Papers by Lei Sha
Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replay (2026.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have remarkable capabilities but are vulnerable to adversarial “jailbreak” attacks designed to bypass safety guardrails. |
| Approach: | They propose to empower a large language model to be its own red teamer . safety self-play allows the model to act as both the Attacker and Defender . |
| Outcome: | The proposed approach outperforms baselines trained on static adversarial datasets and establishes a new benchmark for proactive safety alignment. |
Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreaking (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Reasoning Models (LLMs) have demonstrated impressive performances across diverse domains, but how their safety benefits from enhanced reasoning capabilities against jailbreak queries remains unexplored. |
| Approach: | They propose a safety-aware reasoning paradigm that integrates a pivot token-based safety-based reasoning mechanism into LLMs’ generation process. |
| Outcome: | The proposed model improves the safety of large language models against jailbreak queries while minimizing attacks and maintaining the original performance. |
Auto-Dialabel: Labeling Dialogue Data with Unsupervised Learning (D18-1)
Copied to clipboard
| Challenge: | Existing dialog datasets rely on human labeling, which is expensive, limited in size, and in low coverage. |
| Approach: | They propose a framework to automatically cluster dialogue intents and slots . they collect context features, leverage an autoencoder for feature assembly, and adapt a dynamic hierarchical clustering method for intent and slot labeling. |
| Outcome: | The proposed framework can promote human labeling cost to a great extent and achieve good intent clustering accuracy (84.1%) it also provides reasonable and instructive slot labeling results. |
ShieldLM: Empowering LLMs as Aligned, Customizable and Explainable Safety Detectors (2024.findings-emnlp)
Copied to clipboard
Zhexin Zhang, Yida Lu, Jingyuan Ma, Di Zhang, Rui Li, Pei Ke, Hao Sun, Lei Sha, Zhifang Sui, Hongning Wang, Minlie Huang
| Challenge: | Existing tools for detecting safety issues in LLMs are expensive and inefficient. |
| Approach: | They propose an LLM-based safety detector which annotates the safety of queries and provides explanations for its decisions. |
| Outcome: | The proposed detector outperforms baselines on four sets of query-response pairs and is effective as a safety evaluator for advanced LLMs. |
RecInDial: A Unified Framework for Conversational Recommendation with Pretrained Language Models (2022.aacl-main)
Copied to clipboard
| Challenge: | Existing generative methods to recommend items are shallowly integrated into the model training and have poor chit-chat ability. |
| Approach: | They propose a framework that integrates recommendation into the dialog generation by introducing a vocabulary pointer. |
| Outcome: | The proposed framework outperforms the state-of-the-art models on a benchmark dataset. |
Controlling Text Edition by Changing Answers of Specific Questions (2021.findings-acl)
Copied to clipboard
| Challenge: | In many situations, we need to change specific content in a document. |
| Approach: | They propose a task where we take a long text, a question, and a target answer as input and output a minimally modified text so that it fits the target answer. |
| Outcome: | The proposed task is based on the existing dataset WIKIBIO and tests on a test set. |
RESIN-11: Schema-guided Event Prediction for 11 Newsworthy Scenarios (2022.naacl-demo)
Copied to clipboard
Xinya Du, Zixuan Zhang, Sha Li, Pengfei Yu, Hongwei Wang, Tuan Lai, Xudong Lin, Ziqi Wang, Iris Liu, Ben Zhou, Haoyang Wen, Manling Li, Darryl Hannan, Jie Lei, Hyounghun Kim, Rotem Dror, Haoyu Wang, Michael Regan, Qi Zeng, Qing Lyu, Charles Yu, Carl Edwards, Xiaomeng Jin, Yizhu Jiao, Ghazaleh Kazeminejad, Zhenhailong Wang, Chris Callison-Burch, Mohit Bansal, Carl Vondrick, Jiawei Han, Dan Roth, Shih-Fu Chang, Martha Palmer, Heng Ji
| Challenge: | Existing methods for event prediction are incomplete and noisy. |
| Approach: | They propose to use news-related event schemas to extract newsworthy events . they build a demo website and include a video demonstrating the framework . |
| Outcome: | The proposed framework can be applied to a wide variety of newsworthy scenarios. |
Gradient-guided Unsupervised Lexically Constrained Text Generation (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for lexically constrained generation fail when the search space is too large . a novel method to solve the problem is based on gradient-guided optimization . |
| Approach: | They propose a method to solve lexically-constrained generation as an unsupervised gradient-guided optimization problem. |
| Outcome: | The proposed method achieves state-of-the-art compared to previous methods . it is free of parallel data training, flexible to be used in the inference stage of any pre-trained generation model. |
LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shifts (2025.acl-long)
Copied to clipboard
Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, Jing Shao
| Challenge: | Current safety training focuses on teaching models to reject harmful queries, but recent research shows that adversarial attacks or jailbreak methods bypass these safety mechanisms. |
| Approach: | They propose to use a new attack method to craft multi-turn toxic prompts that gradually lead LLMs to reveal unsafe content. |
| Outcome: | The proposed method outperforms existing methods in diversity, effectiveness, and efficiency across aligned LLMs. |
Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent studies show that fine-tuning with benign data can compromise safety of aligned LLMs. |
| Approach: | They propose a Layer-Aware Representation Filtering method that detects safety-degrading layers within the LLM and leverages their representations to detect them. |
