Research
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
Academic papers, new techniques, benchmarks, and theoretical findings in AI/LLM security.
2,040 items
This paper reformulates model lineage determination as a question of whether two models' parameters lie within the same local optimum of the loss landscape. The authors propose a method for lineage determination and a task-agnostic, modification-type-agnostic way to measure lineage closeness, based on the mean adversarial distance from data points to decision boundaries and the matching rate of predictions. Experiments report 100% accuracy in lineage determination across a wide range of modification scenarios.
DeepFilter modifies the Transformer architecture for industrial process monitoring by replacing the self-attention layer with an efficient filtering layer. The authors argue that canonical self-attention struggles with discriminative patterns in monitoring logs and has quadratic computational complexity, while the filtering layer captures long-term patterns at reduced cost. Experiments on real-world process monitoring datasets reportedly show better accuracy and efficiency than existing state-of-the-art models.
This article introduces an $\ell_{0}$-norm penalty into the Universum support vector machine, so the classifier learns from an auxiliary unlabeled dataset within a lower-dimensional space made of the most relevant variables. The authors establish the existence of an optimal solution, derive necessary and sufficient optimality conditions using two types of stationary points, and develop an alternating direction method of multipliers algorithm whose convergence is shown under specific conditions. Numerical experiments across various datasets are reported as demonstrating the method's effectiveness.
Researchers propose a 3-D-cycle conversion network that takes 3-D MRI features captured by MRI sensors and converts them into synthesized SPECT images, so dopamine neuron activity can be assessed without injecting radioactive drugs. Inspired by CycleGAN, the architecture uses cyclic transformation and reconstruction modules for 3-D synthesis. In the reported experiments, the framework outperforms other CycleGAN-based approaches in both quantitative and qualitative evaluations.
ARNAS++ is a neural architecture search method that finds architectures balancing natural accuracy and adversarial robustness. It uses a supernet with flexible parameter budgets and width, controlled by a parameter budget controlling loss and a learnable filter number reduction ratio. The authors report outperforming competitors on six benchmark datasets under various adversarial attacks.
This article presents a reinforcement learning scheme for safe optimal formation tracking of multiple fixed-wing UAVs under external disturbances and asymmetric control constraints. The method builds a safe set from a control barrier function, integrates it into a nonquadratic cost of a constrained zero-sum differential game, and learns the robust safe Nash policy with a critic-only RL strategy using experience replay, avoiding the persistence of excitation condition. The authors verify stability and forward invariance of the safe set and validate the scheme in simulation.
The authors study the sample complexity of stochastic convex optimization when parameters such as the distance to optimality and the Lipschitz constant are unknown. They propose a reliable model selection method that tunes learning rates to match known-parameter sample complexity up to $\log\log$ factors, and a regularization-based method using norm-regularized empirical risk minimization that estimates the distance to optimality within a constant factor. Few-shot experiments on CIFAR-10 with fine-tuned CLIP models and prompt-engineered Gemini shape counting indicate the model selection method can help mitigate overfitting to small validation sets.
Adversarially trained implicit generative models can suffer unstable dynamics and mode collapse. This work formally characterizes the invariant statistical loss (ISL) as a proper divergence over continuous distributions, showing it is continuous and differentiable so it supports stable gradient-based optimization without adversarial games. It also introduces Pareto-ISL, which uses a generalized Pareto latent distribution to better model heavy tails, and ISL-slicing, which scales the loss to high-dimensional data by averaging rank-based losses over random one-dimensional projections.
The authors propose a nonparametric generative model for time series based on the Schrödinger bridge (SB) approach. The model is characterized by a finite-horizon stochastic differential equation with a path-dependent drift, which the authors estimate from data with kernel regression and simulate to produce synthetic samples. They evaluate it on autoregressive models, a GARCH model and fractional Brownian motion, and apply the synthetic samples to deep hedging on real datasets.
The paper treats diffusion models as an implicit approach to nonparametric density estimation and analyzes them within a statistical framework. It assumes the underlying density factorizes into low-dimensional components, as in Bayesian networks and Markov random fields. The authors show that a diffusion-based implicit estimator adapts to this factorization and achieves the minimax optimal rate under total variation distance, using a sparse weight-sharing neural network architecture.
