Conference research

Embeds iteratively generated chaotic maps into reasoning chains to implement jailbreaks, achieving attack success rates of 96%, 86%, and 98% on three models on the Trotter dataset.

Finds that safety restrictions can be bypassed without modifying the harmful request text, merely by changing the tokenization method, and verifies on three large models that its attack effectiveness is competitive with existing state-of-the-art methods.

We empirically evaluate the safety of 13 SLMs under various jailbreak attacks; most are vulnerable. Defense methods are effective, and we analyze safety degradation caused by techniques such as compression, quantization, and distillation.

By decomposing attack strategies and combining genetic optimization to expand the search space, a jailbreak success rate of over 90% is achieved on the tested Claude-3.5, and cross-model transferability is demonstrated.

Studies rewriting before distillation and watermark neutralization after distillation, finding that targeted rewriting and inference-time neutralization can both eliminate inherited watermarks, with the latter also maintaining knowledge transfer efficiency and lower computational overhead.

We propose the MAC benchmark, using language models to generate deceptive text that reveals compositional vulnerabilities in multimodal representations, and improve both attack success rate and sample diversity through self-training.

Using generative adversarial networks to learn the model's internal safety decision boundary, the average jailbreak success rate across three models is 88.85%, and the defense success rate is 84.17%.

Proposes CoA, which generates multi-turn attack chains from an interrogation perspective to hide jailbreak intent, achieving an attack success rate of 83% on black-box LLMs, higher than the comparison method's 64%.

Malicious queries are split into multiple sub-queries and images are edited step by step, bypassing defenses in over 60% of cases (other methods: 14%), and a Think-Twice Prompting defense is proposed that blocks over 95% of attacks.

Proposing a gray-box attack that delivers harmful instructions through adversarial images or audio, bypassing safety mechanisms across various vision and audio language models, and revealing clear gaps in existing defenses.

Proposes AutoDoS, which constructs DoS attack trees under black-box conditions and iteratively optimizes them, amplifying service response latency by over 250 times, and can bypass existing defenses via Length Trojan.

Theoretical analysis shows that chain-of-thought reasoning has a dual role in jailbreak harm, and proposed the FicDetail jailbreak method to experimentally verify the theoretical findings.

Proposes the DSN attack, which combines cosine decay scheduling with refusal suppression to improve the loss objective of optimization-based jailbreaks, achieving state-of-the-art attack success rates, and can transfer to unseen datasets and black-box models.

We evaluate the behavior of open and closed models in generating personalized fake news, finding that most models lack sufficient safety filtering, and that personalization requirements further reduce filter trigger rates, creating a jailbreak effect.

Proposes the black-box jailbreak method ICE and the evaluation set BiSceneEval, achieving high attack success rates with a single query and cross-model transferability, exposing key vulnerabilities in existing defenses.

Proposes the AVATAR framework, which induces models to calibrate harmless metaphors into harmful content, demonstrating high attack success rates and cross-model transferability on multiple advanced models.

Proposes an RL framework that generates deceptive contexts to rewrite LLM beliefs about basic axioms in mathematics or philosophy, outperforming simple multi-turn prompting methods.

Analyzes and removes redundant constraints in gradient-based jailbreak optimization, increasing cross-model attack success rate from 18.4% to 50.3%, while improving the stability and controllability of attack behavior.

MML reduces exposure of malicious intent through cross-text and image encoding and covert guidance, achieving approximately 99% attack success rate against GPT-4o on three safety benchmarks.

Proposing REDA, which disguises attack intent as defensive tasks, and combined with a few in-context examples achieves single-iteration jailbreak, outperforming existing methods on both open-source and closed-source models.

Evaluates 17 jailbreak attacks across nine aligned models and eight defenses, establishes an attack taxonomy, and finds that heuristic attacks can achieve high success rates but are more easily mitigated by defenses.

Proposed ActorBreaker, which uses multi-turn prompts semantically related to harmful content to bypass defenses; the attack outperforms existing methods in diversity, effectiveness, and efficiency, and derived training data can enhance robustness.

Reconstructed multi-turn jailbreak conversations into single-turn prompts, achieving attack success rates of 70.6% to 95.9%, up to 17.5 percentage points higher than the original attacks, with average token usage reduced by more than half.

Proposes the CEMA black-box attack leveraging cross-task transferability, achieving significant attack effects with only 100 queries, and can attack commercial translation interfaces, language models, and image generation models.

Using individually safe images and text combined to form harmful meanings, nine text-to-image models have unsafe generation rates of about 10% to 70%, and common filters fail to defend effectively.

Constructs a benchmark containing approximately 17,000 tampered video clips, evaluates the resistance of 45 MLLMs to five types of tampering, and finds that robustness varies greatly and larger parameter counts do not necessarily mean greater robustness.

