The paper investigates a new security vulnerability in fine‑tuned Mixture‑of‑Experts large language models, termed structural memorization, where the model not only memorizes training data but also the internal routing pathways used during fine‑tuning. The authors demonstrate that these memorized expert pathways can be recovered from the model’s unconditional generation using only routing and output logits, even without access to the fine‑tuning data. They further show that this vulnerability is amplified in distributed deployments and that traditional membership inference metrics fail to detect it, proposing composite metrics that improve detection of memorized routing structures.
By Fei Wang, Baochun Li, Bo Li
The paper investigates how large language model (LLM) search agents can be manipulated through repeated, coordinated search-result injections, a threat that extends beyond single-page poisoning. It introduces Authority‑Chain Hijack (ACH), a strategy that chains manipulated evidence across multiple sources, achieving high attack success rates on the SafeSearch benchmark. The authors also present Trace‑Guided Strategy Evolution (TGSE), an automated method that refines attacker strategies using execution traces, further improving success rates.
By Xuebin Li, Hanqing Zhao, Siyuan Liang, Kejiang Chen, Weiming Zhang, Dacheng Tao, Nenghai Yu
arXiv:2603. 00801v2 Announce Type: replace Abstract: Language agents increasingly act as web-enabled systems that search, browse, and synthesize information from diverse sources.
By Shrey Shah, Levent Ozgur
arXiv:2607. 04718v1 Announce Type: new Abstract: Deep research agents decompose open-ended queries into subtasks, retrieve web evidence over multiple rounds, and synthesize long-form reports.
By Yue Pan, Ziheng Zhang, Junxiang Lei, Changhao Jia, Qingyi Si, Hongcheng Guo
arXiv:2604.27426v2 Announce Type: replace-cross
Abstract: Local fine-tuning datasets routinely contain sensitive secrets such as API keys, personal identifiers, and financial records. Although "local...
By Zi Li, Tian Zhou, Wenze Li, Jingyu Hua, Yunlong Mao, Sheng Zhong
The paper proposes using lossy compression as a security signal in federated learning by defining a "compression footprint"—a low‑dimensional set of statistics derived from the compressor’s output. It introduces CRAFT, a server‑side aggregation method that leverages these footprints to distinguish honest from malicious updates without extra client metadata or knowledge of attacker numbers. Experiments on six attacks and datasets show CRAFT often outperforms existing robust aggregation baselines, demonstrating that compression can simultaneously reduce communication and enhance security.
By Sachi Shome, William Eiers
arXiv:2609.35908v1 Announce Type: cross
Abstract: Semantic caches reduce LLM serving costs by reusing previously generated answers for semantically similar queries. However, retrieval is based solely...
By Zihan Zhang, Shuangjie Yao, Zesen Liu, Zhixiang Zhang, Wai Ip Lai, Dung Hiu Hilton Yeung, Chun Kit Zhang, Fuchen Ma, Yuanyuan Yuan, Yu Jiang, Dongdong She
FedGraph is a graph-based aggregation framework designed to defend federated large language model fine-tuning against backdoor attacks. It exploits the observation that malicious clients produce consistently similar updates, while benign clients generate diverse ones, by modeling client updates as nodes in a dynamically constructed graph and extracting structural features. The resulting compact client representations enable effective identification and suppression of malicious contributions, achieving high detection accuracy and low false positives in extensive experiments.
By Xi Chen, Chunyi Zhou, Rui Zeng, Xiaogang Xu, Zhe Liu, Shouling Ji
arXiv:2608. 04565v1 Announce Type: cross Abstract: LLM-based search agents are widely used for information-seeking tasks, but their reliance on external tool returns introduces a critical security risk: web content retrieved during execution is untrusted, exposing agents to prompt injection and goal hijacking.
By Xuebin Li, Hanqing Zhao, Siyuan Liang, Kejiang Chen, Weiming Zhang, Dacheng Tao, Nenghai Yu
arXiv:2506.20651v1 Announce Type: cross
Abstract: Recent work has shown that gradient updates in federated learning (FL) can unintentionally reveal sensitive information about a client's local data....
By Fei Wang, Baochun Li
The paper introduces Fed-ADR, a coordinated attack framework where a malicious orchestrator server directs heterogeneous adversarial clients to adapt their gradient updates in real time, thereby evading existing federated learning defenses and drastically reducing global model accuracy. It also presents a lightweight detection mechanism that estimates true client gradients from historical data to spot coordinated attacks, and an in-situ recovery method that restores model performance without restarting training. Experiments on MNIST, Fashion‑MNIST, and CIFAR‑10 show the attack can drop accuracy from over 90% to below 10%, while the defense can recover accuracy to above 90% within a few rounds at a computational cost at least 20× lower than retraining from scratch.
By Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy
FedLNS is a server‑side framework that screens federated learning updates by representing each client’s contribution through changes in trainable normalization‑layer parameters, creating lightweight signatures that can be compared against a history‑aware cross‑client reference. The method requires no extra client‑to‑server communication, raw data, or labeled attack examples, and after screening, the remaining full‑model updates are aggregated with standard federated learning rules. Experiments on GPT‑style, BERT‑style, and LLaMA‑style models with 200 clients demonstrate that FedLNS achieves lower test perplexity than six baselines even when 40% of the population performs target manipulation under both IID and non‑IID data partitions.
By Kai Li, Jong-Ik Park, Carlee Joe-Wong, Wei Ni, Falko Dressler