Targeted-Output Attack

• Targeted-output attacks are adversarial strategies that precisely manipulate model outputs by altering inputs, modifying parameters, or exploiting control systems.
• They employ methods like gradient-based optimization, discrete token selection, and bit-flip techniques to force predetermined predictions and completions.
• Empirical studies demonstrate high success rates across modalities (up to 96% in LLMs) and highlight significant security risks in diverse applications.

A targeted-output attack is an adversarial attack strategy that aims to manipulate a machine learning model to produce a chosen, attacker-specified output (or structured set of outputs) for a given input or class of inputs, often with fine-grained control over when and how the manipulation occurs. In contrast to untargeted attacks, which seek only to induce erroneous or nonsensical predictions, targeted-output attacks induce specific model behaviors—forcing particular label assignments, output sequences, or decoded strings—even in systems that are robustly aligned or protected by standard defenses.

1. Core Definition and Scope

Targeted-output attacks operate by searching for input-space, parameter-space, or infrastructure-level manipulations that steer a model’s response toward an exact target $y^*$ or structured output set $Y^*$. These attacks span a broad range of domains, including classification, structured prediction, generative modeling, multi-modal tasks, and robustness evaluation for deep neural models. Canonical instances include:

• Generating minimal perturbations to force a classifier to assign label $y_t$ (“targeted misclassification”)
• Crafting adversarial prompts, triggers, suffixes, or input tokens that induce LLMs to emit attacker-chosen completions, regardless of context
• Injecting bit-level faults to model weights or activations that deterministically yield targeted outputs for selected queries

Recent research demonstrates that targeted-output attacks are practical against a variety of architectures: transformer-based LLMs, CNN/RNN-based vision–LLMs, audio-LLMs, time-series forecasters, and agentic systems (Ziv et al., 29 Dec 2025, Guo et al., 19 Feb 2026, Liang et al., 2024, Xiu et al., 2 Oct 2025, Zhang et al., 31 Mar 2025).

2. Attack Methodologies Across Modalities

Targeted-output attacks are instantiated with a spectrum of methodologies, adapted to the model’s interface and threat model:

(a) Input-space attacks

For models where attackers control user-facing inputs, the attack corresponds to searching for minimally modified inputs $x'$ that force $f(x') = y_t$:

• Gradient-based optimization in continuous domains (e.g., PGD or AutoPGD for images and time series (Govindarajulu et al., 2023))
• Token-level or discrete optimization for NLP (e.g., coordinate descent over triggers (Liang et al., 2024), synonym substitution prioritized by surrogate model loss (Wang et al., 26 Sep 2025))
• Latent-space attacks in multimodal models, where adversaries perturb encoder outputs to produce targeted decoding (e.g., universal audio perturbation that maps any input to a target transcription (Ziv et al., 29 Dec 2025))
• Structured perturbation using tree-based autoencoders or latent-variable methods for sequence tasks (e.g., targeted partial-caption attacks for image captioners (Xu et al., 2019, Wang et al., 2019))

(b) Model-parameter attacks

When the adversary can manipulate internal parameters, the objective shifts to flipping model weights or cache bits to bias outputs on selected queries:

• Targeted bit-flip attacks in model weights, using rational utility scores to minimize collateral degradation (Guo et al., 19 Feb 2026)
• Targeted Trojan injection in key–value caches, inducing persistent targeted behaviors via single-bit corruptions without affecting global utility (Nahian et al., 27 Nov 2025)
• Targeted backdoor triggers implanted via supervised contrastive losses during pretraining (Du et al., 2023)

(c) Output-constrained and control-plane attacks

Attackers may exploit structured output schemas or decoding constraints to force specific outputs, even when the surface prompt is innocuous:

• Constrained decoding attacks: weaponizing grammar or schema-level output constraints to induce targeted completions (bypassing safety layers) in LLMs (Zhang et al., 31 Mar 2025)
• Prompt engineering for universal, context-independent triggers (Liang et al., 2024)

3. Formal Objective and Optimization Strategies

A typical targeted-output attack is cast as a constrained optimization problem: $$\min_{\delta} \ell\bigl( f(x + \delta),\,y^*\bigr) + \lambda\|\delta\|_p \;\;\text{subject to}\;\; x + \delta \in \mathcal{X}_{\text{valid}}$$ where $\ell$ measures the divergence between the model output and the target $y^*$ (exact match, cross-entropy, or BLEU/ROUGE for sequence tasks), and the perturbation norm is restricted for stealth.

Alternative strategies in discrete or structured-output spaces include:

• Surrogate loss minimization via GCG for universal triggers (Liang et al., 2024)
• EM (Expectation Maximization)/latent SSVM for partial-caption supervision (Xu et al., 2019)
• Black-box query-based adversarial RL for DRL controllers (training an adversarial agent to maximize the probability of reaching target states via output perturbations) (Lee et al., 2020)
• Component-voting and point-to-set objectives for targeted retrieval attacks (Bai et al., 2020)

In infrastructure attacks, selection of bit-flip or cache-targets is guided by gradient-based utility scores or calibration set statistics, optimizing to maximize targeted-output success while suppressing utility loss on benign samples (Guo et al., 19 Feb 2026, Nahian et al., 27 Nov 2025).

