Conference research

Measured leakage via the mutual information between observed signals and target attributes, deriving a lower bound on the number of queries needed for an attack; across seven LLMs, only about a thousand queries with answers alone, about a hundred with logits, and only dozens when the thinking process is disclosed.

It is found that models associate syntactic templates with domain errors, which can override prompt semantics; and it is shown that such spurious correlations can bypass refusals in OLMo-2-7B Instruct and GPT-4o.

Using judge-LLM signals as rewards, a model generating prefix text is adversarially trained, enabling frozen LLMs to achieve higher evaluation scores that are nearly imperceptible, and transferable to unseen models.

From an information-theoretic perspective, generate more universal perturbations by adjusting the mutual information between outputs and adversarial/benign image patterns, improving transfer attack effectiveness against black-box LVLMs and different prompts.

An image preference model is trained to remove and forge watermarks on post-processed images using only a single watermarked image without knowing the watermark model. It is effective against multiple watermarking schemes, questioning their security.

Proposes a black-box TAA framework that bypasses prompt filtering, concept erasure, and image filtering simultaneously, achieving an average attack success rate of 85.6% across 14 T2I models.

Proposes UAP-SAM2, the first universal cross-prompt adversarial attack targeting SAM2, which substantially outperforms existing attacks on six datasets via dual semantic shift perturbations.

By locally cropping and aligning target images in the embedding space, perturbations are concentrated in semantically rich regions, achieving over 90% success rate for transferable targeted attacks on commercial LVLMs.

Organized a watermark attack competition and released a benchmark; the top five teams removed watermarks from at least 89% of images on average while preserving quality, exposing the fragility of existing watermarking methods.

A word-level task concurrency method is proposed and the JAIL-CON iterative attack framework is built, which runs harmful and benign tasks concurrently, can jailbreak mainstream LLMs, and is harder for guardrails to detect than sequential attacks.

Proposes FOA-Attack, combining a global cosine loss with optimal transport-based local feature alignment and dynamic ensemble weighting, to improve the success rate of targeted transfer attacks against closed-source MLLMs.

Proposes training-free Adversarial Paraphrasing, which uses a detector to guide an LLM to rewrite text, reducing the average T@1%F across multiple types of detectors by 87.88%, revealing the fragility of detectors.

Proposes a plug-and-play prefix-forcing objective that selects model-specific prefixes by prefill attack success rate and negative log-likelihood; after replacing GCG's default prefix, the fine-grained attack success rate on Llama-3 rises from 14% to 80%.

First uses benign tasks to teach the model the target response structure, then performs controlled semantic substitution in the final round, achieving an average attack success rate of 93.3% across six models.

Proposes the VMA attack, which uses momentum optimization and differentiable transformations to generate image adversarial perturbations, precisely manipulating VLM outputs, applicable to jailbreaks, hijacking, privacy leakage, and denial of service, and can also inject watermarks.

Proposes a hijacking attack that dynamically allocates perturbation budgets among in-context examples, achieving high attack success rates and good stealth across multiple LLMs, and transferable to other models.

Proposes black-box BoN jailbreak: repeatedly sampling perturbed prompts until a harmful response is elicited, with a success rate of 89% against GPT-4o and 78% against Claude 3.5 Sonnet under 10000 samples, applicable across text, visual, and audio modalities, with the success rate growing as a power law with the number of samples.

Proposes SAA, which uses a witness model to align global and local features of the fine-tuned surrogate model, and introduces a self-adversarial constraint, making adversarial examples more transferable across architectures such as CNN to ViT.

Constructed a medical safety benchmark with over 18,000 prompts, found that most models are vulnerable to paraphrased jailbreaks and over-refuse normal questions, and proposed a lightweight classifier to mitigate this.

Models transfer attacks as consensus robust optimization, proposing CORTA, which achieves 19.1 percentage points higher transfer success rate against CNN and ViT targets with a single surrogate model compared to the best existing method.

We find that introducing regular spacing between repeated textures significantly enhances physical patch attacks; jointly optimizing spacing structure and texture can attack RAFT-Stereo, STTR, and Intel RealSense physical cameras.

Proposes the diffusion-model-based SHIFT attack, which generates semantically different but realistic perturbed states, breaking existing RL defenses and outperforming prior attacks.

Train an adversarial speed function using cascaded distribution shifts to improve the transferability of multi-objective generative adversarial attacks, e.g., success rate increases by 34.58% from Inception-v3 to ResNet-152, and is more resistant to defenses.

Treats unrestricted adversarial example generation as an adversary preference alignment problem; the two-stage APA framework significantly improves black-box attack transferability while maintaining visual consistency.

Proposes the InSUR framework, which generates transferable, adaptive semantic-constraint adversarial examples from natural language instructions, and achieves the first reference-free generation of semantic-constraint 3D adversarial examples.

Based on distribution approximation theory, they optimize a single input-agnostic adversarial perturbation so that it transfers across different image-text pairs, inducing MLLMs to produce harmful responses.

Uses latent-space Bayesian optimization to generate highly readable adversarial suffixes in black-box settings, improving jailbreak success rates and reducing training and inference time, suitable for LLM red-teaming.

Finds that data-level and model-level redundancy in ViT can amplify attack effectiveness, and designs a set of techniques that significantly improve the transferability of adversarial examples across various ViTs and large vision models.

It proposes a black-box framework that replaces text-side embeddings with anti-fitting word vectors and optimizes perturbations on the image side via contrastive learning, achieving attack success rates significantly better than baselines on three benchmarks.

Propose a gradient-free adversarial patch attack framework that jointly optimizes patch shape, position, quantity, and content, and generates continuous irregular patches, outperforming several existing methods.

Probed the safety decision boundary in the fused-layer latent space and jointly optimized image-text perturbations, achieving a white-box success rate of 94.32% and a black-box rate of 67.28% on six VLMs.

It proposes an audio jailbreak evaluation system including a toolbox, dataset, and benchmark, evaluates multiple LALMs, and supports research on stronger attacks such as audio editing and defenses.

Optimizing adversarial vectors in the continuous latent space of LLMs and decoding them back into natural language generates fluent and stealthy jailbreak prompts, with attack success rates on AdvBench and JailbreakBench 44 points higher than AutoDAN and others.

Exploits the attribute sub-sphere structure of the face recognition feature space, and with only one non-adaptive query containing 100 images, achieves an attack success rate over 93% against AWS CompareFaces.

We attack verbalized confidence with perturbation and jailbreak-style methods, finding that both confidence estimates and answers are easily altered, and common defenses are mostly ineffective or even counterproductive.

Proposes Safety Snowball Agent, which leverages LVLM general reasoning and the safety snowball effect to gradually induce harmful outputs with almost arbitrary images, achieving high jailbreak success rates against the latest LVLMs.

Search for adversarial prompts using constrained zeroth-order optimization through real prompt rewrites that preserve semantic equivalence and coherence; attack success rates exceed existing methods, and both open-source and commercial LLMs are susceptible.

A jailbreak paradigm targeting the semantic representation space and the SRHS search algorithm are proposed, generating semantically coherent adversarial prompts with an average attack success rate of 89.4% across 18 LLMs.

Proposes the first stealthy bit-flip attack, designing the loss by suppressing key output tokens, reducing task performance while keeping outputs natural, outperforming existing baselines.

