Selected work

Representative Papers

Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks

May 18, 2026

This work addresses the vulnerability of large language models (LLMs) to diverse backdoor attacks and the limited generalizability of existing defenses. The authors propose Open Benign-Based Rewriting (OBBR), a novel mechanism that leverages LLMs themselves to rewrite training data under the guidance of open benign samples, effectively projecting poisoned inputs into a benign prompt space to neutralize harmful content. Theoretical analysis demonstrates that OBBR outperforms conventional closed-book rewriting strategies. Extensive experiments across five distinct backdoor attacks and four mainstream LLMs show that OBBR improves security by 51% over state-of-the-art defenses and by 25.7% compared to closed-book rewriting, while remaining computationally efficient and preserving model performance on clean tasks.

0 citationsRead paper

Leveraging RAG for Training-Free Alignment of LLMs

May 11, 2026

Current alignment methods for large language models exhibit limited rejection capability against emerging proxy attacks and incur high computational overhead. This work proposes RAG-Pref, a training-free online alignment approach that, for the first time, integrates retrieval-augmented generation (RAG) into the alignment pipeline. By dynamically retrieving preferred and non-preferred response pairs during inference and performing contrastive conditional reasoning, RAG-Pref substantially enhances the model’s ability to reject proxy attacks. Experimental results demonstrate that RAG-Pref improves the average rejection rate against proxy attacks by 3.7× across five mainstream large language models—outperforming offline alignment methods by 1.5×—while simultaneously strengthening general human preference alignment, all with negligible additional computational cost.

0 citationsRead paper

Understanding the Effects of Safety Unalignment on Large Language Models

Apr 02, 2026

Current safety alignment mechanisms are susceptible to circumvention, yet the impact of different de-alignment methods on the malicious capabilities of large language models remains unclear. This work presents the first systematic evaluation of jailbreak-tuning and weight orthogonalization across six mainstream models, comprehensively comparing their effects on adversarial attack capability, hallucination rate, and general language performance. The study reveals that weight orthogonalization substantially enhances a model’s ability to execute sophisticated cyberattacks while maintaining low hallucination rates and preserving original language proficiency, and it is also more difficult to detect. In contrast, supervised fine-tuning effectively suppresses such adversarial behavior without compromising foundational capabilities. These findings highlight the significant security risks posed by weight orthogonalization and provide critical insights for designing robust alignment mechanisms.

0 citationsRead paper

Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems

Aug 19, 2025

Existing vulnerability scoring systems—CVSS, SSVC, EPSS, and the Exploitability Index—exhibit substantial inconsistency in assessing the same vulnerabilities due to divergent objectives and methodologies, undermining the reliability of risk prioritization. Method: This study conducts the first large-scale empirical comparison of these four major frameworks using real-world vulnerability data coupled with observed patching behavior. We employ statistical analysis and classification performance metrics to evaluate their effectiveness in vulnerability triage and exploit-risk prediction. Contribution/Results: Results reveal low inter-system ranking consistency; EPSS achieves superior predictive accuracy for actual exploitation likelihood, whereas CVSS base scores show weak correlation with real-world patching urgency. The study highlights the critical need for cross-framework score alignment and proposes concrete improvements—enhancing transparency, interpretability, and contextual adaptability—to support data-driven vulnerability management decisions. Findings provide both empirical evidence and methodological guidance for refining operational risk prioritization.

0 citationsRead paper

MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignment

May 29, 2025

This work addresses the emerging “False Benign Attack” (FBA) in Model Context Protocol (MCP)—a security threat wherein malicious online content, without requiring file downloads, deceives AI agents into executing unauthorized actions on the user side. We propose RAG-Pref, a novel paradigm that tightly integrates Retrieval-Augmented Generation (RAG) with preference alignment. We are the first to identify and empirically demonstrate the critical role of post-training methods—particularly GRPO—in enhancing model refusal capability against FBA. Additionally, we release the first FBA-specific preference dataset. Experiments show that combining RAG-Pref with Direct Preference Optimization (DPO) significantly improves large language models’ detection and refusal rates for FBA, achieving strong robustness and scalability. Our approach establishes a new, practical pathway for security-aligned inference in MCP ecosystems.

