Glitch tokens—inputs that trigger unpredictable or anomalous behavior in Large Language Models (LLMs)—pose significant challenges to model reliability and safety. Existing detection methods primarily rely on heuristic embedding patterns or statistical anomalies within internal representations, limiting their generalizability across different model architectures and potentially missing anomalies that deviate from observed patterns. We introduce GlitchMiner, an behavior-driven framework designed to identify glitch tokens by maximizing predictive entropy. Leveraging a gradient-guided local search strategy, GlitchMiner efficiently explores the discrete token space without relying on model-specific heuristics or large-batch sampling. Extensive experiments across ten LLMs from five major model families demonstrate that GlitchMiner consistently outperforms existing approaches in detection accuracy and query efficiency, providing a generalizable and scalable solution for effective glitch token discovery.

Recent studies reveal that adversaries can manipulate the internal knowledge of large language models (LLMs) on selected topics through model editing, causing attacker-specified harmful or biased outputs when queried about the edited content. Once such tampered LLMs are distributed, they can mislead users on the targeted topics, thereby potentially propagating misinformation or reinforcing stereotypes. However, existing knowledge manipulation attacks rely on the ability to redistribute compromised models, which is infeasible in constrained settings like Federated Instruction Tuning (FedIT), where a central server controls LLM's training and distribution. In this work, we introduce ShadeEdit, the first attack framework that leverages strengthened model editing to enable knowledge manipulation in FedIT scenarios. ShadeEdit introduces two key components to address two challenges posed by the training process of FedIT: (1) a paraphrase-based editing dataset selection strategy to mitigate the dilution from benign updates on malicious ones by constructing a high-quality editing dataset, and (2) an adaptive manipulation mechanism to evade aggregation-based defenses via an adaptive clipping strategy. ShadeEdit achieves an average 99.5% attack success rate over eight robust aggregation algorithms while preserving instruction-following accuracy, demonstrating its strong attack effectiveness and model-utility preservation.

The big data era has accelerated the development of artificial intelligence (AI). The Model-as-a-Service (MaaS) paradigm has been used to address the substantial challenges associated with the organization and development of AI services. However, the successful delivery of complete AI applications is contingent upon the robust collaboration between microservice architectures and AI services. In this case, hybrid orchestration of AI services and microservices is highly necessary, but it still brings challenges. Furthermore, due to the heterogeneity of servers, resource competition, and multi-instance, the difficulty of hybrid orchestration modeling is enlarged. When considering intricate service dependencies among AI services and microservices, the tight coupling of deployment and routing leads to complex joint optimization problems, vastly aggravating the pressure of hybrid orchestration. Nonetheless, extant literature largely failed to address the intricate competitive and collaborative relationships between AI services and microservices, and fine-grained latency analysis with multi-instance modeling in hybrid orchestration problem. Therefore, we study joint deployment and routing for hybrid AI services and microservices in heterogeneous edge. Firstly, we conduct a precise analysis of latency and energy consumption, based on queuing networks and multi-instance models. Secondly, we propose a reinforcement learning method based on potential functions and segmented rewards (PS_SAC) to optimize end-to-end latency and system energy consumption, achieving efficient hybrid orchestration. Finally, through extensive simulation experiments, the algorithm demonstrates significant advantages in reducing latency, improving resource utilization, and lowering system energy consumption.

Vision-Language Models (VLMs) have become a cornerstone in multi-modal artificial intelligence, enabling seamless integration of visual and textual information for tasks such as image captioning, visual question answering, and cross-modal retrieval. Despite their impressive capabilities, these models often exhibit inherent vulnerabilities that can lead to safety failures in critical applications. Red-teaming is an important approach to identify and test system’s vulnerabilities, but how to conduct red-teaming for contemporary VLMs is an unexplored area. In this paper, we propose a novel multi-modal red-teaming approach, TRUST-VLM, to enhance both the attack success rate and the diversity of successful test cases for VLMs. Specifically, TRUST-VLM is built upon the in-context learning to adversarially test a VLM on both image and text inputs. Furthermore, we involve feedback from the target VLM to improve the efficiency of test case generation. Extensive experiments show that TRUST-VLM not only outperforms traditional red-teaming techniques in generating diverse and effective adversarial cases but also provides actionable insights for model improvement. These findings highlight the importance of advanced red-teaming strategies in ensuring the reliability of VLMs.

