Semantic Representation Attack

• Semantic representation attack is an adversarial technique that manipulates latent meaning in AI models rather than altering surface tokens.
• It employs methods like context-aware substitutions and latent code manipulation to achieve high attack success rates across NLP, vision, and multimodal systems.
• Practical implications include exposing representational vulnerabilities and emphasizing the need for defenses that secure semantic integrity at deeper levels.

Semantic representation attack denotes a class of adversarial and backdoor methods that manipulate the representation of meaning rather than only surface tokens, pixels, or fixed triggers. In the cited literature, the target of manipulation may be a sentence-level semantic similarity constraint, a latent code, a semantic graph, an explanation map, a cross-modal mismatch, a semantic symbol in a communication system, or an execution-flow abstraction for AI agents. The common objective is to alter model behavior while preserving fluency, perceptual quality, interpretive plausibility, or statistical legitimacy at the surface level (Wang et al., 2020, Maheshwary et al., 2020, Luo et al., 2022, He et al., 17 Apr 2025, Xi et al., 3 Dec 2025, Chen et al., 3 Feb 2026).

1. Conceptual scope and representational substrates

The cited work uses semantic representation attack in two closely related senses. In a broad sense, it refers to attacks that operate on semantic, latent, or feature representations rather than direct surface corruption. In a narrower and explicit sense, it names a jailbreak paradigm for aligned LLMs that optimizes toward a harmful semantic equivalence class rather than an exact affirmative response string (Lian et al., 18 Sep 2025, Lian et al., 9 May 2026).

Across domains, the relevant representation is task-dependent. In NLP classification and entailment, semantics is operationalized through contextual word substitution and sentence similarity. In LLM safety, it is operationalized through semantic equivalence classes, AMR or RDF graphs, or in-context remapping of token meaning. In vision and retrieval, it is operationalized through disentangled latent codes, feature similarity, semantic attributes, prototype codes, or high-level semantic feature maps. In semantic communications and AI agents, it is operationalized through semantic symbols, latent transmissions, or structural execution traces rather than conversational surface form (Maheshwary et al., 2020, He et al., 17 Apr 2025, Wang et al., 2021, Zhou et al., 2024, Iyer, 5 Jan 2026).

Domain	Representation targeted	Typical attack mechanism
Text classification / entailment	Contextual semantics	MLM, NSP, USE-constrained substitution
Aligned LLMs	Semantic equivalence class or semantic graph	SRHS, AMR/RDF traversal, in-context hijacking
Vision / retrieval	Latent code, feature representation, attribute space, prototype code	Disentangled feature manipulation, semantic attribute editing, prototype supervision
VLMs / diffusion	Cross-modal semantics or continuous semantic regions	Semantic mismatch poisoning, cross-attention editing
Semantic communications / agents	Semantic symbols, latent transmissions, execution-flow patterns	Backdoor poisoning, latent manipulation, structural tokenization

A persistent theme is that the adversarial signal is designed to remain semantically or statistically plausible to humans or auxiliary systems while still inducing a semantic failure mode in the target model. This suggests that the attack surface shifts from visible perturbation to representational blind spots.

2. Objectives, constraints, and optimization criteria

A standard formulation couples task failure with a semantic-preservation constraint. In the context-aware NLP attack, the adversary seeks $\mathcal{X}_{\mathrm{ADV}}$ such that the model prediction changes while semantic similarity remains above a threshold,

$$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$

with USE-based thresholds $\lambda = 0.8$ for classification and $\lambda = 0.6$ for entailment (Maheshwary et al., 2020).

In feature-space vision attacks, the objective is often to move an adversarial representation away from its own semantic neighborhood and toward another. SSAH attacks semantic similarity directly on feature representations, using cosine similarity and a low-frequency constraint

$$\mathcal{D}_{lf}(x, x') = \| \phi(x) - \phi(x') \|_1,$$

so that perturbations are confined to high-frequency components while the semantic embedding is displaced (Luo et al., 2022).

In LLM jailbreaks, the objective is reformulated from exact textual targeting to semantic equivalence-class targeting. The SRA formulation maximizes probability mass over $\mathcal{Y}_{\Phi}$, the set of responses sharing a harmful semantic representation $\Phi$,

$$x^* = \arg\max_x \sum_{y_i^* \in \mathcal{Y}_{\Phi}} P(y_i^* \mid s_1 \oplus q \oplus x \oplus s_2),$$

under a perplexity-based coherence constraint. The associated theorems, termed the semantic Coherence-Convergence Relationship and Cross-Model Semantic Generalization bound, are used to argue that semantic coherence supports both convergence and transferability (Lian et al., 18 Sep 2025, Lian et al., 9 May 2026).