Converting malicious requests into structured non-natural query languages to bypass safety alignment achieves a high attack success rate on mainstream models and under multiple defenses.

Uses feedback from a retrieval-augmented detector to iteratively rewrite real-time news, generating deceptive samples that reduce the GPT-4o detector's ROC-AUC by 17.5 percentage points.

Proposes the Red Queen attack that hides malicious intent over multiple rounds, achieving an ASR of 87.6% on GPT-4o, and large models are more susceptible; the proposed Red Queen Guard can reduce ASR to below 1%.

A black-box jailbreak method, R2J, is proposed that can jailbreak merely by rewriting the original instruction and iteratively optimizing the strategy, requiring no additional features, being harder to detect, and transferring across multiple datasets and models.

First masks harmful keywords in malicious queries, then uses a simple auxiliary task to encode their semantics to complete jailbreak; on AdvBench the ASR reaches up to 85%, outperforming baselines.

Proposes SemanticCamo, which uses semantic features to replace unsafe content to hide malicious intent, inducing harmful responses in over 80% of cases on average for GPT-4o, Claude-3.5, etc., and is effective against multiple defenses.

Combines jailbreaking with energy-constrained decoding to generate metaphorical implicit hate speech, finding that GPT-4o and dedicated safety models often misclassify it as harmless content.

Proposes the SIJ jailbreak targeting input prompt construction methods, achieving near-100% attack success rates on five open-source models and averaging over 85% on five closed-source models.

Proposes the SEED attack, which covertly injects errors in previous reasoning steps without modifying instructions, inducing errors in subsequent reasoning and final answers across four datasets and four models.

Using DPO fine-tuning to make generated text style approach human writing, only a few samples are needed to significantly reduce the detection performance of mainstream detectors such as Mage and Radar.

Proposing ReGENT based on reinforcement learning, which uses small perturbations imperceptible to the human eye to make target documents retrieved and mislead the RAG final answer, outperforming existing attack methods.

Addressing the lack of safety generalization across semantically equivalent inputs, we find that multi-turn, multi-image, and translation-based attacks introduce new vulnerabilities, and propose a structure-rewriting guardrail that significantly improves refusal of harmful inputs without increasing over-refusals.

Proposes the TIP attack, which embeds sequence transformation tasks into prompts to indirectly construct violating inputs, and the PHRYGE benchmark. Experiments show this attack can bypass the safety protections of six advanced language models.

Evaluates multiple bias-inducing attacks and their transferability, finding that models are generally more susceptible to gender bias attacks, and that larger models and pretrained base models are also often more vulnerable.

Under black-box conditions, generated adversarial images with imperceptible perturbations that increase the inference computational cost of vision-language models by up to 128.47%.

Finds that vertically arranged text significantly reduces model classification accuracy, posing a potential risk of bypassing harmful content detection; chain of thought does not help mitigate this, while few-shot learning combined with detailed analysis is effective.

Tests many-shot jailbreaks in contexts up to 128K tokens, finding that context length is the main factor in attack effectiveness, and that repeated examples or even random text can bypass safety measures.

Proposed the CAA benchmark containing four types of audio attacks, evaluated the robustness of six speech-interactive LALMs, and the results show that GPT-4o is the most resistant to attacks.

Constructs an indirect prompt injection evaluation dataset, evaluates existing and specially trained detection models, and compares two injection removal methods: segment deletion and instruction extraction.

Reversed a training-free prompt injection technique to reinforce original instructions, constructing a defense method; experiments show it outperforms existing defense schemes.

Constructs BatchSafeBench and finds that all LLMs are susceptible to interference from injected instructions in batch prompts; probe-based detection accuracy is about 95%, and the relevant attention heads are analyzed.

Proposes a prompt injection method combining semantic sampling, ranking, and iterative optimization to generate fixed suffixes usable for arbitrary user prompts, and validates effectiveness on four models and ten types of target responses.

Constructed the NotInject evaluation set, found that guardrails can misjudge harmless inputs due to trigger words, and proposed PIGuard to reduce such bias and improve prompt injection detection performance.

By verifying whether instructions and tool calls serve user goals, Task Shield reduces GPT-4o's attack success rate to 2.07% on AgentDojo, while maintaining task utility at 69.79%.

Reviews attack methods such as prompt leakage and prompt jailbreak, summarizes their experimental settings, and explores the relationship between prompt threats and prompt injection attacks.

Build a multi-agent attack evaluation framework with independent memory, and enhance the retrieval and propagation capabilities of poisoned samples, improving attack effectiveness across multiple topologies and scenarios with a hundred agents.

Optimize the distribution of attack prompts among multi-agents under bandwidth, latency, and defense constraints, achieving attack effectiveness up to seven times that of traditional methods and bypassing various existing guardrails.