Large Vision-Language Models (VLMs) have achieved remarkable success in understanding complex real-world scenarios and supporting data-driven decision-making processes. However, VLMs exhibit significant vulnerability against adversarial examples, either text or image, which can lead to various adversarial outcomes, e.g., jailbreaking, hijacking, and hallucination, etc. In this work, we empirically and theoretically demonstrate that VLMs are particularly susceptible to image-based adversarial examples, where imperceptible perturbations can precisely manipulate each output token. To this end, we propose a novel attack called Vision-language model Manipulation Attack (VMA), which integrates first-order and second-order momentum optimization techniques with a differentiable transformation mechanism to effectively optimize the adversarial perturbation. Notably, VMA can be a double-edged sword: it can be leveraged to implement various attacks, such as jailbreaking, hijacking, privacy breaches, Denial-of-Service, and the generation of sponge examples, etc, while simultaneously enabling the injection of watermarks for copyright protection. Extensive empirical evaluations substantiate the efficacy and generalizability of VMA across diverse scenarios and datasets. Code is available at https://github.com/Trustworthy-AI-Group/VMA.

Modern Text-to-Image (T2I) models deploy multi-layered defenses to block Not-Safe-For-Work (NSFW) content generation. These defenses typically include sequential layers such as prompt filters, concept erasers and image filters. While existing adversarial attacks have demonstrated vulnerabilities in isolated defense layers, they prove largely ineffective against multi-layered defenses deployed in real-world T2I systems. In this paper, we demonstrate that exploiting overlapping vulnerabilities across these distinct defense layers enables adversaries to systematically bypass the entire safeguard of T2I systems. We propose Transstratal Adversarial Attack (TAA), a novel black-box framework to compromise T2I models with multi-layered protection. It generates transstratal adversarial prompts to evade all defense layers simultaneously. This is accomplished through transstratal adversarial candidate generation using LLMs to fulfill implicit and subjective adversarial requirements against different defense layers, combined with adversarial genetic optimization for efficient black-box search to maximize the bypass rates and generated image harmfulness. Evaluated across 14 T2I models (e.g., Stable Diffusion, DALL·E, and Midjourney) and 17 safety modules, our attack achieves an average attack success rate of 85.6\%, surpassing state-of-the-art methods by 73.5\%. Our findings challenge the isolated design of safety mechanisms and establish the first benchmark for holistic robustness evaluation in multi-layered safeguarded T2I models. The code can be found in https://github.com/Bluedask/TAA-T2I.

Transactions of prohibited and restricted goods on e-commerce platforms threaten consumer safety and hinder Internet economy growth. However, the lack of such datasets hinders intelligent identification and effective regulation. To address this issue, a large-scale multimodal dataset of prohibited and restricted goods is constructed, comprising 18,446 images and 36,892 texts. Nevertheless, this is insufficient due to the diverse forms and deep concealment of prohibited and restricted products in online transactions. Therefore, we propose a multimodal automatic generation and annotation framework for prohibited and restricted goods in online transactions. This framework consists of an image generation module, a text description module, and an image annotation module. The image generation module is utilized to generate more diverse images for prohibited and restricted goods. The text description module can generate text descriptions for the generated images. The image annotation module is employed to annotate the generated images for various visual tasks. This framework achieved a 24.71 user rating for image generation, a 92.72 % mean average precision for image annotation, and an 81.67 % semantic score for image description. Experimental results demonstrate the effectiveness and accuracy of the proposed automatic annotation framework, which can enhance the effective supervision of prohibited and restricted goods.

Erasure-coded storage systems can achieve highly reliable data storage with low storage overhead. However, updating data blocks necessitates updating parity blocks, and updating multiple data blocks incurs heavy I/O and computational overhead, leading to prolonged update times in heterogeneous storage environments. This paper proposes an erasure-coded multi-data block update method for heterogeneous storage environments, named MBUS, to expedite data updates. MBUS blends re-encoding and delta-based updates and considers factors such as intermediate blocks, computational overhead, and I/O overhead across different storage media. It iteratively computes the minimal I/O time for updating each parity block dynamically. Once the computation equation for each parity block is determined, MBUS prioritizes computing common XOR expressions and reuses the results to reduce the number of XOR operations. MBUS caches a certain number of scheduling plans to minimize redundant computations in subsequent updates, thereby reducing computation time. Experimental results replaying real-world traces demonstrate that MBUS reduces update time by 64.43% compared to state-of-the-art techniques.

