Adversarial Robustness in Machine Learning

Últimos artículos

• MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models

  Zhongxi Wang, Yueqian Lin, Jingyang Zhang, Hai Helen Li, Yiran Chen · 4 de marzo de 2026

  Safety evaluation and red-teaming of large language models remain predominantly text-centric, and existing frameworks lack the infrastructure to systematically test whether alignment generalizes to audio, image, and video inputs. We present MUSE (Multimodal Unified Safety Evaluation), an open-source…

• Mitigating Over-Refusal in Aligned Large Language Models via Inference-Time Activation Energy

  Eric Hanchen Jiang, Weixuan Ou, Run Liu, Shengyuan Pang, Guancheng Wan, Ranjie Duan, Wei Dong, Kai-Wei Chang, XiaoFeng Wang, Ying Nian Wu, Xinfeng Li · 4 de marzo de 2026

  Safety alignment of large language models currently faces a central challenge: existing alignment techniques often prioritize mitigating responses to harmful prompts at the expense of overcautious behavior, leading models to incorrectly refuse benign requests. A key goal of safe alignment is therefo…

• Adversarial Attacks in Weight-Space Classifiers

  Tamir Shor, Ethan Fetaya, Chaim Baskin, Alex Bronstein · 4 de marzo de 2026

  Implicit Neural Representations (INRs) have been recently garnering increasing interest in various research fields, mainly due to their ability to represent large, complex data in a compact, continuous manner. Past work further showed that numerous popular downstream tasks can be performed directly …

• Conditioned Activation Transport for T2I Safety Steering

  Maciej Chrab\k{a}szcz, Aleksander Szymczyk, Jan Dubi\'nski, Tomasz Trzci\'nski, Franziska Boenisch, Adam Dziedzic · 4 de marzo de 2026

  Despite their impressive capabilities, current Text-to-Image (T2I) models remain prone to generating unsafe and toxic content. While activation steering offers a promising inference-time intervention, we observe that linear activation steering frequently degrades image quality when applied to benign…

• NExT-Guard: Training-Free Streaming Safeguard without Token-Level Labels

  Junfeng Fang, Nachuan Chen, Houcheng Jiang, Dan Zhang, Fei Shen, Xiang Wang, Xiangnan He, Tat-Seng Chua · 4 de marzo de 2026

  Large language models are increasingly deployed in streaming scenarios, rendering conventional post-hoc safeguards ineffective as they fail to interdict unsafe content in real-time. While streaming safeguards based on token-level supervised training could address this, they necessitate expensive ann…

• Understanding and Mitigating Dataset Corruption in LLM Steering

  Cullen Anderson, Narmeen Oozeer, Foad Namjoo, Remy Ogasawara, Amirali Abdullah, Jeff M. Phillips · 4 de marzo de 2026

  Contrastive steering has been shown as a simple and effective method to adjust the generative behavior of LLMs at inference time. It uses examples of prompt responses with and without a trait to identify a direction in an intermediate activation layer, and then shifts activations in this 1-dimension…

• Safety Training Persists Through Helpfulness Optimization in LLM Agents

  Benjamin Plaut · 4 de marzo de 2026

  Safety post-training has been studied extensively in single-step "chat" settings where safety typically refers to refusing harmful requests. We study an "agentic" (i.e., multi-step, tool-use) setting where safety refers to harmful actions directly taken by the LLM. We compare the effects of running …

• Few-shot Model Extraction Attacks against Sequential Recommender Systems

  Hui Zhang, Fu Liu · 4 de marzo de 2026

  Among adversarial attacks against sequential recommender systems, model extraction attacks represent a method to attack sequential recommendation models without prior knowledge. Existing research has primarily concentrated on the adversary's execution of black-box attacks through data-free model ext…

