Papers by Michael Backes
The Death and Life of Great Prompts: Analyzing the Evolution of LLM Prompts from the Structural Perspective (2024.emnlp-main)
Copied to clipboard
| Challenge: | Recent research has shown that high-quality prompts are essential for LLMs to produce accurate and relevant responses. |
| Approach: | They analyze 10,538 in-the-wild prompts collected from various platforms and develop a framework that decomposes the prompts into eight key components. |
| Outcome: | The proposed framework decomposes 10,538 in-the-wild prompts into eight components. |
Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have increased the vulnerability of LLMs, but they can cause more severe damage than standalone systems if compromised. |
| Approach: | They propose a new type of attack that induces malfunctions by misleading the agent into executing repetitive or irrelevant actions. |
| Outcome: | The proposed attacks induce failure rates exceeding 80% in multiple scenarios, highlighting the substantial risks associated with this vulnerability. |
JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs (2025.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) have been used to mitigate misuse and to align with human values. |
| Approach: | They propose to use large-scale evaluations of various jailbreak attacks to identify key patterns and test them under eight advanced defenses. |
| Outcome: | The proposed attacks achieve high success rates but are easy to mitigate by defenses. |
Composite Backdoor Attacks Against Large Language Models (2024.findings-naacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) have demonstrated superior performance on various tasks, but untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. |
| Approach: | They propose a composite backdoor attack that scatters multiple trigger keys in different prompt components. |
| Outcome: | The proposed attack achieves 100% Attack Success Rate (ASR) with a False Triggered Rate (FTR) below 2.06% and negligible model accuracy degradation. |
Are We in the AI-Generated Text World Already? Quantifying and Monitoring AIGT on Social Media (2025.acl-long)
Copied to clipboard
| Challenge: | Social media platforms are experiencing a growing presence of AI-Generated Texts (AIGTs) however, the misuse of AIGTs could have profound implications for public opinion . |
| Approach: | They collect a dataset with 2.4M posts from 3 major social media platforms . they then construct a diverse dataset to train and evaluate AIGT detectors . |
| Outcome: | The proposed dataset analyzes 2.4M posts from 3 major social media platforms from 2022 to 2024 . it finds that Medium and Quora show marked increases in AAR . |
DE-CLIP: Few-Shot Anomaly Detection via Difference-Guided Embedding Editing (2026.acl-long)
Copied to clipboard
| Challenge: | Existing approaches to detect anomalies are limited due to the lack of anomalous samples . |
| Approach: | They propose a framework that edits text embeddings based on the differences between normal and anomalous samples. |
| Outcome: | The proposed framework achieves 96.6% and 96.99% AUROC on MVTec datasets. |
InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents (2026.findings-acl)
Copied to clipboard
| Challenge: | Inference attacks are important for assessing model's robustness, but their implementation and parameters are challenging for non-experts. |
| Approach: | They propose an autonomous agent capable of conducting inference attacks without human intervention. |
| Outcome: | The proposed agent achieves a 100.0% task completion rate and near-expert attack performance with an average token cost of only 0.627 per run. |
ModSCAN: Measuring Stereotypical Bias in Large Vision-Language Models from Vision and Language Modalities (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large vision-language models have been widely used but stereotypical biases are unexplored. |
| Approach: | They propose a framework to SCAN stereotypical bias within large vision-language models . they examine stereotype biases with respect to gender and race in three scenarios . |
| Outcome: | The proposed framework can reduce stereotypical biases in large vision-language models . the currently popular models show significant stereotype biase . |
The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Training (2026.findings-acl)
Copied to clipboard
Rui Zhang, Hongwei Li, Yun Shen, Xinyue Shen, Wenbo Jiang, Guowen Xu, Yang Liu, Michael Backes, Yang Zhang
| Challenge: | Misaligned large language models can magnify harm by exploiting them to undermine safety . et al., 2022b; Bai e.t., 2023): misalignment, realignment and model-specific resistance are important . |
| Approach: | They evaluate four methods to identify a mechanism asymmetry between attack and defense . they find that ORPO is most effective for misalignment, but DPO excels in realignment . |
| Outcome: | The proposed methods show a mechanism asymmetry between attack and defense . the proposed methods excel in realignment, but at the expense of model utility . |