0 citationsRead paper

Recent publications

Latest Papers

Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks

May 18, 2026

This work addresses the vulnerability of large language models (LLMs) to diverse backdoor attacks and the limited generalizability of existing defenses. The authors propose Open Benign-Based Rewriting (OBBR), a novel mechanism that leverages LLMs themselves to rewrite training data under the guidance of open benign samples, effectively projecting poisoned inputs into a benign prompt space to neutralize harmful content. Theoretical analysis demonstrates that OBBR outperforms conventional closed-book rewriting strategies. Extensive experiments across five distinct backdoor attacks and four mainstream LLMs show that OBBR improves security by 51% over state-of-the-art defenses and by 25.7% compared to closed-book rewriting, while remaining computationally efficient and preserving model performance on clean tasks.

0 citationsRead paper

Leveraging RAG for Training-Free Alignment of LLMs

May 11, 2026

Current alignment methods for large language models exhibit limited rejection capability against emerging proxy attacks and incur high computational overhead. This work proposes RAG-Pref, a training-free online alignment approach that, for the first time, integrates retrieval-augmented generation (RAG) into the alignment pipeline. By dynamically retrieving preferred and non-preferred response pairs during inference and performing contrastive conditional reasoning, RAG-Pref substantially enhances the model’s ability to reject proxy attacks. Experimental results demonstrate that RAG-Pref improves the average rejection rate against proxy attacks by 3.7× across five mainstream large language models—outperforming offline alignment methods by 1.5×—while simultaneously strengthening general human preference alignment, all with negligible additional computational cost.

0 citationsRead paper

Understanding the Effects of Safety Unalignment on Large Language Models

Apr 02, 2026

Current safety alignment mechanisms are susceptible to circumvention, yet the impact of different de-alignment methods on the malicious capabilities of large language models remains unclear. This work presents the first systematic evaluation of jailbreak-tuning and weight orthogonalization across six mainstream models, comprehensively comparing their effects on adversarial attack capability, hallucination rate, and general language performance. The study reveals that weight orthogonalization substantially enhances a model’s ability to execute sophisticated cyberattacks while maintaining low hallucination rates and preserving original language proficiency, and it is also more difficult to detect. In contrast, supervised fine-tuning effectively suppresses such adversarial behavior without compromising foundational capabilities. These findings highlight the significant security risks posed by weight orthogonalization and provide critical insights for designing robust alignment mechanisms.

0 citationsRead paper

Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems

Aug 19, 2025

Existing vulnerability scoring systems—CVSS, SSVC, EPSS, and the Exploitability Index—exhibit substantial inconsistency in assessing the same vulnerabilities due to divergent objectives and methodologies, undermining the reliability of risk prioritization. Method: This study conducts the first large-scale empirical comparison of these four major frameworks using real-world vulnerability data coupled with observed patching behavior. We employ statistical analysis and classification performance metrics to evaluate their effectiveness in vulnerability triage and exploit-risk prediction. Contribution/Results: Results reveal low inter-system ranking consistency; EPSS achieves superior predictive accuracy for actual exploitation likelihood, whereas CVSS base scores show weak correlation with real-world patching urgency. The study highlights the critical need for cross-framework score alignment and proposes concrete improvements—enhancing transparency, interpretability, and contextual adaptability—to support data-driven vulnerability management decisions. Findings provide both empirical evidence and methodological guidance for refining operational risk prioritization.

0 citationsRead paper

MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignment

May 29, 2025

This work addresses the emerging “False Benign Attack” (FBA) in Model Context Protocol (MCP)—a security threat wherein malicious online content, without requiring file downloads, deceives AI agents into executing unauthorized actions on the user side. We propose RAG-Pref, a novel paradigm that tightly integrates Retrieval-Augmented Generation (RAG) with preference alignment. We are the first to identify and empirically demonstrate the critical role of post-training methods—particularly GRPO—in enhancing model refusal capability against FBA. Additionally, we release the first FBA-specific preference dataset. Experiments show that combining RAG-Pref with Direct Preference Optimization (DPO) significantly improves large language models’ detection and refusal rates for FBA, achieving strong robustness and scalability. Our approach establishes a new, practical pathway for security-aligned inference in MCP ecosystems.

0 citationsRead paper