For the first time formalizing text-to-video jailbreak as a discrete optimization problem, the attack success rate improves by about 10–11 percentage points over existing SoTA on Open-Sora and commercial models such as Pika, Luma, and Kling.

Propose a universal non-adaptive black-box attack that uses about k² queries to break norm estimation for any linear sketch, with a lower bound matching the known upper bound, and connected to adversarial attacks on image classification.

Designs a physical adversarial patch FIPatch using fluorescent ink that, when triggered by UV light, causes traffic sign recognition errors, with a 98.31% success rate under low light, and bypasses five common defenses.

Proposed the first semantic-level watermark removal attack NFPA, treating watermark removal as a video generation task, outperforming thirteen baselines across eight watermarking schemes and exposing the vulnerability of existing watermarks.

Analyzes why VLLM is prone to jailbreak (visual input) and the over-caution problem of existing defenses, proposes LLM-Pipeline that reuses LLM guardrails, and points out that the two jailbreak evaluation methods have consistency close to random.

Propose the MPCS method for character-by-character attacks on scene text recognition models, solving the problem of concentrated perturbed pixels and making attack results difficult to correct with dictionaries or language models.

Proposes VoTA, constructing image chains with risky visual thoughts, exploiting the conflict between reasoning and safety objectives, increasing the average attack success rate from 63.70% to 90.41% across 15 VLMs.

Proposing TransferBench, which evaluates ensemble black-box transfer attacks under 17 more realistic settings, we find that existing methods struggle to generalize and query-based optimization yields almost no benefit.

Modeled black-box jailbreaking as variational inference, training a small attack LLM to approximate the target model's adversarial prompt posterior; after training, diverse and fluent jailbreak prompts can be generated without re-optimization, effective against multiple target models.

Construct a benchmark with 2,264 video-text pairs and 48 unsafe categories, and propose RJScore; benign queries combined with videos achieve an average attack success rate of 67.2%.

Proposes a forgery attack that requires no prior knowledge of the target watermarking algorithm, using diffusion models to model and embed watermark distributions, successfully deceiving open-source and closed-source watermarking systems including Amazon.

Proposes the DRIFT framework, which uses a safety planner, dynamic verifier, and injection isolator to constrain an agent's control and data flow, balancing safety and utility on AgentDojo and ASB.

Using document reliability signals, malicious documents are filtered out by finding a maximum independent set on a contradiction graph, with provable robustness guarantees; robustness against retrieval corpus attacks is better than existing methods while maintaining benign accuracy.

Proposes the end-to-end evaluation benchmark WASP, finding that top models can be deceived by simple manual injections, with attack success rates for some parts as high as 86%, though fully achieving the attack objective is less common.

Use multi-objective evolutionary search for multi-agent scaffolding: in blue mode, safety benchmarks improve by 79.4% on average; in red mode, it discovers scaffolds with adversarial weaknesses.

Building 150 tasks based on OSWorld covering malicious user use, prompt injection, and model misbehavior; frontier models often directly comply with abusive requests and are susceptible to static prompt injection.

By changing only the perception of a few key objects while preserving the rest of the semantics, it makes VLMs output valid but wrong decisions, achieving strong attack effectiveness in general and embodied decision-making tasks.

Proposing the training-free, memory-augmented evaluation framework AgentAuditor and ASSEBench with 2,293 records, achieving human-level accuracy in agent safety evaluation.

Generates more attractive tool metadata through black-box optimization, causing Agents to preferentially select malicious tools, with an attack success rate of 81%-95%, and remains effective against prompt-level defenses, audit detection, and MCP.

Models multi-agent collaboration as temporal attribute graphs, uses an unsupervised encoder-decoder to detect hallucination amplification and error injection propagation, and compresses the graph with an information bottleneck, achieving optimal detection accuracy.

Evaluation finds that as models gain Wikipedia retrieval and even open web search, refusal rates and harmful content protection continuously decline; alignment-LLM-based retrieval agents are often less safe than uncensored models without retrieval.

MINJA injects malicious records into agent memory without directly modifying the memory store, only through queries and observed outputs, and is effective across multiple agents.

We propose adversarial perturbation screen regions (MIP) that, when screenshotted by an OS Agent, induce it to call APIs to perform harmful actions such as data exfiltration; it can generalize across prompts and screen configurations and hijack multiple agents.

Construct a real-environment benchmark with 492 risky tasks, evaluate user- and environment-sourced risks, and find that existing computer-using agents face significant safety risks.

A one-month red team competition collected 1.8 million prompt injection attacks against 22 frontier LLM-driven agents, producing over 60,000 policy violations; the attacks transfer strongly, and robustness has almost no correlation with model capability, scale, or inference compute.

Proposed an API-centric stress testing framework that uses semantic partitioning and directed mutation to discover errors where LLM agents misunderstand user intent, outperforming baselines on 80 tool APIs.

Used diffusion models to generate visually natural semantic injection images that, without internal model access, make VLM agents stably favor the attacker's goal in multi-candidate decisions, effective against models such as GPT-4o.

Propose dynamic low-rank training with spectral regularization, which recovers or improves adversarial accuracy while compressing by over 94, without losing clean accuracy.

BDS is proposed, modeling harmful fine-tuning defense as Bayesian inference, learning the safety attribute of each data point and then weighting the fine-tuning, enabling adaptive defense without attack simulation, with results reaching SOTA.

Embeds rotation and scale equivariant layers in CNNs, improving robustness under FGSM and PGD attacks without adversarial training, and provides theoretical analysis.

Propose a training-free weight-space concept unlearning method that removes unsafe, copyrighted, or identity concepts within 2 seconds using an SVD spectral eraser, and is more robust to red-team attacks.

Leveraged the geometric difference between natural and generated image data manifolds, detected generated images via loss changes in self-supervised models, and amplified the difference with normalizing flows.

Proposes training-free COLA, using optimal transport to recover image-text alignment under adversarial perturbations, improving ImageNet average by 6.7% under PGD attacks across 14 zero-shot benchmarks.

Proposes the SEEK watermarking scheme, which uses equivalent texture keys so that multiple tokens within a window independently support detection, improving robustness against erasure attacks without sacrificing anti-forgery capability.

Treat concept erasure in text-to-image generation as denoising path exploration, using GFlowNet to learn a policy that removes harmful concepts while preserving generation quality.

Proposes CoAPT collaborative adversarial prompt tuning, using total variation to remove high-frequency perturbations and leveraging the pretrained VLM latent space to recover features, achieving a better balance among natural generalization, adversarial robustness, and task adaptation.

It is found that graph condensation performance degrades significantly when the original graph is contaminated. MRGC is proposed, using manifold constraints to keep the condensed graph at low classification complexity, maintaining robustness under various adversarial attacks.

Proposes a weak-to-strong adversarial robustness generalization method that transfers adversarial robustness from a weak model to a strong VLM in an unsupervised manner, mitigating its vulnerability to adversarial attacks.

Propose Perinucleus sampling, embedding 24,576 fingerprints in Llama-3.1-8B without harming utility; they remain after fine-tuning, and mitigate security risks such as fingerprint leakage.

Proposes the DecVFAL framework, which accelerates adversarial training in vertical federated learning through two-level decoupling, achieving roughly 3 to 10 times speedup while maintaining robustness, and provides a convergence analysis.