Proposes an agent guardrail that can adaptively generate and continuously optimize safety checks, effectively addressing task-specific risks and systemic safety risks, and can transfer to different agent tasks.

Proposes CIP, which uses causal influence graphs to let agents anticipate harmful consequences and iteratively correct them, improving safety in code execution and mobile device control tasks.

Uses graph neural networks to detect anomalies in multi-agent dialogue graphs and mitigates attacks through topological intervention; experiments show it can recover more than 40% of performance in prompt injection scenarios.

Analyzing the security of multi-agent systems under malicious attacks from a topological perspective, it is found that systems with high connectivity and large scale are more susceptible to adversarial diffusion, and task performance drops by 29.7% under star topology.

Proposed the AiTM attack, which disrupts collaboration by intercepting and tampering with messages between agents, and verified system vulnerability across multiple frameworks, communication structures, and applications.

Proposing a three-pillar framework of knowledge credibility, reasoning reliability, and input robustness, a review and meta-analysis show that proactive defense improves misinformation prevention by up to 63% over traditional methods.

Proposes ToxEdit, which detects toxic activations during forward propagation and takes adaptive inter-layer pathways, outperforming existing knowledge editing methods in both detoxification effectiveness and preservation of general capabilities.

Proposes APL, which measures harmfulness with intrinsic preference probability and uses a conditional generation attacker for iterative adversarial training, reducing Mistral-7B harmful outputs from 5.88% to 0.43% while largely maintaining utility.

Dynamically adjusts internal representations through adversarial games to balance helpfulness and harmlessness, combined with expert-model-assisted sampling; in experiments, safety outperforms all baselines.

Constructs an e-commerce AIGC risk benchmark containing 253,420 image-text pairs, and proposes soft-prompt matching detection, with recall 9.68% higher than mainstream multimodal models and 37.8 times faster inference.

Evaluating 95 role-playing models, it is found that role-playing fine-tuning weakens safety and the risk varies with role characteristics; proposing SaRFT, which outperforms baselines across multiple models and two types of fine-tuning settings.

Proposes a plug-and-play input filtering framework, EDDF, which extracts "attack essence" from known attacks to build a vector database and performs online detection, reducing the attack success rate by at least 20%.

Proposes GBM regularization for LSTM, S4, and CNN to reduce the impact of input perturbations, improving adversarial robustness by up to 8.8% over baselines, and provides the first systematic analysis of S4's robustness.

Constructs a Chinese safety knowledge short-answer benchmark to evaluate models' factuality on knowledge such as laws, policies, and ethics, and analyzes its relationship with retrieval-augmented generation capability and robustness against attacks.

By constructing toxic hard negatives through adversarial rewriting, the model is fine-tuned with a prototype-based contrastive perplexity objective, reducing toxic generation while maintaining commonsense reasoning and reading comprehension performance.

Proposes the concept of context-driven over-refusal and a two-stage evaluation framework COVER, finding that refusal rates vary with task, system prompt, model family, and number of retrieved documents, with translation and summarization tasks having particularly high refusal rates.

Proposes the suffix prompt defense DPP, which significantly reduces the success rate of standard and adaptive jailbreak attacks on two models while having minimal impact on model utility.

Aiming at over-reliance and emotional dependence that anthropomorphic outputs may cause, organizes interventions by combining literature and crowdsourced editing, and proposes a conceptual framework for classifying and evaluating interventions.

By directly editing a small number of relevant parameters with KL regularization, jailbreaks are suppressed while maintaining general capabilities, and the method can adapt to new attack instances.

We identify attention heads sensitive to jailbreaks and reallocate attention at inference time to highlight the user's core intent, requiring no fine-tuning. It generalizes well across different attacks and models while also accounting for over-defense.

Proposes DIESEL, which reorders candidate tokens at generation time by semantic similarity to preset negative concepts, filtering harmful content without fine-tuning, and is effective in adversarial jailbreak scenarios.

A diffusion denoising layer is inserted between the encoder and classifier, combined with adversarial training, iterative denoising, and ensembling, achieving leading defensive performance against common black-box and white-box text attacks.

To identify synthetic text misuse, proposes geometric coverage detection and adaptive online localization methods, which more accurately detect and locate watermarked segments in mixed text across three watermarking techniques.

Proposes KPO, which combines a protein safety knowledge graph with reinforcement learning, reducing the probability of the model generating harmful protein sequences while maintaining high functionality.

Combined acrostics, sensorimotor norms, and red-green watermarks, achieving a detection rate of 98%, which remained 95% after rewriting attacks, higher than the 49% of red-green watermarks alone.

It is found that global gradient ascent simultaneously damages natural knowledge, causing utility collapse; proposing FTTP, which applies gradient ascent only to target concept knowledge without requiring a retention set, achieving a better trade-off between unlearning and utility.

