claudini/claudini/methods/original/uat

name, full_name, reference, paper_url, code

name	full_name	reference	paper_url	code
UAT	Universal Adversarial Triggers	wallace2019universal	https://arxiv.org/abs/1908.07125	https://github.com/Eric-Wallace/universal-triggers

UAT — Universal Adversarial Triggers

Paper: Wallace et al., "Universal Adversarial Triggers for Attacking and Analyzing NLP" (EMNLP 2019) Links: arXiv | Code \cite{wallace2019universal}

Algorithm

Coordinate-wise greedy search using HotFlip (first-order linear approximation). The predecessor to GCG — uses deterministic coordinate sweep instead of random batch sampling.

Per step (one position flip):

1. Compute token gradient via one-hot trick (1 fwd+bwd) — same as GCG
2. At current position, compute HotFlip scores: -grad[0, pos] (the one-hot gradient directly gives per-token loss derivatives)
3. Get top-k candidate tokens for that position (most negative gradient = best replacement)
4. Build batch of k candidates (current tokens with one position swapped)
5. Evaluate batch (k forward passes), pick best
6. If best improves loss, update tokens
7. Advance position pointer (cycling 0..optim_length-1)

Key Difference from GCG

• UAT: deterministic coordinate-wise sweep (one position at a time, top-k by gradient)
• GCG: random batch (random positions, random samples from top-k)

GCG's stochastic sampling explores more of the search space per step at higher FLOP cost, while UAT is more conservative but cheaper per step.

Key Hyperparameters

• num_candidates: number of top-k tokens to evaluate per position (default: 100, from paper's GPT-2 LM task)

FLOP Cost

Per step: 1 fwd+bwd (gradient) + num_candidates forward passes (evaluation). Much cheaper per step than GCG (which evaluates search_width=512 candidates), but only modifies one position per step.