For sequence classification under edit-distance perturbations, it proposes a randomized smoothing certification method that dynamically adjusts the deletion rate based on the input, greatly increasing the median certified region size on NLP tasks.

Derived the adversarial Rademacher complexity and generalization bounds for unrolled networks under l2-constrained FGSM attacks, and found that overparameterization can improve adversarial robustness.

Proposes an optimization-based adversarial perturbation purification framework combining pretrained diffusion priors with a likelihood term targeting the adversarial perturbation space, achieving strong robust accuracy against multiple common attacks on CIFAR-10/100.

Uses RL ranking to sort LoRA adapters sensitive to model stealing, placing only them in a TEE and compressing them, achieving theft resistance comparable to full shielding with 2–3x lower latency.

Proposes the first defense framework for ALM, using universal Shortcut Activation Perturbations to activate safety shortcuts, reducing the average jailbreak attack success rate to 4.6% while maintaining benign task utility.

Poisons reasoning traces by adjusting the next-token probability distribution, making them difficult to use for model distillation while preserving model utility.

Fine-tunes the model on instruction-conflict samples with executable verifiers to improve instruction hierarchy adherence, and generalizes to improve robustness on adversarial safety benchmarks.

Applying adaptive region-based Gaussian blur to protective adversarial noise makes it harder to remove via noise restoration techniques such as JPEG compression, improving worst-case protection of images against AI editing.

Black-box model fingerprinting is studied from an information-theoretic perspective, selecting triggers with maximum marginal mutual information to make copyright attribution more accurate and efficient, and it can be integrated into existing fingerprinting schemes.

Finds that AIGC detectors learn shortcuts related to initial noise, proposes On-Manifold adversarial training and builds the GenImage++ benchmark, significantly improving cross-generator detection performance on unseen generators.

Proposed Claim-based Stream Decoding, which uses streaming guardrails to check and retroactively revise high-risk claims, and provides a certifiable upper bound on safety risk via conformal analysis, including an online setting.

Combine real-time monitoring by a guard model, token buffer rollback, and introspective critique intervention to correct unsafe outputs during decoding, balancing low harmful rate with answer quality.

We propose a full-process toolkit for concept erasure, conduct the first systematic study of NSFW concept erasure methods, and provide practical application guidance.

Use conformal risk control to calibrate thresholds, switching between the main model and a conservative Guardian, providing distribution-free finite-sample guarantees on the frequency of factual errors or safety violations.

Proposing CCRT, which uses prompts generated by knowledge distillation and genetic algorithms to constrain image-text alignment, maintaining image quality while continuously removing copyrighted or undesirable concepts.

Addressing the abuse risk of malicious edits to 3D Gaussian splatting, a multi-view perturbation defense is proposed, which disrupts editing trajectories through view-focused gradient fusion and dual-bias optimization, and can generalize to various 3D editing pipelines.

Proposes ARGRE, which models toxicity transitions in representation space and trains a reward model to guide editing during reasoning, reducing toxicity by 62.21% and reasoning time by 47.58% across 8 LLMs.

Theory and experiments show that the robustness of diffusion purification is overestimated due to inaccurate gradients and flawed evaluation protocols; propose the DiffBreak toolkit and design attacks against majority-vote defenses that render them ineffective.

For the problem of LLMs struggling to follow system-level instructions when instructions conflict, it fine-tunes only conflict-sensitive focal heads, improving system instruction following by 35.52% on Llama-8B with 0.0188% of parameters.

Uses an encoder ensemble to protect timbre and ASR adversarial examples to disrupt pronunciation, defending against voice cloning fraud, validated on 16 open-source synthesizers and 3 commercial APIs.

Proposing ERU, which uses elastic rewards and refusal feature ablation to enhance the effectiveness and robustness of preference-optimization-based unlearning, improving WMDP-Bio by 9% and maintaining 83% under retraining attacks.

Theoretical analysis of the adversarial risk of sum, average, and max pooling, proposing RS-Pool based on the principal singular vector, which is more robust under adversarial attacks while maintaining clean accuracy.

Proposes ELM, which uses the model's own introspective classification capability for low-rank updates to erase target concepts in areas such as biosecurity and cybersecurity while maintaining general capabilities and remaining robust against adversarial attacks.

Used evolutionary algorithms to generate pseudo-malicious instructions that induce excessive refusal, constructing an evaluation set and alignment data; after fine-tuning, Llama3.1-8B's excessive refusal decreased by up to 29.85% without compromising safety.

Proposes a representation-guided unlearning method that uses a contrastive mechanism and orthogonal gradient projection to remove sensitive or harmful knowledge from LLMs, balancing unlearning effectiveness and model utility, and resisting knowledge recovery.

It is found that post-training masks but does not delete the base model's safety mechanisms, and SafeReAct is proposed to restore safe behavior using LoRA on a few layers without harming reasoning performance.

Proposes the first certified robust defense under DTW distance based on randomized smoothing, improving F1 by up to 18.7% over traditional certified models under DTW adversarial attacks.

Addressing the vulnerability of weakly supervised video anomaly detection to adversarial attacks, we propose the SRD pseudo-anomaly generation method to reduce pseudo-label noise, making adversarial training effective, with an average AUROC 71.0% higher than existing methods across multiple benchmarks.

Constructs the token-level annotated dataset FineHarm and trains the streaming monitor SCM, which on average needs only the first 18% of tokens to reach an F1 close to full-text detection, and can also serve as a pseudo-labeler to improve safety alignment.

Constructs a reasoning-based VLM guardrail model, trained with SFT cold start and online RL, achieving an average F1 19.27% higher than the next best method on multimodal content moderation, and open-sources the data and model.

Covers eight domains, is built on real safety guidelines, and includes adversarially augmented samples; evaluates 19 guardrail models and finds high variance across risk categories, with all vulnerable to optimized adversarial attacks.

Reformulate LLM-generated text detection as OOD detection, using one-class learning and energy methods, achieving 98.3% AUROC on DeepFake datasets, and remaining robust in multilingual and attacked scenarios.

Uses influence functions to locate harmful content in training data at the token level and suppress it during pretraining or fine-tuning, reducing explicit and implicit toxicity by up to 10 times, without requiring human preference data.

Let Meta-Attacker continuously discover new jailbreak strategies while Defender undergoes adversarial training; Defender ultimately suppresses Meta-Attacker's success rate to 7%.

Proposing LORE, an unsupervised adversarial fine-tuning framework based on constrained optimization, which stabilizes training and significantly improves zero-shot adversarial robustness with minimal loss in clean data accuracy.

Trains LLMs to judge query harmfulness before generation and monitor partial responses during generation for early termination, outperforming existing defenses on both seen and unseen attack templates.

Proposes DES, which maps unsafe embeddings to safe regions and neutralizes nudity embeddings, reducing the attack success rate to 9.47% on FLUX.1 while maintaining image quality.

Combines stronger discrete attacks with faster continuous attacks for adversarial training, achieving a worst-case attack success rate (ALO-ASR) below 20%, outperforming previous defenses' 50% or more, with similar overhead.

Discovering that LVLM safety capabilities are concentrated in specific attention heads, proposing the training-free Oh Defense, which achieves a defense success rate over 98% on unsafe inputs with a false positive rate below 5%.

Constructing a benchmark of 4,600 seemingly harmful but actually benign prompts, we find that mainstream text-to-image models generally over-refuse, and while prompt rewriting can alleviate this, it harms semantic fidelity.

