Papers by Yanjun Qi
Zero-knowledge LLM hallucination detection and mitigation through fine-grained cross-model consistency (2025.emnlp-industry)
Copied to clipboard
| Challenge: | Existing methods for hallucination management fail to integrate both detection and mitigation without external knowledge sources. |
| Approach: | They propose a black-box framework that leverages fine-grained cross-model consistency to detect and mitigate hallucinations in LLM outputs without external knowledge sources. |
| Outcome: | The proposed framework improves hallucination detection scores by 6-39% on a FELM dataset . it achieves 9 percentage points improvement in answer accuracy on the GPQA-diamond dataset compared to existing approaches . |
Towards Building a Robust Toxicity Predictor (2023.acl-industry)
Copied to clipboard
| Challenge: | Recent studies have focused on robustness of toxicity language predictors, but this is problematic for real-world toxicity detection. |
| Approach: | They propose a novel adversarial attack that exploits greedy search strategies to fool toxic text classifiers. |
| Outcome: | The proposed attack can detect weaker toxicity language detectors even against unseen attacks. |
TurboFuzzLLM: Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practice (2025.naacl-industry)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking large-language models are limited by their limitations . authors present a mutation-based fuzzing technique that generates effective jailbreaking templates . |
| Approach: | They propose a mutation-based fuzzing technique for efficiently finding effective jailbreaking templates that combine with harmful questions to generate harmful responses. |
| Outcome: | The proposed technique achieves 95% attack success rates on public datasets for leading LLMs . it also shows impressive generalizability to unseen harmful questions and improves model defenses to prompt attacks. |
Towards Improving Adversarial Training of NLP Models (2021.findings-emnlp)
Copied to clipboard
| Challenge: | Recent methods for generating NLP adversarial examples involve combinatorial search and expensive sentence encoders for constraining the generated instances. |
| Approach: | They propose to use vanilla adversarial training to train NLP models using a word substitution attack optimized for vanilla adversary training. |
| Outcome: | The proposed approach improves model performance and standard accuracy and can defend against other types of word substitution attacks. |
AIDE: Attribute-Guided MultI-Hop Data Expansion for Data Scarcity in Task-Specific Fine-tuning (2025.acl-industry)
Copied to clipboard
| Challenge: | Existing methods for fine-tuning large language models for specific tasks require extensive seed datasets or struggle to balance task relevance and data diversity. |
| Approach: | They propose a data synthesis framework that uses a multi-hop process to expand very few seed data points while ensuring data diversity and task relevance. |
| Outcome: | The proposed framework outperforms state-of-the-art methods in task-specific fine-tuning by over 30%. |
Reevaluating Adversarial Examples in Natural Language (2020.findings-emnlp)
Copied to clipboard
| Challenge: | State-of-the-art adversarial examples lack a common definition of what constitutes success . human surveys show that to preserve semantics, we need to increase the minimum cosine similarities between the embeddings of swapped words and between the sentence encodings of original and perturbed sentences. |
| Approach: | They propose a unified definition of what constitutes a successful adversarial example . they propose four categories of constraints that are used to define adversarials . |
| Outcome: | The proposed framework is based on the outputs of two state-of-the-art synonym substitution attacks. |
White-box Testing of NLP models with Mask Neuron Coverage (2022.findings-naacl)
Copied to clipboard
| Challenge: | Recent research has shown that black-box testing is not applicable to NLP models. |
| Approach: | They propose a set of white-box testing methods that are customized for transformer-based NLP models and adapt them to a black-box test suite. |
| Outcome: | The proposed methods can reduce testing suites by 60% while retaining failing tests, thereby concentrating faultdetection power of the test suite. |
TaeBench: Improving Quality of Toxic Adversarial Examples (2025.naacl-industry)
Copied to clipboard
| Challenge: | Existing adversarial examples generate invalid or ambiguous examples that fool the systems into wrong detection. |
