Beyond adapting Large Language Models (LLMs) to specialized applications, fine-tuning has recently been shown to recover private information that is no longer accessible through direct queries. Previous fine-tuning recovery attacks, however, require genuine private supervision drawn from the same distribution, i.e., th...
Jian-Hong Li, Jia-Hao Chen, Yuwen Pu et al.· 0 citations
Large language models (LLMs) exhibit strong general capabilities, yet their parameters typically remain fixed after deployment, limiting learning from new interactions. In open-ended environments, this motivates self-evolving agents that continually update reusable state-including model parameters, memories, tool defin...
Jia-Hao Chen, Zhou Feng, Ou-Bo Ma et al.· 1 citation
This work introduces PROSE (Provenance through Relational Organization of Semantic Expression), replacing fixed query sets with a target semantical domain and brittle response keys with semantic structures internalized as domain-conditioned response behavior.
Zhong-Rui Sun, Jia-Hao Chen, Ou-Bo Ma et al.· 0 citations
SkillShift is presented, a constrained black-box framework for covert policy steering without explicit target command injection or task hijacking that combines semantically plausible policy edits with hierarchical validation, failure-guided optimization, and strategy compression to preserve effectiveness, output validi...
Jia-Rui Li, Jia-Hao Chen, Chun-Yi Zhou et al.· 0 citations
This study unveils the capability of attackers to generate adversarial policies even when restricted to partial observations of the victims in multi-agent competitive environments, and proposes a novel black-box attack (SUB-PLAY) that incorporates the concept of constructing multiple subgames to mitigate the impact of...
Oubo Ma, Yuwen Pu, L. Du et al.· Conference on Computer and C...· 16 citations
This work forms this problem as backdoor generalization under training--inference trigger shift and introduces Lilith, a black-box anchor-to-family framework that achieves high family-wise attack success with limited utility degradation and a small trigger generalization gap.
