There is no universally agreed upon definition of adversarial risk.

Neural networks are known to be vulnerable toadversarial attacks, which are imperceptible perturbations to input data that maximize loss [38, 15, 5].

Traditional approaches focus on aligning models during the instruction tuning orreinforcement learning stages, referred tointhis paperas'postalignment'.

One approach to predicting human attention is through saliency models, which have received considerable research attention.