Papers by Ruoxi Jia
SelfPrompt: Autonomously Evaluating LLM Robustness via Domain-Constrained Knowledge Guidelines and Refined Adversarial Prompts (2025.coling-main)
Copied to clipboard
| Challenge: | Existing frameworks for evaluating robustness of large language models rely on standardized benchmarks that can escalate costs and limit evaluations across domains. |
| Approach: | They propose a framework to evaluate the robustness of large language models using adversarial prompts and domain-constrained knowledge guidelines. |
| Outcome: | The proposed framework reduces dependency on conventional benchmarks and provides efficient evaluations in constrained domains. |
Selective Differential Privacy for Language Modeling (2022.naacl-main)
Copied to clipboard
| Challenge: | Existing methods to protect sensitive data from leaking are over-pessimistic and undifferentiated. |
| Approach: | They propose a new privacy notion, selective differential privacy, to provide rigorous privacy guarantees on the sensitive portion of the data to improve model utility. |
| Outcome: | The proposed privacy-preserving mechanism achieves better utility while remaining safe under various privacy attacks compared to baselines. |
Retracing the Past: LLMs Emit Training Data When They Get Lost (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for extracting training data from large language models exhibit limited success . existing methods offer limited insight into the fundamental drivers of memorization leakage . |
| Approach: | They propose a framework for extracting memorized data by maximizing model uncertainty . they propose mismatched fine-tuning to weaken alignment and induce confusion . |
| Outcome: | The proposed attacks outperform baselines on unaligned and aligned LLMs . the proposed attacks exploit the model uncertainty of the input snippets induced by the model entropy spike . |
Demystifying Synthetic Data in LLM Pre-training: A Systematic Study of Scaling Laws, Benefits, and Pitfalls (2025.emnlp-main)
Copied to clipboard
Feiyang Kang, Newsha Ardalani, Michael Kuchnik, Youssef Emad, Mostafa Elhoushi, Shubhabrata Sengupta, Shang-Wen Li, Ramya Raghavendra, Ruoxi Jia, Carole-Jean Wu
| Challenge: | a large-scale empirical study compares natural web data, diverse synthetic types, and mixtures of natural and synthetic data. |
| Approach: | They conduct a large-scale empirical study on large-volume LLMs using a unified protocol and scaling laws. |
| Outcome: | The proposed method is faster than pre-training on natural web data, the authors show . their results are consistent with previous studies on rephrased text and textbooks . |
Skin-in-the-Game: Decision Making via Multi-Stakeholder Alignment in LLMs (2024.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have shown remarkable capabilities in tasks such as summarization, arithmetic reasoning, and question answering. |
| Approach: | They propose a framework that explores decisions’ consequences from multiple stakeholder perspectives and a SKIG framework to enhance moral reasoning in large language models. |
| Outcome: | The proposed framework exhibits marked improvements compared to baselines across different language models and benchmarks. |
PBI-Attack: Prior-Guided Bimodal Interactive Black-Box Jailbreak Attack for Toxicity Maximization (2025.emnlp-main)
Copied to clipboard
Ruoxi Cheng, Yizhong Ding, Shuirong Cao, Ranjie Duan, Xiaoshuang Jia, Shaowei Yuan, Simeng Qin, Zhiqiang Wang, Xiaojun Jia
| Challenge: | Existing methods to jailbreak Large Vision Language Models do not consider interaction between images and text. |
| Approach: | They propose a prior-guided bimodal interactive black-box jailbreak attack for toxicity maximization that exploits the interaction of images and text. |
| Outcome: | The proposed method outperforms state-of-the-art jailbreak methods in black box scenarios and in closed-source LVLMs. |
MAViS: A Multi-Agent Framework for Long-Sequence Video Storytelling (2026.eacl-long)
Copied to clipboard
| Challenge: | Experimental results show that MAViS achieves state-of-the-art performance in assistive capability, visual quality, and video expressiveness. |
| Approach: | They propose an end-to-end multi-agent collaborative framework for long-sequence video storytelling that orchestrates specialized agents across multiple stages. |
| Outcome: | The proposed framework achieves state-of-the-art performance in assistive capability, visual quality, and video expressiveness. |
Can We Trust the Performance Evaluation of Uncertainty Estimation Methods in Text Summarization? (2024.emnlp-main)
Copied to clipboard
| Challenge: | Text summarization is a key natural language generation task, but the high cost of inaccurate summaries raises concerns about the reliability of uncertainty estimation on text summarisation (UE-TS) evaluation methods. |
| Approach: | They propose a UE-TS benchmark that evaluates the uncertainty estimation capabilities of two large language models and one pre-trained language model on three datasets. |
| Outcome: | The proposed benchmark evaluates the uncertainty estimation capabilities of two large language models and one pre-trained language model on three datasets, with human-annotation analysis incorporated where applicable. |
DiPT: Enhancing LLM Reasoning through Diversified Perspective-Taking (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing work on improving language model reasoning typically explores a single solution path, which can be prone to errors. |
| Approach: | They propose a novel approach that incorporates diversified viewpoints into existing reasoning methods to improve their reasoning performance. |
| Outcome: | The proposed approach can be flexibly integrated into existing models that focus on a single reasoning approach, enhancing their reasoning performance and stability when presented with paraphrased problems. |
BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Safety backdoors in large language models can be triggered while evading detection during normal interactions. |
| Approach: | They propose a bi-level optimization method that uses a key insight: backdoor triggers induce a uniform drift in the model’s embedding space . inner level identifies universal perturbations to the decoder’s embedded spaces that steer the model towards defender-defined unwanted behaviors; outer level fine-tunes the model to reinforce safe behaviors against these perturbations. |
| Outcome: | The proposed mitigation method reduces the success rate of safety backdoor attacks from over 95% to 1% for general harmful behaviors and from 47% to 0% for Sleeper Agents, without compromising the model’s usefulness. |
FASTTRACK: Reliable Fact Tracing via Clustering and LLM-Powered Evidence Validation (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods to fact tracing rely on assessing the similarity between training samples and the query along a certain dimension, such as lexical similarity, gradient, or embedding space. |
| Approach: | They propose a new approach that harnesses the capabilities of Large Language Models to validate supportive evidence for queries and clusters the training database towards a reduced extent for LLMs to trace facts. |
| Outcome: | The proposed approach outperforms existing methods in accuracy and efficiency while being x33 faster than TracIn. |
Just Fine-tune Twice: Selective Differential Privacy for Large Language Models (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to protect language models from privacy leakage suffer from limited user control and low utility . et al., 2018: a novel framework that achieves SDP for state-of-the-art large transformer-based models. |
| Approach: | They propose a framework that applies differential privacy to large language models . they use redacted in-domain data to fine-tune the model with original in- domain data . |
| Outcome: | The proposed framework achieves strong utility compared to baselines. |