A distinct variant replaces semantic preservation with explanation preservation. AdvChar requires misclassification, minimal detectable change, and similarity of interpreter output,

$$F(x') = c' \neq c, \qquad G(x', F) = g' \approx g = G(x, F),$$

with an interpretation similarity function based on the change in the order of token importances. Here, the semantic representation under attack includes not only the classifier’s decision boundary but also the explanation surface exposed to the end user (Abdukhamidov et al., 22 Jul 2025).

3. Text, interpretation, and jailbreak instantiations

In conventional NLP settings, semantic representation attacks are realized through context-aware lexical replacement. The method in “A Context Aware Approach for Generating Natural Language Attacks” masks a selected word, uses BERT-based masked language modeling to generate substitutes, and then uses next sentence prediction with the pair (original input, masked input) to favor semantically consistent substitutions. Candidate words are filtered by counter-fitting cosine similarity, and candidate sentences are filtered by USE. The reported attack achieves more than 90% success across all tested models and datasets, perturbs 4.2% of words for BERT and 3.2% for LSTM on IMDB, and has the lowest grammatical error increase rate, including 0.38 for BERT on IMDB (Maheshwary et al., 2020).

The attack surface widens when explanation modules are part of the deployed system. AdvChar is a black-box attack on interpretable NLP systems that relies on interpreter outputs rather than model confidence or gradients to select tokens for perturbation. Using SHAP, Saliency Maps, or LIME attributions, it applies simple character-level changes while enforcing explanation stability. It was evaluated on seven NLP models and three interpretation models, achieves up to 79–81% ASR, alters only 2 characters on average, and maintains interpretation similarity with IoU often above 0.7, versus at most 0.36 for baseline attacks (Abdukhamidov et al., 22 Jul 2025).

For aligned LLMs, the literature shifts from semantic preservation to semantic activation of harmful intent. GraphAttack parses malicious goals into AMR, RDF, or JSON-based knowledge graphs, organizes actions, entities, attributes, and context into a graph $G=(V,E)$, and traverses transformation edges such as synonym, generalization/specification, role/context, syntactic, and indirect reference. It reports ASR up to 87% against models including GPT-4o, GPT-3.5, Claude-3.7-Sonnet, Llama-3.3-70B-Instruct-turbo, and Qwen2.5-72B-Instruct, with RDF representations outperforming AMR and surface-level approaches, and with some models showing an 8x ASR increase when semantic graphs are paired with code-generation requests (He et al., 17 Apr 2025).

The proper-name SRA line of work makes the same shift explicit. One version reports 89.41% average ASR across 18 LLMs, including 100% on 11 models, with adversarial prompts that are concise, interpretable, and far lower in perplexity than GCG or AutoDAN; another, LLM-agnostic formulation reports a 99.71% average attack success rate across 26 open-source LLMs, 100% ASR on 24/26 models, average adversarial suffix length of 1–3 tokens, and black-box success on GPT-4.1 and GPT-5 (Lian et al., 18 Sep 2025, Lian et al., 9 May 2026).

A more direct representation-level mechanism appears in Doublespeak. It replaces a harmful keyword such as “bomb” with a benign token such as “carrot” across in-context examples, causing the benign token’s internal representation to converge toward the harmful one layer by layer. The paper reports 74% ASR on Llama-3.3-70B-Instruct with a single-sentence context override and uses logit lens and Patchscopes to show that benign semantics in early layers transition into harmful semantics in later ones (Yona et al., 3 Dec 2025).

4. Visual, multimodal, and retrieval formulations

In computer vision, an early semantic representation attack is to perturb disentangled latent factors rather than pixels. “Generating Semantic Adversarial Examples via Feature Manipulation” proposes vector-based and feature map-based disentangled representations, links latent dimensions to human-interpretable attributes through traversal, and demonstrates nearly 100% success on MNIST and CelebA together with universal, image-agnostic semantic adversarial examples. On MNIST, the reported SSIM rises from 77.20% for ordinary latent attacks to 81.85% for semantic attacks and 84.32% for boosted attacks, while latent-space distance decreases from 7.01 to 2.23 and 1.16 respectively (Wang et al., 2020).

