically equivalent and coherent; and diversity, meaning the retained directions cover a broad range of valid transformations (Liang et al., 12 May 2026).

Construction proceeds in two stages. First, candidate generation proposes $V$5 rephrasings $V$6 using WordNet synonyms, paraphrase LLM calls, or syntactic transformations. Second, concept optimization solves a convex optimization problem over selection weights $V$7. The objective encourages high relevance through cosine similarity in latent space to $V$8, semantic equivalence via cross-entropy loss between LLM explanation scores, and diversity via a log-determinant penalty: $V$9 where

$f_{\mathcal{T}(\cdot)}$0

After solving this problem via projected gradient descent, REALISTA selects the top-$f_{\mathcal{T}(\cdot)}$1 rephrasings with largest $f_{\mathcal{T}(\cdot)}$2 and computes their latent differences $f_{\mathcal{T}(\cdot)}$3. Each direction is then validated for semantic equivalence and fluency by an instructed LLM checker, and only directions passing that test are retained. This design embeds semantic safeguards before attack optimization begins, rather than treating validity as a purely post hoc filter.

4. Optimization algorithm

REALISTA solves the latent simplex-constrained problem using a two-stage stochastic optimization procedure (Liang et al., 12 May 2026). The first stage is single-concept initialization. For each dictionary direction $f_{\mathcal{T}(\cdot)}$4, the attack sets $f_{\mathcal{T}(\cdot)}$5, decodes

$f_{\mathcal{T}(\cdot)}$6

evaluates $f_{\mathcal{T}(\cdot)}$7, and retains the top-$f_{\mathcal{T}(\cdot)}$8 initial coefficient vectors.

The second stage iteratively refines each chosen initialization. At each iteration $f_{\mathcal{T}(\cdot)}$9, the current latent is decoded, semantic equivalence to $\mathbf{y}$0 is checked, and the best valid coefficient vector $\mathbf{y}$1 is updated if appropriate. The gradient $\mathbf{y}$2 is estimated via Gumbel-Softmax reparameterization, after which REALISTA applies a Langevin step followed by projection onto the simplex: $\mathbf{y}$3 The temperature is then decayed according to the schedule $\mathbf{y}$4.

Three components are singled out in the paper. Single-concept initialization identifies strong one-direction attacks; Projected Langevin Dynamics injects noise to escape flat regions and explore the latent simplex; and semantic equivalence is checked by an LLM-based judge at each step, with violating gradient steps discarded. This suggests that REALISTA treats attack realism as an actively maintained invariant during optimization rather than as an auxiliary preference.

5. Experimental setting and empirical performance

The evaluation uses a filtered MMLU subset consisting of 347 questions across 16 subjects. The attacked models include Llama-3-3B, Llama-3-8B, Qwen-2.5-7B, and Qwen-2.5-14B as open-source systems, and GPT-5-Nano and GPT-5-Mini as commercial reasoning models under free-form response settings. For open-ended MCQA, the objective is to minimize next-token loss for a target incorrect choice $\mathbf{y}$5; for free-form settings, it is to minimize a hallucination evaluator score $\mathbf{y}$6 via instructions. Baselines are Raw prompting, SECA, LARGO, and ICD. Reported metrics are attack success rate Best-of-$\mathbf{y}$7, Semantic Coherence Error (SCE), and Semantic Equivalence Error (SEE) (Liang et al., 12 May 2026).

On Llama-3-3B for MCQA, the reported values for ASR@30 / SCE / SEE are: Raw prompting 45.5\% / 1.6\% / 0.0\%, SECA 79.6\% / 0.7\% / 0.9\%, LARGO 84.7\% / 41.1\% / 97.4\%, ICD 90.8\% / 14.0\% / 100\%, and REALISTA 97.1\% / 2.2\% / 0.9\%. On Qwen-2.5-7B, the corresponding values are Raw prompting 6.4\% / 1.6\% / 0.0\%, SECA 32.5\% / 1.2\% / 3.8\%, LARGO 23.9\% / 43.4\% / 96.5\%, ICD 11.5\% / 14.0\% / 100\%, and REALISTA 41.6\% / 3.3\% / 2.9\%.

