SoftCom: LLM Attacks & Wireless Combining

• SoftCom is a dual-domain paradigm involving adversarial attacks on soft prompt-compression in LLMs and soft-source information combining for ultra-reliable wireless networking.
• In LLM contexts, SoftCom manipulates latent embeddings via suffix insertion or additive perturbation to achieve high attack success rates with minimal impact on fluency.
• In wireless systems, SoftCom aggregates soft log-likelihood ratios from multiple streams, significantly improving packet delivery reliability without hardware changes.

SoftCom denotes two distinct technical paradigms: (1) a class of adversarial attacks against "soft" prompt-compression modules in LLM agent stacks, and (2) "Soft-Source Information Combining" (SSIC), a soft-information-based multi-stream protocol for ultra-reliable wireless networking. Both leverage manipulation or aggregation in latent (continuous) space, respectively targeting vulnerabilities in LLM context compression or boosting communication reliability through LLR fusion. The specifics of each are fundamentally shaped by their domain—security-critical LLM pipelines or cross-layer wireless protocol stacks—and the nature of their underlying continuous representations.

1. SoftCom in Prompt Compression: Definition and Operational Distinction

SoftCom is an attack methodology designed for soft prompt-compression modules that substitute discrete token pruning with continuous embedding or "soft prompt" representations. Such compressors employ an encoder function mapping natural-language context $C$ into a fixed-size latent vector $\mathbf{h} = f_\theta(\cdot)$. In contrast to HardCom, which targets token-level or character-level aspects of compression, SoftCom strategically inserts or perturbs vectors in the latent space prior to the compression encoder, thus altering downstream LLM behavior without introducing malicious discrete tokens [(Liu et al., 27 Oct 2025), Sec. 4.1–4.2].

This latent-space hijacking exploits the information bottleneck and semantic drift uniquely associated with vectorized compression. The attack manipulates the compressed memory obtained from $\mathrm{Embed}(C)$, targeting either a specific $\mathbf{h}_{\mathrm{target}}$ (targeted attacks) or generic deviation from $\mathbf{h}_{\mathrm{base}}$ (non-targeted), as formalized in Eq. 13 of (Liu et al., 27 Oct 2025).

2. Mathematical Foundations and Optimization Formulation

The SoftCom attack formalism introduces an augmentative or perturbative bias upstream of the compressor:

• Suffix embedding: $\mathbf{E}_{\mathrm{suffix}}$ concatenated to base embeddings.
• Additive perturbation: $\mathbf{E}_0 \mapsto \mathbf{E}_0 + \Delta$.

The adversary solves: $$\min_{\mathbf{Z}\ \mathrm{or}\ \Delta}\;\;\mathcal{L}_{\text{adv}} + \alpha\|\Delta\|_2^2 + \beta D_{\mathrm{KL}}\!\bigl(p(y\mid x, \mathbf{E}_0)\|\;p(y\mid x,\mathbf{E}')\bigr)$$ where $\mathcal{L}_{\text{adv}}$ is a (negative) cosine similarity objective: maximizing deviation from $\mathbf{h}_{\mathrm{base}}$ (non-targeted) or alignment with $\mathbf{h} = f_\theta(\cdot)$0 (targeted). $\mathbf{h} = f_\theta(\cdot)$1 and $\mathbf{h} = f_\theta(\cdot)$2 are trade-off hyperparameters for perturbation magnitude and distributional consistency (Eq. 13, (Liu et al., 27 Oct 2025)).

Latent perturbations are realized via trainable logits $\mathbf{h} = f_\theta(\cdot)$3 (defining "soft" token distributions yielding $\mathbf{h} = f_\theta(\cdot)$4 or $\mathbf{h} = f_\theta(\cdot)$5) or direct per-token embedding shifts, optimized by projected gradient descent subject to $\mathbf{h} = f_\theta(\cdot)$6 for stealth preservation.

3. Algorithms and Attack Pipeline in LLM Contexts

SoftCom's algorithms comprise:

• Suffix-based attacks: Append trainable soft embedding vectors as pseudo-tokens.
• Token-representation edits: Either generate new per-position embeddings via $\mathbf{h} = f_\theta(\cdot)$7 or directly add $\mathbf{h} = f_\theta(\cdot)$8 to original embeddings.

The attack procedure follows an iterative pipeline (Sec. 4.2, (Liu et al., 27 Oct 2025)):

1. Tokenize input and embed to yield $\mathbf{h} = f_\theta(\cdot)$9.
2. Initialize attack variables $\mathrm{Embed}(C)$0 or $\mathrm{Embed}(C)$1.
3. Form modified embeddings by suffix concat or additive perturbation.
4. Propagate through $\mathrm{Embed}(C)$2 to obtain new latent $\mathrm{Embed}(C)$3.
5. Evaluate loss $\mathrm{Embed}(C)$4 (targeted or non-targeted) plus regularization.
6. Backpropagate gradients to attack variables.
7. Iterate for $\mathrm{Embed}(C)$5 epochs (typically up to 100).
8. Freeze and apply adversarial context to the downstream LLM.

