Papers by Gongshen Liu
EVA: Evolving Semantic Adversaries for Red-Teaming GUI Agents Against Environmental Injection Attacks (2026.findings-acl)
Copied to clipboard
Yijie Lu, Manman Zhao, Tianjie Ju, Zihe Yan, Xinbei Ma, Yuan Guo, Daizong Ding, Gongshen Liu, Zhuosheng Zhang
| Challenge: | Existing methods for red-teaming face a trade-off between requiring target-specific knowledge and incurring prohibitive computational costs. |
| Approach: | They propose a framework that evolves payloads exclusively on the semantic dimension via a discovery-deployment pipeline. |
| Outcome: | Experiments show that EVA outperforms baselines in terms of attack success rate while evolving benign seeds into successful attacks within 1.18 to 1.71 iterations. |
The Confidence Paradox: Unveiling the Latent Discriminative Power of Diffusion Large Language Models in Mathematical Reasoning (2026.findings-acl)
Copied to clipboard
| Challenge: | Diffusion large language models (DLLMs) are a promising alternative to autoregressive (AR) generation, offering token-level probabilities under bidirectional context. |
| Approach: | They propose to use diffusion large language models to generate token-level probabilities under bidirectional context and to examine the calibration paradox inherent to their native uncertainty estimates. |
| Outcome: | The proposed model outperforms AR baselines on mathematical reasoning benchmarks and is highly miscalibrated on reasoning benchmark. |
UOR: Universal Backdoor Attacks on Pre-trained Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to attack pre-trained language models rely on manual selection of triggers and backdoor representations. |
| Approach: | They propose a backdoor attack method that turns manual selection into automatic optimization . they propose to use poisoned contrastive learning to learn more uniform backdoor representations . |
| Outcome: | The proposed method achieves better attack performance on text classification tasks compared to manual methods. |
SEARL: Joint Optimization of Policy and Tool Graph Memory for Self-Evolving Agents (2026.acl-long)
Copied to clipboard
| Challenge: | Recent advances in Reinforcement Learning with Verifiable Rewards (RLVR) have demonstrated significant potential in single-turn reasoning tasks. |
| Approach: | They propose a tool-memory based self-evolving agentic framework that integrates planning with execution. |
| Outcome: | The proposed framework is able to extract explicit knowledge from historical data and leverage inter-trajectory correlations to densify reward signals. |
Investigating Multi-Hop Factual Shortcuts in Knowledge Editing of Large Language Models (2024.acl-long)
Copied to clipboard
| Challenge: | Recent work has demonstrated the power of large language models in recalling knowledge and reasoning. |
| Approach: | They propose to erase shortcut neurons to mitigate the associated risks . 20% of the failures are attributed to shortcuts, they find . |
| Outcome: | The proposed approach reduces failures in multi-hop knowledge editing caused by shortcuts by 20% . |
Backdoor NLP Models via AI-Generated Text (2024.lrec-main)
Copied to clipboard
| Challenge: | Existing attacks disregard fluency and semantic fidelity of poisoned text, rendering it easily detectable. |
| Approach: | They propose to use AI-generated poisoned text to attack NLP models by establishing covert associations between trigger patterns and target labels without affecting normal accuracy. |
| Outcome: | The proposed method achieves effective attacks while maintaining fluency and semantic similarity across all scenarios. |
TransAdv: A Translation-based Adversarial Learning Framework for Zero-Resource Cross-Lingual Named Entity Recognition (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for named entity recognition are limited by noise in translation . Existing approaches to named entities recognition are mainly based on labeled data . |
| Approach: | They propose a framework to mitigate lexical and syntactic errors of translated data . they propose to use multi-level adversarial learning and multi-model knowledge distillation to mitigate noise . |
| Outcome: | The proposed framework mitigates lexical and syntactic errors of translated data . it achieves competitive performance to state-of-the-art models . |
OS-Kairos: Adaptive Interaction for MLLM-Powered GUI Agents (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing efforts to build GUI agents focused on the autonomous mode have failed to address the problem of over-execution. |
| Approach: | They propose an adaptive GUI agent that predicts confidence levels at each interaction step and elicits adaptive interaction. |
| Outcome: | The proposed GUI agent outperforms existing models on a complex dataset and on established benchmarks. |
Hierarchy-Aware Global Model for Hierarchical Text Classification (2020.acl-main)
Copied to clipboard