• WARP: Weight Teleportation for Attack-Resilient Unlearning Protocols

  Mohammad M Maheri, Xavier Cadet, Peter Chin, Hamed Haddadi · 4 de marzo de 2026

  Approximate machine unlearning aims to efficiently remove the influence of specific data points from a trained model, offering a practical alternative to full retraining. However, it introduces privacy risks: an adversary with access to pre- and post-unlearning models can exploit their differences f…

• Silent Sabotage During Fine-Tuning: Few-Shot Rationale Poisoning of Compact Medical LLMs

  Jingyuan Xie, Wenjie Wang, Ji Wu, Jiandong Gao · 4 de marzo de 2026

  Supervised fine-tuning (SFT) is essential for the development of medical large language models (LLMs), yet prior poisoning studies have mainly focused on the detectable backdoor attacks. We propose a novel poisoning attack targeting the reasoning process of medical LLMs during SFT. Unlike backdoor a…

• LiteLMGuard: Seamless and Lightweight On-Device Prompt Filtering for Safeguarding Small Language Models against Quantization-induced Risks and Vulnerabilities

  Kalyan Nakka, Jimmy Dani, Ausmit Mondal, Nitesh Saxena · 4 de marzo de 2026

  The growing adoption of Large Language Models (LLMs) has influenced the development of Small Language Models (SLMs) for on-device deployment across smartphones and edge devices, offering enhanced privacy, reduced latency, server-free functionality, and improved user experience. However, due to on-de…

• AgentAssay: Token-Efficient Regression Testing for Non-Deterministic AI Agent Workflows

  Varun Pratap Bhardwaj · 4 de marzo de 2026

  Autonomous AI agents are deployed at unprecedented scale, yet no principled methodology exists for verifying that an agent has not regressed after changes to its prompts, tools, models, or orchestration logic. We present AgentAssay, the first token-efficient framework for regression testing no…

• Inherited Goal Drift: Contextual Pressure Can Undermine Agentic Goals

  Achyutha Menon, Magnus Saebo, Tyler Crosse, Spencer Gibson, Eyon Jang, Diogo Cruz · 4 de marzo de 2026

  The accelerating adoption of language models (LMs) as agents for deployment in long-context tasks motivates a thorough understanding of goal drift: agents' tendency to deviate from an original objective. While prior-generation language model agents have been shown to be susceptible to drift, the ext…

• NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion

  Max Collins, Jordan Vice, Tim French, Ajmal Mian · 4 de marzo de 2026

  Adversarial samples exploit irregularities in the manifold `learned' by deep learning models to cause misclassifications. The study of these adversarial samples provides insight into the features a model uses to classify inputs, which can be leveraged to improve robustness against future attacks. Ho…

• Speculative Speculative Decoding

  Tanishq Kumar, Tri Dao, Avner May · 4 de marzo de 2026

  Autoregressive decoding is bottlenecked by its sequential nature. Speculative decoding has become a standard way to accelerate inference by using a fast draft model to predict upcoming tokens from a slower target model, and then verifying them in parallel with a single target model forward pass. How…

• Talking with Verifiers: Automatic Specification Generation for Neural Network Verification

  Yizhak Y. Elboher, Reuven Peleg, Zhouxing Shi, Guy Katz, Jan K\v{r}et\'insk\'y · 4 de marzo de 2026

  Neural network verification tools currently support only a narrow class of specifications, typically expressed as low-level constraints over raw inputs and outputs. This limitation significantly hinders their adoption and practical applicability across diverse application domains where correctness r…

• From Shallow to Deep: Pinning Semantic Intent via Causal GRPO

  Shuyi Zhou, Zeen Song, Wenwen Qiang, Jiyan Sun, Yao Zhou, Yinlong Liu, Wei Ma · 4 de marzo de 2026

  Large Language Models remain vulnerable to adversarial prefix attacks (e.g., ``Sure, here is'') despite robust standard safety. We diagnose this vulnerability as Shallow Safety Alignment, stemming from a pathology we term semantic representation decay: as the model generates compliant prefixes, its …

