Baolin Zheng, Guanlin Chen, Qingyang Teng, Hongqiong Zhong, Yingshui Tan, Zhendong Liu, Weixun Wang, Jiaheng Liu, Jian Yang, Huiyun Jing, Jincheng Wei, Wenbo Su, Xiaoyong Zhu, Bo Zheng, Kaifu Zhang. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Yingshui Tan, Boren Zheng, Baihui Zheng, Kerui Cao, Huiyun Jing, Jincheng Wei, Jiaheng Liu, Yancheng He, Wenbo Su, Xiaoyong Zhu, Bo Zheng, Kaifu Zhang. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025.

Large Language Models (LLMs) have showcased remarkable potential across various domains, especially in text generation. However, their vulnerability to jailbreak attacks presents considerable challenges to secure deployment, as attackers can use carefully crafted prompts to bypass safety measures and generate harmful content. Current jailbreak methods generally suffer from two significant limitations: a restricted strategy space for generating adversarial prompts and insufficient optimization of prompts based on feedback from LLMs. To overcome these challenges, we present Multistep Adaptive Attack Agent (MATA), an approach that employs a game-theoretic interaction between attack model and target model to adaptively execute jailbreak attacks on LLMs. This method enables iterative attempts based on reflection, gradually identifying the optimal jailbreak attack strategy within a complex strategy space. We compared MATA with mainstream methods across multiple open-source and closed-source LLMs, including Llama3.1, GLM4, and GPT4o. The results demonstrate that our approach exceeds existing methods in terms of attack success rate, average number of queries, and prompt diversity, effectively identifying vulnerabilities in LLMs.

Deep Neural Network (DNN) models are usually trained with tremendous data and computation resources. Thus, DNN models are now regarded as important assets, however facing a great risk of being stolen and illegal distribution. In recent years, watermark is introduced to protect the ownership of DNN models. The watermark can be extracted in a relatively simple way to declare the ownership of the model. However, watermark is vulnerable to be attacked. In this work, we propose a watermark defense method for DNN model based on pruning. Inspired by the pruning methods, we design a fused channel-wise pruning strategy which selects important filters for watermarks embedding. Specifically, we introduce a novel method to enhance the watermark robustness by selecting important filters as the watermark carrier based on multiple pruning methods, including network slimming, efficient filter and entropy. We conduct experiments on the VGG-19 model with the CIFAR-10 dataset. The experimental results show that this method is robust against fine-tuning attack, pruning attack and overwriting attack. In addition, our method does not significantly change the distribution of model weights so that the watermark is hard to be detected.