Although existing backdoor defenses have gained success in mitigating backdoor attacks, they still face substantial challenges. In particular, most of them rely on large amounts of clean data to weaken the backdoor mapping but generally struggle with residual trigger effects, resulting in persistently high attack success rates (ASR). Therefore, in this paper, we propose a novel Backdoor defense method based on Directional mapping module and adversarial Knowledge Distillation (BeDKD), which balances the trade-off between defense effectiveness and model performance using a small amount of clean and poisoned data. We first introduce a directional mapping module to identify poisoned data, which destroys clean mapping while keeping backdoor mapping on a small set of flipped clean data. Then, the adversarial knowledge distillation is designed to reinforce clean mapping and suppress backdoor mapping through a cycle iteration mechanism between trust and punish distillations using clean and identified poisoned data. We conduct experiments to mitigate mainstream attacks on three datasets, and experimental results demonstrate that BeDKD surpasses the state-of-the-art defenses and reduces the ASR by 98% without significantly reducing the CACC.

The widespread adoption of large language models (LLMs) in commercial and research settings has intensified the need for robust intellectual property protection.Recently, backdoor-based LLM fingerprint paradigms have emerged as a promising solution for this challenge.In practical application, the low-cost multi-model collaborative technique, i.e., LLM ensemble, combines diverse LLMs to leverage their complementary strengths, garnering significant attention and practical adoption.Unfortunately, the vulnerability of the existing LLM fingerprint methods for the ensemble scenario is unexplored.In order to comprehensively assess the robustness of LLM fingerprints in the ensemble scenario, in this paper, we propose two novel fingerprint inhibitory attack methods: token filter attack (TFA) and sentence verification attack (SVA).The TFA gets the next token from a unified set of tokens created by the token filter mechanism at each decoding step.The SVA filters out fingerprint responses through a sentence verification mechanism based on perplexity and voting.Experimentally, the proposed methods effectively inhibit the fingerprint response while maintaining ensemble performance.Compared with state-of-the-art attack methods, the proposed method can achieve better performance.The findings necessitate enhanced robustness in LLM fingerprinting.

Training and serving large language models (LLMs) is resource-intensive, making reliable intellectual property (IP) protection and blackbox ownership verification increasingly important.Model fingerprinting enables such verification by injecting a small set of secret query-response behaviors, but many existing fingerprints rely on explicit markers or predetermined outputs that are weakly grounded in prompt semantics.This semantic mismatch yields atypical fingerprint responses, reduces stealthiness, and exposes fingerprints to removal by response normalization.We formalize this vulnerability via a new removal attack, Generation Revision Intervention (GRI), which applies system-prompt-level revision and response standardization to steer models toward typical answers, substantially compromising representative injected baselines.To close this semantic gap, we propose the Implicit Fingerprints (ImF): we encode ownership information into a natural-looking target response y via linguistic steganography, then derive a CoTaugmented query x that embeds semantic cues from y to guide the model toward an output sufficiently close to y for decoding-based verification.Experiments on 15 LLMs show that ImF improves stealthiness and remains verifiable under model updates and deploymenttime prompt interventions; additional analyses further show stability under common decoding variation and realistic related-model partial merging.

Yinghan Zhou, Juan Wen, Wanli Peng, Xue Yiming, ZiWei Zhang, Wu Zhengxian. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2025.

Linguistic steganalysis is a technique to distinguish whether a text carrier contains secret information via statistical features. Current state-of-the-art methods are caught in two constraints. First, they cannot make accurate predictions on unlearned text distributions. In other words, the performance relies on the consistency of the training and testing distributions. Second, sufficient samples are required to fine-tune these models to reach their optimal states. In this article, we break through these obstacles by developing an effective steganalysis framework in a few-shot scenario. We first build the meta-datasets to simulate the real-world steganalysis environment that contains multi-distributional source and target domains with sparse target-domain samples. Then we propose a few-shot linguistic steganalysis framework combined with an adversarial meta-training mechanism to learn task-transferable features from source task sets to target tasks. Extensive experiments conducted on benchmark datasets show our model has a stable capability to learn transferable knowledge in detecting steganalysis tasks with extremely few-shot samples. We also validate the effectiveness of the model through multi-class steganalysis experiments to identify extra steganographic information involving embedding algorithms and capacities. Our proposed framework is effectively demonstrated to compensate for the drawback of state-of-the-art methods and tremendously improve the detection performance.

