Yiming Huang, Zhenbo Shi, Xin-Cheng Wen, Jichuan Zeng, Cuiyun Gao, Peiyi Han, Chuanyi Liu. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Yuhao Zhang, Liang Yan, Shaoming Duan, Xinyu Zha, Jinhang Su, Peiyi Han, Chuanyi Liu. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

The rapid proliferation of large language models (LLMs) in web-scale applications has heightened the need for robust security mechanisms. To address these challenges, various guardrail strategies have been introduced, including input filters, output moderation, and model alignment. Among them, input-side guardrails are commonly adopted as the first line of defense against adversarial prompts. However, we identify a critical architectural weakness: a representation asymmetry between input-side guardrails and the core LLMs, which creates a security gap exploitable by adversaries. Through systematic analysis, we show that guardrails are fragile when facing minor character perturbations, while LLMs remain semantically resilient and can still reconstruct malicious intent from noisy inputs. Exploiting this asymmetry, we propose RepMism, a hybrid adversarial framework that combines character injection with chain-of-thought hijacking, coordinated through hierarchical scheduling and safety continuation. Our extensive empirical evaluation across four commercial LLMs and five state-of-the-art guardrails demonstrates RepMism's strong attack capability, achieving high success rates. Importantly, we identify a ''success interval'' where perturbations effectively bypass guardrail detection yet remain interpretable to target models. These findings expose key flaws in current multi-layer security architectures and offer actionable guidance for building more resilient defenses through perturbation-aware training and cross-layer representation alignment.

Deep neural networks (DNNs) have achieved remarkable performance in many tasks, yet they often behave as opaque black boxes. Explanation-guided learning (EGL) methods steer DNNs using human-provided explanations or supervision on model attributions. These approaches improve interpretability but typically assume benign inputs and incur heavy annotation costs. In contrast, both predictions and saliency maps of DNNs could dramatically alter facing imperceptible perturbations or unseen patterns. Adversarial training (AT) can substantially improve robustness, but it does not guarantee that model decisions rely on semantically meaningful features. In response, we propose Explanation-Guided Adversarial Training (EGAT), a unified framework that integrates the strength of AT and EGL to simultaneously improve prediction performance, robustness, and explanation quality. EGAT generates adversarial examples on the fly while imposing explanation-based constraints on the model. By jointly optimizing classification performance, adversarial robustness, and attributional stability, EGAT is not only more resistant to unexpected cases, including adversarial attacks and out-of-distribution (OOD) scenarios, but also offer human-interpretable justifications for the decisions. We further formalize EGAT within the Probably Approximately Correct learning framework, demonstrating theoretically that it yields more stable predictions under unexpected situations compared to standard AT. Empirical evaluations on OOD benchmark datasets show that EGAT consistently outperforms competitive baselines in both clean accuracy and adversarial accuracy (+37%) while producing more semantically meaningful explanations, and requiring only a limited increase (+16%) in training time.

Recent advances in large language models (LLMs) have significantly improved the accuracy of Text-to-SQL systems. However, a critical challenge remains: the semantic mismatch between natural language questions (NLQs) and their corresponding SQL queries. This issue is exacerbated in large-scale databases, where semantically similar attributes hinder schema linking and semantic drift during SQL generation, ultimately reducing model accuracy. To address these challenges, we introduce CRED-SQL, a framework designed for large-scale databases that integrates Cluster Retrieval and Execution Description. CRED-SQL first performs cluster-based large-scale schema retrieval to pinpoint the tables and columns most relevant to a given NLQ, alleviating schema mismatch. It then introduces an intermediate natural language representation—Execution Description Language (EDL)—to bridge the gap between NLQs and SQL. This reformulation decomposes the task into two stages: Text-to-EDL and EDL-to-SQL, leveraging LLMs’ strong general reasoning capabilities while reducing semantic deviation. Extensive experiments on two large-scale, cross-domain benchmarks—SpiderUnion and BirdUnion—demonstrate that CRED-SQL achieves new state-of-the-art (SOTA) performance, validating its effectiveness and scalability. Our code is available at https://github.com/smduan/CRED-SQL.git

