[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-291288-105":59,"doc-detail-291288-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","closing-the-distribution-gap-in-adversarial-training-for-llms","Closing the Distribution Gap in Adversarial Training for LLMs","","Adversarial training for large language models improves robustness against adversarial behavior, yet models still fail on simple in-distribution manipulations such as rewriting prompts in the past tense or translating them into other languages. The work links this fragility to a limitation of current algorithms: they optimize adversarial loss only on the training set and inadequately cover the underlying data distribution. It introduces Distributional Adversarial Training (DAT) using Diffusion LLMs to sample diverse, high-likelihood prompt-response pairs, then applies continuous adversarial training to reduce worst-case error and achieve stronger robustness.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/closing-the-distribution-gap-in-adversarial-training-for-llms/291288/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/closing-the-distribution-gap-in-adversarial-training-for-llms/291288.png","ImageObject",300,407,{"name":92,"@type":93},"Ben Jamin","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",11,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What problem does the paper address in adversarial training for LLMs?","Question",{"text":113,"@type":114},"The paper addresses persistent vulnerability of LLMs to simple in-distribution attacks that are natural inputs outside the distribution covered by fixed training sets.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Why do current adversarial training methods remain brittle according to the paper?",{"text":118,"@type":114},"They mainly minimize adversarial loss on the training set but do not adequately approximate the true population robust risk, leaving a distribution gap tied to data distribution coverage.",{"name":120,"@type":111,"acceptedAnswer":121},"How does Distributional Adversarial Training (DAT) improve robustness?",{"text":122,"@type":114},"DAT leverages Diffusion LLMs to sample diverse, high-likelihood harmful prompt-response pairs from a generative surrogate distribution, then applies continuous adversarial training to minimize worst-case error and close the gap.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},291288,1789644299,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},2336478466772,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Closing the Distribution Gap in Adversarial Training for LLMs  \nChengzhi Hu * 1 Jonas Dornbusch * 1 David Ldke 1 Stephan Gnnemann 1 Leo Schwinn 1  \narXiv :2602 . 15238v2 [ cs .LG] 18 Feb 2026  \nAbstract  \nAdversarial training for LLMs is one of the most promising methods to reliably improve robustness against adversaries. However, despite significant progress, models remain vulnerable to simple in-distribution exploits, such as rewriting promptsin the past tense or translating them into otherlanguages. We argue that this persistent fragility stems from a fundamental limitation in current adversarial training algorithms: they minimize adversarial loss on their training set but inadequately cover the data distribution, resulting in vulnerability to seemingly simple attacks. To bridge this gap, we propose Distributional Adversarial Training, DAT. We leverage Diffusion LLMs to approximate the true joint distribution of promptsand responses, enabling generation of diverse, high-likelihood samples that address generalization failures. By combining optimization over the data distribution provided by the diffusion model with continuous adversarial training, DAT achieves substantially higher adversarial robustness than previous methods. Code and models are available on GitHub and Hugging Face (Link) .  \n1. Introduction  \nEnsuring the safety of Large Language Models (LLMs) is a prerequisite for their reliable deployment. While alignment techniques such as RLHF (Ouyang et al., 2022) successfully reduce the likelihood of harmful outputs in normal use, models remain highly vulnerable to adversarial prompts (Zou et al., 2023 ; Zhu et al., 2023 ; Li et al., 2024) . Adversarial Training (AT) has emerged as one of the most promising defenses, aiming to improve robustness by augmenting training data with worst-case adversarial inputs (Goodfellow et al., 2015 ; Madry et al., 2018) . Recently, AT has been successfully scaled to LLMs (Xhonneux et al., 2024 ; Casper et al., 2024) . Yet, despite these advances, models remain sur-  \n*Equal contribution 1Technical University of Munich, Germany. Correspondence to: Chengzhi Hu \u003C[cm.hu@tum.de](cm.hu@tum.de) >, Jonas Dornbusch \u003C[jonas.dornbusch@tum.de](jonas.dornbusch@tum.de) >.  \nPreprint. February 19, 2026.  \nFigure 1. Standard AT minimizes the empirical robust risk over a fixed dataset D (brown), which provides a poor approximation of the population robust risk. This results in a distribution gap where the model remains vulnerable to the manifold of natural language q (blue) . Specifically, standard methods fail to cover the distribution of prompts q˜(x | yharm) (green) that are likely to trigger harmful responses. Our DAT framework bridges this gap by optimizing over a surrogate distribution defined by a diffusion LLM pdθiff (x|yhamr) (purple), allowing the model to train on a distribution that more closely matches the true population.  \nprisingly brittle, exhibiting simple generalization failures. A model might refuse a complex, optimized attack string but effectively bypass its own safety training if the same request is merely translated into a low-resource language (Yonget al., 2023) or rephrased in the past tense (Andriushchenko & Flammarion, 2024) . These are not adversarial examples in the traditional sense of optimized model-specific perturbations. Rather, they are valid, natural inputs that lie just outside the distribution observed during training.  \nWe argue that these failures stem from the decomposition of the robust risk (Madry et al., 2018) . Minimizing the robust risk over the true underlying data distribution q(x, y) inherently involves minimizing two distinct sources of error: the data distribution approximation error and the adversarial optimization error. The former relates to how well the training data covers q (x, y), while the latter relates to finding the worst-case perturbation within a local region. Standard AT algorithms effectively address the optimization error by robustify","cbCaifnymdtuWgzO","https://ap.wps.com/l/cbCaifnymdtuWgzO","pdf",503634,14,"English","# Introduction\n## Problem setting: adversarial prompts and generalization failures\n## Proposed approach: Distributional Adversarial Training (DAT)\n## Contributions and expected impact","[{\"question\":\"What problem does the paper address in adversarial training for LLMs?\",\"answer\":\"The paper addresses persistent vulnerability of LLMs to simple in-distribution attacks that are natural inputs outside the distribution covered by fixed training sets.\"},{\"question\":\"Why do current adversarial training methods remain brittle according to the paper?\",\"answer\":\"They mainly minimize adversarial loss on the training set but do not adequately approximate the true population robust risk, leaving a distribution gap tied to data distribution coverage.\"},{\"question\":\"How does Distributional Adversarial Training (DAT) improve robustness?\",\"answer\":\"DAT leverages Diffusion LLMs to sample diverse, high-likelihood harmful prompt-response pairs from a generative surrogate distribution, then applies continuous adversarial training to minimize worst-case error and close the gap.\"}]","Closing the Distribution Gap in Adversarial Training for LLMs | PDF",35]