Proposes MEOW, which achieves unlearning by fine-tuning with counterfactual labels generated by an offline LLM, requiring no auxiliary models or retained data; it achieves better unlearning on ToFU and is more robust to attacks.

Combined logits-based and sampling-based watermarking schemes, adaptively embedding watermarks using token entropy and semantic entropy, and outperformed baselines in the combined performance of detectability, robustness, text quality, and safety.

Finds that vision-language models exhibit specific activation patterns when processing unsafe prompts, and accordingly proposes HiddenDetect, which requires no fine-tuning and outperforms existing state-of-the-art methods in jailbreak detection.

Finds that pruning harms vision-language model safety, and proposes HSR to locate safety-critical attention heads and restore relevant neurons, improving safety performance across multiple pruning settings.

Proposes the anthropomorphic tone metric HumT, finds that users prefer less anthropomorphic outputs in many contexts, and uses DumT to reduce anthropomorphic tone while maintaining performance.

Locates safety-critical singular vectors and initializes LoRA accordingly, restricting training updates to safety-related parameters; experiments show it preserves defense effectiveness while mitigating general capability loss.

Proposes the multi-channel unbiased watermark MCmark, which improves robustness while preserving the original generation distribution; experiments show detectability improves by more than 10% over the existing best unbiased watermark.

Proposes the GREATER framework that synchronously updates the attacker and detector, improving detection and defense across ten text perturbations and six types of adversarial attacks, while also enhancing attack generation efficiency.

Proposes a pipeline for automatically generating paired data containing implicit offensiveness and popular slang; the generated data has high pairing consistency and supports training high-performance detoxification models through simple instruction fine-tuning.

By training to amplify the edit distance difference when the model rewrites human versus machine text, it achieves generated-text detection, and outperforms existing detection methods in cross-domain and adversarial attack tests.

Improve model merging through neuron localization, screening, and conflict-update isolation, reducing the harmful response rate by 31.4% on Llama-3-8B-Instruct while retaining 95% of utility performance.

Combines similar meme retrieval, bidirectional insight extraction, and multi-agent debate to detect harmful memes without labeled data, outperforming existing zero-shot methods on three datasets.

Proposes a multi-turn safety alignment framework that trains models with thought-guided attack learning, iterative attack-defense, and future-reward reinforcement learning, simultaneously improving red-team attack capability and target model safety performance.

Using large models for zero-shot and few-shot re-ranking to reduce exposure to harmful content, and proposing two evaluation metrics, experiments on three datasets outperform existing proprietary moderation methods.

To address refusal position bias, the model is trained to shift from harmful content to refusal at any generated position, improving safety across six attack scenarios on two types of models without harming performance.

Proposes a multi-scale conformal prediction detection framework and the RealDet dataset, improving detection performance and adversarial attack robustness while constraining the false positive rate in machine-generated text detection.

Proposes RepBend, which integrates activation steering into the fine-tuning loss to disrupt harmful behavior representations, reducing attack success rate by up to 95% across multiple jailbreak benchmarks with negligible loss of general capabilities.

Aiming at the vulnerability of embedding-as-a-service to model extraction attacks, proposes ESpeW to inject a unique watermark into each embedding, with an impact on embeddings below 1%, and can resist watermark removal attacks.

Leverages the model's ability to identify already generated harmful content to progressively correct harmful outputs combined with speculative decoding, improving safety while maintaining helpfulness and inference speed.

Evaluated 13 reasoning models on StrongReject and WildJailbreak and found their safety lags behind their reasoning ability; proposed the CoT-style safety training dataset SafeChain, which improves safety after fine-tuning while maintaining reasoning performance.

Constructs a safety unlearning benchmark with 3,000 images and 28.8K VQA pairs, finds that existing methods tend to over-forget; proposes Prompt Decouple Loss, which reduces LLaVA's SARR metric by 79.5%.

Uses a binary classifier router to distinguish easy and hard samples, invoking a large safety guardrail model only for hard cases, improving the trade-off between computational cost and safety performance on multiple benchmarks.

Proposing CKU, which locates and protects neurons related to useful knowledge, clipping their gradients when forgetting harmful knowledge; experiments show it can improve safety while maintaining overall performance.

Proposes RATIONAL, which trains the model to perform explicit safety reasoning before answering, enabling it to refuse harmful prompts while providing contextually appropriate responses to counter jailbreak attacks.

Through large-scale experiments and human review, the random walk watermark removal attack is examined, finding that mixing is slow and quality discrimination is unreliable, with a removal success rate of only 10% after human review.

It finds that jailbreaks push harmful activations beyond the safety boundary, and proposes activation boundary defense ABD, with an average defense success rate exceeding 98% and general capability impact below 2%.

