Papers by Mengxin Zheng
CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing certified robustness methods for certifying input-specific text perturbations have shown promise in certifyling UTPs, but masking only adversarial words can eliminate the attack. |
| Approach: | They propose a method to certify a language model’s robustness against UTPs by using random smoothing. |
| Outcome: | The proposed method achieves high certified accuracy under extensive masking and achieves state-of-the-art results in multiple settings. |
BadFair: Backdoored Fairness Attacks with Group-conditioned Triggers (2024.findings-emnlp)
Copied to clipboard
| Challenge: | *BadFair* is a backdoored fairness attack methodology that discriminates and produces incorrect results for specific groups. |
| Approach: | They propose a backdoored fairness attack methodology that discriminates and produces incorrect results for specific groups. |
| Outcome: | The proposed model achieves 85% success rate in attacks aimed at target groups on average while only incurring a minimal accuracy loss. |
Factuality Beyond Coherence: Evaluating LLM Watermarking Methods for Medical Texts (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing benchmarks focus on detection-quality tradeoffs and overlook factual risks. |
| Approach: | They propose a method that assesses factual accuracy and coherence . they use a factor-weighted score to prioritize factual accurate beyond coherency . |
| Outcome: | The proposed method assesses factual accuracy and coherence in medical text . it shows current watermarking methods substantially compromise medical factuality . |
Conjunctive Prompt Attacks in Multi-Agent LLM Systems (2026.acl-long)
Copied to clipboard
| Challenge: | Existing defenses do not reliably stop the attack because no single component appears malicious in isolation. |
| Approach: | They study conjunctive prompt attacks where trigger key and adversarial template appear benign alone but activate harmful behavior when routing brings them together. |
| Outcome: | The proposed model significantly improves performance over baselines while keeping false activations low. |
Jailbreaking LLMs with Arabic Transliteration and Arabizi (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to ‘jailbreak’ attacks, focusing on the Arabic language and its various forms. |
| Approach: | They propose to use Arabic transliteration and chatspeak to generate unsafe content on platforms like OpenAI GPT-4 and Anthropic Claude 3 Sonnet. |
| Outcome: | The proposed model could generate unsafe content on platforms like OpenAI GPT-4 and Anthropic Claude 3 Sonnet, highlighting the need for more comprehensive safety training across all language forms. |
Evaluating the Robustness and Accuracy of Text Watermarking Under Real-World Cross-Lingual Manipulations (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a study focuses on evaluating watermarking methods for the English language . the literature for evaluating cross-lingual watermarks is scarce . |
| Approach: | They evaluate representative watermarking methods in four different languages . they examine the quality of text under different watermark procedures . |
| Outcome: | The proposed method is compared with other evaluation methods in four different languages. |
TrojFSP: Trojan Insertion in Few-shot Prompt Tuning (2024.naacl-long)
Copied to clipboard
| Challenge: | Prompt tuning on a few data samples presents security issues, e.g., Trojan attacks. |
| Approach: | They propose a method to transfer established data poisoning attacks directly to few-shot prompt tuning, a technique to address the poisoned imbalance issue. |
| Outcome: | The proposed method achieves an ASR of over 99% while maintaining negligible decreases in CDA. |