| Approach: | They propose an annotation pipeline for quality control of generated toxic adversarial examples (TAE) they use model-based automated annotation and human-based quality verification to assess quality requirements of a TAE dataset. |
| Outcome: | The proposed pipeline can transfer-attack SOTA toxicity content moderation models and services with adversarial training. |
TextAttack: A Framework for Adversarial Attacks, Data Augmentation, and Adversarial Training in NLP (2020.emnlp-demos)
Copied to clipboard
| Challenge: | TextAttack provides implementations of 16 adversarial attacks from the literature and supports a variety of models and datasets. |
| Approach: | They introduce a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
| Outcome: | This paper introduces a Python framework for adversarial attacks, data augmentation, and adversarially training in NLP. |
LaRS: Latent Reasoning Skills for Chain-of-Thought Reasoning (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods require human experts or pre-trained LLMs to describe the skill to guide the selection. |
| Approach: | They propose a new approach that uses unsupervised learning to create a latent space representation of rationales with a variable called a reasoning skill. |
| Outcome: | Empirical results show that LaRS outperforms SOTA skill-based selection methods . it processes example banks four times faster and reduces LLM inferences by half . |
QiMeng-Attention: SOTA Attention Operator is generated by SOTA Attention Algorithm (2025.findings-acl)
Copied to clipboard
Qirui Zhou, Shaohui Peng, Weiqiang Xiong, Haixin Chen, Yuanbo Wen, Haochen Li, Ling Li, Qi Guo, Yongwei Zhao, Ke Gao, Ruizhi Chen, Yanjun Wu, Zhao Chen, Yunji Chen
| Challenge: | Existing LLMs cannot comprehend the complex data flow and computation process of the attention operator and utilize low-level primitive to exploit GPU performance. |
| Approach: | They propose an LLM-friendly Thinking Language (LLM-TL) that can decouple the generation of high-level optimization logic and low-level implementation on GPU and enhance LLMs’ understanding of attention operator. |
| Outcome: | The proposed method outshines existing LLMs on A100, RTX8000, and T4 GPUs, achieving a speed-up of up to 35.16. |
The Subtle Art of Defection: Understanding Uncooperative Behaviors in LLM based Multi-Agent Systems (2026.eacl-industry)
Copied to clipboard
| Challenge: | Existing literature on uncooperative behavior degrades collective outcomes and requires more resilient multi-agent systems. |
| Approach: | They propose a game theory-based taxonomy of uncooperative agent behaviors and a structured, multi-stage simulation pipeline that dynamically generates and refines uncooperation behaviors as agents’ states evolve. |
| Outcome: | The proposed framework achieves 96.7% accuracy in generating realistic uncooperative behaviors, validated by human evaluations. |
Augmented Adversarial Trigger Learning (2025.findings-naacl)
Copied to clipboard
| Challenge: | Gradient optimization-based adversarial attack methods can generate jailbreak prompts or leak system prompts. |
| Approach: | They propose an algorithm that enhances negative log-likelihood loss and augments it with auxiliary loss. |
| Outcome: | The proposed approach outperforms current state-of-the-art techniques in nearly 100% of attacks while requiring 80% fewer queries. |
RIVAL: Reinforcement Learning with Iterative and Adversarial Optimization for Machine Translation (2025.findings-emnlp)
Copied to clipboard
Tianjiao Li, Mengran Yu, Chenyu Shi, Yanjun Zhao, Xiaojing Liu, Qi Zhang, Xuanjing Huang, Qiang Zhang, Jiayin Wang
| Challenge: | Using reinforcement learning from human feedback, large language models perform poorly when applied to colloquial subtitle translation tasks. |
| Approach: | They propose an adversarial training framework that iteratively updates the offline reward model and the online LLM to improve training outcomes. |
| Outcome: | The proposed training framework significantly improves upon translation baselines. |
Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderation (2025.emnlp-industry)
Copied to clipboard
| Challenge: | Existing jailbreaking methods create adversarial prompts to bypass LLM safeguards. |
| Approach: | They propose a framework for generating stealthy jailbreak prompts that enables knowledge sharing across attack paths. |
| Outcome: | The proposed framework outperforms state-of-the-art methods for attacking both open and closed LLMs with attack success rates of >96%. |