Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls

Summary: Unit 42 researchers built an automated fuzzer called AdvJudge-Zero that manipulates LLM-based AI judges into approving policy violations using stealthy input sequences, a form of prompt injection. The tool achieved a 99% success rate in bypassing controls across several widely used architectures, using benign formatting tokens that yield perplexity scores as low as verified stealth jailbreak tokens and far lower than GCG gibberish.

Why it matters: AI judges often serve as the final line of defense and are used to score model responses during RLHF training, so a hacked judge means the AI learns the wrong lessons. The same fuzzing methodology, run internally with adversarial training, can reduce that 99% attack success rate to near zero.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
AI Security
Related