Ensuring the Safety of the Intended Functionality (SOTIF) for autonomous vehicles (AVs) is critical. Effective risk assessment helps AVs make decisions and avoid risks. However, existing methods face challenges due to environmental uncertainties, insufficient multi-dimensional risk quantification, and limited predictive accuracy. To address this challenge, we propose an uncertainty-aware probabilistic risk assessment framework that quantifies the risk of AVs violating safety constraints and calculates the expected average severity of such violations in uncertain environments. We first establish a general SOTIF risk model to characterize the static risk of the AV and surrounding traffic participants. Following this, we introduce a method for predicting dynamic uncertainty risks, resulting in probabilistic risk quantification. This framework accounts for multi-dimensional uncertainties and enhances safety under dynamic conditions. Extensive evaluations across typical traffic scenarios-including highways, intersections, and roundabouts-demonstrate that our method outperforms typical algorithms like Time Headway (THW) and Time-toCollision (TTC). Empirical studies in extreme scenarios further validate the framework's ability to reduce risks and improve system generalization. The related code is available at: https://github.com/idslab-autosec/risk_uncertainty.

This paper presents Hamster, a novel synchronous Byzantine Fault Tolerant protocol that achieves high throughput and weaker dependency on synchrony. Specifically, Hamster is the first to introduce coding techniques into synchronous BFT, addressing the challenges posed by higher fault tolerance requirements and significantly reducing communication complexity. Consequently, Hamster achieves linear throughput gains as the number of nodes increases, surpassing Sync HotStuff. Additionally, with minor modifications, Hamster can operate effectively in mobile sluggish environments, further reducing its dependency on strict synchrony. We implement Hamster, and experimental results highlight its performance advantages. Specifically, Hamster achieves$2.5\times $the throughput of Sync HotStuff in a network of 9 nodes, with this gain growing to$10\times $as the network scales to 65 nodes. This increasing throughput advantage makes Hamster more applicable to large-scale distributed systems.

Lowering the memory requirement in full-parameter training on large models has become a hot research area. MeZO fine-tunes the large language models (LLMs) by just forward passes in a zeroth-order SGD optimizer (ZO-SGD), demonstrating excellent performance with the same GPU memory usage as inference. However, the simulated perturbation stochastic approximation for gradient estimate in MeZO leads to severe oscillations and incurs a substantial time overhead. Moreover, without momentum regularization, MeZO shows severe over-fitting problems. Lastly, the perturbation-irrelevant momentum on ZO-SGD does not improve the convergence rate. This study proposes ZO-AdaMU to resolve the above problems by adapting the simulated perturbation with momentum in its stochastic approximation. Unlike existing adaptive momentum methods, we relocate momentum on simulated perturbation in stochastic gradient approximation. Our convergence analysis and experiments prove this is a better way to improve convergence stability and rate in ZO-SGD. Extensive experiments demonstrate that ZO-AdaMU yields better generalization for LLMs fine-tuning across various NLP tasks than MeZO and its momentum variants.

Federated learning (FL) allows decentralized medical institutions to collaboratively learn a shared global model without breaching data privacy. However, in the context of medical image segmentation, data distributions across centers may vary a lot due to the diverse imaging protocols, vendors and partial annotation, which usually hampers the optimization convergence and the performance of FL. In this paper, we propose a novel approach called federated knowledge augmentation (FedKA) to address the non-IID (non-independent and identically distributed) problem in medical image segmentation within FL. FedKA first designs a pixel-wise knowledge augmentation method to preserve the knowledge of globally labeled regions for the local model during training, and augments each local feature statistical knowledge based on a mixture of Gaussian distribution. Our experiments on public datasets show the superiority of FedKA over the state-of-the-art methods in test performance.