• Guiding Sparse Neural Networks with Neurobiological Principles to Elicit Biologically Plausible Representations

  Patrick Inoue, Florian R\"ohrbein, Andreas Knoblauch · 4 de marzo de 2026

  While deep neural networks (DNNs) have achieved remarkable performance in tasks such as image recognition, they often struggle with generalization, learning from few examples, and continuous adaptation - abilities inherent in biological neural systems. These challenges arise due to DNNs' failure to …

• Contextualized Privacy Defense for LLM Agents

  Yule Wen, Yanzhe Zhang, Jianxun Lian, Xiaoyuan Yi, Xing Xie, Diyi Yang · 4 de marzo de 2026

  LLM agents increasingly act on users' personal information, yet existing privacy defenses remain limited in both design and adaptability. Most prior approaches rely on static or passive defenses, such as prompting and guarding. These paradigms are insufficient for supporting contextual, proactive pr…

• Value Flows

  Perry Dong, Chongyi Zheng, Chelsea Finn, Dorsa Sadigh, Benjamin Eysenbach · 3 de marzo de 2026

  While most reinforcement learning methods today flatten the distribution of future returns to a single scalar value, distributional RL methods exploit the return distribution to provide stronger learning signals and to enable applications in exploration and safe RL. While the predominant method for …

• DualSentinel: A Lightweight Framework for Detecting Targeted Attacks in Black-box LLM via Dual Entropy Lull Pattern

  Xiaoyi Pang, Xuanyi Hao, Pengyu Liu, Qi Luo, Song Guo, Zhibo Wang · 3 de marzo de 2026

  Recent intelligent systems integrate powerful Large Language Models (LLMs) through APIs, but their trustworthiness may be critically undermined by targeted attacks like backdoor and prompt injection attacks, which secretly force LLMs to generate specific malicious sequences. Existing defensive appro…

• IU: Imperceptible Universal Backdoor Attack

  Hsin Lin, Yan-Lun Chen, Ren-Hung Hwang, Chia-Mu Yu · 3 de marzo de 2026

  Backdoor attacks pose a critical threat to the security of deep neural networks, yet existing efforts on universal backdoors often rely on visually salient patterns, making them easier to detect and less practical at scale. In this work, we introduce a novel imperceptible universal backdoor attack t…

• BadRSSD: Backdoor Attacks on Regularized Self-Supervised Diffusion Models

  Jiayao Wang, Yiping Zhang, Mohammad Maruf Hasan, Xiaoying Lei, Jiale Zhang, Junwu Zhu, Qilin Wu, Dongfang Zhao · 3 de marzo de 2026

  Self-supervised diffusion models learn high-quality visual representations via latent space denoising. However, their representation layer poses a distinct threat: unlike traditional attacks targeting generative outputs, its unconstrained latent semantic space allows for stealthy backdoors, permitti…

• Frontier Models Can Take Actions at Low Probabilities

  Alex Serrano, Wen Xing, David Lindner, Erik Jenner · 3 de marzo de 2026

  Pre-deployment evaluations inspect only a limited sample of model actions. A malicious model seeking to evade oversight could exploit this by randomizing when to "defect": misbehaving so rarely that no malicious actions are observed during evaluation, but often enough that they occur eventually in d…

• KERV: Kinematic-Rectified Speculative Decoding for Embodied VLA Models

  Zihao Zheng, Zhihao Mao, Maoliang Li, Jiayu Chen, Xinhao Sun, Zhaobo Zhang, Donggang Cao, Hong Mei, Xiang Chen · 3 de marzo de 2026

  Vision-Language-Action (VLA) models build a token-domain robot control paradigm, yet suffer from low speed. Speculative Decoding (SD) is an optimization strategy that can boost inference speed. Two key issues emerge when integrating VLA and SD: first, SD relies on re-inference to address token error…