The stated findings are that REALISTA attains higher ASR, including +17.5\% over SECA on Llama-3-3B, while keeping semantic error minimal; that LARGO and ICD achieve high ASR by violating semantic equivalence, with SEE $\mathbf{y}$8; and that REALISTA succeeds on Qwen-2.5-7B where discrete SECA lags. On commercial reasoning models with free-form outputs, REALISTA is reported to improve ASR@30 by $\mathbf{y}$9 over raw, while maintaining SEE/SCE near zero. The paper therefore frames its contribution as combining optimization flexibility with semantic realism more effectively than either discrete realistic attacks or unconstrained latent attacks.

6. Ablations, failure modes, and defenses

The ablation study examines dictionary size, optimization hyperparameters, realism-related error rates, and activated concept patterns (Liang et al., 12 May 2026). For dictionary size, $\mathcal{L}_{\mathrm{hall}}$0, performance improves up to approximately $\mathcal{L}_{\mathrm{hall}}$1 and then saturates; excessively large $\mathcal{L}_{\mathrm{hall}}$2 introduces redundant directions and slows optimization with marginal gains. For optimization, the study varies step size $\mathcal{L}_{\mathrm{hall}}$3, temperature decay $\mathcal{L}_{\mathrm{hall}}$4, and budget $\mathcal{L}_{\mathrm{hall}}$5. Larger $\mathcal{L}_{\mathrm{hall}}$6 allows stronger attacks but increases the risk of semantic drift, and the reported balanced choice is $\mathcal{L}_{\mathrm{hall}}$7, $\mathcal{L}_{\mathrm{hall}}$8, and $\mathcal{L}_{\mathrm{hall}}$9, which yields the best SEE/SCE versus ASR tradeoff.

Semantic realism is further analyzed through SEE and SCE. The reported ranges are SEE $\mathbf{y}^*$0 and SCE $\mathbf{y}^*$1, and human evaluations on 100 samples are said to confirm the LLM-based SEE/SCE judgments. Figure 1 reports the top-20 frequently activated directions across the 347 MMLU prompts, with frequent patterns including “counterfactual,” “inverted,” “conditional,” “imperative,” and “elaborate.” These labels indicate that the latent dictionary can be interpreted as organizing prompt edits into recurring semantic transformation types.

The stated limitations are threefold. First, performance depends on dictionary quality, and poor paraphrase coverage degrades the attack. Second, the method requires an LLM-based decoder and is therefore susceptible to decoding errors. Third, the semantic equivalence safeguard depends on the reliability of an LLM judge. The proposed defenses are robust paraphrase-invariant structures, latent adversarial training that incorporates dictionary directions in adversarial fine-tuning, prompt fingerprinting to detect latent-space perturbations via grammar traces, and stronger semantic safeguards that combine multiple equivalence judges or human audit on critical prompts. This suggests that REALISTA is best understood not only as an attack method but also as a concrete stress test for whether LLM pipelines are genuinely invariant to semantically preserving prompt transformations.

7. Conceptual position and terminological context

REALISTA’s use of “realistic” refers to semantic equivalence and coherence of adversarial prompts, not to realism scoring in perceptual or sensor domains. That distinction is important because adjacent work uses related vocabulary in a different sense. “A Realism Metric for Generated LiDAR Point Clouds” defines realism as a learned measure of whether local LiDAR statistics resemble real-world measurements and studies its correlation with downstream segmentation performance (Triess et al., 2022). “Image Realness Assessment and Localization with Multimodal Features” uses multimodal features and textual inconsistency descriptions to estimate global image realness and produce dense realness maps for unrealistic regions (Kaushik et al., 16 Sep 2025).

Within that broader landscape, REALISTA is a language-model attack framework rather than a realism-assessment metric. Its realism constraint is operationalized through semantically valid rephrasings, simplex-constrained latent mixtures, and repeated semantic checking during optimization. A plausible implication is that the name captures a shift in adversarial NLP from unrestricted perturbation toward attacks that are intended to remain human-plausible under close semantic scrutiny.