| Outcome: | The proposed method can detect safety-degrading features in benign data and remove them from the model. |
Towards Harmonized Uncertainty Estimation for Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) have demonstrated exceptional capabilities in handling a wide range of downstream tasks. |
| Approach: | They propose a method that employs a lightweight model trained on data aligned with the target LLM’s performance to adjust uncertainty scores. |
| Outcome: | The proposed method achieves improvements of up to 60% over existing methods. |
DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreak (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are susceptible to generating harmful content when prompted with carefully crafted inputs, a vulnerability known as LLM jailbreaking. |
| Approach: | They propose an end-to-end generative approach for jailbreak rewriting inspired by diffusion models that uses a sequence-tosequence (seq2sequ) diffusion model as a generator, conditioning on the original prompt and guiding the denoising process with a novel attack loss. |
| Outcome: | Experiments on Advbench and Harmbench show that the proposed method outperforms autoregressive jailbreak models across evaluation metrics including ASR, fluency, diversity and diversity. |
SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory (2026.acl-long)
Copied to clipboard
| Challenge: | Existing defenses for Large Language Models suffer from a 'memory gap' parameter-modifying methods are computationally expensive and inference-time filters cannot retain or reuse defense knowledge across interactions. |
| Approach: | They propose a framework that secures Large Language Models through a dual-component safety memory system. |
| Outcome: | The proposed framework significantly reduces attack success rates while preserving interpretability and efficiency. |
How Far are LLMs from Being Our Digital Twins? A Benchmark for Persona-Based Behavior Chain Simulation (2025.findings-acl)
Copied to clipboard
| Challenge: | Recent studies have focused on dialogue simulation while overlooking human behavior simulation, which is crucial for digital twins. |
| Approach: | They propose to integrate persona metadata into LLMs and use it to iteratively infer contextually appropriate behaviors within dynamic scenarios. |
| Outcome: | The proposed model is based on 15,846 distinct behaviors across 1,001 unique personas and incorporates persona metadata to iteratively infer appropriate behaviors within dynamic scenarios. |
ASETF: A Novel Method for Jailbreak Attack on LLMs through Translate Suffix Embeddings (2024.emnlp-main)
Copied to clipboard
| Challenge: | Attaching suffixes to harmful instructions can hack the defense of Large language models (LLMs) However, due to the unreadable of adversarial suffix, it can be relatively easily penetrated by common defense methods such as perplexity filters. |
| Approach: | They propose an algorithm to embed adversarial suffixes into coherent and understandable text to attack Large language models (LLMs) using a Advbench dataset. |
| Outcome: | The proposed approach reduces the computation time of adversarial suffixes and achieves a much better attack success rate than existing techniques. |
HAUNTATTACK: When Attack Follows Reasoning as a Shadow (2026.findings-acl)
Copied to clipboard
| Challenge: | Emerging Large Reasoning Models (LRMs) excel in mathematical and reasoning tasks, showcasing remarkable capabilities. |
| Approach: | They propose a framework that embeds harmful instructions into reasoning questions . they evaluate 11 LRMs and observe an average attack success rate of over 70% . |
| Outcome: | The proposed framework improves reasoning models by 13 percentage points over baseline. |
ATM: Adversarial Tuning Multi-agent System Makes a Robust Retrieval-Augmented Generator (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) are proven to benefit a lot from retrieval-augmented generation (RAG) due to noisy and fabricating content, it is inevitable that RAG systems are vulnerable to these noises and prone to respond incorrectly. |
| Approach: | They propose to optimize retrieval-augmented generation (RGG) with an Adversarial Tuning Multi-agent system (ATM) ATM steers the Generator to have a robust perspective of useful documents for question answering with the help of an auxiliary Attacker agent. |
| Outcome: | The proposed system improves the retrieval-augmented generator with an auxiliary Attacker agent and can discriminate useful documents amongst fabrications. |
Be a Multitude to Itself: A Prompt Evolution Framework for Red Teaming (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have gained increasing attention for their capacity to generate harmful content. |
| Approach: | They propose a scalable evolution framework to evolve red teaming prompts across breadth and depth dimensions, facilitating automatic generation of numerous high-quality and diverse red team prompts. |
| Outcome: | The proposed framework surpasses existing red teaming methods on attack success rate and diversity. |
Detecting Frames in News Headlines and Lead Images in U.S. Gun Violence Coverage (2021.findings-emnlp)
Copied to clipboard
Isidora Tourni, Lei Guo, Taufiq Husada Daryanto, Fabian Zhafransyah, Edward Edberg Halim, Mona Jalal, Boqi Chen, Sha Lai, Hengchang Hu, Margrit Betke, Prakash Ishwar, Derry Tanti Wijaya
| Challenge: | Journalists have been using both text and images to frame news stories . lead images may carry additional background knowledge about the event . |
| Approach: | They find that combining lead images and contextual information with text improves news framing . they release the first multimodal news framming dataset related to gun violence in the u.s. |
| Outcome: | The study shows that combining lead images with text improves prediction of news frames . it also shows that using multiple modes of information improves frame image relevance . |