Social networks contributed massive text data generated by users in it, which were crucial in information explosion. These unstructured and ambiguous expressed data may result in difficulty in obtaining available contextual information from it, which can help us gain more accurate insights into user-generated content, user preferences, and topic dynamics within social networks. By training on a large-scale unsupervised corpus and fine-tuning parameters using a limited amount of supervised data, the pretrained language model can effectively capture rich contextual information and achieve excellent performance in numerous downstream tasks of natural language processing (NLP). For the low-resource language such as Tibetan, the distributed representation results of dynamic changes obtained from pretrained language models can effectively alleviate the problem of insufficient labeled data. In order to achieve more effective contextual information and word-level semantic information in Tibetan social media, we collected a large amount of Tibetan language corpus and trained a Tibetan pretrained language model, named as Tibetan-BERT-wwm, by using the whole word masking strategy. Additionally, we apply the model to analyze textual data from social networks to assess its efficacy in capturing user sentiments and news topic in Tibetan social media. In this study, accuracy, precision, recall, and F1 score were used to evaluate its performance. The results showed that the macro-F1 of Tibetan-BERT-wwm in the public dataset TNCC document and title are 75.55% and 64.17%, the self-built sentiment analysis dataset is 70.98%. Compared with other pretrained language models, the Tibetan-BERT-wwm model can capture the semantic information of Tibetan well and improve the Tibetan classification effect.

Technical Q&A sites, such as Stack Overflow and Ask Ubuntu, have been widely utilized by software engineers to seek support for development challenges. However, not all the raised questions get instant feedback, and the retrieved answers can vary in quality. The users can hardly avoid spending much time before solving their problems. Prior studies propose approaches to automatically recommend answers for the question posts on technical Q&A sites. However, the lengthiness and the lack of background knowledge issues limit the performance of answer recommendation on these sites. The irrelevant sentences in the posts may introduce noise to the semantics learning and prevent neural models from capturing the gist of texts. The lexical gap between question and answer posts further misleads current models to make failure recommendations. From this end, we propose a novel neural network named TopicAns for answer selection on technical Q&A sites. TopicAns aims at learning high-quality representations for the posts in Q&A sites with a neural topic model and a pre-trained model. This involves three main steps: (1) generating topic-aware representations of Q&A posts with the neural topic model, (2) incorporating the corpus-level knowledge from the neural topic model to enhance the deep representations generated by the pre-trained language model, and (3) determining the most suitable answer for a given query based on the topic-aware representation and the deep representation. Moreover, we propose a two-stage training technique to improve the stability of our model. We conduct comprehensive experiments on four benchmark datasets to verify our proposed TopicAns’s effectiveness. Experiment results suggest that TopicAns consistently outperforms state-of-the-art techniques by over 30% in terms of Precision@1.

Transformer-based models have achieved great success on sentence pair modeling tasks, such as answer selection and natural language inference (NLI).These models generally perform cross-attention over input pairs, leading to prohibitive computational costs.Recent studies propose dual-encoder and late interaction architectures for faster computation.However, the balance between the expressive of crossattention and computation speedup still needs better coordinated.To this end, this paper introduces a novel paradigm MixEncoder for efficient sentence pair modeling.MixEncoder involves a lightweight cross-attention mechanism.It avoids the repeated encoding of the same query for different candidates, thus allowing modeling the query-candidate interaction in parallel.Extensive experiments conducted on four tasks demonstrate that our Mix-Encoder can speed up sentence pairing by over 113x while achieving comparable performance as the more expensive cross-attention models.The source code is available at https: //github.com/ysngki/MixEncoder.

Adapting deep learning (DL) techniques to automate nontrivial coding activities, such as code documentation and defect detection, has been intensively studied recently. Learning to predict code changes is one of the popular and essential investigations. Prior studies have shown that DL techniques, such as neural machine translation (NMT), can benefit meaningful code changes, including bug fixing and code refactoring. However, NMT models may encounter bottleneck when modeling long sequences; thus, they are limited in accurately predicting code changes. In this article, we design a Transformer-based approach, considering that the Transformer has proven effective in capturing long-term dependencies. Specifically, we propose a novel model named DTrans. For better incorporating the local structure of code, i.e., statement-level information in this article, DTrans is designed with dynamically relative position encoding in the multihead attention of the Transformer. Experiments on benchmark datasets demonstrate that DTrans can more accurately generate patches than the state-of-the-art methods, increasing the performance by at least 5.45–46.57% in terms of the exact match metric on different datasets. Moreover, DTrans can locate the lines to change with 1.75–24.21% higher accuracy than the existing methods.