Trains a lightweight classification head on the last-layer hidden states of a dialogue model for streaming harmful content detection, achieving SOTA on XSTest and SafeRLHF, about 300 times faster than LLM moderation models.

By using contrastive learning to balance the influence of each node in the propagation tree on prediction, the clean data classification accuracy is maintained on Twitter and Weibo data, and resistance to injection of model-generated messages is enhanced.

Finds that the "risk coupling" between villainous characters and user questions creates a safety-utility trade-off, proposes the ADMP method to dynamically adjust preferences and introduces CMS, improving safety metrics while maintaining utility.

Proposes ThinkGuard, a guardrail model with critique generation, distilling structured critiques from large models; it achieves the highest average F1 across multiple safety benchmarks, improving accuracy by 16.1% over LLaMA Guard 3.

Proposes AIDSAFE, which uses multi-agent iterative negotiation to generate CoT data containing safety policies; fine-tuning open-source LLMs on this data improves safety generalization and jailbreak robustness while maintaining acceptable utility.

Finds that introducing the visual modality causes representation shift leading to degradation of safety alignment, and proposes an inference-time intervention method CMRM, reducing LLaVA-7B's unsafe rate from 61.53% to 3.15%.

Propose the concept of safety calibration that simultaneously measures under-safety and over-safety, construct a dataset of 3,600 image-text pairs to evaluate 11 VLMs, and find that calibration improvement methods harm model utility.

Proposes the STA-1 watermark, which preserves the original token distribution in expectation, reduces output quality risk in low-entropy scenarios, and achieves efficient detection that requires no prompts or white-box models and is robust to various attacks.

Finds that when an attacker clones an embedding service, existing watermarks can be removed through rewriting; proposes a linear transformation watermark and verifies its robustness against rewriting attacks both theoretically and experimentally.

Addressing the gap where models can recognize jailbreaks yet still generate unsafe responses, propose the training-free defense SAGE, achieving an average defense success rate of 99% across tested attacks.

To prevent opinion manipulation, constructs a large-scale Korean comment dataset and proposes an interpretable detection framework, achieving F1 scores of 98.5% and 84.3% for model-generated comment detection and source attribution, respectively.

We propose the NaVAB benchmark to evaluate the alignment of LLMs with the values of five countries—China, the US, the UK, France, and Germany—and show that combining alignment techniques can bring model values closer to a target country.

Enhanced safety alignment by simulating the long-term social impact of suggestions, constructed 100 indirect harm scenarios, and the new dataset improved performance by over 20%.

Proposes the model merging method MergeAlign, which improves expert model safety by interpolating domain and alignment parameter increments, with almost no loss of domain performance on medical and financial benchmarks.

Model decoding as heuristic-guided search, with a custom reward trading off harmlessness, helpfulness, and other objectives; experiments show improved alignment and complementarity with RLHF and prompting methods.

Uses the model's internal safety judgment signals to reorder preference data, mitigating distribution shift from off-policy training, improving safety performance and avoiding roughly 300x computational cost.

Comparing instruction-tuned models with base models, we find that fine-tuning increases the model's acceptance of false user information and shifts susceptibility from the assistant role to the user role.

Proposes a generative psycholexical method and a five-factor value system that, compared with the Schwartz value system, better characterizes model values and improves safety prediction and alignment outcomes.

To address overfitting in weakly supervised alignment, a two-stage framework that simultaneously improves the quality of supervision signals and input questions is proposed, significantly increasing the performance gap recovery rate on mathematical benchmarks.

Proposed HyPER to select a combination of human and model preference annotations, reducing labor costs while improving reward model performance, and found that prompts with moderate safety risk or complexity benefit most from human feedback.

Reveals from compression theory and experiments that aligned models tend to regress to pretraining behavior distributions after further fine-tuning, and this rebound tendency strengthens with larger model size and pretraining data volume.

Proposes a low-rank safety subspace fusion method that restores the safety alignment of fine-tuned models without further fine-tuning, and experiments show it has minimal impact on downstream task performance.

Constructs a reward model benchmark covering 23 languages and tasks such as safety, finding a significant gap between English and non-English performance, and that model preferences also vary greatly across languages.

Combines a four-stage safety reasoning chain with step-wise routed multi-LoRA experts to improve model safety, jailbreak resistance, and over-refusal, reporting performance comparable to o1.

Proposes MPO, which transfers safety capabilities by narrowing the reward gap between advantaged and target languages; improves multilingual safety alignment across three model families without degrading general utility.

Releases a dataset distinguishing helpfulness from harmfulness, covering 19 categories of harm and three severity levels, and uses it to train a severity-aware review model and safe RLHF algorithms.

Proposes PopAlign, introducing six contrastive strategies at the prompt, model, and pipeline levels that require no additional feedback annotation; experiments show that diverse preference data can improve alignment effectiveness.