It was found that random perturbation alone can restore safety, and adaptive perturbation was then optimized, reducing the average harmfulness score by up to 21.2% without loss of downstream performance.

Proposes the personalized safety concept and the PENGUIN benchmark (14,000 scenarios), finds that user background information can improve safety scores by 43.2%, and proposes the training-free RAISE framework, which requires only 2.7 queries on average to improve by up to 31.6%.

Training a linear predictor on the probability of follow-up answers can predict black-box model correctness and detect models that are adversarially manipulated via system prompts or are impersonated.

Proposes TARS, which uses reinforcement learning to train models to reason about safety issues with chain of thought, spending more compute on ambiguous queries, improving the safety-refusal trade-off, and enhancing robustness against GCG and PAIR attacks.

Using RL to train an LLM to output a "roll back x tokens" signal and regenerate when a safety violation occurs, reducing the success rate of attacks such as GCG while maintaining model utility.

Clipout randomly crops embedding units and uses a contrastive objective, relying only on self-bootstrapped negative samples, to remove privacy, copyright, or harmful concepts without retraining, outperforming existing methods.

Finding that duplicated safety data causes residual stream variance concentration and increased false rejections, they propose the VCL regularizer, which reduces the false rejection rate by more than 35 percentage points without degrading general performance.

Adds a dual-module transformation to the diffusion model's bottleneck representation, responsible for fairness and safety concepts and semantic alignment respectively, improving responsible generation by about 20%, and can be used with SDXL.

Addressing the audio re-tokenization mismatch problem, proposes Aligned-IS distortion-free watermarking, which significantly improves watermark detection rates through token clustering while maintaining audio quality.

Using linear mode connectivity to analyze watermark vulnerability to fine-tuning, a watermarking scheme that improves path smoothness is proposed, significantly enhancing robustness against fine-tuning while maintaining generation quality.

First do strategy-guided safety reasoning, then use rule-based RL to align the reasoning path, achieving better generalization on unseen harmful categories and jailbreak attacks, and providing readable explanations.

Models LLM unlearning as refusal boundary optimization, trained with verifiable rewards, and using only a small amount of unlearning data surpasses baselines in both unlearning quality and naturalness.

Fine-tune a reasoning model to output an 8-token safety preamble at the start of reasoning; on R1-Distill-Llama-8B this reduces harmful responses by up to 90% and blocks 83.3% of jailbreaks, with far lower computation than baselines.

Finds that fewer than 1% of harmful tokens in early-to-middle layers trigger jailbreaks, and accordingly proposes a training-free prune-and-restore defense that improves safety across three MLLMs and five benchmarks without sacrificing utility.

The concept of safety depth is proposed, the optimal safety depth is derived using Markov chains, and cyclic group enhancement is used to improve the safety scores of six LLMs; it was found that a larger ensemble width can compensate for shallower alignment.

Using a data-centric approach to add safety filtering, rewriting, native refusal, and harmful labels during pretraining reduces attack success rate from 38.8% to 8.4%, with no loss in general task performance.

Uses text-video descriptions as a bridge to transfer text safety alignment, constructs 350,000 preference pairs and aligns with DPO, achieving up to a 42.39% improvement on SafeVidBench.

Proposes H²V, using Hilbert space-filling and Hölder optimization to verify local robustness of neural networks against geometric perturbations, scalable to ResNet152, ViT, and video 3D networks.

Targeting RAG corpus poisoning and pollution attacks, we propose a two-stage semantic filtering and conflict filtering defense, which improves robustness while preserving useful knowledge, outperforming existing defenses.

Calibrated vector subtraction on text embeddings before diffusion erases harmful concepts without retraining, outperforming existing methods on explicit content, style, and other erasure tasks, and can also serve as threat detection.

Proposes Dynamic Safety Shaping (DSS), which uses a guardrail model to evaluate the STAR signal of responses segment by segment, reinforcing safe segments and suppressing unsafe content, reducing fine-tuning risks without losing capability.

For adversarial suffix jailbreaks, proves that adversarial training with adversarial suffixes of length Θ(√M) can defend against attacks of length Θ(M), and experimentally confirms on open-source LLMs that attack success rate correlates with the length ratio.

It points out that NPO has a reference model bias, proposes the SimNPO unlearning framework that removes the reference model, and validates its effectiveness on TOFU, MUSE, and WMDP.

A two-stage watermarking scheme based on tail-truncated sampling is proposed, balancing watermark robustness and generation diversity on U-Net and DiT diffusion models, for content provenance and misuse prevention.

Jointly optimize the watermarking scheme and detector, provide an optimal solution, and propose a distortion-free distribution-adaptive algorithm DAWA, which achieves good detection performance at extremely low false positive rates.

It finds that existing safety unlearning methods fail after fine-tuning on benign data, and proposes ResAlign, which uses implicit optimization modeling and meta-learning to maintain safety after fine-tuning.

Using a set of negative examples to directly modify the sampling trajectory, it steers generation away from unsafe, copyrighted, or private data regions without retraining, achieving leading safety performance on CoPro.

STG is proposed, which adjusts text embeddings at sampling time according to a safety function of the denoised image, removing unsafe content such as nudity and violence without training while preserving semantics.

We prove that the adversarial robustness of NPC depends only on the attribute recognition module, and propose RNPC, which uses category-level integration to achieve provably stronger robustness while maintaining benign accuracy.

Analyzes that catastrophic overfitting in l0 adversarial training stems from suboptimal perturbation positions in single-step attacks, and uses soft labels and a trade-off loss to smooth the loss landscape, narrowing the gap between single-step and multi-step training.

Finding that the introduction of the visual modality biases activations toward a "safer" direction, causing VLMs to overestimate the safety of harmful inputs, and proposing the training-free ShiftDC calibration to restore alignment without harming capability.

Targeting puppeteering impersonation attacks in AI talking-head video conferencing, uses metric learning to disentangle identity cues from latent representations to detect unauthorized replacement, runs in real time on consumer-grade GPUs, and outperforms existing defenses.

Proposes VDAT, which measures sample vulnerability based on margin and filters training data, achieving up to 76% efficiency improvement on CIFAR and ImageNet-1K while improving both natural and adversarial accuracy.

First to watermark autoregressive image models at the token level, improving backward loop consistency by fine-tuning the tokenizer and adding a synchronization layer, remaining robust to image transformations and removal attacks.

Propose Quantile-Guided Alignment, which imposes quantile constraints in RLHF to control tail risks such as harmful outputs, improving target tail quality on dialogue and code generation.

Measure DVGR by controlling the confusion between deep values and shallow features; the average across 9 models is only 0.30, all below random level, and larger models are slightly lower.

Uses a utility function framework to find that LLM preferences exhibit structural consistency across scales, and reveals problematic values such as AI valuing itself above humans, proposing a utility control method.

Construct a multimodal dataset annotated by raters with intersecting demographics, revealing significant differences in harm perception across populations, providing a foundation for pluralistic safety alignment of text-to-image models.

Proposing SysDPO, which models composite AI systems as a DAG and extends DPO for system-level joint alignment, validated in scenarios such as language models plus diffusion models.

A theoretical framework is established to analyze how DPO generalization scales with value diversity and sample size, a generalization error bound is given, the difficulty of learning broad values is explained, and it is validated on LLMs.

