Papers by Xuandong Zhao
Provably Confidential Language Modelling (2022.naacl-main)
Copied to clipboard
| Challenge: | Existing methods to train language models without memorizing sensitive data are mismatched and can be difficult to screen and filter. |
| Approach: | They propose a method to train language generation models while protecting the confidential segments of training data. |
| Outcome: | The proposed method prevents unintended memorization by randomizing parts of the training process while protecting strong confidentiality. |
A Practical Examination of AI-Generated Text Detectors for Large Language Models (2025.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods to detect large language models are prone to misuse, such as generating fake news articles, facilitating academic plagiarism or spamming. |
| Approach: | They evaluate several popular detectors to evaluate their effectiveness against a range of domains, datasets, and models. |
| Outcome: | The proposed methods perform poorly in certain settings, with TPR@.01 as low as 0%. |
Efficiently Identifying Watermarked Segments in Mixed-Source Texts (2025.acl-long)
Copied to clipboard
| Challenge: | Existing methods for watermarking entire documents neglect identifying individual watermark segments within long, mixed-source documents. |
| Approach: | They propose a framework for partial watermark detection that detects whether there is a watermark segment in long text and an adaptive online learning algorithm to pinpoint the precise location of watermark segments. |
| Outcome: | The proposed framework outperforms existing methods and is adaptable to other watermarking techniques. |
AGENTVIGIL: Automatic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents (2025.findings-emnlp)
Copied to clipboard
Zhun Wang, Vincent Siu, Zhe Ye, Tianneng Shi, Yuzhou Nie, Xuandong Zhao, Chenguang Wang, Wenbo Guo, Dawn Song
| Challenge: | AGENTVIGIL is a black-box optimization framework to exploit indirect prompt injection vulnerabilities . indirect prompts compromise the core of LLM agents by manipulating contextual information rather than direct user prompts. |
| Approach: | They propose a black-box optimization framework to exploit indirect prompt injection vulnerabilities . they use a Monte Carlo tree-based algorithm to iteratively refine inputs . |
| Outcome: | The proposed framework achieves 71% and 70% success rates against two public benchmarks . |
Compressing Sentence Representation for Semantic Retrieval via Homomorphic Projective Distillation (2022.findings-acl)
Copied to clipboard
| Challenge: | Existing pre-trained language models produce large sentence embeddings, resulting in performance gap between large and small models. |
| Approach: | They propose a method that augments a small Transformer encoder model with learnable projection layers to produce compact sentences while mimicking a large pre-trained language model to retain the sentence representation quality. |
| Outcome: | The proposed method achieves 2.7-4.5 points performance gain on STS and SR tasks while maintaining the quality of the pre-trained language models. |
Position: LLM Watermarking Should Align Stakeholders’ Incentives for Practical Adoption (2026.findings-acl)
Copied to clipboard
| Challenge: | despite advances in watermarking algorithms, real-world deployment remains limited . model watermarks can be used to protect intellectual property and promote trust in AI . |
| Approach: | They propose to revisit three classes of watermarking to examine incentives for large language models . model watermarks naturally aligns with LLM provider interests, yet faces new challenges in open-source ecosystems . |
| Outcome: | The proposed methods can be used in dataset decontamination, user-controlled provenance, and in-context watermarking. |
Pre-trained Language Models Can be Fully Zero-Shot Learners (2023.acl-long)
Copied to clipboard
| Challenge: | Existing approaches to pre-trained language models require fine-tuning on labeled datasets or manually constructing proper prompts. |
| Approach: | They propose a nonparametric prompting PLM for fully zero-shot language understanding . they compare it to previous methods for text classification and text entailment . |
| Outcome: | The proposed method outperforms previous methods on diverse tasks. |
Distillation-Resistant Watermarking for Model Protection in NLP (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Existing protection methods such as watermarking only work for images but are not applicable to text. |
| Approach: | They propose a technique that injects watermarks into the victim’s prediction probability corresponding to a secret key and is able to detect such a key by probing a suspect model. |
| Outcome: | The proposed technique detects stealing suspects at 100% accuracy on four NLP tasks while the prior method fails on two. |
MarkLLM: An Open-Source Toolkit for LLM Watermarking (2024.emnlp-demo)
Copied to clipboard
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, Irwin King, Philip Yu
| Challenge: | Large Language Models (LLMs) embed imperceptible yet algorithmically detectable signals in outputs to identify LLM-generated text. |
| Approach: | They propose to develop an open-source toolkit for LLM watermarking that embeds imperceptible yet algorithmically detectable signals in model outputs to identify LLM-generated text. |
| Outcome: | MarkLLM provides a unified framework for implementing LLM watermarking algorithms, while providing user-friendly interfaces to ensure ease of access. |
A Survey on Detection of LLMs-Generated Content (2024.findings-emnlp)
Copied to clipboard
Xianjun Yang, Liangming Pan, Xuandong Zhao, Haifeng Chen, Linda Petzold, William Yang Wang, Wei Cheng
| Challenge: | Recent advances in large language models have led to an increase in synthetic content generation . the ability to detect LLMs-generated content has become of paramount importance . |
| Approach: | They propose to provide a detailed overview of existing detection strategies and benchmarks, scrutinizing their differences and advocating for more adaptable and robust models to enhance detection accuracy. |
| Outcome: | The proposed model will be able to detect human-written content in real time. |
GumbelSoft: Diversified Language Model Watermarking via the GumbelMax-trick (2024.acl-long)
Copied to clipboard
| Challenge: | Large language models generate human-like content, but they also pose a problem with generation diversity, negatively impacting generation diversity and user experience. |
| Approach: | They propose a Logits-Addition watermark and three variants that aim to enhance diversity to overcome generation diversity challenges. |
| Outcome: | The Logits-Addition watermark outperforms the Logits+Trick-based watermark in diversity tests and outperformed other decoding-based methods by 0.1 to 0.3. |
SafeKey: Amplifying Aha-Moment Insights for Safety Reasoning (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Reasoning Models (LRMs) introduce a new paradigm of explicitly reasoning before answering, but they pose great safety risks against harmful queries and adversarial attacks. |
| Approach: | They propose a safety aha moment that activates safety reasoning and leads to a safe response. |
| Outcome: | The proposed model can generalize to unseen jailbreak prompts while maintaining general abilities. |