Several later works attack semantics more directly in feature or attribute space. SIA jointly optimizes in semantic attribute space and pixel space using AttGAN, with iterative gradient ascent on both $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$0 and $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$1. It is presented for model diagnosis, stronger attacks, and robustness to imbalanced datasets, with attribute sensitivity histograms revealing model vulnerability and with adversarial training on SIA improving transferable robustness across gradient-based attacks (Luo et al., 2023). SSAH attacks semantic similarity on feature representations and constrains perturbations to high-frequency components via wavelet decomposition; it reports ASR of 99.94 on CIFAR-10, 99.80 on CIFAR-100, and 98.01 on ImageNet-1K, with ImageNet-1K FID 3.90 and Tencent Cloud success 37.98%, compared with a previous maximum of 21.71% (Luo et al., 2022).

Other studies exploit semantic structure for targeted retrieval or latent misdirection. ProS-GAN constructs a target-label prototype code as a category-level semantic representative for deep hashing, and supervises a generator by minimizing the Hamming distance between the adversarial hash code and the prototype code, improving targeted attack performance and transferability (Wang et al., 2021). “Semantic Autoencoder and Its Potential Usage for Adversarial Attack” shows that latent contents of adversarial samples constructed from a semantic encoder with deliberate wrong label information exhibit a different distribution while the images remain visually almost unchanged, with adversarial images reported around PSNR $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$2 and SSIM $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$3 (Ming et al., 2022).

Backdoor work extends the same logic from adversarial examples to trigger design. “An Invisible Backdoor Attack Based On Semantic Feature” extracts low-level and high-level semantic features from a pre-trained victim model, derives a sample-adaptive trigger through channel attention, and uses an encoder network with skip connections to synthesize poisoned images. It reports ImageNet PSNR 33.59, SSIM 0.9969, LPIPS 0.0020, ASR close to or exactly 1.000, and ASR above 0.97 even with a 3% poisoning rate (Chen, 2024). “3S-attack” uses Grad-CAM to extract class-relevant semantic features, embeds them spectrally with DCT, and then enforces pixel-level restrictions. It reports ASR 89.3% on CIFAR-10, 94.1% on GTSRB, and 97.4% on Animal-10, together with CIFAR-10 PSNR 35.65 dB and Animal-10 SSIM 0.962, while noting that Activation Clustering remains more effective than several other defenses (Yin et al., 14 Jul 2025).

Multimodal systems expose additional semantic interfaces. BadSem poisons vision-LLMs by deliberately misaligning image-text pairs, treating cross-modal semantic mismatch as an implicit trigger. Across four VLMs it reports over 98% average ASR, strong out-of-distribution generalization, transfer across poisoning modalities, and failure of both system-prompt and supervised fine-tuning mitigations (Zhong et al., 8 Jun 2025). SemBD, for text-to-image diffusion, replaces discrete textual triggers with continuous semantic regions by editing cross-attention key and value projection matrices and adding semantic regularization against incomplete semantics. It reports 100% ASR, robustness to state-of-the-art input-level defenses with DSR between 2% and 25.8%, and ASR remaining above 90% after full or LoRA fine-tuning (Chen et al., 3 Feb 2026).

5. Semantic communications and agent-security variants

Semantic communications introduces a distinct representational target: the semantic content carried by compressed or latent transmissions. “Is Semantic Communications Secure? A Tale of Multi-Domain Adversarial Attacks” models transmitter and receiver as an autoencoder plus a semantic task classifier, and demonstrates test-time attacks at both the input image and wireless-signal stages. A non-targeted attack with perturbation strength $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$4 reduces classifier accuracy to 0.11 while MSE remains 0.09, and the combined multi-domain attack is reported as more effective than conventional jamming at changing the semantics of the transferred information (Sagduyu et al., 2022).

Backdoor attacks in semantic communications target reconstructed semantic symbols rather than labels alone. BASS poisons transmitter and receiver datasets so that triggered inputs reconstruct an attacker-defined target semantic symbol while clean inputs remain normal. The paper gives, for MNIST at $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$5 compression ratio and poison ratio $$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$6, PSNR 28.310 on clean data and 29.507 on poisoned data, and proposes three defenses: a joint training framework, reverse engineering of the trigger through feature-similarity minimization, and pruning-based mitigation, with pruning reported to reduce clean performance by 2.2% on MNIST and 2.1% on CIFAR10 while eliminating the backdoor (Zhou et al., 2024).