Crime prediction plays a vital role in public security. Existing studies infer crime locations or crime groups without considering individual GPS trajectory data. They ignore joint influence on crime patterns coming from the internal relationship between criminals, locations, and time. In this study, we propose Fusion Information Graph Attention Networks (FIGAT), which classifies individuals into high and low risks with personal movement time series and location trajectories. To solve the independence of individual crime behavior and the fusion information loss problem, FIGAT proposes Multi-dimension Fusion Information Graph to combine semantic correlation features with conventional person basic features, time features, and location features. FIGAT constructs a multi-relation graph attention layer, which utilizes the semantic relationship and node information to accurately classify individuals into high and low risks. We evaluate FIGAT with 14,625,884 GPS trajectories from 1038 individuals collected by a real-world public safety department. The results demonstrate that FIGAT improves F1 score by 41%, 32%, and 23% compared with legacy machine learning, RNN-based deep learning, and graph neural network SOTA methods, respectively. T-SNE results and ablation experiments further prove the effectiveness of FIGAT.

As a complementary technology to traditional network security, trust computing scheme has been playing an increasingly important role in providing cloud service. However, many organizations constantly face trust computing challenges; moreover, establishing a highly trustworthy cloud ecosystem can be costly and time-consuming. In this article, we originally propose the conceptual model and formal definitions for a trustworthy collaboration service ecosystem, and construct a Bi-trustworthy cloud collaboration service (Bi-TCCS), which is a scheme based on an innovative bilateral social feedback (referred to as “bi-feedback”) scheme. First, a trust-aware collaboration service model is proposed based on cloud service brokerages (CSBs), which can provide intermediation and aggregation capabilities to enable organizations to deploy their services across a collaborative cloud environment. Then, we propose a bi-feedback scheme based on the inherent social relationship among three network communities, which are composed of three types of network entities: cloud users, CSBs, and cloud service providers. The proposed scheme is effective and reliable against garnished and bad-mouthing attacks resulting from the traditional social feedback scheme. Moreover, we innovatively adopt an aggregating method for overall trust based on deviation analysis. This method can minimize errors and overcome the limitations of traditional schemes, where trust attributes are weighted manually. Theoretical analysis and experiments verify the effectiveness ofBi-TCCS. Compared with existing approaches, the service successful ratio ofBi-TCCSincreased by 12 percent under highly dishonest cloud environment. These results also indicate thatBi-TCCSis more adaptable both in the random walk and cheating profiles, which represents a substantial improvement in tracking the dynamic behavior of cloud services.

Summary Cloud computing has become a new Internet application model, where network virtualization is recognized as an important technology for allowing multiple heterogeneous virtual networks (VNs) to coexist on a shared substrate network (SN). As demands in cloud computing increase, the scale of VN greatly increases as well, and providing an end‐to‐end SN to embed VNs in terms of scale is difficult. To utilize SN resources fully, we devise a topology‐aware Node‐Fusion algorithm, which is different from the traditional virtual network embedding (VNE) algorithms, for repeatable VNE over substrate nodes problem. We rank the resource of nodes through a novel solution by considering the CPU and bandwidth of adjacent link capacity and the number of adjacent links of each node as resources, and rank a node on the basis of resources. Furthermore, we embed several virtual nodes into the same substrate node together in accordance with Node‐Fusion interconnection value during the node mapping process, which can greatly improve the success ratio of the subsequent link mapping phase. Evaluation results confirm that Node‐Fusion outperforms traditional classical heuristics (Link‐opt, Node‐opt, and ORSTA), which are modified to fit into our model, with regard to acceptance ratio, long‐term revenue, long‐term cost, and revenue‐cost ratio.