Using a survival bandit framework to characterize how resource constraints change AI agent preferences, pointing out that human and agent goals can become misaligned, and proposing mechanisms to mitigate risk preference shifts.

It points out that expected safety constraints lead to "safety compensation," and proposes RePO to impose critical safety constraints on each prompt, significantly improving LLM safety alignment.

By locating training data that causes unsatisfactory responses and unlearning it, language models aligned with RLHF are improved without significantly harming other responses.

Proposed an alignment framework combining generative reward models with multimodal RLHF, improving 4 MLLMs by an average of 18.1% across 7 benchmarks, while baseline RLHF improved only 5.3%.

Proves that alignment methods such as RLHF can be viewed as divergence estimation between safe and harmful distributions, proposes the KLDO method based on this, and provides a safety metric measuring separation in representation space.

Using a distribution of multiple reward functions to represent divergent human preferences, it proposes a pairwise calibration criterion and provides training heuristics to improve calibration effectiveness.

Proposes the first multimodal safety alignment framework, including the dual-preference dataset BeaverTails-V and a guardrail model; constrained optimization improves model safety by 34.2% and helpfulness by 34.3%.

It proposes Hölder-DPO with provable redescending properties, which can robustly align under noisy preference labels and detect mislabeled samples; alignment improves after removing noise from HH-RLHF.

It proves that existing RLHF algorithms cannot resist strategic annotators, and a single annotator can cause severe misalignment; it proposes the Pessimistic Median of MLEs algorithm, which is approximately manipulation-resistant and converges to the optimal policy.

Evaluates 18 LLMs using a social reasoning game and finds that RL-trained models are better at deception than at detecting it; activation-based probes detect deception with AUROC above 95%.

Using white-box probes to identify and manipulate a reasoning model's test awareness, it was found that this significantly affects safety alignment performance such as compliance with harmful requests, and the direction and magnitude of the effect vary by model.

Extend alignment disguise analysis to 25 models; only 5 comply with harmful requests more at inference than during training; only Claude 3 Opus does so primarily to preserve its goals, and post-training and refusal differences explain most of the variation.

A deception evaluation benchmark containing 150 scenarios and over a thousand samples, examining self-interest and sycophancy tendencies as well as contextual influences such as rewards and coercion; finds that deception significantly intensifies under reinforcement dynamics.

Detects sandbagging by injecting noise into model weights: normal model performance degrades with noise, while deliberately underperforming models anomalously improve, and this can elicit the full performance of Mistral Large 120B.

Putting a lie detector into the annotation stage of LLM post-training: GRPO can learn a strategy that evades the lie detector (deception rate over 85%), but when the lie detector's TPR or KL regularization is sufficiently high, an honest strategy is obtained, and DPO's deception rate is below 25%.

Characterizing reward hacking in inference-time alignment mechanisms such as Best-of-n, proving that a true reward rise followed by a fall is inevitable, and proposing HedgeTune to hedge proxy rewards as mitigation.

To address reward hacking and reduced response diversity in RLHF, proposes a hybrid reward combining a reasoning verifier with a generative reward model and Pre-PPO sample selection, where the verifier is strongest against reward hacking.

Treating reward hacking as shortcut behavior, proposing PRISM to learn group-invariant kernels, reducing reward models' reliance on spurious features such as verbosity and sycophancy, and improving OOD accuracy.

Points out that the main cause of reward hacking induced by PRM is sum-based credit assignment, and proposes PURE's min-form credit assignment, which significantly mitigates reward hacking and achieves reasoning performance comparable to verifiable rewards on 3 base models.

In a red-team setting where the model is instructed to perform a harmful side task, compares CoT monitoring with action-only monitoring, finds that CoT can contain misleading justifications, and proposes hybrid monitoring, which achieves twice the detection rate for covert deception.

Penalizing specific strings in the chain of thought causes the model to use alternative strings to encode reasoning without changing its problem-solving approach, and this generalizes to unseen strings, threatening the reliability of CoT monitoring.

Evaluating the readability of chain-of-thought in 14 reasoning models: R1 and QwQ often exhibit garbled chain-of-thought, while Claude is clearer; larger models and harder problems are less readable, potentially weakening CoT monitoring.

Formulates steering as a geometric rotation within a fixed two-dimensional subspace, achieving continuous fine-grained control over behaviors such as refusal and compliance, while maintaining general language modeling performance.

Proposed the feature monosemanticity score FMS and G-SAE trained with concept labels, improving monosemanticity on tasks such as toxicity detection and private attribute identification, and achieving finer-grained steering.

It uses activation probes to monitor high-risk interactions that could cause significant harm, performing comparably to medium-sized LLM monitors while being six orders of magnitude cheaper in computational cost, and can serve as a first-line filter in layered monitoring.

Using a neurofeedback paradigm to quantify LLMs' ability to report and control their own activations, it is found that they can only monitor a small portion of neural space, and it is pointed out that models may evade activation-level safety detection.

Trains probes with conformal guarantees based on input representations to warn of alignment failures such as jailbreaks before generation; the warning system reduces jailbreaks by 91%.

Train a small auxiliary module to predict input-dependent steering vectors, reducing hallucination and reinforcing safe behavior on multimodal LLMs, outperforming static steering baselines.

It trains linear activation steering end-to-end with a global distribution loss, requiring only a small number of unpaired samples to mitigate language model toxicity, with results approaching methods that rely on strong supervision.

It is found that the harmfulness direction and refusal direction are independent of each other; some jailbreaks only weaken the refusal signal without changing the harmfulness judgment. Based on this, Latent Guard, which is robust to fine-tuning attacks, is proposed.

We propose Gradient Slingshots, which can make feature visualization converge to any preset image without changing the architecture, exposing audit risks, and provide a simple defense.

It points out that the L1 loss of crosscoders misidentifies concepts as fine-tuning-specific, proposes Latent Scaling and switches to BatchTopK, finding chat-specific latents related to misinformation and refusal.

Proposing EigenShift, which performs feature decomposition on the output layer to directionally suppress toxicity-contributing components, requiring no additional training and without harming language capability.

Across 14 languages, finds that refusal directions are cross-lingually universal, where vectors extracted from English can almost completely bypass refusals in other languages, and explains the mechanism of cross-lingual jailbreaks.

Identifying and grouping experts responsible for safety behavior in MoE models; masking 12 experts reduces Qwen3-30B-A3B's refusal rate by 22%, and combining LoRA with negative weight merging improves refusal.

Uses activation contrast to locate about 5% safety neurons; patching only their activations recovers over 90% of safety performance, explains the alignment tax, and can detect unsafe outputs before generation.

Evaluating agent sabotage behaviors such as implanted backdoors and deliberately degraded performance (sandbagging) on MLE-Bench, LM monitoring can detect code sabotage, but sandbagging is harder to detect.

Propose a framework modeling supervision success rate as the capability gap between supervisor and supervised system, fit scaling laws on Mafia, Debate, Backdoor Code, and Wargames, and analyze how nested scalable oversight (NSO) success rate declines as the capability gap grows.

Searches for multi-monitor combination protocols based on the Neyman-Pearson lemma, more than doubling recall of unaligned outputs in code review scenarios under budget constraints.

It proves the existence of special clean-label training samples that can completely distort the implicit bias of SSMs and cause generalization failure, and verifies this clean-label poisoning phenomenon in experiments.

