18 citations · 43 across the 19 of their papers we have counts for
21 papers
PROVISO: Provenance-Informed Action Selection for Secure LLM Agents
Bo Yan, Qi Zhang, Ziwen Kan +2
LLM agents act on the external world through tools and third-party skills, so a single executed action can cause irreversible harm. Existing defenses judge a proposed action withou…
Greedy Decoding Is Not Precision-Invariant: Cross-Precision Output Divergence in LLM Inference
Gaoyuan Du, Anam Nawaz Khan, Rex Zhou +4
Greedy decoding from large language models is commonly treated as deterministic. We show it is not precision-invariant: the same model, prompt, and decoding algorithm produce diffe…
Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models
Kunlin Cai, Kaiyuan Zhang, Zihang Xiang +4
Text-to-Speech (TTS) foundation models are increasingly fine-tuned on private datasets to synthesize highly personalized voices, introducing severe privacy risks by exposing both b…
(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure
Habibur Rahaman, Qipan Xu, Zafaryab Haider +3
Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifac…
ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generation
Jinghuai Zhang, Pengyue Yu, Zhexiao Lin +3
Image-based Retrieval-Augmented Generation (IRAG) conditions a frozen generator on reference images retrieved from an external database, supporting both text-to-image (T2I) and que…
RogueMerge: Robust and Unified Attacks against LLM Model Merging
Jinghuai Zhang, Yetian He, Kunlin Cai +3
Model merging composes specialized capabilities into a single LLM by aggregating task-specific LLMs sourced from unverified public platforms, exposing a critical supply-chain attac…
Token Inflation: How Dishonest Providers Can Overcharge for Large Language Model Usage
Shahinul Hoque, Jinghuai Zhang, Jinyuan Sun +1
Per-token billing is now the standard pricing model for commercial large language models (LLMs), so the honesty of reported token counts directly affects what users pay. We show th…
What-If World: A Causal Benchmark for General World Models in Embodied Scenarios
Kunlin Cai, Rui Song, Jinghuai Zhang +7
Video generation models are increasingly used as world simulators for tasks like driving and robotic manipulation. What matters in these settings is not whether a single video look…
LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models
Abdullah Al Nomaan Nafi, Fnu Suya, Swarup Bhunia +1
Jailbreak attacks expose a persistent gap between the intended safety behavior of aligned large language models and their behavior under adversarial prompting. Existing automated m…
HAMLOCK: HArdware-Model LOgically Combined attacK
Sanskar Amgain, Daniel Lobo, Atri Chatterjee +2
The growing use of third-party hardware accelerators (e.g., FPGAs, ASICs) for deep neural networks (DNNs) introduces new security vulnerabilities. Conventional model-level backdoor…
DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples
Abdullah Al Nomaan Nafi, Habibur Rahaman, Zafaryab Haider +4
Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to…
Adversarial Hubness in Multi-Modal Retrieval
Tingwei Zhang, Fnu Suya, Rishi Jha +2
Hubness is a phenomenon in high-dimensional vector spaces where a point from the natural distribution is unusually close to many other points. This is a well-known problem in infor…
Understanding Variation in Subpopulation Susceptibility to Poisoning Attacks
Evan Rose, Fnu Suya, David Evans
Machine learning is susceptible to poisoning attacks, in which an attacker controls a small fraction of the training data and chooses that data with the goal of inducing some behav…
SoK: Pitfalls in Evaluating Black-Box Attacks
Fnu Suya, Anshuman Suri, Tingwei Zhang +3
Numerous works study black-box attacks on image classifiers. However, these works make different assumptions on the adversary's knowledge and current literature lacks a cohesive or…
What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?
Fnu Suya, Xiao Zhang, Yuan Tian +1
We study indiscriminate poisoning for linear learners where an adversary injects a few crafted examples into the training data with the goal of forcing the induced model to incur h…
Manipulating Transfer Learning for Property Inference
Yulong Tian, Fnu Suya, Anshuman Suri +2
Transfer learning is a popular method for tuning pretrained (upstream) models for different downstream tasks using limited data and computational resources. We study how an adversa…
Stealthy Backdoors as Compression Artifacts
Yulong Tian, Fnu Suya, Fengyuan Xu +1
In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a s…
Model-Targeted Poisoning Attacks with Provable Convergence
Fnu Suya, Saeed Mahloujifar, Anshuman Suri +2
In a poisoning attack, an adversary with control over a small fraction of the training data attempts to select that data in a way that induces a corrupted model that misbehaves in…
Scalable Attack on Graph Data by Injecting Vicious Nodes
Jihong Wang, Minnan Luo, Fnu Suya +3
Recent studies have shown that graph convolution networks (GCNs) are vulnerable to carefully designed attacks, which aim to cause misclassification of a specific node on the graph…
Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
Fnu Suya, Jianfeng Chi, David Evans +1
We study adversarial examples in a black-box setting where the adversary only has API access to the target model and each query is expensive. Prior work on black-box adversarial ex…
Query-limited Black-box Attacks to Classifiers
Fnu Suya, Yuan Tian, David Evans +1
We study black-box attacks on machine learning classifiers where each query to the model incurs some cost or risk of detection to the adversary. We focus explicitly on minimizing t…