Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,033 items
This article establishes information-theoretic limitations on the robustness of AI security and alignment. It argues that knowing these limits and preparing for their challenges is essential for responsible AI adoption, and it also proves broader implications for the cognitive reasoning limitations of AI systems.
Classical tensor decomposition methods cannot handle ragged tensors, which have irregular index patterns. The authors propose a CP-based, geometry-aware separable decomposition framework that models the valid domain with a binary weighting tensor and decouples the objective into independent subproblems. The method uses a domain-adapted proximal alternating minimization solver with a convergence guarantee, and it reports superior accuracy and efficiency on multispectral, hyperspectral and spatial transcriptomics data.
DrawMotion is a diffusion-based framework that generates 3D human motions from both a text description and a freehand drawing condition. It converts hand-drawn stickman sketches into spatial control, and a Multi-Condition Module fuses the text, sketch and 2D trajectory conditions inside the diffusion process. The authors report that the drawing approach cuts user time by approximately 46.7% when producing motions that match users' intentions.
TemSR, a framework for time-series source-free unsupervised domain adaptation, is proposed to transfer temporal dependencies to a target domain without access to source data. It uses a masking, recovery and optimization process to generate a source-like distribution, refined by local context-aware regularization and anchor-based recovery diversity maximization. Experiments across seven time-series tasks show it surpasses existing methods that require source-specific pretraining designs.
DreamFuse is a unified diffusion-based approach for image fusion that integrates foreground objects into background scenes. The authors curate a cross-scene dataset with iterative in-context learning and existing tools, then use the Diffusion Transformer's attention mechanism to align foreground and background features. The paper reports superiority over state-of-the-art methods across multiple metrics.
Researchers built a transformer-based regression model that fuses temporal biomechanical features, outsole images, footwear metadata and anthropometric data to predict personalized slip resistance scores for 84 footwear models. Trained on 578 walking trials by 18 participants on wet and dry ice, the model performed better on dry surfaces (RMSE 1.34° ± 0.34°, R² 0.45 ± 0.09, MAPE 10.48% ± 3.58%) than on wet surfaces (RMSE 2.34° ± 0.43°, R² 0.47 ± 0.12, MAPE 21.45% ± 6.89%).
The authors propose DFMDM, a dynamically filtering multistage diffusion model for cross-corpus speech emotion recognition. It runs a three-stage loop of generation, filtering and enhancement, where an adversarial domain classifier guides pseudosample generation and a dynamic filtering module removes low-quality samples that deviate from target domain features. The model reports significant gains over state-of-the-art approaches on CASIA, EmoDB, eNTERFACE and IEMOCAP.
MaliVD is a vulnerability detection method for source code that uses a multi-modal attention mechanism over sequential, tree-based and graph-based features. It identifies vulnerability types and pinpoints the lines where they are triggered. Compared with eight advanced models across three large datasets, it reports higher F1 scores and localization precision, including a 21.82% F1 improvement on the ReliVul dataset.
Researchers examined the communication between EV chargers and vehicles and found the SAE J1772 charging control protocol lacks authenticity protection. They proposed ChargeX, a class of attacks that inserts a hardware circuit to modify charging control signals, and tested it on a public charging station and two home chargers using a simulated vehicle load. They showed it could force a Tesla's charging state from "stand by" to "charging", potentially causing overcharging, and could push any state into an error state for a denial of service.
Researchers present VM-DSSE-FB, a verifiable multi-user dynamic searchable symmetric encryption scheme for cloud storage. It fuses symmetric encryption with homomorphic addition and bitmap indexing to provide forward and backward privacy, uses an encrypted update queue per user, and supports accurate multi-keyword queries. The authors report adaptive security and claim better functionality and efficiency than similar schemes.
This paper proposes an adaptive regulatory system for privacy grounded in contextual integrity. The authors argue that flawed regulatory paradigms legitimize harms from the data economy and slow responses to privacy violations. The system has three learning cycles: designing regulations, real-time monitoring and enforcement, and ongoing evaluation.
Researchers evaluate twenty-eight representative LLMs on thirteen named entity recognition (NER) datasets across five domains, with parameter counts from 3 billion to 175 billion. They assess supervised fine-tuning, parameter scale, hallucinations and prompt designs using an LLM-based NER framework (LLM-NER) with a Recognition phase and a Check phase. The study finds that fine-tuning improves instruction following, performance rises with parameter scale, hallucinations appear in all evaluated models, and all models are sensitive to prompt design.
The paper presents CShard, a blockchain sharding protocol that uses repairable fountain codes (RFCs), an information coding method with a locality feature, to define transaction verification and to recover blocks of corrupted shards by decoding. It also proposes a ghost reporter mechanism, which lets all nodes verify transactions by submitting reports, to detect corrupted shards and to allow smaller node counts per shard.
This paper studies transferable targeted attacks on image models that work without victim-model training data or black-box feedback. The authors introduce two blind estimation measures, self-alignment and self-transferability, to assess each image transformation. They find that simple scaling transformations uniquely enhance targeted transferability, and they build S$^{4}$4ST, a scale transformation method, which achieves state-of-the-art effectiveness-efficiency balance across architectures, training distributions and tasks.
OpenAI has opened applications for the OpenAI Safety Fellowship, a pilot program for external researchers, engineers and practitioners working on safety and alignment of advanced AI systems. The program runs from September 14, 2026 through February 5, 2027, with fellows expected to produce a substantial research output such as a paper, benchmark or dataset. Applications close May 3, and successful applicants will be notified by July 25.
Fix: Guiding LLMs to check their outputs, via the Check phase of LLM-NER, is described as a feasible way to alleviate hallucinations.
IEEE Xplore (Security & AI Journals)This paper presents a theoretical framework for transfer-based black-box adversarial attacks, deriving a transferability bound that links adversarial transferability to flat minima over a surrogate model set and the adversarial model discrepancy. Based on this bound, the authors build a surrogate model set with diverse adversarial vulnerabilities and generate a model-Diversity-compatible Reverse Adversarial Perturbation (DRAP). Experiments on the NIPS2017 and CIFAR-10 datasets against various target models show the proposed attack is effective.