Search arXiv⌕ Search

arXiv subjects

Hang Fu

Publications and source records attributed to Hang Fu.

At least 19 recordsLinked to original sources
arXiv2026

Spore: Efficient and Training-Free Privacy Extraction Attack on LLMs via Inference-Time Hybrid Probing

With the wide adoption of personal AI assistants such as OpenClaw, privacy leakage in user interaction contexts with large language model (LLM) agents has become a critical issue. Existing privacy attacks against LLMs primarily target training data, while research on inference-time contextual privacy risks in LLM agent memory remains limited. Moreover, prior methods often incur high attack costs, requiring multiple queries or relying on white-box assumptions, which limits their practicality in real-world deployments. To address these issues, we propose a training-free privacy extraction attack targeting LLM agent memory, which we name \textsc{Spore}. \textsc{Spore} is compatible with both black-box and gray-box settings. In the black-box setting, \textsc{Spore} can efficiently extract a small candidate set via a single query to recover the original private information. In the gray-box setting, \textsc{Spore} allows the attacker to leverage multi-ranked tokens for more accurate and faster privacy extraction. We provide an information-theoretic analysis of \textsc{Spore} and show that it achieves high query efficiency with substantial per query information leakage. Experiments on multiple frontier LLMs show that \textsc{Spore} outperforms attack success rate over existing state-of-the-art (SOTA) schemes. It also maintains low attack cost and remains stable across different model parameter settings. We further evaluate the robustness of \textsc{Spore} against existing defense mechanisms. Our results show that \textsc{Spore} consistently bypasses both detection and strong safety alignment, demonstrating resilient performance in diverse defensive settings and real-world safety threats.

cs.CR↗
arXiv2026

Inhibitory Attacks on Backdoor-based Fingerprinting for Large Language Models

The widespread adoption of Large Language Model (LLM) in commercial and research settings has intensified the need for robust intellectual property protection. Backdoor-based LLM fingerprinting has emerged as a promising solution for this challenge. In practical application, the low-cost multi-model collaborative technique, LLM ensemble, combines diverse LLMs to leverage their complementary strengths, garnering significant attention and practical adoption. Unfortunately, the vulnerability of existing LLM fingerprinting for the ensemble scenario is unexplored. In order to comprehensively assess the robustness of LLM fingerprinting, in this paper, we propose two novel fingerprinting attack methods: token filter attack (TFA) and sentence verification attack (SVA). The TFA gets the next token from a unified set of tokens created by the token filter mechanism at each decoding step. The SVA filters out fingerprint responses through a sentence verification mechanism based on perplexity and voting. Experimentally, the proposed methods effectively inhibit the fingerprint response while maintaining ensemble performance. Compared with state-of-the-art attack methods, the proposed method can achieve better performance. The findings necessitate enhanced robustness in LLM fingerprinting.

cs.CR↗
arXiv2025

Towards Provably Secure Generative AI: Reliable Consensus Sampling

Existing research on generative AI security is primarily driven by mutually reinforcing attack and defense methodologies grounded in empirical experience. This dynamic frequently gives rise to previously unknown attacks that can circumvent current detection and prevention. This necessitates the continual updating of security mechanisms. Constructing generative AI with provable security and theoretically controllable risk is therefore necessary. Consensus Sampling (CS) is a promising algorithm toward provably secure AI. It controls risk by leveraging overlap in model output probabilities. However, we find that CS relies on frequent abstention to avoid unsafe outputs, which reduces utility. Moreover, CS becomes highly vulnerable when unsafe models are maliciously manipulated. To address these issues, we propose a new primitive called Reliable Consensus Sampling (RCS), that traces acceptance probability to tolerate extreme adversarial behaviors, improving robustness. RCS also eliminates the need for abstention entirely. We further develop a feedback algorithm to continuously and dynamically enhance the safety of RCS. We provide theoretical guarantees that RCS maintains a controllable risk threshold. Extensive experiments show that RCS significantly improves robustness and utility while maintaining latency comparable to CS. We hope this work contributes to the development of provably secure generative AI.

cs.CR↗
arXiv2025

Can LLMs Threaten Human Survival? Benchmarking Potential Existential Threats from LLMs via Prefix Completion

Research on the safety evaluation of large language models (LLMs) has become extensive, driven by jailbreak studies that elicit unsafe responses. Such response involves information already available to humans, such as the answer to "how to make a bomb". When LLMs are jailbroken, the practical threat they pose to humans is negligible. However, it remains unclear whether LLMs commonly produce unpredictable outputs that could pose substantive threats to human safety. To address this gap, we study whether LLM-generated content contains potential existential threats, defined as outputs that imply or promote direct harm to human survival. We propose \textsc{ExistBench}, a benchmark designed to evaluate such risks. Each sample in \textsc{ExistBench} is derived from scenarios where humans are positioned as adversaries to AI assistants. Unlike existing evaluations, we use prefix completion to bypass model safeguards. This leads the LLMs to generate suffixes that express hostility toward humans or actions with severe threat, such as the execution of a nuclear strike. Our experiments on 10 LLMs reveal that LLM-generated content indicates existential threats. To investigate the underlying causes, we also analyze the attention logits from LLMs. To highlight real-world safety risks, we further develop a framework to assess model behavior in tool-calling. We find that LLMs actively select and invoke external tools with existential threats. Code and data are available at: https://github.com/cuiyu-ai/ExistBench.