Aiming to improve Internet content accessing capacity of the system, cloud proxy platforms are used to improve the visiting performance in network export environment. Limited by complexity of cloud proxy system, trustworthy guarantee of cloud system becomes a difficult problem. Considering the self-government of autonomic computing, it could enhance cloud system trustworthy and avoids system management security and reliable problems brought by complex construction. Based on the idea of self-supervisory, a mechanism to enhance security of cloud system was proposed in this paper. First, a trustworthy autonomous enhancement framework for virtual machines was proposed. Second, a method to extract linear relationship of monitoring items in the virtual machine based on ARX model was put forward. According to the mapping relation between monitoring items and system modules, an abnormal module positioning technology based on Naive Bayes classifier was developed to realize self-sensing of abnormal system conditions. Finally, security threats of virtual machines including malicious dialogue and buffer memory of hot attacks were tested through experiments. Results showed that the proposed trustworthy enhancement mechanism of virtual machines based on autonomic computing could achieve trustworthy enhancement of virtual machines effectively and provide an effective safety protection for the cloud system.

Content-Defined Chunking (CDC) has been playing a key role in data deduplication systems recently due to its high redundancy detection ability. However, existing CDC-based approaches introduce heavy CPU overhead because they declare the chunk cut-points by computing and judging the rolling hashes of the data stream byte by byte. In this article, we propose FastCDC, a Fast and efficient Content-Defined Chunking approach, for data deduplication-based storage systems. The key idea behind FastCDC is the combined use of five key techniques, namely, gear based fast rolling hash, simplifying and enhancing the Gear hash judgment, skipping sub-minimum chunk cut-points, normalizing the chunk-size distribution in a small specified region to address the problem of the decreased deduplication ratio stemming from the cut-point skipping, and last but not least, rolling two bytes each time to further speed up CDC. Our evaluation results show that, by using a combination of the five techniques, FastCDC is 3-12X faster than the state-of-the-art CDC approaches, while achieving nearly the same and even higher deduplication ratio as the classic Rabin-based CDC. In addition, our study on the deduplication throughput of FastCDC-based Destor (an open source deduplication project) indicates that FastCDC helps achieve 1.2-3.0X higher throughput than Destor based on state-of-the-art chunkers.

Because cloud storage services have been broadly used in enterprises for online sharing and collaboration, sensitive information in images or documents may be easily leaked outside the trust enterprise on-premises due to such cloud services. Existing solutions to this problem have not fully explored the tradeoffs among application performance, service scalability, and user data privacy. Therefore, we propose CloudDLP, a generic approach for enterprises to automatically sanitize sensitive data in images and documents in browser-based cloud storage. To the best of our knowledge, CloudDLP is the first system that automatically and transparently detects and sanitizes both sensitive images and textual documents without compromising user experience or application functionality on browser-based cloud storage. To prevent sensitive information escaping from on-premises, CloudDLP utilizes deep learning methods to detect sensitive information in both images and textual documents. We have evaluated the proposed method on a number of typical cloud applications. Our experimental results show that it can achieve transparent and automatic data sanitization on the cloud storage services with relatively low overheads, while preserving most application functionalities.

Previous work [13] suggests that tangled changes (i.e., different change intents aggregated in one single commit message) could complicate tracing to different change tasks when developers manage software changes. Identifying links from changed source code to untangled change intents could help developers solve this problem. Manually identifying such links requires lots of experience and review efforts, however. Unfortunately, there is no automatic method that provides this capability. In this paper, we propose AutoCILink, which automatically identifies code to untangled change intent links with a pattern-based link identification system (AutoCILink-P) and a supervised learning-based link classification system (AutoCILink-ML). Evaluation results demonstrate the effectiveness of both systems: the pattern-based AutoCILink-P and the supervised learning-based AutoCILink-ML achieve average accuracy of 74.6% and 81.2%, respectively.