| Challenge: | Existing methods for hierarchical text classification are limited and lack holistic structural information. |
| Approach: | They propose a hierarchy-aware global model with two variants that learn hierarchy-based label embeddings through an encoder and conduct inductive fusion of label-alike text features. |
| Outcome: | The proposed model improves on three benchmark datasets. |
Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining (2025.coling-main)
Copied to clipboard
| Challenge: | Existing backdoor defense methods are ineffective for generative large language models . generative LLMs output sequences of high-dimensional token logits instead of low-dimensional classification logits . |
| Approach: | They propose a method that leverages sample-wise gradients to identify backdoor samples without retraining LLMs. |
| Outcome: | The proposed method outperforms baselines significantly in identifying backdoor samples without retraining LLMs. |
Entity-Aware Abstractive Multi-Document Summarization (2021.findings-acl)
Copied to clipboard
| Challenge: | Existing models for multidocument summarization do not focus on explicitly modeling the underlying semantic information across documents. |
| Approach: | They propose an entityaware model for abstractive multi-document summarization that augments the classical Transformer-based encoder-decoder framework with a heterogeneous graph consisting of text units and entities as nodes. |
| Outcome: | The proposed model can deal with saliency and redundancy issues explicitly and can be used with pre-trained language models, arriving at improved performance. |
A Unified Syntax-aware Framework for Semantic Role Labeling (D18-1)
Copied to clipboard
| Challenge: | Syntactic information has been paid a great attention over the role of enhancing SRL . but the gap between syntax-aware and syntax-gnostic SRL is smaller . a new framework proposes syntax-based SRL for a wide range of NLP tasks . |
| Approach: | They propose to extend existing models to investigate more effective ways of incorporating syntax into sequential neural networks. |
| Outcome: | The proposed framework outperforms existing models on CoNLL-2009 benchmarks in English and Chinese. |
SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing attacks are classified into end-to-end and pre-training types based on the attack phase . Existing backdoor attacks are based upon perplexity, fine-pruning, and maxEntropy. |
| Approach: | They propose an entropy-based poisoning filter that mitigates backdoor attacks . they propose an invisible and universal task-agnostic backdoor attack via syntactic transfer . |
| Outcome: | The proposed attack can transfer backdoors to various downstream tasks while preserving pre-trained language models' pre-training capabilities. |
Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agents (2025.findings-emnlp)
Copied to clipboard
Pengzhou Cheng, Haowen Hu, Zheng Wu, Zongru Wu, Tianjie Ju, Daizong Ding, Zhuosheng Zhang, Gongshen Liu
| Challenge: | MLLM-powered GUI agents expose multiple interaction-level triggers, causing backdoor attacks . backdoor injection maximizes feature difference across sample classes, improving flexibility . |
| Approach: | They propose a framework for red-teaming backdoor attacks using MLLMs . they construct composite triggers by combining goal and interaction levels . |
| Outcome: | The proposed framework is effective and stealthy for red-teaming backdoor attacks. |
Multiple Character Embeddings for Chinese Word Segmentation (P19-2)
Copied to clipboard
| Challenge: | Chinese word segmentation is regarded as character-based sequence labeling task in most current work but it neglects important fact: Chinese characters contain both semantic and phonetic meanings. |
| Approach: | They propose a shared bi-LSTM-CRF model which fuses linguistic features efficiently by sharing the LSTM network during the training procedure. |
| Outcome: | The proposed model achieves state-of-the-art in AS and CityU corpora without external lexical resources. |
A Multi-Task Dual-Tree Network for Aspect Sentiment Triplet Extraction (2022.coling-1)
Copied to clipboard
| Challenge: | Existing methods are poor at detecting complicated relations between aspects and opinions . detecting unclear boundaries of multi-word aspects and opinion is also a challenge . |
| Approach: | They propose a multi-task dual-tree network to extract triplets from a given sentence . they employ a constituency tree and a modified dependency tree to enhance the interaction . |
| Outcome: | The proposed model extracts triplets from a given sentence, and it is effective on four datasets. |
Modeling Multi-turn Conversation with Deep Utterance Aggregation (C18-1)
Copied to clipboard
| Challenge: | Existing work on retrieval-based context modeling for multi-turn conversation ignores interactions among previous utterances. |
