arXiv AI
Aug 6
Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning
arXiv:2608. 05045v1 Announce Type: cross Abstract: Released aligned large language models remain vulnerable to malicious downstream finetuning.
CANARY: Zero-Label Detection of Fine-Tuning Contamination in Language Models
arXiv:2606. 01695v1 Announce Type: new Abstract: Adversaries can implant latent harmful behavior by poisoning as few as 1% of fine-tuning examples.
Related stories
arXiv AI
Jun 10
Stop Early, Spend Less: Hidden-State Probes as a Practical Recipe for Streaming Moderation of LLM Outputs
arXiv:2606. 10487v1 Announce Type: cross Abstract: Deploying large language models in user-facing systems requires efficient output safety filtering.
arXiv AI
Jun 24
AdversaBench: Automated LLM Red-Teaming with Multi-Judge Confirmation and Cross-Model Transferability
arXiv:2606. 24589v1 Announce Type: new Abstract: Scaling adversarial evaluation of large language models requires both a method for generating hard inputs and a reliable way to confirm that resulting failures are real.
arXiv Machine Learning
Jul 30
ToxScreen: Detecting Whether an LLM Has Been Poisoned
arXiv:2607. 26849v1 Announce Type: cross Abstract: As large language models (LLMs) are deployed in high-stakes domains, adversaries may poison training data to implant backdoors: hidden triggers that covertly manipulate model behavior at inference time.
arXiv Computation and Language
Sep 25
LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders
The paper investigates how trigger-based backdoors function in large language models by using sparse autoencoders (SAEs) to identify feature directions across layers and transformer components. In a controlled experiment, 1B and 8B models were made to continue English prompts in French or German when presented with fixed trigger sequences. The study finds that different SAE feature directions correspond to trigger detection, residual-stream propagation, and language tracking, with residual-stream features being most effective for controlling the backdoor behavior.
arXiv AI
Jun 9
Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs
arXiv:2606. 07963v1 Announce Type: new Abstract: Backdoor attacks in large language models (LLMs) are often treated as isolated trigger-response failures, motivating defenses tailored to specific triggers or behaviors.
arXiv AI
4d ago
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
arXiv:2609.36570v1 Announce Type: cross Abstract: Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that...
arXiv AI
Jun 30
Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense
arXiv:2606. 29441v1 Announce Type: cross Abstract: Inference-time safety methods for large language models have proliferated, yet no systematic comparison exists.
arXiv Machine Learning
Jul 14
HyperSafe: Inference-Time Safety Recovery for Fine-Tuned Language Models
arXiv:2607. 11475v1 Announce Type: new Abstract: Safety alignment in large language models can be fragile under fine-tuning, as even benign task adaptation may increase harmful compliance.
arXiv AI
Jun 19
Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software
arXiv:2606. 20502v1 Announce Type: cross Abstract: Whether LLMs scoring well on vulnerability benchmarks genuinely reason about security or merely pattern-match on contaminated data remains unresolved.
arXiv Machine Learning
Sep 16
Test-Time Unlearning via Sparse Autoencoder
arXiv:2609.16229v1 Announce Type: new Abstract: Machine unlearning aims to remove specific knowledge from a trained large language model (LLM) without retraining from scratch. Existing methods modify...
Hugging Face Trending Papers
Jul 22
Defense Against LLM Backdoors using Critical Neuron Isolation Pruning
Large language models (LLMs) are vulnerable to backdoor attacks, where hidden triggers induce malicious outputs. Existing defenses generally fall into inference-time detection or training-time mitigation, but face two key limitations.