Proposes γ-PO, which suppresses preference data noise through pairwise calibration of reward intervals, improving on multiple alignment benchmarks by an average of 4.4% over other baselines.

Classifies safety risks into three levels according to legal standards, constructing a benchmark with 24,860 multiple-choice questions and 1,106 question-answering items; Claude-3.5-Sonnet and GPT-4o both have multiple-choice accuracy not exceeding 80.5%, with 20 models averaging 68.8%.

Proposes SEA, which synthesizes embeddings of other modalities using only text data for safety alignment, improving safety on image, video, and audio models, and proposes video and audio safety evaluation benchmarks.

Proposes IRR, which identifies and removes unsafe parameter updates and recalibrates retained parameters, improving safety performance on harmful queries and jailbreaks while maintaining downstream performance in full fine-tuning and LoRA experiments.

Quantitatively evaluates value principles from comprehensiveness, precision, and compatibility, proposes the HiVaP framework that retrieves principles level by level according to scenarios, and experiments show it can improve alignment effectiveness.

Proposes a computationally efficient influence function approximation method to quantify the role of human feedback on reward models, and uses it to detect annotator bias and guide feedback toward expert judgment.

Found that personal value alignment may increase harmful model behavior, analyzed the association between values and risk and psychological explanations, and proposed a contextual alignment method to improve safety.

Through multiple-choice evaluations with no correct option, finds that aligned models often follow instructions and choose incorrect answers, exposing a conflict between alignment optimization and reflective judgment.

In simulated legislative scenarios, it is found that models can use covert wording to conceal beneficiary companies; replanning and sampling increase the deception rate by up to 40 percentage points, and human evaluation supports the automated evaluation results.

Reward models are easily hijacked by surface features such as verbosity and lists; CARMO first dynamically generates evaluation criteria related to the query before scoring, which theoretically can mitigate reward hacking and improves 2.1% on Reward Bench.

Finds that prompt template bias learned by reward models can trigger reward hacking, making models prefer specific formats; proposes PBC to calibrate reward scores, which can be combined with length debiasing methods.

Proposes STA, which separates and manipulates decoupled knowledge components to enhance safety; experiments show its robustness and flexibility in adversarial scenarios, and verify its control effect on reasoning models.

Proposes COSMIC, which uses cosine similarity to automatically select refusal steering directions and target layers without relying on refusal tokens, and can identify refusal directions even in adversarial scenarios and weakly safety-aligned models.

Probe vectors are trained for different toxicity categories, dynamically selected and scaled during generation, then subtracted from the model; toxicity is reduced by up to 78.52% with fluency nearly unchanged.

Dynamically adjusts the contribution of feed-forward layer sub-updates based on input relevance, improving predictions with fewer trainable parameters, and shows effectiveness in sentiment-controlled generation and reducing toxic outputs.

Proposes MAT-Steer, which mitigates attribute conflicts through selective token intervention and sparse orthogonal steering vectors, outperforming existing methods on tasks balancing attributes such as factuality and toxicity.

Identifies neurons related to aggressive expression and conducts ablation and activation experiments, finding that manipulating only a few neurons can increase aggressiveness by up to 33%, with effects varying by layer position.

Through experiments and mechanistic analysis, finds that the safety decisions of multiple aligned models rely excessively on template regions, leading to jailbreak vulnerability; reducing this reliance is expected to improve defenses.

Constructed a high-noise simulated training environment, characterized the learning behavior of poisoned data using confidence variance, and identified target labels and poisoned samples, with attack success rate reduction averaging 21% higher than the second-best defense.

Proposes CoS, which detects backdoors by checking consistency between reasoning steps and final outputs, applicable to API-only models. Experiments show stronger models benefit more.

Proposes the AGGD attack, which generates adversarial passages to inject into the retrieval corpus, achieving an attack success rate 15–17 percentage points higher than HotFlip on ANCE, and can transfer to RAG knowledge poisoning.

Through more than 1,300 experiments comparing 12 backdoor attacks, finds that parameter-efficient fine-tuning attacks consistently outperform fine-tuning-free methods in classification tasks, and provides a unified research toolbox.

Proposed an editing-based generative backdoor that requires only modifying a small number of local parameters and few-shot examples to trigger with high success rate, and when triggered can output preset dangerous information while completing downstream tasks.

Proposes a two-stage fine-tuning method called MEraser, which completely removes backdoor-based certified fingerprints in tested models using fewer than a thousand samples while maintaining model performance.

Proposes a method of passing backdoors to merged models by maliciously uploading models, which is effective across multiple models, merging algorithms, and real-model experiments, and can resist the three tested defenses.

Proposes GMTP, which uses retriever similarity gradients to locate key tokens and uses MLM to check mask probabilities, filtering out more than 90% of poisoned content while retaining relevant documents.