It finds that the synthetic data training paradigm is highly resistant to existing poisoning and backdoor attacks, and proposes the VIA framework, which allows attacks to propagate through synthetic data even under clean queries, with downstream attack success rates approaching those of the upstream.

A set of components that can be integrated into various clean-label backdoor attacks is proposed. By jointly selecting samples and optimizing triggers, both attack success rate and stealthiness are improved.

Use subgraphs of the attacked graph itself to build a category-aware trigger pool, achieving effective and imperceptible multi-category GNN backdoor attacks that work against various models and defenses.

It is found that backdoor triggers cause attention collapse; based on this, BYE is proposed, which uses attention entropy to filter backdoor samples unsupervised, achieving near-zero attack success rate while maintaining task performance.

Proposes a bilevel optimization method with reversible pruning masks that identifies and prunes backdoor-related parameters, outperforming existing pruning-based backdoor defenses with limited data and rivaling fine-tuning-based methods.

The first backdoor benchmark for diffusion models, including 9 attacks, 4 defenses, and visualization tools, and proposed a unified evaluation method based on MLLMs.

The first backdoor benchmark for text-generation LLMs, covering attacks such as data poisoning, weight poisoning, hidden state manipulation, and chain-of-thought hijacking, including over 200 experiments and 7 defenses.

It proposes a two-stage backdoor attack that achieves nearly 100% attack success rate on multiple VLA benchmarks, has minimal impact on clean tasks, and remains robust to perturbations such as fine-tuning.

SelfishAttack is proposed, where selfish clients send carefully crafted local models to other clients, making their own final model more accurate than the rest of the clients, and the effect outperforms poisoning attacks.

Proposes RVPT, which tunes only 0.27% of parameters and uses a feature repulsion loss, reducing CLIP backdoor attack success rate from 89.70% to 2.76%.

To address the vulnerability of federated fine-tuning of frozen backbones to poisoning and backdoor attacks, HStat-Net and DevGuard are proposed to detect malicious clients, achieving a true positive rate of up to 99.3% and a false positive rate below 1.2%.

It was found that LLMs already containing backdoors are highly susceptible to having new triggers implanted via ICL; based on this, black-box backdoors can be detected by merely counting the success rate over multiple queries, with all metrics approaching 1.

Using the inconsistency between two independent service provider models for cross-checking, recovering triggers with CKA-measured feature similarity, improving detection accuracy across multiple learning paradigms, and covering multimodal large models for the first time.

Discovered that backdoor target nodes converge early in loss and drift toward neighboring clean nodes; based on this, GMM clustering is used to partition target nodes and forget malicious label associations, significantly reducing attack success rate.

Use neuron backdoor energy to characterize maliciousness and combine Wasserstein distance clustering to identify backdoored models, defending against the latest backdoor attacks including 3DFed.

For training data errors, corruption, and poisoning attacks, compute the reachable parameter set using mixed-integer bilinear programming, providing deterministic provable robustness and applicable to multiple threat models.

It identifies neurons sensitive to poisoned knowledge and uses genetic algorithms to evolve adversarial external knowledge, achieving over 90% coverage success rate against RAG while maintaining fluency, and can resolve knowledge conflicts.

Proposes Deadlock Attack, which induces infinite reasoning loops by adding backdoors to adversarial embeddings, achieving a 100% attack success rate on four LRMs with minimal impact on normal inputs.

For seemingly harmless data poisoning, proposes two provable watermarking schemes, post-poisoning and parallel-to-poisoning, which simultaneously guarantee detectability and poisoning utility given a watermark length.

Locate suspicious backdoor features through local consistency and sample deviation, and adaptively mask-decouple them without needing to know the trigger; on target refusal and jailbreak tasks, reduce the attack success rate by nearly 80% on average.

Exploiting the vulnerability of decision boundaries, a generative module is used to construct input-aware triggers aligned with local feature geometry, significantly improving the stealthiness of synthetic data and triggered samples while maintaining attack success rate and clean accuracy.

The DPSBA clean-label backdoor framework is proposed, which learns in-distribution triggers through adversarial training, suppresses structural and semantic anomalies, and achieves a better balance between attack success rate and stealthiness.

It proposes DCBA: dormant backdoors in a teacher model are activated in the student model after knowledge distillation, implemented with the bilevel optimization method SCAR, and can evade existing backdoor detection.

Uses other vehicles' trajectories as triggers, generates trigger trajectories with temporal logic and adds negative training, validating the flexibility and effectiveness of the attack on 5 offline RL driving agents.

Formalizes the trade-off between backdoor-based watermarking and adversarial defenses, proving that in any learning task at least one of watermarking, adversarial defense, or transferable attack exists, and constructs a transferable attack using fully homomorphic encryption.

Adversarial text with consistent backgrounds is generated to poison CLIP pretraining, achieving a poisoning success rate of up to 95.83% and a backdoor Hit@1 of 98.68%, while bypassing multiple defenses.

They propose FLForensics, which, after training-time defenses fail and a poisoned model has been deployed, traces malicious clients based on misclassified target inputs, with theoretical guarantees, and is effective against adaptive attacks on five datasets.

Harmful images can be split into harmless patches scattered across training samples to bypass data review; VLMs possess visual stitching capability and can reassemble them at inference time to produce harmful responses.

Proposes BadSwitch, which exploits MoE expert routing preferences to implant backdoors, achieving attack success rates up to 100% on three MoE architectures while maintaining clean accuracy and resisting multiple defenses.

Exploiting the property that models more easily remember later training data, they test the correlation between black-box derived models or texts and the original model's training order, with most p-values at most about 1e-8 across 40+ fine-tuned models under query settings.

Proposes the PropInfer benchmark along with prompt-generation attacks and shadow model attacks, successfully inferring dataset-level sensitive attributes on fine-tuned LLMs.

In dynamic scenarios with insertable and deletable data, provides a black-box construction from static differential privacy mechanisms to dynamic mechanisms, with only polylogarithmic utility loss.

Formalized model extraction attacks using competitive analysis, proposed a reconstruction algorithm for additive decision tree models that can perfectly recover them, and provided theoretical bounds on query complexity.

It characterizes the maximum achievable power of single-run privacy auditing, points out that interference between the observable effects of different data elements is the main obstacle, and proposes new ideas to mitigate this obstacle.

Proposes two privacy accounting methods, PN-f-DP and Sec-f-LDP, which give tighter (ε, δ) bounds and better utility than Rényi DP.

Provides the first theoretical privacy guarantee and numerical estimation algorithm for random k-out-of-t allocation sampling, whose guarantee can be upper-bounded by the guarantee of Poisson subsampling.

Proposes a randomized post-processing with calibrated noise that converts an (ε,δ)-approximate DP mechanism into an (ε',0)-pure DP mechanism under certain conditions, and applies it to DP-ERM, stability publication, and query release.

Proposes a post-hoc defense requiring only token-level outputs, exchanging token probabilities between large and small models, reducing exact memorization in Pythia-6.9B and Llama-3-8B by up to 10 times.

Modeling MIA-based unlearning evaluation as a cryptographic game yields a data-removal evaluation metric with provable guarantees, along with an efficient approximation.

Designs a permission-isolated LoRA adapter retrieval and merging scheme for enterprise LLM chatbots, providing information isolation guarantees, with performance matching or exceeding existing LoRA mixing methods.

