Papers by Du Su
Steering Away from Refusal: A Black-box Jailbreak Method Based on First-Token Distribution (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to analyze black-box jailbreaks lack direct optimization signals to refine adversarial prompts. |
| Approach: | They propose a distribution-jailbreak attack method that selects effective jailbreak templates and iteratively optimizes adversarial suffixes by maximizing the KL divergence from the standard refusal distribution. |
| Outcome: | The proposed method achieves state-of-the-art Attack Success Rate (ASR) on all tested open-source models and delivers over 94% ASR on GPT-4.1. |
LLMs Assist NLP Researchers: Critique Paper (Meta-)Reviewing (2024.emnlp-main)
Copied to clipboard
Jiangshu Du, Yibo Wang, Wenting Zhao, Zhongfen Deng, Shuaiqi Liu, Renze Lou, Henry Zou, Pranav Narayanan Venkit, Nan Zhang, Mukund Srinath, Haoran Zhang, Vipul Gupta, Yinghui Li, Tao Li, Fei Wang, Qin Liu, Tianlin Liu, Pengzhi Gao, Congying Xia, Chen Xing, Cheng Jiayang, Zhaowei Wang, Ying Su, Raj Shah, Ruohao Guo, Jing Gu, Haoran Li, Kangda Wei, Zihao Wang, Lu Cheng, Surangika Ranathunga, Meng Fang, Jie Fu, Fei Liu, Ruihong Huang, Eduardo Blanco, Yixin Cao, Rui Zhang, Philip Yu, Wenpeng Yin
| Challenge: | a comparative analysis of paper (meta-)reviews by large language models (LLMs) aims to identify and distinguish LLMs from human activities . |
| Approach: | They present a comparative analysis to identify and distinguish LLM activities from human activities. |
| Outcome: | The proposed analysis aims to improve recognition of instances when someone implicitly uses LLMs for reviewing activities. |
GIFT: Guided Fine-Tuning and Transfer for Enhancing Instruction-Tuned Language Models (2026.acl-long)
Copied to clipboard
Zhiwen Ruan, Yichao Du, Jianjie Zheng, Longyue Wang, Yun Chen, Peng Li, Jinsong Su, Yang Liu, Guanhua Chen
| Challenge: | Existing adapter-based transfer methods treat instruction-tuned models as passive targets . direct fine-tuning can disrupt this delicate balance and lead to instability or performance degradation. |
| Approach: | They propose a framework that incorporates instruction-level guidance into task adaptation. |
| Outcome: | The proposed framework outperforms direct fine-tuning and representative transfer-based baselines while maintaining robust generalization and favorable test-time scaling behavior. |
DetectRL-X: Towards Reliable Multilingual and Real-World LLM-Generated Text Detection (2026.acl-long)
Copied to clipboard
Junchao Wu, Yefeng Liu, Chenyu Zhu, Hao Zhang, Zeyu Wu, Tianqi Shi, Yichao Du, Longyue Wang, Weihua Luo, Jinsong Su, Derek F. Wong
| Challenge: | Existing detectors are limited in their ability to detect large language models generated content in multilingual environments. |
| Approach: | They propose a multilingual benchmark to evaluate advanced detectors across 8 dimensions to better align with real-world applications. |
| Outcome: | The proposed benchmark encompasses 8 languages commonly used in commercial contexts and collects human-written texts from 6 domains highly susceptible to LLM misuse. |
Distilling Large Embeddings via Hyperspherical Householder Quantization (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for quantizing large embeddings rely on Euclidean quantization, which is poorly aligned with the angular geometry induced by contrastive embeddment training. |
| Approach: | They propose a geometry-aware distillation method that compresses large embeddings into short discrete representations via iterative Householder transformations on the unit hypersphere. |
| Outcome: | The proposed method reduces decoding cost and maintains strong semantic retrieval accuracy. |
PRDetect: Perturbation-Robust LLM-generated Text Detection Based on Syntax Tree (2025.findings-naacl)
Copied to clipboard
| Challenge: | Recent methods for detecting LLM-generated text have shown impressive performance, but in real-world scenarios, users often introduce perturbations to the text. |