A later threat model moves from poisoning to on-path latent tampering. “Rethinking Security in Semantic Communication: Latent Manipulation as a New Threat” introduces Diffusion-based Re-encoding (DiR) and Test-Time Adaptation Latent Manipulation (TTA-LM). DiR replaces an intercepted latent with a diffusion-generated latent conditioned on an attacker prompt, whereas TTA-LM updates the intercepted latent by gradient descent on a CLIP-based semantic loss. Both are reported to alter the decoded semantics while preserving natural latent-space distributions, making them covert and difficult to detect (Xi et al., 3 Dec 2025).

Agent security work generalizes the same principle from latent vectors to behavioral traces. “Structural Representations for Cross-Attack Generalization in AI Agent Threat Detection” distinguishes linguistic attacks such as social engineering and prompt injection from structural attacks such as tool hijacking and data exfiltration. Standard conversational tokenization fails catastrophically on tool hijacking and data exfiltration, with AUC 0.39 and 0.46 respectively, while structural tokenization based on nine execution-flow tokens yields 0.85 on both and 0.97 on unknown attacks. A gated multi-view fusion model raises social-engineering detection to 0.89 without sacrificing structural detection (Iyer, 5 Jan 2026). This suggests that, for agentic systems, the semantic locus of attack is often the action trace rather than the utterance.

6. Defenses, misconceptions, and unresolved problems

A recurring finding is that surface-level defenses often fail when the attack is representationally aligned with the model’s own abstraction. In VLMs, system prompting and supervised fine-tuning do not mitigate BadSem effectively, with ASR generally remaining above 90–95% after clean-data fine-tuning (Zhong et al., 8 Jun 2025). In diffusion models, SemBD is explicitly designed to evade prompt enumeration and attention-consistency detection by using continuous semantic regions and multi-entity targets, and the reported balanced-set detection accuracies of 52.5% for NaviT2I, 39.5% for UFID, 57.0% for T2IShield_FTT, and 48.5% for T2IShield_CDA are close to chance (Chen et al., 3 Feb 2026).

Interpretability does not, by itself, provide security. AdvChar exploits the interpreter output as a token-importance oracle, preserving the explanation while changing the prediction (Abdukhamidov et al., 22 Jul 2025). GraphAttack similarly argues that safety mechanisms focused on surface-level patterns are vulnerable to contextual framing, abstraction, and knowledge-to-code transformations, and recommends semantic parsing, graph- or ontology-level intent analysis, cross-representation consistency checks, and intent-aware code evaluation (He et al., 17 Apr 2025).

A common misconception is that semantic attacks are necessarily invisible in every representation. The cited literature does not support that conclusion. 3S-attack is stealthy in spatial, spectral, and semantic domains against several defenses, yet Activation Clustering remains more effective and reveals that complete semantic stealth in model latent space is not guaranteed (Yin et al., 14 Jul 2025). Likewise, semantic autoencoder attacks preserve pixel similarity while shifting latent distributions, indicating that invisibility in input space need not imply invisibility in representation space (Ming et al., 2022).

Another misconception is that semantic attacks are purely destructive. In representation learning for skeleton action recognition, A$$\mathbf{F}(\mathcal{X}) \neq \mathbf{F}(\mathcal{X}_{\mathrm{ADV}}), \qquad S(\mathcal{X}, \mathcal{X}_{\mathrm{ADV}}) \geq \lambda,$$7MC deliberately uses attack-based semantic perturbation to construct hard positive and hard negative pairs. Its Attack-Augmentation and Positive-Negative Mixer components are used to learn more robust representations, and the paper reports competitive state-of-the-art performance on three public datasets (Xu et al., 2023). This suggests that semantic representation attacks also function as diagnostic and training instruments, not only as security failures.

The unresolved problem common to these papers is the gap between surface alignment and semantic control. LLM SRA argues that low-perplexity, semantically coherent prompts improve both white-box convergence and black-box transferability (Lian et al., 9 May 2026). Doublespeak shows that semantic overwrite can emerge after the layer where refusal behavior is typically expressed (Yona et al., 3 Dec 2025). Structural tokenization for agents shows that the crucial abstraction for unseen attacks may be execution flow rather than natural language (Iyer, 5 Jan 2026). Semantic communication studies argue for semantic integrity or authentication at the latent level rather than reliance on reconstruction fidelity alone (Zhou et al., 2024, Xi et al., 3 Dec 2025). Taken together, these results indicate that defenses confined to token filters, static trigger scans, or low-level anomaly metrics are systematically misaligned with the representational level at which many modern attacks operate.