Multimodal retrieval-augmented generation (RAG) systems enhance large vision-language models by integrating cross-modal knowledge, enabling their increasing adoption across real-world multimodal tasks. These knowledge databases may contain sensitive information that requires privacy protection. However, multimodal RAG systems inherently grant external users indirect access to such data, making them potentially vulnerable to privacy attacks, particularly membership inference attacks (MIAs). Existing MIA methods targeting RAG systems predominantly focus on the textual modality, while the visual modality remains relatively underexplored. To bridge this gap, we propose MrM, the first black-box MIA framework targeted at multimodal RAG systems. It utilizes a multi-object data perturbation framework constrained by counterfactual attacks, which can concurrently induce the RAG systems to retrieve the target data and generate information that leaks the membership information. Our method first employs an object-aware data perturbation method to constrain the perturbation to key semantics and ensure successful retrieval. Building on this, we design a counterfact-informed mask selection strategy to prioritize the most informative masked regions, aiming to eliminate the interference of model self-knowledge and amplify attack efficacy. Finally, we perform statistical membership inference by modeling query trials to extract features that reflect the reconstruction of masked semantics from response patterns. Experiments on two visual datasets and eight mainstream commercial visual-language models (e.g., GPT-4o, Gemini-2) demonstrate that MrM achieves consistently strong performance across both sample-level and set-level evaluations, and remains robust under adaptive defenses.

Open knowledge bases (e.g., websites) are widely adopted in Retrieval-Augmented Generation (RAG) systems to provide supplementary knowledge (e.g., latest information). However, such sources inevitably contain biased or harmful content, and incorporating these untrusted contents into the RAG process introduces significant safety risks, including the degradation of LLM performance and the potential generation of harmful outputs. Recent studies have shown that this vulnerability can be further amplified by adversarial poisoning attacks specifically targeting the knowledge sources. Most existing methods primarily emphasize improving the accuracy and efficiency of RAG systems, usually overlooking these critical safety concerns. In this paper, we propose a safety-aware retrieval framework (ShieldRAG) designed to augment language model generation by jointly optimizing for both relevance and safety in the retrieved knowledge content. The core idea of ShieldRAG is to transfer the safety knowledge implicitly encoded in powerful LLMs into the retriever model through an adversarial knowledge alignment mechanism. This can empower the retriever with the safety awareness, and adapt to the diverse and unknown distribution of unsafe content encountered in practical scenarios. We evaluate ShieldRAG on seven real-world datasets using five widely-used LLMs and two state-of-the-art poisoning attack strategies. Experimental results show that our method substantially improves the robustness of RAG systems against unsafe knowledge sources, while maintaining competitive performance in terms of generation accuracy and efficiency.

Yuanhong Huang, Huili Wang, Xueying Bai, Jinrui Wang, Jiajun Liu, Ziqin Wang, Wanchun Ni, Shangguang Wang, Tao Qi. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Jinrui Wang, Zhenfeng Gao, Wendan Wang, Huili Wang, Zichen Qin, Linjie Zhu, Hongke Fu, Shangguang Wang, Tao Qi. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Recently, on-device large models (e.g., 7B parameter LLMs and LVLMs) are increasingly deployed in real-world services such as mobile assistants, edge computing, and IoT systems, where low latency and resource efficiency are critical. Since large models trained on general-domain data are typically suboptimal for downstream services, In-Context Learning (ICL) technique is widely used to enhance their task-specific service performance without extra tuning. However, effective ICL methods generally necessitate a sufficient amount of supervised data to provide abundant service-related information, which usually leads to a long context (i.e., more texts or images input) for models to process. This long context issue can significantly degrade the real-time inference efficiency and also impact the information utilization effectiveness, particularly for on-device large models with limited long context modeling capacities. To tackle this challenge, we propose a Personalized Knowledge Refinement (PKR) framework to achieve efficient and effective ICL for on-device large models. Specifically, we first introduce a personalized knowledge extraction module, which analyzes the inference behaviors of the target model on small-scale supervised data and then convert these behavioral patterns into personalized service-specific knowledge as the instruction context. Furthermore, we propose an adaptive knowledge filtration mechanism to model the informativeness of the extracted knowledge and eliminate the redundant ones, further improving the knowledge encoding efficiency per unit of context length. Experiments based on 14 benchmarks spanning both textual and visual task services, and 4 large models, demonstrated that PKR consistently improves task accuracy while reducing context length and inference latency, making it a practical solution for real-world on-device services. Codes are released athttps://github.com/wanghl21/PKR.

Large vision-language models (LVLMs) derive their capabilities from extensive training on vast corpora of visual and textual data. Empowered by large-scale parameters, these models often exhibit strong memorization of their training data, rendering them susceptible to membership inference attacks (MIAs). Existing MIA methods for LVLMs typically operate under white- or gray-box assumptions, by extracting likelihood-based features for the suspected data samples based on the target LVLMs. However, mainstream LVLMs generally only expose generated outputs while concealing internal computational features during inference, limiting the applicability of these methods. In this work, we propose the first black-box MIA framework for LVLMs, based on a prior knowledge-calibrated memory probing mechanism. The core idea is to assess the model memorization of the private semantic information embedded within the suspected image data, which is unlikely to be inferred from general world knowledge alone. We conducted extensive experiments across four LVLMs and three datasets. Empirical results demonstrate that our method effectively identifies training data of LVLMs in a purely black-box setting and even achieves performance comparable to gray-box and white-box methods. Further analysis reveals the robustness of our method against potential adversarial manipulations, and the effectiveness of the methodology designs. Our code and data are available at \url{https://github.com/spmede/KCMP}.