4. Empirical Findings and Domain-Specific Instantiations

LLMs and NLP

• Prompt-trigger attacks on open-source LLMs reach up to 72% exact-match accuracy on unseen payloads with short, universal context-independent triggers (Liang et al., 2024).
• Dynamic target jailbreaks that adapt to the model’s own sampling distribution (rather than fixed low-density targets) accelerate attack convergence and reach >87% attack success rate on aligned LLMs with orders-of-magnitude fewer optimization steps than prior baselines (Xiu et al., 2 Oct 2025).
• Control-plane attacks via structured decoding in LLMs achieve 96%+ attack success rates, bypassing prompt/output audits (Zhang et al., 31 Mar 2025).
• Multistep transferability is demonstrated: triggers trained on one LLM family generalize to higher-capacity or differently tuned checkpoints (Liang et al., 2024).
• Backdoor UOR attacks on pre-trained LLMs insert “universal” output representations for triggers, producing near-perfect transfer attacks across downstream tasks and architectures (Du et al., 2023).

Multimodal and Vision-Language Systems

• Black-box targeted adversarial example generation for image captioning can force RNN-based captioners to emit arbitrary partial captions, even in the absence of ground-truth overlap (Xu et al., 2019).
• Ask–Attend–Attack orchestrates decision-based black-box targeted attacks on image-to-text models, leveraging evolutionary search guided by CLIP similarity and semantic constraints to reach up to 0.86 METEOR on VIT-GPT2 (Zeng et al., 2024).
• Object-fabrication targeted attacks enable feature-space perturbations to implant non-existent, attacker-chosen objects into detection outputs, with close to 100% attack success on YOLOv5 (Zhang et al., 2022).
• In deep hashing retrieval, point-to-set targeted attacks using component-voted anchor codes are up to 20 points more effective by mAP than point-to-point attacks and remain imperceptible (Bai et al., 2020).

Time-Series Forecasting, RL, and Audio

• Fine-grained targeted attacks on LSTM forecasters (directional, amplitudinal, temporal) closely match the desired output distribution while remaining statistically undetectable by KS tests (KS-distance < 0.05) (Govindarajulu et al., 2023).
• Query-efficient RL-based adversarial policies in control problems can reliably drive DRL agents to adversarial target states, with black-box state-unaware policies matching or exceeding state-aware attack strength (Lee et al., 2020).
• Universal targeted audio perturbations learned at the encoder boundary yield >90% “exact match” attack success with negligible impact on speech intelligibility and across speakers/accents (Ziv et al., 29 Dec 2025).

5. Threat Models, Limitations, and Countermeasures

The threat spectrum ranges from standard white-box (full model access) to black-box (query-only, hard-label) to control-plane or infrastructure-level (system access to weights or caches):

• Bit-flip attacks exploiting DRAM/Rowhammer vulnerabilities achieve successful targeted LLM manipulation with <15 bit flips and minimal collateral damage (Guo et al., 19 Feb 2026).
• Trojan attacks on LLM key–value caches enable persistent, data-agnostic, targeted-output hijacking with a single bit-flip, transferably across datasets, models, and tasks (Nahian et al., 27 Nov 2025).
• Dynamic output attacks (TDOA) use clustering-based surrogate models and farthest-label selection to mount label-specific attacks in black-box settings with only a handful of queries (achieving up to 82% ASR in static and 50% ASR in dynamic output scenarios) (Wang et al., 26 Sep 2025).
• Targeted adversarial watermarks in diffusion models (ACE/ACE+) create systematic, accumulative errors during unauthorized fine-tuning, outperforming untargeted adversarial watermarks by ~0.2 points in MS-SSIM or CLIP-IQA (Zheng et al., 2023).

Mitigations discussed include:

• Denying user grammars from masking core refusal/policy tokens in structured decoding (Zhang et al., 31 Mar 2025)
• Token provenance tracking and auditing in LLM outputs (Zhang et al., 31 Mar 2025)
• Certified adversarial training (region-based smoothing, robust feature extraction) (Govindarajulu et al., 2023)
• Adversarially-robust fine-tuning against triggers/backdoors (Liang et al., 2024, Du et al., 2023)
• Real-time monitoring of encoder or cache activations for anomalous trajectories (Ziv et al., 29 Dec 2025, Nahian et al., 27 Nov 2025)
• Layer-level integrity checks and hardware ECC for DRAM/parameter faults (Guo et al., 19 Feb 2026)

6. Impact, Transferability, and Open Problems

Targeted-output attacks have shifted the focus from general model robustness breakdowns toward fine-grained control, high transferability, and practical threat vectors against production and safety-critical AI deployments. Cross-domain transfer, “universal” triggers/backdoors, infrastructure-level attacks, and dynamic adversarial objectives (e.g., Dynamic Target in LLMs) have widened the attack surface beyond previous benchmarks. Notable open challenges include:

• Automated tuning of universal targets (e.g., latent pattern selection for diffusion model protection or partial-caption sequence targeting)
• Provably robust defenses that resist concise and context-independent triggers
• Statistical detection techniques that can distinguish closely distribution-matched adversarial examples
• Efficient and black-box attacks that close the gap to white-box effectiveness (Wang et al., 26 Sep 2025, Xiu et al., 2 Oct 2025, Liang et al., 2024, Nahian et al., 27 Nov 2025)
• Robust pipeline audits for structured-output and agentic systems

Targeted-output attacks represent a critical, rapidly evolving dimension of adversarial ML research, with ongoing implications for model alignment, deployment safety, and the theoretical limits of controllability in neural systems (Liang et al., 2024, Xiu et al., 2 Oct 2025).