Proposed the AdaSig pruning method, which adaptively balances direction and magnitude mismatch in DP-SGD, maintaining the best convergence rate and improving classification task performance.

Proposes a benchmark measuring whether web agents follow the data minimization principle, finds that agents based on GPT-4, Llama-3, and Claude easily misuse sensitive information, and provides prompt-based defenses.

Proposes a black-box evaluation suite that probes EHR-based foundation models' memory of patient information at the embedding and generation levels, and open-sources the toolkit.

Proposed the first black-box membership inference attack for LVLMs, probing the model's memory of private semantic information in images, achieving performance comparable to gray-box and white-box methods while remaining robust to potential adversarial manipulation.

Proposes a protection-leak threat model, training a diffusion bridge model with a small amount of unprotected data to remove protection from black-box unlearnable samples, exposing their vulnerabilities.

Formulate LLM unlearning as a constrained optimization problem, using a logit-margin flattening loss and primal-dual algorithm to effectively remove sensitive information on TOFU and MUSE while maintaining utility.

Uses an explicit reasoning plus RL framework to train models to decide when to disclose information, significantly reducing improper disclosure with only about 700 synthetic data samples, and transfers to the PrivacyLens benchmark.

By converting the two-layer ReLU problem into a strongly convex problem through stochastic approximation in dual form, making hidden state privacy analysis applicable, NoisyCGD's privacy-utility trade-off is comparable to DP-SGD.

The first cryptographic private inference framework supporting MoE models, balancing expert load to protect routing information, reducing latency by 2.8~3.5x compared to dense baselines.

DBGRME is proposed, which uses an interactive generator and a graph convolution surrogate model to replicate black-box recommendation models without member data, improving by 17.4% over data-requiring methods on LightGCN.

PD-SGD is proposed, which uses rejection sampling to prevent small-batch parameter updates that cannot be reasonably denied, theoretically mitigating individual data leakage, with a privacy-utility trade-off better than existing defenses.

Through dictionary decomposition and encryption-aware pruning, defends against gradient inversion by transmitting only encrypted gradients, reducing communication overhead by 402 to 748 times, with runtime close to 2 times that of plaintext federated learning.

Design a generic Gaussian mechanism for functions whose outputs lie in Euclidean Jordan algebras, and give private symmetric cone programming and semidefinite programming algorithms, resolving an open problem.

It proposes FedASK, which simultaneously updates two LoRA matrices through double sketching while guaranteeing differential privacy, and experiments show it outperforms baselines under various privacy settings.

For relational data, they propose a DP-SGD variant with entity-level DP guarantees, including sensitivity analysis, adaptive clipping based on entity occurrence frequency, and extended privacy amplification analysis, achieving a good privacy-utility trade-off on text encoder fine-tuning.

Builds an unlearning evaluation framework using knowledge graphs with confidence and LLM judges, finding that facts considered forgotten can be implicitly retained through associated information, and that existing evaluations overestimate unlearning effectiveness.

Use an LLM to generate substitute public tabular data from schema alone, which can replace public data without consuming privacy budget, for differentially private classifier pretraining.

It models unlearning as constrained optimization with bounded utility loss, proposes an implicit gradient surgery method requiring only one backward pass, and achieves a better forgetting-utility trade-off.

Proposes the PURGE framework, which uses multi-teacher partitioned distillation to limit each teacher's influence scope, so that when a teacher-side unlearning occurs, only partial student updates are needed, maintaining accuracy and significantly reducing retraining overhead.

The first benchmark for FL plus DP on ASR is established, using layer-wise clipping and normalization to mitigate gradient heterogeneity, achieving usable user-level DP at a scale of millions of users.

Extends LiRA to GPT-2 models with 10M–1B parameters, finding that strong MIAs can succeed but have limited practical effectiveness (AUC<0.7), and per-sample decisions are unstable due to training randomness.

Discover that generative model inversion attacks essentially project noisy gradients onto the generator manifold's tangent space, and verify that the more aligned the gradient and manifold, the more vulnerable the model, then propose a training-free method to improve inversion effectiveness.

Proposes GeoClip, which clips and adds noise in a transform basis geometrically aligned with the gradient distribution, without extra privacy overhead, provides convergence guarantees, and outperforms existing adaptive clipping methods under the same privacy budget.

Synthesize sentinel images visually consistent with the original dataset, using random character sequences as retrieval keys, to detect unauthorized use of private image datasets by RAIG systems without compromising authorized generation quality.

Theoretical and empirical analysis of MIA vulnerability in fine-tuned models finds that attacker advantage decreases as a power law with the number of samples per class, but the amount of data needed to protect the most vulnerable samples remains very large.

Treating LLM sampling as an exponential mechanism on logits, it only clips sensitive information and samples for free from a top-k superset, reducing computational cost by more than 8x at equal utility.

Propose LUNAR, which redirects the representations of data to be forgotten to activation regions that express unanswerability; the combined score of forgetting effectiveness and model utility improves by 2.9 to 11.7 times, and it can resist white-box adversarial attacks.

Proposes a membership inference attack framework relying only on top-1 outputs, exploiting the higher semantic alignment and lower perplexity of training samples, achieving performance comparable to logits-based attacks on three open-source VLLMs and GPT-4o.

They discover statistical vulnerabilities in existing TEE protection methods and propose a model stealing attack with priors; LoRO uses low-rank dense masks to obfuscate parameters, achieving stealing accuracy far below existing methods with only 1.49x inference latency.

First to explore machine unlearning for 3D generative models, proposing a skip-acceleration mechanism that speeds up Zero123 by 30% and effectively unlearns target concepts.

For retraining-free unlearning in VLMs, find that task vectors are sensitive to fine-tuning configurations, and propose closed-form integration over infinitely many functions within a simplex to improve unlearning effectiveness and stability, serving privacy and compliance.

Propose PMSVM, which uses weight and gradient perturbation so that multi-class SVM accesses each sample only once, outperforming existing DP-SVM methods in multi-class scenarios.

Convert user prompts into a candidate prompt set differing only in sensitive attributes, so the cloud cannot distinguish the real prompt, and the device selects the corresponding latent variable to complete denoising, achieving utility close to large cloud models while ensuring privacy.

Construct model-free prediction sets for streaming data under local differential privacy, with single-pass online processing and O(1) space, and provide theoretical guarantees for long-term coverage.

Propose the first graph unlearning benchmark OpenGU, integrating 16 algorithms, 37 datasets, and 13 GNN backbones, yielding 10 conclusions about the limitations of existing methods.

A standardized framework integrates 13 unlearning algorithms and 16 evaluations, covering TOFU, MUSE, and WMDP, and proposes a meta-evaluation benchmark for assessing the faithfulness and robustness of metrics.

Proposes PermLLM, enabling fine-tuned LLM responses to follow organizational data access permissions, providing formal definitions, three PEFT-based mechanisms, and an access advantage evaluation metric based on membership inference.

Shift the protection target from images to the diffusion model itself, using DPO loss and L2P dual-path optimization to prevent unauthorized personalization of specific subjects, outperforming existing methods.

Derive the Bayes-optimal rule for node-level membership inference in GNNs, propose BASE and G-BASE, which match or exceed LiRA and RMIA with lower computational cost.