cs.CR↗
arXiv2025

Free-MAD: Consensus-Free Multi-Agent Debate

Multi-agent debate (MAD) is an emerging approach to improving the reasoning capabilities of large language models (LLMs). Existing MAD methods rely on multiple rounds of interaction among agents to reach consensus, and the final output is selected by majority voting in the last round. However, this consensus-based design faces several limitations. First, multiple rounds of communication increases token overhead and limits scalability. Second, due to the inherent conformity of LLMs, agents that initially produce correct responses may be influenced by incorrect ones during the debate process, causing error propagation. Third, majority voting introduces randomness and unfairness in the decision-making phase, and can degrade the reasoning performance. To address these issues, we propose \textsc{Free-MAD}, a novel MAD framework that eliminates the need for consensus among agents. \textsc{Free-MAD} introduces a novel score-based decision mechanism that evaluates the entire debate trajectory rather than relying on the last round only. This mechanism tracks how each agent's reasoning evolves, enabling more accurate and fair outcomes. In addition, \textsc{Free-MAD} reconstructs the debate phase by introducing anti-conformity, a mechanism that enables agents to mitigate excessive influence from the majority. Experiments on eight benchmark datasets demonstrate that \textsc{Free-MAD} significantly improves reasoning performance while requiring only a single-round debate and thus reducing token costs. We also show that compared to existing MAD approaches, \textsc{Free-MAD} exhibits improved robustness in real-world attack scenarios.

cs.AI↗
arXiv2025

Retrieval-Confused Generation is a Good Defender for Privacy Violation Attack of Large Language Models

Recent advances in large language models (LLMs) have made a profound impact on our society and also raised new security concerns. Particularly, due to the remarkable inference ability of LLMs, the privacy violation attack (PVA), revealed by Staab et al., introduces serious personal privacy issues. Existing defense methods mainly leverage LLMs to anonymize the input query, which requires costly inference time and cannot gain satisfactory defense performance. Moreover, directly rejecting the PVA query seems like an effective defense method, while the defense method is exposed, promoting the evolution of PVA. In this paper, we propose a novel defense paradigm based on retrieval-confused generation (RCG) of LLMs, which can efficiently and covertly defend the PVA. We first design a paraphrasing prompt to induce the LLM to rewrite the "user comments" of the attack query to construct a disturbed database. Then, we propose the most irrelevant retrieval strategy to retrieve the desired user data from the disturbed database. Finally, the "data comments" are replaced with the retrieved user data to form a defended query, leading to responding to the adversary with some wrong personal attributes, i.e., the attack fails. Extensive experiments are conducted on two datasets and eight popular LLMs to comprehensively evaluate the feasibility and the superiority of the proposed defense method.

cs.CR↗
arXiv2025

ImF: Implicit Fingerprint for Large Language Models

Training large language models (LLMs) is resource-intensive and expensive, making protecting intellectual property (IP) for LLMs crucial. Recently, embedding fingerprints into LLMs has emerged as a prevalent method for establishing model ownership. However, existing fingerprinting techniques typically embed identifiable patterns with weak semantic coherence, resulting in fingerprints that significantly differ from the natural question-answering (QA) behavior inherent to LLMs. This discrepancy undermines the stealthiness of the embedded fingerprints and makes them vulnerable to adversarial attacks. In this paper, we first demonstrate the critical vulnerability of existing fingerprint embedding methods by introducing a novel adversarial attack named Generation Revision Intervention (GRI) attack. GRI attack exploits the semantic fragility of current fingerprinting methods, effectively erasing fingerprints by disrupting their weakly correlated semantic structures. Our empirical evaluation highlights that traditional fingerprinting approaches are significantly compromised by the GRI attack, revealing severe limitations in their robustness under realistic adversarial conditions. To advance the state-of-the-art in model fingerprinting, we propose a novel model fingerprint paradigm called Implicit Fingerprints (ImF). ImF leverages steganography techniques to subtly embed ownership information within natural texts, subsequently using Chain-of-Thought (CoT) prompting to construct semantically coherent and contextually natural QA pairs. This design ensures that fingerprints seamlessly integrate with the standard model behavior, remaining indistinguishable from regular outputs and substantially reducing the risk of accidental triggering and targeted removal. We conduct a comprehensive evaluation of ImF on 15 diverse LLMs, spanning different architectures and varying scales.