| Approach: | They propose a method that detects syntactic trees that are minimally affected by perturbations and exhibit distinct differences between human-written and LLM-generated text. |
| Outcome: | The proposed method shows that it is significantly better against perturbations on the HC3 and GPT-3.5-mixed datasets and also has the shortest time expenditure. |
Adopting the Word-Pair-Dependency-Triplets with Individual Comparison for Natural Language Inference (C18-1)
Copied to clipboard
| Challenge: | Existing approaches to perform natural language inference ignore syntactic dependency among words or use tree-LSTM to generate sentence representation with irrelevant information. |
| Approach: | They propose to perform natural language inference with Word-Pair-Dependency-Triplets . they propose to compare the triplets of a given passage-pair to make judgement more interpretable . |
| Outcome: | The proposed approach is better than most of the approaches that use tree structures and comparable to other state-of-the-art approaches. |
Training LLMs to be Better Text Embedders through Bidirectional Reconstruction (2025.emnlp-main)
Copied to clipboard
Chang Su, Dengliang Shi, Siyuan Huang, Jintao Du, Changhua Meng, Yu Cheng, Weiqiang Wang, Zhouhan Lin
| Challenge: | Existing text embedding approaches often leverage the embeddment of the final token, typically a reserved special token such as ‘[EOS]‘. |
| Approach: | They propose to add a new training stage before contrastive learning to enrich the semantics of the final token embedding. |
| Outcome: | The proposed training stage improves performance on the Massive Text Embedding Benchmark (MTEB), achieving new state-of-the-art results across different LLM base models and scales. |
Jailbreak LLMs through Internal Stance Manipulation (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to exploit LLMs' inherent safety mechanism, including GCG and AutoDAN, are ineffective for certain malicious requests. |
| Approach: | They propose a method that generates jailbreak prompts to suppress a refusal stance and induce affirmative responses by modifying adversarial prompts. |
| Outcome: | The proposed method outperforms the best baseline approach in Llama-2-7b-chat and achieves a 92.2% success rate across all models. |
TwinVoice: A Multi-dimensional Benchmark Towards Digital Twins via LLM Persona Simulation (2026.findings-acl)
Copied to clipboard
Bangde Du, Minghao Guo, Songming He, Ziyi Ye, Xi Zhu, Weihang Su, Shuqi Zhu, Yujia Zhou, Yongfeng Zhang, Qingyao Ai, Yiqun Liu
| Challenge: | Existing studies show that advanced LLMs produce text indistinguishable from human writing. |
| Approach: | They propose a benchmark to assess persona simulation across diverse contexts by decomposing the evaluation into six fundamental capabilities including opinion consistency, memory recall, logical reasoning, persona tone, and syntactic style. |
| Outcome: | The proposed model achieves moderate accuracy but falls short of the basic capabilities needed to simulate personas in real-world contexts. |
Too Consistent to Detect: A Study of Self-Consistent Errors in LLMs (2025.emnlp-main)
Copied to clipboard
Hexiang Tan, Fei Sun, Sha Liu, Du Su, Qi Cao, Xin Chen, Jingang Wang, Xunliang Cai, Yuanzhuo Wang, Huawei Shen, Xueqi Cheng
| Challenge: | Existing detection methods fail to account for **self-consistent error** . study identifies self-consistency errors and evaluates them . |
| Approach: | They propose a method that fuses hidden state evidence from an external verifier LLM to detect self-consistent errors. |
| Outcome: | The proposed method significantly enhances performance on self-consistent errors across three LLM families. |
The Subtle Art of Defection: Understanding Uncooperative Behaviors in LLM based Multi-Agent Systems (2026.eacl-industry)
Copied to clipboard
| Challenge: | Existing literature on uncooperative behavior degrades collective outcomes and requires more resilient multi-agent systems. |