Distributed storage systems typically use erasure codes for fault tolerance to reduce storage overhead. However, the data repair process in erasure-coded systems can generate heavy I/O overhead. Existing methods typically increase redundancy to improve repair speed, but this approach results in substantial storage overhead. To enhance repair speed while reducing storage costs, this paper proposes a Machine Learning-based Adaptive Recovery (MLAR) method. Given an application’s access patterns for a file, MLAR uses an adaptive encoding model to calculate the optimal code for each file. When applying fault tolerance with the optimal code, lower-redundancy codes can achieve faster repair speeds than higher-redundancy codes. MLAR employs machine learning to predict file access patterns. Experimental results replaying real-world I/O workloads show that, MLAR reduces storage overhead by 12.8% and recovery time by 23.7%, compared to state-of-the-art methods.

Text-to-image (T2I) diffusion models enjoy great popularity and many individuals and companies build their applications based on publicly released T2I diffusion models. Previous studies have demonstrated that backdoor attacks can elicit T2I diffusion models to generate unsafe target images through textual triggers. However, existing backdoor attacks typically demand substantial tuning data for poisoning, limiting their practicality and potentially degrading the overall performance of T2I diffusion models. To address these issues, we propose EvilEdit, a training-free and data-free backdoor attack against T2I diffusion models. EvilEdit directly edits the projection matrices in the cross-attention layers to achieve projection alignment between a trigger and the corresponding backdoor target. We preserve the functionality of the backdoored model using a protected whitelist to ensure the semantic of non-trigger words is not accidentally altered by the backdoor. We also propose a visual target attack EvilEdit VTA, enabling adversaries to use specific images as backdoor targets. We conduct empirical experiments on Stable Diffusion and the results demonstrate that the EvilEdit can backdoor T2I diffusion models within one second with up to 100% success rate. Furthermore, our EvilEdit modifies only 2.2% of the parameters and maintains the model's performance on benign prompts. Our code is available at https://github.com/haowang-cqu/EvilEdit.

Large-scale pre-trained generative models are taking the world by storm, due to their abilities in generating creative content. Meanwhile, safeguards for these generative models are developed, to protect users' rights and safety, most of which are designed for large language models. Existing methods primarily focus on jailbreak and adversarial attacks, which mainly evaluate the model's safety under malicious prompts. Recent work found that manually crafted safe prompts can unintentionally trigger unsafe generations. To further systematically evaluate the safety risks of text-to-image models, we propose a novel Automatic Red-Teaming framework, ART. Our method leverages both vision language model and large language model to establish a connection between unsafe generations and their prompts, thereby more efficiently identifying the model's vulnerabilities. With our comprehensive experiments, we reveal the toxicity of the popular open-source text-to-image models. The experiments also validate the effectiveness, adaptability, and great diversity of ART. Additionally, we introduce three large-scale red-teaming datasets for studying the safety risks associated with text-to-image models. Datasets and models can be found in https://github.com/GuanlinLee/ART.

Speech emotion recognition plays a crucial role in analyzing psychological disorders, behavioral decision‐making, and human‐machine interaction applications. However, the majority of current methods for speech emotion recognition heavily rely on data‐driven approaches, and the scarcity of emotion speech datasets limits the progress in research and development of emotion analysis and recognition. To address this issue, this study introduces a new English speech dataset specifically designed for emotion analysis and recognition. This dataset consists of 5503 voices from over 60 English speakers in different emotional states. Furthermore, to enhance emotion analysis and recognition, fast Fourier transform (FFT), short‐time Fourier transform (STFT), mel‐frequency cepstral coefficients (MFCCs), and continuous wavelet transform (CWT) are employed for feature extraction from the speech data. Utilizing these algorithms, the spectrum images of the speeches are obtained, forming four datasets consisting of different speech feature images. Furthermore, to evaluate the dataset, 16 classification models and 19 detection algorithms are selected. The experimental results demonstrate that the majority of classification and detection models achieve exceptionally high recognition accuracy on this dataset, confirming its effectiveness and utility. The dataset proves to be valuable in advancing research and development in the field of emotion recognition.

Illegal construction poses a safety hazard to both cities and people and affects the social stability and long-term stability of the country. Therefore, it is important to detect illegal buildings as early as possible. However, current illegal building detection methods generally suffer from either detection cycles or low detection accuracies. To solve these challenges, this study adopts an unusual method that detects illegal building objects to prevent illegal building behavior. A detection model, CRMNet, which is based on the anchor-free detection model CenterNet, and dataset for illegal building objects are proposed. ResNet50 is selected as the backbone for extracting futures after weighing the computational cost and detection accuracy. Furthermore, Mish, a new activation function, is used to improve the identification accuracy of illegal building objects. Experimental results show that the mean average precision (mAP) of the proposed detector on the illegal building object dataset reached 88.16%, which is higher than that of other popular object detection methods. Additionally, in contrast to mainstream target detection methods, the proposed detection method has fewer parameters and a higher detection accuracy, which can be better applied to mobile devices and smart devices.