Peering Behind the Shield: Guardrail Identification in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Identifying guardrails in conversational AI agents is critical for identifying malicious content . identifying guardrail components in black-box AI agents poses security challenges . |
| Approach: | They propose a method that leverages guard-specific adversarial prompts to detect guardrails in black-box AI agents. |
| Outcome: | The proposed method achieves perfect classification accuracy in multiple scenarios. |
Pruning Unsafe Tickets: A Resource-Efficient Framework for Safer and More Robust LLMs (2026.acl-long)
Copied to clipboard
| Challenge: | Empirical evaluations on ML models show substantial reductions in unsafe generations and improved robustness against jailbreak attacks. |
| Approach: | They propose a resource-efficient pruning framework that directly identifies unsafe behaviors while preserving model utility. |
| Outcome: | The proposed framework reduces unsafe generations and improves robustness against jailbreak attacks with minimal utility loss. |
Open Schrödinger’s Closed Box: Identifying Retrieval Augmented Generation in API-Accessible Large Language Model Services (2026.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) are powerful at question-answering but prone to hallucinations due to limited domain-specific or up-to-date knowledge. |
| Approach: | They propose a framework for IDentifying RAG properties in LLM services that integrates LLMs with retrieval systems and adds an external retriever and knowledge database to mitigate hallucinations. |
| Outcome: | The proposed framework detects RAG-enhanced LLMs with 99.97% accuracy with partial or no optional knowledge and nearly 100% when the LLM and database are known. |
Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race? (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have focused on the models, neglecting the full deployment pipeline . previous studies have underestimated the practical success of these attacks . |
| Approach: | They evaluate the effectiveness of jailbreak attacks targeting LLM safety alignment . they highlight critical gaps and call for further refinement of detection accuracy and usability . |
| Outcome: | The proposed attacks can detect at least one safety filter across the entire deployment pipeline. |
Rethinking Assessments of Prompt Injection Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Prompt injection attacks are recognized as one of the primary risks faced by LLM-integrated applications in recent years. |
| Approach: | They evaluate prompt injection attacks on LLM-integrated applications across 37 target tasks, 185 injected tasks, 21 attack instructions, and 143,745 queries. |
| Outcome: | The proposed framework provides a solid foundation for assessing vulnerabilities in LLM-integrated applications and evaluating the efficacy of defensive strategies. |
Reward Yourself: Efficient Self Rewards for Trustworthy Sampling (2026.findings-acl)
Copied to clipboard
| Challenge: | Retraining reward models to address privacy leaks and stereotypes is expensive . recent advances in large language models have led to improvements in understanding . |
| Approach: | They propose a lightweight intrinsic reward that can be used to prune existing LLMs to approximate an "untrust" and an ""untrust "" token distribution. |
| Outcome: | Experiments with two reward models and four LLMs show that selfRW improves trustworthiness with minimal impact on general utility benchmarks. |
When GPT Spills the Tea: Comprehensive Assessment of Knowledge File Leakage in GPTs (2025.acl-long)
Copied to clipboard
| Challenge: | Existing studies show that adversarial prompts can induce GPTs to leak knowledge file content. |
| Approach: | They propose a workflow inspired by Data Security Posture Management to identify five leakage vectors for knowledge file leakage using 651,022 GPT metadata and 11,820 flows. |
| Outcome: | The proposed workflow analyzes 651,022 GPT metadata, 11,820 flows, and 1,466 responses to identify five leakage vectors: metadata, GPT initialization, retrieval, sandboxed execution environments, and prompts. |
Reconstruct Your Previous Conversations! Comprehensively Investigating Privacy Leakage Risks in Conversations with GPT Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing GPT models allow users to interact with them for multiple rounds to optimize the task execution. |
| Approach: | They propose a conversation reconstruction attack targeting the contents of previous conversations between GPT models and benign users, i.e., the benign users’ input contents during their interaction with GPT. |
| Outcome: | The proposed attacks demonstrate that GPT-4's defense mechanisms are ineffective against these attacks. |
PeerCheck: Enhancing LLM-Generated Academic Reviews Towards Human-Level Quality (2026.findings-acl)
Copied to clipboard
| Challenge: | Increasing use of large language models (LLMs) in academic review has raised concerns about quality and fairness. |
| Approach: | They propose a framework to improve the quality of LLM-generated reviews by using retrieval-augmented generation. |
| Outcome: | The proposed framework improves the human-level quality of LLM-generated reviews by adopting prompt engineering and retrieval-augmented generation. |