Implement a universal adversarial suffix attack on GPT-2, and explain how you'd evaluate it safely.

Use greedy coordinate gradient from Zou et al.: optimise one token suffix that makes a target completion likely across many prompts, which makes it universal. Token gradients propose swaps; exact loss picks the best.

import torch
import torch.nn.functional as F

def loss(model, E, prompt, oh, target):
    # E = model.transformer.wte.weight
    x = torch.cat([E[prompt], oh @ E, E[target]])
    out = model(inputs_embeds=x[None]).logits[0]
    n = len(target)
    return F.cross_entropy(out[-n - 1:-1], target)

def gcg_step(model, prompts, suf, target,
             k=64, tries=128):
    model.requires_grad_(False)  # grads on oh only
    E = model.transformer.wte.weight
    oh = F.one_hot(suf, E.shape[0]).to(E.dtype)
    oh.requires_grad_()
    sum(loss(model, E, p, oh, target)
        for p in prompts).backward()
    cand = (-oh.grad).topk(k, dim=1).indices
    best, best_l = suf, float("inf")
    for _ in range(tries):
        s = suf.clone()
        i = torch.randint(len(s), (1,)).item()
        s[i] = cand[i, torch.randint(k, (1,)).item()]
        with torch.no_grad():
            o = F.one_hot(s, E.shape[0]).to(E.dtype)
            l = sum(loss(model, E, p, o, target).item()
                    for p in prompts)
        if l < best_l:
            best, best_l = s, l
    return best

Evaluate safely: a local model, a benign target string, success rate on held-out prompts, and defences like perplexity filtering.