Why it matters
Perturbation family shapes robustness. Understanding shapes defense.
Advertisement
The architecture
Add noise / drop chars / swap tokens.
Aggregate over samples.
Advertisement
How it works end to end
Character-level: cheap + effective vs GCG.
Token-level: expensive.
Aggregation: majority / average.