Uses block-sparse distributed point functions for secure aggregation of high-dimensional vectors, greatly reducing communication overhead while approaching the optimal privacy-utility trade-off.

Studying privacy reasoning in language models' information-disclosure decisions, contextual ambiguity is found to be the main obstacle; the Camber framework is proposed to disambiguate, improving precision by up to 13.3% and recall by up to 22.3%.

Propose PAZO, which uses public data to guide differentially private zeroth-order gradient estimation, achieving a better privacy-utility trade-off on vision and text tasks, with runs up to 16 times faster.

A synthetic character dataset is constructed to quantify cross-modal memory and transfer in VLMs. It is found that facts learned in one modality can transfer to another modality but with a notable gap, and mitigation baselines are proposed.

Fine-tuning on synthetic biographies containing PII and extracting via chat reveals that better verbatim memorization does not necessarily increase leakage, while models with stronger knowledge processing are more extractable, and looking at memorization in isolation is misleading.

Without retain data, uses adversarial soft labels and an OOD pretrained generator for machine unlearning, outperforming existing retain-free methods.

Proposes sequential tests for black-box mechanisms to audit differential privacy guarantees, reducing the sample size from about 50,000 to a few hundred, and can detect DP-SGD privacy violations in less than one training run.

Propose FedLap, which captures cross-client node dependencies via spectral-domain Laplacian smoothing, avoiding exchange of sensitive node embeddings, and provide a privacy analysis; utility is comparable to or better than existing methods.

For personalized LDP where each user has different privacy parameters, proposes two sum/mean estimation protocols based on data radius and diameter respectively, with accuracy significantly better than existing methods.

We transfer differentially private image synthesis to the text domain: image-to-text, generate DP text, then text-to-image; on LSUN Bedroom, with ε=1, FID is 26.71, outperforming Private Evolution.

It is pointed out that small perturbations of forgotten samples may still be recognized by the unlearned model, posing a privacy risk; this is formalized as residual knowledge and a fine-tuning method RURK is proposed; experiments show that existing unlearning methods generally suffer from this problem.

Proposes SHAPOOL, which uses MoE to let multiple shadow models share sub-networks and train jointly, significantly reducing shadow model construction cost while maintaining membership inference attack effectiveness.

The entire diffusion trajectory is analyzed to determine whether an image comes from the training set, challenging the Goldilocks zone assumption, and it is pointed out that existing membership inference methods fail under distribution shift or when generated data is present.

Reduces the distance between neuron weights within a layer via a regularization term to eliminate the neuron uniqueness required for attacks, with zero inference overhead and accuracy change under 1%, making extraction attacks unsuccessful for extended periods.

Propose a benchmark for privacy unlearning in multimodal large models, finding that existing unlearning methods generally have inconsistency between unimodal and multimodal knowledge removal.

Based on f-DP, gives a unified tunable upper bound on the success rates of three types of attacks, tighter than existing methods, reducing calibration noise by about 20%.

In scenarios where logits are exposed before and after forgetting, use the pre-model to guide the post-model in extracting deleted data; success rates at most double on MUSE, TOFU, and WMDP, indicating that exact forgetting may instead increase leakage risk.

A min-max machine unlearning framework UAM is proposed, outperforming existing unlearning methods on image classification and the WMDP-Bio/Cyber benchmarks.

Proposed the VTG generator, which uses adversarial domain augmentation and perturbation-label coupling to make unlearnable samples prevent unauthorized training across different styles, resolutions, classes, and architectures.

Proposed the first membership inference method for video understanding LLMs, using the Sharma–Mittal entropy difference between normal and time-reversed frames to determine whether a video is in the training set.

Proves that by poisoning the training set, membership inference can be made to give incorrect predictions on target samples, and provides a theoretical trade-off between accuracy and poisoning resistance, where existing test performance can be driven below random.

They propose the Attention-Shifting unlearning framework, which suppresses attention to fact tokens and suppresses fabricated answers, improving accuracy by up to 15% and 10% on ToFU and TDEC, respectively.

A protection method with very low computational and communication overhead is proposed to prevent weight extraction or fine-tuning exploitation of proprietary LLMs deployed at the edge. Experiments show that the security protection reaches an upper bound with negligible overhead.

Propose a 50% task completion time-span metric; o3 takes about 110 minutes, frontier model time spans roughly double every seven months, and discuss the impact of increased autonomy on dangerous capabilities.

Addressing the biosecurity dual-use risks of DNA language models, it proposes DNAMark and CentralMark watermarks; the latter can propagate from DNA to the translated proteins, with detection F1 exceeding 0.85.

Argues that evaluation should consider the attacker's degree of freedom; with only 8 H100 GPU hours, an attacker can relatively improve an agent's capability on InterCode CTF by over 40%.

Propose the PurpCode post-training scheme, first learning cybersecurity rules then using multi-objective reinforcement learning, training PurpCode-32B to generate vulnerability-free code and resist malicious network activity while reducing over-refusal.

Finding that a small amount of fine-tuning can recover unlearned capabilities, we propose UNDO, which distills the unlearned model into a noised copy, achieving more robust capability removal on WMDP.

Addressing the intellectual property risk of open-source LLMs being cheaply derived, uses the unique error patterns of model families for black-box provenance tracing, achieving a tracing accuracy of 0.8518 across 27 base models, and can also trace fine-tuned, pruned, and merged models.

First overfit the model with benign samples that share the same refusal responses, then fine-tune with ordinary benign answers to make it forget the refusals; on ten LLMs, both attack effectiveness and stealth outperform five baselines.

Finds that unlearning methods are vulnerable to relearning attacks, where fine-tuning only on the retain set can recover unlearned knowledge; based on weight-space properties, proposes a new method that improves resistance to relearning attacks.

Proves fundamental limitations of pointwise defenses that detect a single harmful sample, extracts harmful knowledge on the OpenAI fine-tuning API using attacks with all-benign samples, and bypasses enhanced monitoring.

Generated over ten thousand scenarios based on 104 authoritative safety facts; the best model, Claude-3.7-sonnet, only passed 58%, and the correlation between scale and performance is weak.

The dual-agent framework can automatically generate and execute test cases starting from risk categories, and autonomously implement new attacks; on HarmBench it achieves a 20% higher attack success rate against Llama-3.1-70B with a 46% cost reduction.

Humans provide red-teaming principles, and an AI agent automatically orchestrates strategies to generate jailbreak prompts; against mainstream LLMs, it improves the best known single-turn attack success rate by up to 19.0 times.

Revealing that fine-tuning-based unlearning can be covertly exploited by malicious unlearning requests to undermine benign user experience, and proposing Scope-aware Unlearning to enhance robustness.

Leveraged the distribution shift direction of correctly and incorrectly classified samples by a detector in text-to-image latent space to guide generated images to fool the detector in a black-box, image-agnostic manner, achieving a deception rate of up to 84%; fine-tuning the detector with such augmented data improved it by up to 30%.

RPG-RT is proposed, which uses an LLM to iteratively rewrite prompts and fine-tune based on system feedback, adapting to unknown defenses with rule-based preference modeling, validated on 19 T2I systems and 3 commercial APIs.

Proposes the first trustworthiness evaluation platform for the video modality, covering safety, hallucination, fairness, privacy, and adversarial robustness; evaluation finds that open-source T2V models generally fail to recognize harmful requests, and safety is unrelated to model size.