REALISTA: A realistic latent-space adversarial attack that induces hallucinations in large language models

The researchers propose REALISTA, a latent-space adversarial attack framework that induces hallucinations in large language models through semantically equivalent rewrites, and successfully attacks large reasoning models in free-response settings where prior realistic attacks failed. The method formulates hallucination induction as a constrained optimization problem, with the goal of finding adversarial prompts that are semantically equivalent to and coherent with benign user prompts. REALISTA builds, for each input, a dictionary of valid edit directions, each corresponding to a semantically equivalent and coherent rewrite, and then optimizes continuous combinations of these directions in latent space, combining the optimization flexibility of continuous attacks with the semantic realism of discrete rewrite attacks. Experiments show that REALISTA achieves performance superior or comparable to state-of-the-art realistic attacks on open-source large language models, and the code is open-sourced on GitHub (https://github.com/Buyun-Liang/REALISTA）。