| Approach: | They propose a game theory-based taxonomy of uncooperative agent behaviors and a structured, multi-stage simulation pipeline that dynamically generates and refines uncooperation behaviors as agents’ states evolve. |
| Outcome: | The proposed framework achieves 96.7% accuracy in generating realistic uncooperative behaviors, validated by human evaluations. |
WebOlympus: An Open Platform for Web Agents on Live Websites (2024.emnlp-demo)
Copied to clipboard
| Challenge: | Web agents are emerging as powerful tools for automating tasks in cyberspace . however, there is a lack of standardized and user-friendly tools for research and development . |
| Approach: | They propose an open platform for web agents operating on live websites with a Chrome extension and a safety monitor module to ensure their trustworthiness. |
| Outcome: | WebOlympus is an open platform for web agents operating on live websites. |
Low-Entropy Watermark Detection via Bayes’ Rule Derived Detector (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for text watermarking ignore strong evidences embedded in low-entropy tokens, causing statistical measures to falsely indicate the absence of a watermark. |
| Approach: | They propose a Bayes' Rule derived watermark Detector which exploits watermark information from every token by leveraging the posterior probability of watermark’s presence. |
| Outcome: | The proposed method achieves 50% and 70% relative improvements over baselines in code generation and math problem-solving tasks. |
Token-Level Policy Optimization: Linking Group-Level Rewards to Token-Level Aggregation via sequence-level likelihood (2026.acl-long)
Copied to clipboard
| Challenge: | Group Relative Policy Optimization (GRPO) has significantly advanced the reasoning ability of large language models (LLMs). |
| Approach: | They propose a token-level framework that leverages sequence-level likelihood to link group-level rewards with individual tokens via token- level aggregation and introduces a KL-Divergence mask constraint that targets tokens with positive advantages and decreasing entropy to mitigate abrupt policy updates. |
| Outcome: | Experiments show that TEPO achieves state-of-the-art performance on mathematical reasoning benchmarks and reduces convergence time by 50% compared with GRPO/DAPO. |
Safety-Utility Conflicts Are Not Global: Surgical Alignment via Head-Level Diagnosis (2026.acl-long)
Copied to clipboard
| Challenge: | Existing mitigation strategies rely on global gradient geometry to resolve alignment conflicts . however, they overlook Modular Heterogeneity within Transformers, resulting in suboptimal trade-offs . Conflict-Aware Sparse Tuning (CAST) combines head-level diagnosis with sparse fine-tuning . |
| Approach: | They propose a framework that integrates head-level diagnosis with sparse fine-tuning to address this limitation. |
| Outcome: | The proposed framework integrates head-level diagnosis with sparse fine-tuning to reduce alignment conflicts in LLMs. |
The Fall of ROME: Understanding the Collapse of LLMs in Model Editing (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Recent studies have found that model editing methods can cause large language models to collapse with just a single edit. |
| Approach: | They propose a method that uses prefixed keys and adds prefixes during testing to prevent model collapse. |
| Outcome: | The proposed method prevents model collapse while maintaining effectiveness, the authors show . Rank-One Model Editing (ROME) has been found to cause model collapse with just a single edit . |
BaseCal: Unsupervised Confidence Calibration via Base Model Signals (2026.acl-long)
Copied to clipboard
Hexiang Tan, Wanli Yang, Junwei Zhang, Xin Chen, Rui Tang, Du Su, Jingang Wang, Yuanzhuo Wang, Fei Sun, Xueqi Cheng
| Challenge: | Post-trained LLMs typically compromise reliability with severe overconfidence, resulting in inaccurate responses. |
| Approach: | They propose a solution that feeds PoLLMs into the base LLM to get confidence. |
| Outcome: | The proposed solution reduces expected calibration error (ECE) by 42.90% compared to the best unsupervised baselines. |