Convolutional neural networks (CNNs) are vulnerable to being deceived by adversarial examples generated by adding small, human-imperceptible perturbations to a clean image. In this paper, we propose an image reconstruction network that reconstructs an input adversarial example into a clean output image to defend against such adversarial attacks. Due to the powerful learning capabilities of the residual block structure, our model can learn a precise mapping from adversarial examples to reconstructed examples. The use of a perceptual loss greatly suppresses the error amplification effect and improves the performance of our reconstruction network. In addition, by adding randomization layers to the end of the network, the effects of additional noise are further suppressed, especially for iterative attacks. Our model has the following four advantages. 1) It greatly reduces the impact of adversarial perturbations while having little influence on the prediction performance of clean images. 2) During inference phase, it performs better than most existing model-agnostic defense methods. 3) It has better generalization capability. 4) It can be flexibly combined with other methods, such as adversarially trained models.

Currently, Deep Learning and Convolutional Neural Network (CNN) have been widely used in many fields and have generated very high value in these fields, especially in the field of image recognition. But there are some deficiencies in certain issues of image recognition. For example, CNN’s recognizing performance is not good at different angles of objects and overlapping objects. Also, CNN is sometimes very sensitive to slight perturbations, modifying one pixel of a recognized image may cause recognition errors. For these problems, the capsule network (CapsNet) proposed by Geoffrey Hinton can solve the problems of traditional convolutional networks. Shortly after CapsNet was proposed, the model structure was relatively simple, and many aspects could be explored for improvement. This paper will optimize CapsNet from two aspects: “optimization of routing mechanism” and “increase Dropout operation.” And carry out experiments and results analysis on these optimizations.

Labeling test cases is expensive. Given a limited number of test cases to be labeled, more evenly spreading test cases over the input domain has a better chance to hit the nonpoint failure patterns. In this paper, we propose a spreading points (test cases) algorithm based on local layout of points (the locally spreading approach is referred to as LS). The LS repositions the initial test set and evolves it to improve the minimum distance among points. During the locally spreading process, for every point, a feasible direction of movement is solved according to its nearest neighbors, and along this direction the point can increase the shortest pairwise distance between it and other points. We investigate the effective of the LS approach, considering it as an add-on to the Adaptive Random Testing (ART) technique. The simulation results show that the LS can improve effectiveness (P-measure) of the ART.

The ability to reason about and respond to their own emotional states can enhance the believability of Non-Player Characters (NPCs). In this paper, we use a Partially Observable Markov Decision Process (POMDP)-based framework to model emotion over time. A two-level appraisal model, involving quick and reactive vs. slow and deliberate appraisals, is proposed for the creation of affective autonomous characters based on POMDPs, wherein the probability of goal satisfaction is used in an appraisal and reappraisal process for emotion generation. We not only extend Probabilistic Computation Tree Logic (PCTL) for reasoning about the properties of emotional states based on POMDPs but also illustrate how four reactive (primary) emotions and nine deliberate (secondary) emotions can be derived by combining PCTL with the belief-desire theory of emotion. The results of an empirical study suggest that the proposed model can be used to create characters that appear to be more believable and more intelligent.

BACKGROUND: The majority of experimentally verified molecular interaction and biological pathway data are present in the unstructured text of biomedical journal articles where they are inaccessible to computational methods. The Biomolecular interaction network database (BIND) seeks to capture these data in a machine-readable format. We hypothesized that the formidable task-size of backfilling the database could be reduced by using Support Vector Machine technology to first locate interaction information in the literature. We present an information extraction system that was designed to locate protein-protein interaction data in the literature and present these data to curators and the public for review and entry into BIND. RESULTS: Cross-validation estimated the support vector machine's test-set precision, accuracy and recall for classifying abstracts describing interaction information was 92%, 90% and 92% respectively. We estimated that the system would be able to recall up to 60% of all non-high throughput interactions present in another yeast-protein interaction database. Finally, this system was applied to a real-world curation problem and its use was found to reduce the task duration by 70% thus saving 176 days. CONCLUSIONS: Machine learning methods are useful as tools to direct interaction and pathway database back-filling; however, this potential can only be realized if these techniques are coupled with human review and entry into a factual database such as BIND. The PreBIND system described here is available to the public at http://bind.ca. Current capabilities allow searching for human, mouse and yeast protein-interaction information.