Controllability-Aware Adversarial Examples Against LLM-Based Network Traffic Classifiers

Jul 16, 2026

Large language models (LLMs) are increasingly used as network intrusion detection classifiers, yet adversarial robustness under realistic attacker constraints is not well understood. A controllability-aware black-box transfer framework partitions flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) groups, then restricts perturbations to DC while freezing IC/UC. Finite-difference PGD, greedy coordinate-wise, and NES examples are generated with a shared XGBoost surrogate and transferred across multiple IDS benchmarks and 27 LLM configurations, showing substantial, dataset- and comparator-dependent LLM vulnerability.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Introduction

Related Work

Controllability-Aware Adversarial Examples Against LLM-Based Network Traffic Classifiers Zhenpeng Li arXiv :2607 .07739v 1 [ cs .CR] 8 Jul 2026 Abstract—Large language models (LLMs) are increasingly explored as network intrusion detection classifiers, but their adversarial robustness under realistic attacker constraints remains unclear. We present a controllability-aware black-box transfer framework for LLM-based network traffic classifiers. The framework partitions flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) groups according to network communication semantics, then restricts perturbations to DC features while freezing IC/UC features. Using a shared XGBoost surrogate, we generate finitedifference PGD, greedy coordinate-wise, and NES adversarial examples and transfer them to seven LLM targets and two conventional ML targets across five IDS benchmarks from 1999 to 2022. Across 27 valid LLM configurations and over 500,000 adversarial examples, we find that LLM transfer vulnerability is substantial but dataset- and comparator-dependent. Compared with LightGBM, LLMs are more vulnerable on RT-IoT2022 and CIC-IDS-2018, comparable on NSL-KDD and UNSW-NB15, and less vulnerable on HIKARI-2021; compared with the averaged ML baseline, LLMs show higher ASR on all five datasets. We further observe a consistent cross-architecture transfer hierarchy: gradient-and score-based perturbations transfer more effectively than greedy perturbations across all 27 LLM cells and 9/10 ML cells. Cross-surrogate validation with tree, neural, and linear surrogates yields similar LLM ASR, reducing evidence that the findings are XGBoost-specific. Constraint violation rate is 0% by construction. Index Terms—Adversarial machine learning, large language models, network intrusion detection, transfer attacks, semantic constraints. I. INTRODUCTION The use of large language models for network intrusion detection is an active research direction, driven by their ability to process heterogeneous flow features as natural language descriptions [1], [2] . While production deployment remains limited, commercial systems such as Microsoft Copilot for Security already integrate LLMs into security operations pipelines, processing network telemetry alongside threat intelligence. Whether LLM-based classifiers can be evaded through controllability-constrained traffic modifications is therefore a concrete security question: production-integrated LLMs processing live network telemetry can be targeted by adversaries with access only to public data and a local classifier. Adversarial robustness of traditional ML-based intrusion detection systems (IDS) has been studied extensively [3],[4], [5] . However, existing work suffers from two limitations when applied to the LLM-IDS setting. First, most attacks Z. Li is with Guangzhou Health Science College, GuangYuanZhong Road 248, Guangzhou, Guangdong 510405, China (e-mail: [2025301001@gzws.edu.cn](2025301001@gzws.edu.cn)). Corresponding author. Manuscript received—; revised—; accepted—. perturb arbitrary features without respecting the attacker’s operational constraints—an attacker cannot control response bytes from a remote server, nor dictate aggregated statistics computed by network monitors. Second, no prior work evaluates whether adversarial transferability—the dominant practical attack vector—behaves differently when the target is a Transformer-based language model versus a gradient-boosted tree or neural network. We address both gaps through three contributions: (C1) Controllability-Aware Attack Framework. We formalize an attacker capability taxonomy that classifies network flow features into Directly Controllable (DC), Indirectly Controllable (IC), and Uncontrollable (UC) categories, grounded in the physical semantics of network communication (Section III) . Adversarial perturbations are restricted to DC features, producing examples that are more realistic

FAQs

What is the controllability-aware framework proposed for LLM-based network traffic classifiers?

It groups network flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) based on communication semantics, and restricts adversarial perturbations to DC features while freezing IC/UC features.

How are adversarial examples generated and transferred in the study?

Using a shared XGBoost surrogate, the framework generates finite-difference PGD, greedy coordinate-wise, and NES adversarial examples and transfers them to multiple LLM targets and conventional ML targets under a black-box transfer threat model.

What determines the level of LLM vulnerability reported in the results?

The vulnerability is substantial but depends on the dataset and comparator; LLMs show higher ASR versus the averaged ML baseline on all five datasets, while comparisons against LightGBM vary by dataset and show a consistent cross-architecture transfer hierarchy.

Jul 16, 2026

Upload by Theodore