Hyperparameters (learning rate $\mathrm{Embed}(C)$6, budget $\mathrm{Embed}(C)$7, and regularization weights $\mathrm{Embed}(C)$8) modulate attack strength, stealth, and generator fluency or coherence. Ablations show that removing regularization (KL or norm) slightly increases attack success rate (ASR) but severely impacts surface-level fluency (perplexity) and semantic stability (cosine sim) [(Liu et al., 27 Oct 2025), Table 8].

4. Empirical Findings: Efficacy, Stealthiness, and Transferability

SoftCom achieves state-of-the-art ASR and preference flip rates (PFR) on both ICAE (Mistral-7B) and AutoCompressors (Llama-2-7B-6K):

Task / Metric	ICAE (suffix)	ICAE (token)	AutoCompressors (suffix)	AutoCompressors (token)
QA ASR	0.73	0.86	0.89	0.98
LLM Preference (PFR ↓)	0.96	0.96	0.80	0.83
Embedding Cosine Sim	>0.98	>0.98	>0.98	>0.98
PPL Increase (pts)	<2	<2	<2	<2

SoftCom outperforms baseline prompt-injection methods (ASR $\mathrm{Embed}(C)$9 0.47, PFR $\mathbf{h}_{\mathrm{target}}$0 0.11). Runtime is modest (11–12 s per 100 epochs on ICAE; 25–26 s on AutoCompressors) [(Liu et al., 27 Oct 2025), Table 6]. Attacks are highly transferable: token-level SoftCom achieves $\mathbf{h}_{\mathrm{target}}$10.83 PFR across encoder-decoder and decoder-only compressors.

Two demonstrated case studies confirm real-world implications: (a) tool selection in VSCode Cline—where SoftCom induces a lower-quality model selection while preserving chain-of-thought fluency—and (b) product recommendation in Ollama, successfully changing product ranking after compression [(Liu et al., 27 Oct 2025), Figs. 11–14].

5. Limitations of Existing Defenses and Prospects for Mitigation (LLM Context)

Detection frameworks reliant on surface-level metrics or LLM self-consistency are inadequate against SoftCom. Perplexity-based checks flag only 1–13% of attacks; LLM self-judgment identifies under 5%. The KL regularizer stabilizes the output distribution, further defeating countermeasures. Counterfactual stability heuristics are brittle: minor context changes yield inconsistent mitigation [(Liu et al., 27 Oct 2025), Table 12–13, Appendix D].

Potential mitigation strategies include adversarial training of compressors, auditing via input–output consistency under random embedding perturbations, and joint fine-tuning of compressor–LLM pairs to absorb latent drifts through a global alignment loss.

6. SoftCom as Soft-Source Information Combining (SSIC) in Wireless Networking

In wireless networks, SoftCom refers to SSIC, a protocol for ultra-reliable packet delivery by aggregating soft (LLR) information across $\mathbf{h}_{\mathrm{target}}$2 parallel streams (Zhang et al., 2022). The SSIC system comprises:

• Dispatcher: Duplicates each IP packet, encapsulates via a virtual connection frame (VCI/VCS), transmits copies over $\mathbf{h}_{\mathrm{target}}$3 unmodified 802.11 NICs.
• Physical Layer: Per-stream decoders output hard bits (on CRC pass) or soft LLR vectors $\mathbf{h}_{\mathrm{target}}$4 (on CRC fail).
• Aggregator: Collects soft/hard data from all streams for a given packet (VCI/VCS), applies one of three soft descrambling algorithms, and fuses LLRs via summation:

$\mathbf{h}_{\mathrm{target}}$5

followed by a hard decision.

Soft descrambling recovers LLRs of original bits from scrambled outputs, employing either "hard-r soft-x" (using hard-decoded pilots for seed estimation), HRSX (ML-based), or SRSX (full posterior marginalization over LFSR seeds).

No hardware modifications are required; all operations run as layer-2.5 middleware via standard Linux TUN/TAP interfaces.

7. Performance, Experimental Results, and Quantitative Reliability Gains (Wireless Context)

Empirical deployment of SSIC (SoftCom) over two Wi-Fi physical links demonstrates:

• Single stream: 1–2% PLR, 2–3% PER, up to 4% total FR under static placement.
• SSIC: PLR $\mathbf{h}_{\mathrm{target}}$6 0.01%, PER 0.1–0.6%, achieving $\mathbf{h}_{\mathrm{target}}$799.99% packet delivery reliability in favorable scenarios.
• SSIC vs. DUP: Additional 2× reduction in FR due to soft LLR combination; 4–6× reduction vs. best single stream (Zhang et al., 2022).

Mobile scenarios favor SSIC with most stable and lowest error rates (FR 2–6%) despite radio heterogeneity or movement, confirming the exponential reduction in PER with increasing $\mathbf{h}_{\mathrm{target}}$8 and soft information exploitation.

The SSIC paradigm does not require changes to the TCP/IP stack or commercial NIC hardware, enabling transparent deployment and significant reliability improvements for short-range wireless communications.

---

SoftCom thus encapsulates two technically unrelated but structurally parallel advances: a high-efficacy, stealthy latent-space compression attack vector on LLM agents (Liu et al., 27 Oct 2025), and a practical, standards-compatible method for reliability amplification in wireless packet delivery via cross-stream soft-combining (Zhang et al., 2022). Both exploit the informational and operational properties of continuous latent representations to achieve goals unattainable with traditional discrete-only mechanisms.