This paper studies how knowledge transfer affects the generation accuracy of generative models. It fine-tunes a target-task model from a pre-trained source-task model, using a Shared Embedding concept and a transfer learning framework measured by distribution metrics such as Kullback-Leibler divergence. Theoretical and experimental results for diffusion and normalizing flow models show better performance than non-transfer counterparts.
This paper studies statistical guarantees for denoising reflected diffusion models, which use a reflected diffusion process as the noise driver to avoid the thresholding procedures that implementations add to handle the unbounded state space of idealised models. Under Sobolev smoothness assumptions, the authors establish convergence rates in total variation that, up to a polylogarithmic factor, match the minimax lower bound. Their contributions include the statistical analysis of this model class and a refined score approximation method in time and space based on spectral decomposition and neural network analysis.
The paper introduces a two-step method for probabilistic rainfall downscaling, which generates finer-scale rainfall distributions from coarse-scale deterministic weather variables while preserving temporal and spatial dependence. Marginal location-specific distributions are fitted with joint generalised neural models, which extend generalised linear models with a deep neural network, and spatial coherence is modelled with a censored latent Gaussian copula whose correlation matrix comes from a Gaussian Process Kernel. The authors report that the approach outperforms existing methods on a large UK dataset.
This paper derives the neural scaling law, which describes how a foundation model's cross entropy rate changes with training tokens, parameters, and compute, from Zipf's law on token distributions. The authors chain the derivation through Heaps' law on vocabulary growth and Hilberg's hypothesis on entropy scaling. They illustrate the steps with a toy example, the Santa Fe process, which satisfies all four statistical laws.
This paper analyzes Chain-of-Thought (CoT) prompting from a statistical perspective, using a multi-step latent variable model to show that the CoT estimator approximates a Bayesian estimator that infers the posterior from examples in the prompt. The authors prove the statistical error splits into a prompting error, which decreases exponentially as the number of prompt examples grows, and a pretraining error of the pretrained LLM. They also construct a transformer model class and establish its generalization error under the PAC-Bayes framework.
This paper proposes mitigating hard sample interference (MHSI), a method for adversarial training that reduces the accuracy-robustness trade-off caused by samples near the decision boundary. It combines a weighted adaptive (WA) mechanism that strengthens learning on clean samples with a dynamic calibration (DC) strategy that adjusts hard-sample probability outputs, guided by gradient norm and Hessian analysis. Experiments on CIFAR-10, CIFAR-100, Tiny ImageNet and SVHN report up to a 6.22% robustness gain over the AT baseline under an l-infinity attack.
Out-of-distribution inputs often cause object detectors to make overconfident predictions on non-target objects. The authors report that up to 13% of objects in widely used OoD test sets belong to in-distribution classes, distorting reported performance, and propose a training-time method that fine-tunes the detector on a synthesized OoD dataset that resembles in-distribution objects. This reduces hallucination error by 91% for a YOLO model on BDD-100K.
Fix: The source describes a training-time mitigation: fine-tuning the detector on a carefully synthesized OoD dataset that semantically resembles in-distribution objects, which suppresses objectness on OoD objects. It states this generalizes across YOLO, Faster R-CNN and RT-DETR and supports few-shot adaptation.
IEEE Xplore (Security & AI Journals)UQLM is a Python package for detecting hallucinations in Large Language Models using uncertainty quantification (UQ) techniques. It provides a suite of UQ-based scorers that produce response-level confidence scores from 0 to 1, offered as an off-the-shelf library that can be integrated to improve the reliability of LLM outputs.
Abstract Gradient Training (AGT) is a unified framework for certifying a given model and training procedure against training data perturbations, covering bounded perturbations, removal of data points, and addition of new samples. It works by bounding the reachable set of parameters to establish provable parameter-space bounds, and it targets models trained with first-order optimization methods. The framework is presented as covering data poisoning, machine unlearning, and differential privacy.
MarkDiffusion is an open-source Python toolkit for generative watermarking of latent diffusion models. It provides a unified implementation framework, a mechanism visualization suite for embedded and extracted watermark patterns, and an evaluation module with 24 tools and 8 automated pipelines for detectability, robustness, and output quality. The counts reflect the initial release, and the code is available at https://github.com/THU-BPM/MarkDiffusion.