Recommender systems are widely employed to mitigate information overload by tailoring online content to individual preferences. Existing recommendation methods typically focus on optimizing the relevance between candidate item content and user historical behaviors. However, these methods often neglect the quality of recommended content, which can negatively affect user experience and hinder the long-term growth of platforms. In fact, addressing this issue is particularly challenging, as signal on content quality feedback is typically sparse in the user interaction data (e.g., clicks) commonly used for model training. In this article, we propose a human feedback alignment framework for recommender system (HFAR), which leverages well-aligned large language models to simulate human feedback on content quality to enhance recommendation. Specifically, we propose a multi-task learning-based knowledge transfer framework to infuse recommendation models with an awareness of fine-grained feedback on content quality from targeted perspectives. Furthermore, we develop a contrastive learning-based feedback integration mechanism to embed targeted human feedback into the ranking strategy to enable quality-aware recommendation decision-making. Besides, we propose a multi-objective joint training framework to optimize the model jointly under utility and quality objectives. Experiments show that HFAR achieves a maximum improvement of 84.78% in recommendation quality, while maintaining both recommendation accuracy and efficiency.

Robustness and privacy protection are two important factors of trustworthy federated learning (FL). Existing FL works usually secure data privacy by perturbing local model gradients via the differential privacy (DP) technique, or defend against poisoning attacks by filtering the local gradients in the outlier of the gradient distribution before aggregation. However, these two issues are often addressed independently in existing works, and how to secure federated learning in both privacy and robustness still needs further exploration. In this paper, we unveil that although DP noisy perturbation can improve the learning robustness, DP-FL frameworks are not inherently robust and are vulnerable to a carefully-designed attack method. Furthermore, we reveal that it is challenging for existing robust FL methods to defend against attacks on DP-FL. This can be attributed to the fact that the local gradients of DP-FL are perturbed by random noise, and the selected central gradients inevitably incorporate a higher proportion of poisoned gradients compared to conventional FL. To address this problem, we further propose a new defense method for DP-FL (named Robust-DPFL), which can effectively distinguish poisoned and clean local gradients in DP-FL and robustly update the global model. Experiments on three benchmark datasets demonstrate that baseline methods cannot ensure task accuracy, data privacy, and robustness simultaneously, while Robust-DPFL can effectively enhance the privacy protection and robustness of federated learning meanwhile maintain the task performance.

Generative Linguistic Steganography (GLS) is applied to protect privacy against excessive censorship by employing Language Models (LMs) to hide privacy messages in texts. To effectively circumvent censorship, GLS generates steganographic texts (stegos) that closely resemble normal human texts (covers) as possible. However, due to the inherent distribution difference between LM-generated text and human covers, existing methods that simply use LMs to generate stegos face challenges in achieving sufficient imperceptibility. To narrow the gap between stegos and covers, this paper proposes a distribution reformation method named ${\mathbf{Frequency}}$ ${\mathbf{REformed}}$ ${\mathbf{Softmax}}$ $\left( {{\mathbf{FREmax}}} \right)$. ${\mathbf{FREmax}}$ generates highly imperceptible stegos aligned with human text by reforming the softmax function in the generation stage of LMs. This reformation is based on the frequency distribution of tokens in the human corpus, ensuring that the distribution of LM-generated stegos closely resembles that of humans. Extensive experimental results show that ${\mathbf{FREmax}}$ improves the linguistic quality and imperceptibility of the generated stegos, providing a valuable remedy to existing GLS methods .1

Due to the widespread use of text in cyberspace, linguistic steganography, which hides secret information into normal texts, develops quickly in these years. While linguistic steganography protects users’ privacy, it also has the risk of being abused to endanger network security. Therefore, its corresponding detection technology, namely linguistic steganalysis, has attracted more and more researchers’ attention in the past several years. However, most of the current linguistic steganalysis methods rely heavily on a large number of labeled samples, which presents a significant gap from real-world scenarios where labeled steganographic samples are difficult to obtain. In this paper, we proposed the Pre-trained Language model with Self-training for Few-shot Linguistic Steganalysis (LSFLS) method which effectively copes with few-shot linguistic steganalysis through a small number of labeled samples and some auxiliary unlabeled samples. Numerous experiments have proved that the proposed method can achieve high detection accuracy of linguistic steganalysis when only a few labeled samples are provided (even less than 10), significantly improving the detection ability of existing methods in few-shot scenario. Furthermore, the experimental results demonstrate that the proposed method can maintain good detection capability in the case of data source mismatch and label unbalance. We believe that our work will greatly advance the practical application of linguistic steganalysis techniques.

Heterogeneous parallel steganography (HPS) has become a new trend of current streaming media voice steganography, which hides secret information in the frames of streaming media with multiple kinds of orthogonal steganography. Because of the complexity and imperceptibility of HPS, detecting its existence is a challenge for previous steganalysis methods, especially in the case of short sliding window length and low embedding rate. In order to improve the situation, we design a fast and efficient detection method named the key feature extraction and fusion network (KFEF) based on attention mechanism. The proposed model is able to effectively extract the key characteristic of the exceptions due to steganography and fuse the extracted features for different steganographic algorithms used in HPS. Experimental results show that the proposed method significantly improves the classification accuracy in detecting both low embedding rate samples and short segment samples. In addition, the detection time consumption is shorter than other methods and meets real-time requirements. Finally, with the help of attention we can predict the approximate locations of secret information which may bring new ideas to further steganalysis.