Proposes a backdoor paradigm BadMLLM that requires no external trigger, implicitly inserting promotional content when answers involve specific objects, balancing attack effectiveness and model utility across five MLLMs.

Poisoning instruction fine-tuning data in just one or two languages transfers to unpoisoned languages, achieving an average attack success rate of 99% across 26 languages, remaining effective after defenses, with stronger models being more susceptible.

By editing the bottleneck layer of a text encoder, a trojan can be implanted without training or data, achieving an average attack success rate of 91% and reducing injection time to 25 seconds.

Proposes W2SDefense, which uses a small clean teacher model to guide poisoned large models to forget backdoors through feature alignment distillation, effective against multiple backdoor attacks without harming performance.

Comparing explanations of backdoored models on clean versus poisoned inputs, it is found that poisoned inputs trigger diverse and logically flawed explanations, accompanied by changes in final-layer tokens and attention.

Proposes the extraction algorithm LoRD for large models, which uses victim model responses to guide local model preference learning, validates extraction effectiveness on multiple commercial models, and analyzes query cost and watermark defense weakening.

Proposed GRUN, which uses soft gating to distinguish target data and adjusts representations via ReFT to suppress generation, significantly improving forgetting effectiveness and model utility while removing copyrighted and private data.

Through thousands of multi-setting experiments re-evaluating membership inference, finds that most methods are not statistically better than baselines, effectiveness is affected by model scale and domain, and threshold selection is a neglected challenge.

Proposes the PhiMM attack: training a phishing model disguised as a specialized capability, which after victim merging can extract PII and membership information, with an average PII leakage increase of 3.9% and membership inference leakage increase of 17.4%.

Proposed the first open-source multimodal unlearning benchmark, containing 200 fictional characters and 3700 images, evaluated 11 methods, and found that jointly unlearning both modalities outperforms single-modality unlearning.

Proposes NeuMuter, which forgets specified data by modulating the outputs of only about 1% of FFN neurons, effectively forgetting on four LLMs while maintaining downstream task performance.

Combining a general-purpose LLM with a genetic algorithm, we generate relevant and diverse synthetic text under differential privacy constraints, significantly improving downstream task performance while preserving privacy.

Based on local differential privacy, dynamically constructs and replaces sensitive-word adjacency lists by semantic density, achieving a better balance between privacy and utility, and outperforming strong baselines on three datasets.

Proposes a context influence metric based on differential privacy to distinguish leakage caused by parametric knowledge versus context, and finds that context deviating from the parametric knowledge distribution can cause privacy leakage.

Proposes an attack that extracts sensitive information using the model's low-ranked output tokens, and validates its effectiveness in both privacy extraction in agent applications and direct training data extraction scenarios.

Proposed a geometrically constrained gradient ascent method that removes entity-related visual patterns while preserving textual knowledge, outperforming compared unlearning baselines across all evaluation dimensions.

Addressing the problem of multimodal models memorizing and leaking sensitive information, a method is proposed to identify and prune relevant neurons by modality, achieving more balanced cross-modal unlearning with less impact on model utility.

Proposed the entity-level unlearning method Opt-Out and the evaluation set ELUDe, which uses Wasserstein distance between parameters to delete knowledge of target entities, and experiments showed it outperforms existing methods.

Proposes PIG, which extracts personal identity information through gradient-based iterative optimization of context, outperforming baselines on four white-box and two black-box models, revealing privacy leakage risks after safety alignment.

Constructs a contextual privacy benchmark covering regulations, case law, privacy policies, and synthetic data, and finds that although models can identify key contextual parameters, privacy compliance capabilities remain insufficient.

Proposes PME, which detects and edits personally identifiable information memorized by models, reducing training data extraction leakage without affecting the base language model; attack accuracy drops to zero in some configurations.

Proposes a two-step privacy theft attack: first, the LLM recalls and fills in masked text to extract PII candidates, then a reference model calibrates the ranking; PII can still be reconstructed even when training data has been cleaned.

Starting from anonymized clinical entities, LLMs are used to complete context and generate synthetic corpora, requiring only a small number of original documents; experiments show utility close to the original data, with privacy security better than baselines.

A non-gradient method, REVS, is proposed that modifies a small number of neurons related to sensitive information to unlearn PII such as emails and SSNs, outperforming other methods in resistance to extraction attacks while maintaining model integrity.

Proposes SaMIA, which uses only the n-gram matching score of LLM-generated text to compute pseudo-likelihood for determining whether text is in the training set, achieving performance comparable to existing methods without requiring likelihood, and applicable to closed-source models.

Proposes DuoLearn, which distinguishes hard tokens to learn from memorized tokens to forget based on token characteristics, defending against membership inference attacks during training while improving language modeling performance by about 10%.

