Papers by Xuehai Tang
LyapLock: Bounded Knowledge Preservation in Sequential Large Language Model Editing (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing models for enhancing knowledge updating are prone to performance degradation due to incomplete knowledge preservation mechanisms. |
| Approach: | They propose a model for locate-then-edit that decomposes long-term constrained programming into tractable stepwise subproblems for efficient solving. |
| Outcome: | The proposed framework achieves asymptotic optimal editing performance while meeting the constraints of long-term knowledge preservation. |
More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters (2026.acl-long)
Copied to clipboard
| Challenge: | Existing safety alignment methods leave Large Language Models vulnerable to sophisticated jailbreak attacks. |
| Approach: | They propose a safety reasoning internalization framework that internalizes safety reasoning into an implicit computational pathway using Low-Rank Adaptation (LoRA). |
| Outcome: | The proposed framework achieves a 43% lower Attack Success Rate (ASR) against distinct jailbreak attacks compared to strong baselines. |
Gamma-Guard: Lightweight Residual Adapters for Robust Guardrails in Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) are widely deployed as zero-shot evaluators for answer grading, content moderation, and document ranking. |
| Approach: | They propose a system that trains LLMs with adapters to denoise embeddings and refocus attention. |
| Outcome: | The proposed model lifts adversarial accuracy from 5% to 95% a 90 percentage-point gain while reducing clean-data accuracy by just 8 percentage points. |
HearSay Benchmark: Do Audio LLMs Leak What They Hear? (2026.findings-acl)
Copied to clipboard
Jin Wang, Kaiwen Luo, Liang Lin, Weiliu Wang, Yitian Chen, Moayad Aloqaily, Xuehai Tang, Zhenhong Zhou, Kun Wang, Li Sun, Qingsong Wen
| Challenge: | Recent advances in audio large language models have led to their potential privacy implications unexplored. |
| Approach: | They propose a benchmark to examine whether ALLMs leak user privacy through acoustic voiceprints. |
| Outcome: | The proposed benchmark is constructed from over 22,000 real-world audio clips. |
Resolving the Security-Auditability Dilemma with Auditable Latent Chain-of-Thought Alignment (2026.acl-long)
Copied to clipboard
| Challenge: | Extensive experiments show that ALCA reduces the success rate of adaptive jailbreak attacks by over 40% compared to strong baselines, while preserving performance. |
| Approach: | They propose a framework that decouples internal reasoning from external output and allows the model to reconstruct its latent reasoning into human-readable text for supervision under specific guidance. |
| Outcome: | The proposed framework reduces the success rate of adaptive jailbreak attacks by over 40% compared to baselines while preserving performance. |
FABLE: Fine-grained Fact Anchoring for Unstructured Model Editing (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for model editing memorize text holistically without reliable fine-grained fact access. |
| Approach: | They propose a hierarchical framework that decouples fine-grained fact injection from holistic text generation. |
| Outcome: | The proposed framework significantly improves fine-grained question answering while maintaining state-of-the-art holistic editing performance. |
Chain of Attack: Hide Your Intention through Multi-Turn Interrogation (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak attacks focus on single-turn dialogue scenarios, leaving vulnerabilities in multi-turn contexts inadequately explored. |
| Approach: | They propose an optimal interrogation principle to conceal the jailbreak intent and introduce a multi-turn attack chain generation strategy called CoA. |
| Outcome: | The proposed method shows that black-box LLMs exhibit insufficient resistance under multi-turn interrogation, with more advantages (ASR, 83% vs 64%) |