← Back to Library

Monotonicity as an Architectural Bias for Robust Language Models

Authors: Patrick Cooper, Alireza Nadali, Ashutosh Trivedi, Alvaro Velasquez

Published: 2026-02-02

arXiv ID: 2602.02686v1

Added to Library: 2026-02-04 03:04 UTC

📄 Abstract

Large language models (LLMs) are known to exhibit brittle behavior under adversarial prompts and jailbreak attacks, even after extensive alignment and fine-tuning. This fragility reflects a broader challenge of modern neural language models: small, carefully structured perturbations in high-dimensional input spaces can induce large and unpredictable changes in internal semantic representations and output. We investigate monotonicity as an architectural inductive bias for improving the robustness of Transformer-based language models. Monotonicity constrains semantic transformations so that strengthening information, evidence, or constraints cannot lead to regressions in the corresponding internal representations. Such order-preserving behavior has long been exploited in control and safety-critical systems to simplify reasoning and improve robustness, but has traditionally been viewed as incompatible with the expressivity required by neural language models. We show that this trade-off is not inherent. By enforcing monotonicity selectively in the feed-forward sublayers of sequence-to-sequence Transformers -- while leaving attention mechanisms unconstrained -- we obtain monotone language models that preserve the performance of their pretrained counterparts. This architectural separation allows negation, contradiction, and contextual interactions to be introduced explicitly through attention, while ensuring that subsequent semantic refinement is order-preserving. Empirically, monotonicity substantially improves robustness: adversarial attack success rates drop from approximately 69% to 19%, while standard summarization performance degrades only marginally.

🔍 Key Points

  • Development of AgentDyn, a dynamic open-ended benchmark to assess the resilience of AI agents against prompt injection attacks.
  • Identification and critical analysis of three major flaws in existing benchmarks: lack of dynamic tasks, absence of helpful instructions, and overly simplistic user tasks.
  • Empirical investigation demonstrating that state-of-the-art defenses exhibit significant vulnerabilities when tested against AgentDyn, highlighting their inadequacy for real-world deployment.
  • Introduction of a comprehensive suite of 60 challenging user tasks and 560 injection scenarios across various real-life applications such as Shopping and GitHub.
  • Evaluation results showing that almost all defenses face severe utility drops under dynamic and complex attack scenarios, exposing the shortcomings in their robustness.

💡 Why This Paper Matters

This paper is relevant and important because it addresses the critical security challenges posed by prompt injection attacks in AI agents, which are increasingly integrated into complex real-world applications. By introducing AgentDyn, the authors not only provide a new standard for evaluating agent defenses but also raise awareness about the limitations of current methods and the need for more robust security frameworks. This contribution is vital as it informs both researchers and developers on the vulnerabilities of existing systems and encourages the advancement of secure AI technologies.

🎯 Why It's Interesting for AI Security Researchers

This paper is of interest to AI security researchers as it presents groundbreaking insights into the vulnerabilities of existing defenses against prompt injection attacks, a significant concern for the deployment of AI systems. The introduction of AgentDyn as a new benchmark for assessing agent security and its ability to expose hidden failures of traditional defenses offers valuable data and encourages further research and innovation in the design of more secure AI architectures. The findings can influence the development of protective measures and promote a deeper understanding of AI security within the research community.

📚 Read the Full Paper