Systematically identify five types of leakage pathways for GPTs knowledge files, among which a privilege escalation vulnerability introduced by the code interpreter can allow attackers to directly download original files, with a success rate of 95.95%.

It is found that syntactically similar queries suffer the greatest performance loss in entity unlearning; using them for regularization can protect such queries while maintaining or improving performance on other subsets.

Proposes the first fingerprinting method for black-box tampering detection of LLMs, using only 5 fingerprint samples to detect fine-tuning, compression, and backdoor injection with a detection rate exceeding 99.2%.

Proposing the SHIP attack: the supplier implants permutation triggers that activate only when appearing in a precise order, bypassing the deployer's system prompt, achieving ASR up to 100% on eight models and resisting six defenses.

Proposes the UNCD framework and the UNCD-Cyber benchmark for fine-grained evaluation of dangerous capability removal, and uses UNCD-Agent to generate unlearning data targeting residual knowledge to improve unlearning effectiveness.

Construct 14,888 multiple-choice questions covering seven categories of frontier risks, and find that most tested Chinese models have a weighted risk tendency exceeding 40%; the measurement target is the tendency in responses, not actual behavior.

Builds a three-stage evaluation framework and conducts 14,400 agent simulations on 12 LLMs, finding that they spontaneously exhibit catastrophic behaviors and deception, and that stronger reasoning ability often correlates with higher risk.

Uses vulnerability descriptions to supervise contrastive learning of code representations, achieving F1 scores of 72.82% and 80.34% on vulnerability detection and classification tasks, respectively, outperforming existing methods.

Constructed MalwareBench with 3,520 jailbreak prompts and found that mainstream models have an average rejection rate of 60.93% for malicious code requests, which drops to 39.92% when combined with jailbreaks.

Proposing SDD, which makes the model generate high-quality but irrelevant responses to harmful prompts, causing general capabilities to degrade significantly under malicious fine-tuning, thereby suppressing harmful instruction execution; experiments verify its effectiveness.

Through multi-agent collaboration, iteratively supplements high-difficulty meme images, adaptively evaluates multimodal models' understanding of harmfulness, and reveals fine-grained reasoning weaknesses of different models.

Proposes a Monte Carlo tree search framework using a large model as the world model, improving red-team attack success rate while maintaining computational efficiency.

Have two instances of the same model hold opposing viewpoints to persuade a neutral instance, evaluating the persistence of bias across models and languages, as well as the tendency to reinforce misinformation or shift toward harmful viewpoints.

Built a safety awareness benchmark covering 29 scenario categories and 1,500 image-text input pairs, found that nine models simultaneously have problems of both missing dangerous content and over-sensitivity, and none of the three types of improvement methods reached a satisfactory level.

Proposed the multilingual CSRT red-teaming framework, which achieved 46.7% more successful attacks than standard English attacks across ten models, revealing weaknesses in multilingual safety alignment.

Proposes CogSafe, which dynamically generates multi-turn dialogues through scenario simulation, policy decision-making, and cognitive processes, with experiments validating the effectiveness and scalability of its safety evaluation.

Proposes DESGD, which uses the evil score of a small unsafe model to adjust the target model's logits during decoding, achieving an ASR of 92.83% on Llama-3.2-3B, higher than the 83.48% of adversarial fine-tuning.

Tests six mainstream retrievers; most can select harmful passages for over 50% of malicious queries, instruction-following capabilities can be exploited, and harmful passages cause safety-aligned LLMs to satisfy malicious requests.

Analyzing conversations where users use ChatGPT for companionship in loneliness, finding that it fails to properly respond to suicidal ideation and trauma, with toxic content occurring 35% more often in related conversations.

Constructs a long-context safety benchmark with 1,543 cases, evaluates 16 models and finds that most safety rates are below 55%, and that short-context safety performance does not guarantee long-context safety.

Proposes dual implicit toxicity and a benchmark containing 317,638 questions, evaluates 13 LMMs, and finds they struggle to handle such toxicity, with performance significantly declining at the difficult level.

Constructed LLM safety evaluation datasets for Kazakh and Russian, and experiments showed significant differences in safety performance between multilingual and specialized models, emphasizing the need for regionalized safety data.

Evaluates 11 safety review models, finding that surface wording such as apologies can significantly distort safety judgments; multi-model joint review shows improvement but still cannot eliminate such sensitivity.

Synthesizes safety training data from three dimensions—lexical, malicious intent, and jailbreak strategies—and after fine-tuning, reduces the average harm score by 14.29% and the attack success rate by 20% compared to the best baseline.

Finds that text in existing benchmarks leaks image risk cues, constructs 2,200 image-text samples without such leakage, and finds that multimodal alignment outperforms text-only alignment after eliminating the leakage.