Text steganography involves discreetly concealing sensitive messages within natural text, while text steganalysis serves as its counterpart by aiming to detect suspicious text that may contain embedded secret information. Detecting steganographic text has become increasingly difficult because evolving steganographic algorithms produce ever-changing text distributions. Consequently, few-shot text steganalysis, which identifies steganographic text with scarce examples regardless of its distribution has become a research hotspot. The state-of-the-art few-shot text steganalysis relies on the inter-class variance between classes, i.e., they behave satisfactorily in detecting large-variance classes while being incompetent in distinguishing confusable samples from similar steganographic settings. In this paper, we propose an Adversary-Refinement Framework for Text Steganalysis, namely ARTS, which employs a task-invariant extractor and a task-relevant projector to implement an “attract and repel” process. Specifically, in the “attract” stage, we align task-invariant features through adversarial training to shorten the intra-class distance. Afterward, the refined prototypes are projected to a new space in the “repel” stage, and then a refined penalty item is applied to enlarge the inter-class distance. Extensive experiments conducted in six datasets with different inter-class variances demonstrate the superiority of the proposed model over the SOTA models.

Recent advances in large language models (LLMs) have blurred the boundary of high-quality text generation between humans and machines, which is favorable for generative text steganography. Currently, advanced steganographic mapping is not suitable for LLMs since most users are restricted to accessing only the black-box API or user interface of the LLMs, thereby lacking access to the training vocabulary and its sampling probabilities. In this paper, we explore a black-box generative text steganographic method based on the user interfaces of large language models, which is called LLM-Stega. The main goal of LLM-Stega is to ensure secure covert communication between Alice (sender) and Bob (receiver) by using the user interfaces of LLMs. Specifically, We first construct a keyword set and design a new encrypted steganographic mapping to embed secret messages. Furthermore, an optimization mechanism based on reject sampling is proposed to guarantee accurate extraction of secret messages and rich semantics of generated stego texts. Comprehensive experiments demonstrate that the proposed LLM-Stega outperforms current state-of-the-art methods.

Designing de novo molecules with specific biological activity is an essential task since it holds the potential to bypass the exploration of target genes, which is an initial step in the modern drug discovery paradigm. However, traditional methods mainly screen molecules by comparing the desired molecular effects within the documented experimental results. The data set limits this process, and it is hard to conduct direct cross-modal comparisons. Therefore, we propose a solution based on cross-modal generation called GexMolGen (Gene Expression-based Molecule Generator), which generates hit-like molecules using gene expression signatures alone. These signatures are calculated by inputting control and desired gene expression states. Our model GexMolGen adopts a "first-align-then-generate" strategy, aligning the gene expression signatures and molecules within a mapping space, ensuring a smooth cross-modal transition. The transformed molecular embeddings are then decoded into molecular graphs. In addition, we employ an advanced single-cell large language model for input flexibility and pre-train a scaffold-based molecular model to ensure that all generated molecules are 100% valid. Empirical results show that our model can produce molecules highly similar to known references, whether feeding in- or out-of-domain transcriptome data. Furthermore, it can also serve as a reliable tool for cross-modal screening.

The growth of social networks has fueled advancements in text steganography techniques. As a covert communication form, text steganography discreetly embeds information by adding low-amplitude noise, significantly complicating its detection, and making steganographic texts increasingly difficult to identify. Existing steganalysis models achieve high detection accuracy by assuming that the training and testing sets are independent and identically distributed (i.i.d). However, meeting the i.i.d. requirement between training and testing datasets is impractical in real-world scenarios because it is often impossible to pinpoint which texts contain steganography or to identify the algorithms used in their creation. Therefore, obtaining labeled data for training is often unfeasible, and training models with each pair of source and target domains for each task significantly inconveniences the practical application of steganalysis models. Given these detection challenges, we propose a test-time adaptive steganalysis paradigm to accommodate detection scenarios without training data. Employing a generic pre-trained language model as a foundation and optimizing the model during testing allows it to self-adjust to new and varied data sets. The model relies only on the test data and its parameters in this fully test-time adaptation setting. It's important to note that detecting steganographic texts is an immense challenge; thus, we integrate test-time entropy minimization (TTem) to enhance the detection accuracy of steganographic texts. Extensive experiments show that the proposed method achieves good performance for test-time adaptation cross-domain linguistic steganalysis.

Existing linguistic steganalysis methods require the training and testing datasets to be independent and identically distributed (i.i.d). However, in real-world scenarios, various types of text and steganographic algorithms are employed to generate steganographic text, making it challenging to fulfill the requirement of independent and identical distribution between training and test datasets. This issue, known as the domain mismatch problem, significantly diminishes the detection performance. Thus, it is reasonable to consider domain adaptation by reducing the distribution discrepancy of different domains. However, how to measure and minimize the discrepancy for linguistic steganalysis remains a big challenge. In this paper, we put forward a cross-domain linguistic steganalysis architecture based on a new domain distance metric and adaptive weight selection network. Concretely, a novel steganographic domain distance metric (SDDM) is first proposed, which can effectively characterize the overall distribution discrepancy and capture the weak noise introduced by the information embedding process. Additionally, an adaptive weight selection network with a switching-path structure is designed to calculate domain-specific attention weights, facilitating the model to adapt to various discrepancies scenarios and enhancing its domain-invariant feature representation capability. Extensive experiments show that the proposed method achieves state-of-the-art performance for cross-domain linguistic steganalysis.

Automatic detection of lettuce growth traits is of great significance in modern greenhouse cultivation. Existing methods mainly focus on capturing coarse representations from RGB or RGB-D images with learnable convolutional neural networks. However, due to the significant appearance-varying discrepancies at different growth stages, coarse representations and inefficient depth fusion strategies limit the performance of automatic detection of lettuce growth traits. To alleviate the above problem, this paper proposes a novel detection method for lettuce growth traits based on transformer and convolutional neural network. In this method, we design a dual-transformer module and a residual module to effectively extract multi-scale representations and depth representations from appearance-varying lettuce images. In addition, a feature coupling bridge is proposed to fuse the multi-scale representations and depth representations. The experimental results show that our method outperforms the state-of-the-art methods.

Recently, Diffusion Models (DMs) boost a wave in AI for Art yet raise new copyright concerns, where infringers benefit from using unauthorized paintings to train DMs and generate novel paintings in a similar style. To address these emerging copyright violations, in this paper, we are the first to explore and propose to utilize adversarial examples for DMs to protect human-created artworks. Specifically, we first build a theoretical framework to define and evaluate the adversarial examples for DMs. Then, based on this framework, we design a novel algorithm to generate these adversarial examples, named AdvDM, which exploits a Monte-Carlo estimation of adversarial examples for DMs by optimizing upon different latent variables sampled from the reverse process of DMs. Extensive experiments show that the generated adversarial examples can effectively hinder DMs from extracting their features. Therefore, our method can be a powerful tool for human artists to protect their copyright against infringers equipped with DM-based AI-for-Art applications. The code of our method is available on GitHub: https://github.com/mist-project/mist.git.

Text steganography is becoming increasingly secure by eliminating the distribution discrepancy between normal and stego text. On the other hand, the existing cross-entropy-based steganalysis models struggle to distinguish subtle distribution differences and lack robustness regarding confusable samples. To enhance steganalysis accuracy on hard-to-detect samples, this paper draws on contrastive learning to design a text steganalysis framework incorporating supervised contrastive loss into the training process. This framework improves feature representation by pushing apart embeddings from different classes while pulling closer embeddings from the same class. The experimental results show that our method makes remarkable improvement compared to the four baseline models. Additionally, as the embedding rate increases, our method's advantages become increasingly apparent, with maximum improvements of 13.98%, 12.47%, and 13.65% over the baseline methods across three common linguistic steganalysis datasets, Twitter, IMDB, and News, respectively. Our code is available at https://github.com/Katelin-glt/SCL-Stega https://github.com/katelin-glt/SCL-Stega.

Text steganalysis is a technique to distinguish between steganographic text and normal text via statistical features. Current state-of-the-art text steganalysis models have two limitations. First, they need sufficient amounts of labeled data for training. Second, they lack the generalization ability on different detection tasks. In this paper, we propose a meta-learning framework for text steganalysis in the few-shot scenario to ensure model fast-adaptation between tasks. A general feature extractor based on BERT is applied to extract universal features among tasks, and a meta-learner based on attentional Bi-LSTM is employed to learn task-specific representations. A classifier trained on the support set calculates the prediction loss on the query set with a few samples to update the meta-learner. Extensive experiments show that our model can adapt fast among different steganalysis tasks through extremely few-shot samples, significantly improving detection performance compared with the state-of-the-art steganalysis models and other meta-learning methods.

Traditional text steganalysis methods rely on a large amount of labeled data. At the same time, the test data should be independent and identically distributed with the training data. However, in practice, a large number of text types make it difficult to satisfy the i.i.d condition between the training set and the test set, which leads to the problem of domain mismatch and significantly reduces the detection performance. In this paper, we draw on the ideas of domain adaptation and transductive learning to design a novel text steganalysis method. In this method, we design a distributed adaptation layer and adopt three loss functions to achieve domain adaptation, so that the model can learn the domain-invariant text features. The experimental results show that the method has better steganalysis performance in the case of domain mismatch.

The prevailing text steganalysis models deal with only one domain of steganographic text. When learning steganographic text from other domains, it will forget the previously learned features, resulting in degraded model performance on the previous domain. We create a chronological task sequence and draw on the ideas of lifelong learning to propose a novel steganalysis method. We use BERT to extract the common features shared among the current task and the previous tasks. Then, we extract explicit and latent features based on two learning scenarios: next sentence prediction and task ID classification, which are constrained by regularization to prevent the feature space from changing too much when switching tasks. And we design the replay mechanism and three loss functions to make a trade-off between the previous and the current tasks. Furthermore, we evaluate our model under hybrid steganography, which detects a mixture of texts generated by different steganography algorithms with different embedding capabilities. Extensive experiments show that our model mitigates the catastrophic forgetting issues and outperforms the state-of-the-art models in continual text steganalysis tasks.

Text has become one of the most extensively used digital media in Internet, which provides steganography an effective carrier to realize confidential message hiding. Nowadays, generation-based linguistic steganography has made a significant breakthrough due to the progress of deep learning. However, previous methods based on recurrent neural network have two deviations including exposure bias and embedding deviation, which seriously destroys the security of steganography. In this article, we propose a novel linguistic steganographic model based on adaptive probability distribution and generative adversarial network, which achieves the goal of hiding secret messages in the generated text while guaranteeing high security performance. First, the steganographic generator is trained by using generative adversarial network to effectively tackle the exposure bias, and then the candidate pool is obtained by a probability similarity function at each time step, which alleviates the embedding deviation through dynamically maintaining the diversity of probability distribution. Third, to further improve the security, a novel strategy that conducts information embedding during model training is put forward. We design various experiments from different aspects to verify the performance of the proposed model, including imperceptibility, statistical distribution, anti-steganalysis ability. demonstrate that our proposed model outperforms the current state-of-the-art steganographic schemes.

With the extensive use of texts on social network, text steganography, which protects several sensitive messages by embedding secret data into normal texts, has attracted widespread attention. As an adversary, text steganalysis which reveals the existence of hidden messages is also important. Recently, Deep Neural Networks (DNNs) have led to significant improvements in text steganalysis. However, the deeper and wider DNNs cause the increase of inference time, which restricts the practicality of text steganalysis. In this paper, we propose an effective and real-time text steganalysis method based on multi-stage transfer learning to enhance inference efficiency and detection performance simultaneously. The experimental results show that the proposed text steganalysis method can outperform previously reported methods in terms of detection accuracy and inference efficiency.

With the emergence of the generation-based steganography, the traditional text steganalysis methods show the unsatisfactory detection performance as the manually extracted features are simple and non-universal. The recently proposed deep learning-based text steganalysis methods can obtain the great detection accuracy by extracting the high-level features. In this letter, a hybrid text steganalysis method (R-BILSTM-C) is proposed through combining the advantages of Bidirectional Long Short Term Memory Recurrent Neural Network (Bi-LSTM) and Convolutional Neural Network (CNN). The proposed method can efficiently capture both local features and long-term semantic information from text to improve the detection accuracy. In the proposed method, the Bi-LSTM architecture is used to capture the long-term semantic information of texts. And the asymmetric convolution kernels with different sizes are applied to extract the local relationship between words. In addition, the high dimensional semantic feature space is visualized. Experimental results show that the proposed method adapts to the different steganographic algorithms efficiently, and achieves the comparable or superior detection performance for the various sentence lengths compared with other state-of-the-art text steganalysis methods.

The prevailing text steganalysis methods detect steganographic communication by extracting hand-crafted features and classifying them using SVM. However, these features are designed based on the statistical changes caused by steganography, thus they are difficult to adapt to different kinds of embedding algorithms and the detection performance is heavily dependent on the text size. In this letter, we propose a novel text steganalysis model based on convolutional neural network, which is able to capture complex dependencies and learn feature representations automatically from the texts. First, we use a word embedding layer to extract the semantic and syntax feature of words. Second, the rectangular convolution kernels with different sizes are used to learn the sentence features. To further improve the performance, we present a decision strategy for detecting the long texts. Experimental results show that the proposed method can effectively detect different kinds of text steganographic algorithms and achieve comparable or superior performance for a wide variety of text sizes compared with the previous methods.

The Android permission mechanism prevents malicious application from accessing the mobile multimedia data and invoking the sensitive API. However, there are still lots of deficiencies in the current permission management, which results in the permission mechanism being unable to protect users’ private data properly. In this paper, a dynamic management scheme of Android permission based on machine learning is proposed to solve the problem of the existing permission mechanism. In order to accomplish the dynamic management, the proposed scheme maintains a dynamic permission management database which records the state of permissions for each application. Only the permission which is granted state in the database can be used in this application. In the whole process, the scheme first classifies the application by means of machine learning, then retrieves the corresponding permission information from databases, and issues the dangerous permission warning to users. Finally, the scheme updates the dynamic management database according to the users’ decisions. Through this scheme, users can prevent malicious behaviour of accessing private data and invoking sensitive API in time. The solution increases the flexibility of permission management and improves the security and reliability of multimedia data in Android devices.