Although existing backdoor defenses have gained success in mitigating backdoor attacks, they still face substantial challenges. In particular, most of them rely on large amounts of clean data to weaken the backdoor mapping but generally struggle with residual trigger effects, resulting in persistently high attack success rates (ASR). Therefore, in this paper, we propose a novel Backdoor defense method based on Directional mapping module and adversarial Knowledge Distillation (BeDKD), which balances the trade-off between defense effectiveness and model performance using a small amount of clean and poisoned data. We first introduce a directional mapping module to identify poisoned data, which destroys clean mapping while keeping backdoor mapping on a small set of flipped clean data. Then, the adversarial knowledge distillation is designed to reinforce clean mapping and suppress backdoor mapping through a cycle iteration mechanism between trust and punish distillations using clean and identified poisoned data. We conduct experiments to mitigate mainstream attacks on three datasets, and experimental results demonstrate that BeDKD surpasses the state-of-the-art defenses and reduces the ASR by 98% without significantly reducing the CACC.

The widespread adoption of large language models (LLMs) in commercial and research settings has intensified the need for robust intellectual property protection.Recently, backdoor-based LLM fingerprint paradigms have emerged as a promising solution for this challenge.In practical application, the low-cost multi-model collaborative technique, i.e., LLM ensemble, combines diverse LLMs to leverage their complementary strengths, garnering significant attention and practical adoption.Unfortunately, the vulnerability of the existing LLM fingerprint methods for the ensemble scenario is unexplored.In order to comprehensively assess the robustness of LLM fingerprints in the ensemble scenario, in this paper, we propose two novel fingerprint inhibitory attack methods: token filter attack (TFA) and sentence verification attack (SVA).The TFA gets the next token from a unified set of tokens created by the token filter mechanism at each decoding step.The SVA filters out fingerprint responses through a sentence verification mechanism based on perplexity and voting.Experimentally, the proposed methods effectively inhibit the fingerprint response while maintaining ensemble performance.Compared with state-of-the-art attack methods, the proposed method can achieve better performance.The findings necessitate enhanced robustness in LLM fingerprinting.

Linguistic steganalysis aims to detect whether a given text contains hidden information, playing a critical role in ensuring the security and integrity of modern communication systems. While existing deep learning-based steganalysis methods have shown promise in detecting text with hidden information (stego text), they suffer from severe performance degradation when the test domain does not match the target domain. Previous studies enhance detection accuracy under domain mismatch via domain adaptation methods, but they typically require access to source-domain data. To solve the problem with only unlabeled data in target domain, existing studies have used test-time adaptation (TTA) methods. Although they have achieved good results, there is a serious limitation: in this unsupervised scenario with only unlabeled target-domain data, the prediction of the model is unreliable, and parameter optimization based on this unreliable prediction will lead to error accumulation. To address this limitation, we propose Anomaly-Guided Test-Time Adaptation (AGTTA), a novel test-time adaptation framework for linguistic steganalysis. It consists of two stages: anomaly-guided pseudo-label generation and test-time adaptation. Specifically, we design an anomaly-guided pseudo-label generation module according to the distribution difference between cover and stego text. Then, during test-time adaptation, we design a dual-objective optimization including entropy minimization loss and pseudo-label cross-entropy loss, enabling effective unlabeled target domain adaptation without source data access. Existing experiments on three datasets and five steganography methods demonstrate that AGTTA significantly outperforms existing steganalysis methods without source data, achieving state-of-the-art performance.

Yinghan Zhou, Juan Wen, Wanli Peng, Xue Yiming, ZiWei Zhang, Wu Zhengxian. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2025.

Text steganography involves discreetly concealing sensitive messages within natural text, while text steganalysis serves as its counterpart by aiming to detect suspicious text that may contain embedded secret information. Detecting steganographic text has become increasingly difficult because evolving steganographic algorithms produce ever-changing text distributions. Consequently, few-shot text steganalysis, which identifies steganographic text with scarce examples regardless of its distribution has become a research hotspot. The state-of-the-art few-shot text steganalysis relies on the inter-class variance between classes, i.e., they behave satisfactorily in detecting large-variance classes while being incompetent in distinguishing confusable samples from similar steganographic settings. In this paper, we propose an Adversary-Refinement Framework for Text Steganalysis, namely ARTS, which employs a task-invariant extractor and a task-relevant projector to implement an “attract and repel” process. Specifically, in the “attract” stage, we align task-invariant features through adversarial training to shorten the intra-class distance. Afterward, the refined prototypes are projected to a new space in the “repel” stage, and then a refined penalty item is applied to enlarge the inter-class distance. Extensive experiments conducted in six datasets with different inter-class variances demonstrate the superiority of the proposed model over the SOTA models.

Linguistic steganography is becoming increasingly secure with the resurgence of generative language models and steganographic algorithms. Incorporating advanced objectives to optimize the steganalysis model is a promising solution for hard-to-detect samples. Previous research proves the effectiveness of supervised contrastive loss in detecting various linguistic steganography methods. However, it has not taken full advantage of label information and hard negative samples in contrastive learning. In this letter, we propose a dual-network architecture PWCL-Stega, which gives more weight to the confusable negative pairs in contrastive learning, guiding the encoder to identify more intricate patterns between them. We further align the distributions from the same sample through different dropout masks by minimizing bidirectional KL divergence to improve the quality of representations. Experimental results demonstrate that our method achieves significant improvements of up to 13% and surpasses baseline methods on major benchmarks, even outperforming the state-of-the-art results.

In recent years, large language models (LLM) have progressed rapidly, leading to growing concerns about the proliferation of difficult-to-distinguish AI-generated content. This has given rise to a range of issues, including fake news, academic fraud, phishing emails, posing significant dangers across various domains. However, current machine-generated text (MGT) detection methods still face challenges, including the need to access model's output logits or losses, which makes it unable to adapt to black-box scenarios in the real world, and difficult to deploy models with large parameter sizes. Therefore, we propose a compression-based lightweight network for MGT detection that leverages the ability of lossless compression to effectively extract features between categories. With fewer parameters, our framework achieves state-of-the-art performance in MGT detection under black box conditions. Experiments demonstrate that our approach performs exceptionally well on both Chinese and English datasets. Specifically, our method achieves a fulltext detection accuracy of 99.5%, surpassing the previous SOTA method.