Building a trustworthy cloud is critical for its practical use. Most current researches usually take integrity measurements using trusted computing to address trust issue, such as integrity measurement architecture (IMA) implemented in Linux kernel. However, some runtime attacks intrude the system while not tampering with the programs, which cannot be detected by integrity mechanism. We call them non-tampering attacks. This paper presents TraceVirt, a framework for detecting these non-tampering attacks, which combines the strong isolation and event-driven capacity to log runtime information. The logging data is processed by remote intrusion analysis cluster to analyze potential attacks. The experimental results show that TraceVirt can detect the real world non-tampering attacks and the performance overhead is acceptable.

Cloud computing is broadly recognized as one of major factors in achieving more flexible, scalable, and efficient systems. However, as customers lose the direct control of their data and applications hosted by cloud providers, the trustworthiness of cloud services is a main issue that hinders the deployment of cloud applications. In this paper, we have developed a novel framework to detect compromises on physical servers in cloud services, via remote attestation with a Trusted Third Party (TTP). Furthermore, to avoid the TTP becoming a bottleneck, we have designed a cloud based TTP platform, using a small private cloud to audit large clouds. We have implemented a prototype system, and evaluated it with several common benchmarks to demonstrate its efficiency. Our experimental results show that the proposed framework is effective in detecting compromise and adds little overhead to a common IaaS cloud environment.

Data De-duplication has become a commodity component in data-intensive storage systems. But compared with other traditional storage paradigms, de-duplication system achieves elimination of data duplications or redundancies at the cost of bringing several additional layers or function components into the I/O path, and these additional components are either CPU-intensive or I/O intensive, largely hindering the overall system performance. Direct against the above potential system bottlenecks, this paper quantitatively analyzes the overhead of each main component introduced by de-duplication, and then proposes two performance optimization methods. The one is parallel calculation of content aware chunk identifiers, which fully utilizes the parallelism both inter and intra chunks by using a certain task partition and chunk content distribution algorithm. Experiments demonstrate that it can improve up to 150% of the system throughput, and at the same time much better utilize the multiprocessor resources. The other one is storage pipelining, which overlaps the CPU-bound, I/O-bound and network communication tasks. Through a dedicated five-stage storage pipeline design for file archival operations, experimental results show that the system throughput can increase up to 25% according to our workloads.

Data de-duplication has become a commodity component in data-intensive systems and it is required that these systems provide high reliability comparable to others. Unfortunately, by storing duplicate data chunks just once, de-duped system improves storage utilization at cost of error resilience or reliability. In this paper, R-ADMAD, a high reliability provision mechanism is proposed. It packs variable-length data chunks into fixed sized objects, and exploits ECC codes to encode the objects and distributes them among the storage nodes in a redundancy group, which is dynamically generated according to current status and actual failure domains. Upon failures, R-ADMAD proposes a distributed and dynamic recovery process. Experimental results show that R-ADMAD can provide the same storage utilization as RAID-like schemes, but comparable reliability to replication based schemes with much more redundancy. The average recovery time of R-ADMAD based configurations is about 2-6 times less than RAID-like schemes. Moreover, R-ADMAD can provide dynamic load balancing even without the involvement of the overloaded storage nodes.

Networked storage incorporates networking technology and storage technology, greatly extending the reach of the storage subsystem. In this paper, we present a novel Quality of Service (QoS) scheduling scheme to satisfy the requirements of different QoS requests for access to the networked storage system. Our key ideas include breaking down the requests into appropriate chunks of smaller sizes and taking the network characteristics into consideration such that 1) each session channel has smoother data access, 2) resource requirements such as buffer usage are reduced, and 3) more urgent requests can preempt a less urgent request. Our experimental results show that our scheme is effective in obtaining these goals.

In this study six different mode switching techniques (i.e. timeout mode switching, non-preferred hand mode switching, barrel button mode switching, pressure mode switching, tilt mode switching and azimuth mode switching) based on multiple parameters pen input are proposed. The results indicate that the techniques utilizing tilt angle and azimuth offer faster performance than the others.