My adversarial prompt detector was flagging academic papers as GCG suffix attacks.

Not occasionally. 72% of the time.

Here's what happened, why it makes complete sense in hindsight, and the fix that brought it down to 6.7%.

What GCG Suffix Attacks Look Like

GCG (Greedy Coordinate Gradient) attacks are adversarial strings that look like complete noise: