Papers by Baolei Zhang
CTRAP: Embedding Collapse Trap to Safeguard Large Language Models from Harmful Fine-Tuning (2026.acl-long)
Copied to clipboard
| Challenge: | Fine-tuning-as-a-service exposes models to harmful fine-tuneing attacks . however, inherent general adaptability of LLMs allows them to bypass selective unlearning by rapidly relearning or repurposing their general capabilities for harmful tasks. |
| Approach: | They propose a paradigm shift that inducing model collapse instead of selective removal by relearning or repurposing general capabilities for harmful tasks. |
| Outcome: | The proposed model collapse mechanism neutralizes the very general capabilities that attackers exploit, tackling the core issue unaddressed by selective unlearning. |
SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing membership inference attacks require access to complete logits, but such access is often unavailable in real-world deployments where only the generated text is exposed. |
| Approach: | They propose a surrogate-free label-only MIA approach that directly estimates token probabilities through Monte Carlo sampling of the target model. |
| Outcome: | The proposed approach outperforms existing label-only attacks and serves as a foundational density estimator in the label-exclusive setting. |
Prompt-Guided Internal States for Hallucination Detection of Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) generate incorrect or logically incorrect responses, which is known as LLM hallucinations. |
| Approach: | They propose a framework for supervised hallucination detection using in-domain data by prompting changes to the structure related to text truthfulness in LLMs’ internal states. |
| Outcome: | The proposed framework enhances the cross-domain generalization of existing hallucination detection methods. |
BadActs: A Universal Backdoor Defense in the Activation Space (2024.findings-acl)
Copied to clipboard
| Challenge: | Backdoor attacks pose an increasingly severe security threat to Deep Neural Networks . existing methods focused on the word space are ineffective against feature-space triggers - a recent study has shown . |
| Approach: | They propose a backdoor defense that purifies backdoor samples in the activation space . they aim to eliminate backdoor triggers while preserving the integrity of clean data . |
| Outcome: | The proposed method achieves state-of-the-art against backdoor attacks on clean data. |