| Approach: | They propose retrieval-based response matching for multi-turn conversation . they propose to combine previous utterances into context using a deep utterrance aggregation model . |
| Outcome: | The proposed model outperforms state-of-the-art methods on three multi-turn conversation benchmarks including an e-commerce dialogue corpus. |
Acquiring Clean Language Models from Backdoor Poisoned Datasets by Downscaling Frequency Space (2024.acl-long)
Copied to clipboard
| Challenge: | Prior work attempts to mitigate backdoor learning during training LMs on poisoned datasets . backdoor attack poisons a small portion of training data by implanting specific text patterns . |
| Approach: | They propose a multi-scale low-rank adaptive model that prioritizes learning of clean mapping . they propose radial scalings to reduce the success rate of diverse backdoor attacks . |
| Outcome: | The proposed model outperforms baselines significantly in the frequency space . it reduces the success rate of diverse backdoor attacks to below 15% across datasets . |
ALIS: Aligned LLM Instruction Security Strategy for Unsafe Input Prompt (2025.coling-main)
Copied to clipboard
| Challenge: | Existing instruction tuning methods may fail to balance performance with robustness against attacks from user input like prompt injection and jailbreaking. |
| Approach: | They propose an instruction tuning paradigm to decompose user inputs into irreducible atomic instructions and organize them into instruction streams to guide response generation of model. |
| Outcome: | The proposed model can maintain security constraints by ignoring or rejecting user mode instructions when user mode instruction conflicts with kernel mode instructions. |
How Large Language Models Encode Context Knowledge? A Layer-Wise Probing Study (2024.lrec-main)
Copied to clipboard
| Challenge: | Existing studies have focused on enhancing the factualness of large language models using context knowledge. |
| Approach: | They propose to use ChatGPT to construct probing datasets that provide diverse and coherent evidence corresponding to various facts. |
| Outcome: | The proposed model can encode knowledge across different layers, and it is compared with existing models. |
R-Judge: Benchmarking Safety Risk Awareness for LLM Agents (2024.findings-emnlp)
Copied to clipboard
Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, Rui Wang, Gongshen Liu
| Challenge: | Large language models (LLMs) have shown compelling abilities in reasoning, decision-making, and instruction following. |
| Approach: | They propose a benchmark to evaluate the proficiency of large language models (LLMs) in judging and identifying safety risks given agent interaction records. |
| Outcome: | The proposed model outperforms the best-performing model, GPT-4o, while no other models significantly exceed the random. |
Is Continuous Prompt a Combination of Discrete Prompts? Towards a Novel View for Interpreting Continuous Prompts (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing studies on the interpretability and transferability of continuous prompts have not been conducted on the subject. |
| Approach: | They propose to interpret continuous prompts as the weighting of discrete prompts by jointly optimizing prompt fidelity and downstream fidelity. |
| Outcome: | The proposed interpretations provide effective readability and plausibility, which is helpful to understand the decision-making of continuous prompts and discover potential shortcuts. |
Few-shot Table-to-text Generation with Prefix-Controlled Generator (2022.coling-1)
Copied to clipboard
| Challenge: | Neural table-to-text generation approaches are data-hungry and lack labeled data. |
| Approach: | They propose a prompt-based approach for few-shot table-to-text generation using a task-specific prefix and an input-specific input prefix. |
| Outcome: | The proposed approach is able to generate table-to-text summaries with a few instances and is validated on human, book and song datasets. |
Improving Constituent Representation with Hypertree Neural Networks (2022.naacl-main)
Copied to clipboard
| Challenge: | Existing methods of span representation are based on simple derivations from word representations and do not utilize compositional structures of natural language. |
| Approach: | They propose a hypertree neural network that is structured with constituency parse trees to improve representations of constituent spans. |
| Outcome: | The proposed model improves representations of constituent spans using constituency parse trees. |
Sliced Recurrent Neural Networks (C18-1)
Copied to clipboard
| Challenge: | Recurrent neural networks have difficulty in parallelization because of their recurrent structure. |
| Approach: | They propose sliced recurrent neural networks (SRNNs) which can be parallelized by slicing sequences into many subsequences. |
| Outcome: | The proposed recurrent neural networks perform better than standard RNNs on six large-scale sentiment analysis datasets. |