跳转至

文章背景与核心概要

状态空间模型（SSMs）如 Mamba 凭借线性时间复杂度，为传统的 Transformer 架构语言模型提供了一种计算效率更高的替代方案。然而，学界对其对抗鲁棒性的研究仍处于起步阶段。本文引入并研究了隐藏状态投毒攻击（Hidden State Poisoning Attacks, HiSPAs）——这是一种新型漏洞，特定的简短输入短语会引发 SSM 产生“部分失忆”效应，从而不可逆地覆写其隐藏状态中的信息。

为了评估这一威胁，作者开发了 RoBench-25 基准测试，用于评估在 HiSPA 影响下的信息检索能力，结果揭示了 SSM 极度脆弱： * 混合模型脆弱性： 52B 的混合 SSM-Transformer 模型 Jamba-1.7-Mini 在特定 HiSPA 触发器下于 RoBench-25 上遭遇全面崩溃，而纯 Transformer 模型则保持了良好的鲁棒性。 * 提示词注入弱点： HiSPA 触发器显著削弱了 Jamba 在 Open-Prompt-Injections 基准测试上的性能表现。 * 广泛的普适性： 理论和实验发现同样适用于 Mamba-2 以及 Nemotron-3-Nano 等混合模型。

最后，可解释性分析揭示了在攻击过程中 Mamba 隐藏层的独特激活模式，这为未来构建 HiSPA 防御系统奠定了基础。完整代码与实验数据已发布在 GitHub 仓库中。

Hidden State Poisoning Attacks against Mamba-based Language Models

Summary

State Space Models (SSMs) like Mamba offer a computationally efficient alternative to traditional Transformer-based language models by achieving linear time complexity. However, their adversarial robustness remains largely unexplored. This paper introduces and investigates Hidden State Poisoning Attacks (HiSPAs)—a vulnerability where specific short input phrases trigger a "partial amnesia" effect in SSMs, irreversibly overwriting information in their hidden states.

To evaluate this, the authors developed RoBench-25, a benchmark assessing information retrieval under HiSPAs, which revealed severe vulnerabilities in SSMs: * Hybrid Model Vulnerability: The 52B hybrid SSM-Transformer model Jamba-1.7-Mini experiences total collapse on RoBench-25 under certain HiSPA triggers, whereas pure Transformers remain resilient. * Prompt Injection Weakness: HiSPA triggers significantly weaken Jamba's performance on the Open-Prompt-Injections benchmark. * Broad Applicability: Theoretical and empirical findings extend to Mamba-2 and hybrid models like Nemotron-3-Nano.

Finally, an interpretability analysis uncovers distinct activation patterns in Mamba's hidden layers during these attacks, paving the way for future HiSPA mitigation systems. The full code and experimental data are available in the GitHub Repository.

Paper Metadata

Paper Metadata

  • arXiv ID: arXiv:2601.01972 [cs.CL]
  • Authors: Alexandre Le Mercier, Chris Develder, Thomas Demeester
    • Authors: Alexandre Le Mercier, Chris Develder, Thomas Demeester
  • Primary Subject: Computation and Language (cs.CL)
    • Primary Subject: Computation and Language (cs.CL)
  • Secondary Subjects: Artificial Intelligence (cs.AI), Machine Learning (cs.LG)
    • Secondary Subjects: Artificial Intelligence (cs.AI), Machine Learning (cs.LG)
  • Publication: Accepted to Findings of the Association for Computational Linguistics: EMNLP 2026 (27 pages, 4 figures)
    • Publication: Accepted to Findings of the Association for Computational Linguistics: EMNLP 2026 (27 pages, 4 figures)
  • Submitted: January 5, 2026; Last Revised: September 1, 2026 (v5)
    • Submitted: January 5, 2026; Last Revised: September 1, 2026 (v5)
  • DOI: 10.48550/arXiv.2601.01972

Abstract

State space models (SSMs) like Mamba offer efficient alternatives to Transformer-based language models, with linear time complexity. Yet, their adversarial robustness remains critically unexplored. This paper studies the phenomenon whereby specific short input phrases induce a partial amnesia effect in such models, by irreversibly overwriting information in their hidden states, referred to as a Hidden State Poisoning Attack (HiSPA). Our benchmark RoBench-25 allows evaluating a model's information retrieval capabilities when subject to HiSPAs, and confirms the vulnerability of SSMs against such attacks. Even the recent Jamba-1.7-Mini SSM--Transformer (a 52B hybrid model) collapses on RoBench-25 under some HiSPA triggers, whereas pure Transformers do not. We also observe that HiSPA triggers significantly weaken the Jamba model on the popular Open-Prompt-Injections benchmark, unlike pure Transformers. We further show that the theoretical and empirical findings extend to Mamba-2, and also analyse a Mamba-2-based hybrid (Nemotron-3-Nano). Finally, our interpretability study reveals patterns in Mamba's hidden layers during HiSPAs that could be used to build a HiSPA mitigation system. The full code and data to reproduce the experiments can be found at this GitHub link.

Access & Resources

Access & Resources