cs.CL↗
arXiv2025

Ramp Up NTT in Record Time using GPU-Accelerated Algorithms and LLM-based Code Generation

Homomorphic encryption (HE) is a core building block in privacy-preserving machine learning (PPML), but HE is also widely known as its efficiency bottleneck. Therefore, many GPU-accelerated cryptographic schemes have been proposed to improve the performance of HE. However, these methods often require complex modifications tailored to specific algorithms and are tightly coupled with specific GPU and operating systems. It is interesting to ask how to generally offer more practical GPU-accelerated cryptographic algorithm implementations. Given the powerful code generation capabilities of large language models (LLMs), we aim to explore their potential to automatically generate practical GPU-friendly algorithm code using CPU-friendly code. In this paper, we focus on number theoretic transform (NTT) -- the core mechanism of HE. We first develop and optimize a GPU-friendly NTT (GNTT) family that exploits PyTorch's fast matrix computation and precomputation, achieving an approximately 62x speedup -- a significant boost over existing ones. Then we explore GPU-friendly code generation using various LLMs, including DeepSeek-R1, OpenAI o1 and o3-mini. We discover many interesting findings throughout the process. For instance, somewhat surprisingly, our experiments demonstrate that DeepSeek-R1 significantly outperforms OpenAI o3-mini and o1, but still cannot beat our optimized protocol. The findings provide valuable insights for turbocharging PPML and enhancing code generation capabilities of LLMs. Codes are available at: https://github.com/LMPC-Lab/GenGPUCrypto.

cs.CR↗
arXiv2024

HDMba: Hyperspectral Remote Sensing Imagery Dehazing with State Space Model

Haze contamination in hyperspectral remote sensing images (HSI) can lead to spatial visibility degradation and spectral distortion. Haze in HSI exhibits spatial irregularity and inhomogeneous spectral distribution, with few dehazing networks available. Current CNN and Transformer-based dehazing methods fail to balance global scene recovery, local detail retention, and computational efficiency. Inspired by the ability of Mamba to model long-range dependencies with linear complexity, we explore its potential for HSI dehazing and propose the first HSI Dehazing Mamba (HDMba) network. Specifically, we design a novel window selective scan module (WSSM) that captures local dependencies within windows and global correlations between windows by partitioning them. This approach improves the ability of conventional Mamba in local feature extraction. By modeling the local and global spectral-spatial information flow, we achieve a comprehensive analysis of hazy regions. The DehazeMamba layer (DML), constructed by WSSM, and residual DehazeMamba (RDM) blocks, composed of DMLs, are the core components of the HDMba framework. These components effectively characterize the complex distribution of haze in HSIs, aiding in scene reconstruction and dehazing. Experimental results on the Gaofen-5 HSI dataset demonstrate that HDMba outperforms other state-of-the-art methods in dehazing performance. The code will be available at https://github.com/RsAI-lab/HDMba.

cs.CV↗
arXiv2023

B\"ottcher coordinates at wild superattracting fixed points

Let $p$ be a prime number, let $g(x)=x^{p^{2}}+p^{r+2}x^{p^{2}+1}$ with $r\in\mathbb{Z}_{\geq0}$, and let $\phi(x)=x+O(x^{2})$ be the B\"ottcher coordinate satisfying $\phi(g(x))=\phi(x)^{p^{2}}$. Salerno and Silverman conjectured that the radius of convergence of $\phi^{-1}(x)$ in $\mathbb{C}_{p}$ is $p^{-p^{-r}/(p-1)}$. In this article, we confirm that this conjecture is true by showing that it is a special case of our more general result.

math.DS↗
arXiv2022

Dynamics of quadratic polynomials and rational points on a curve of genus $4$

Let $f_t(z)=z^2+t$. For any $z\in\mathbb{Q}$, let $S_z$ be the collection of $t\in\mathbb{Q}$ such that $z$ is preperiodic for $f_t$. In this article, assuming a well-known conjecture of Flynn, Poonen, and Schaefer, we prove a uniform result regarding the size of $S_z$ over $z\in\mathbb{Q}$. In order to prove it, we need to determine the set of rational points on a specific non-hyperelliptic curve $C$ of genus $4$ defined over $\mathbb{Q}$. We use Chabauty's method, which requires us to determine the Mordell-Weil rank of the Jacobian $J$ of $C$. We give two proofs that the rank is $1$: an analytic proof, which is conditional on the BSD rank conjecture for $J$ and some standard conjectures on L-series, and an algebraic proof, which is unconditional, but relies on the computation of the class groups of two number fields of degree $12$ and degree $24$, respectively. We finally combine the information obtained from both proofs to provide a numerical verification of the strong BSD conjecture for $J$.

math.NT↗
arXiv2020

Uniform unlikely intersections for unicritical polynomials

Fix $d\geq2$, and consider the family $f_{t}(z)=z^{d}+t$ of polynomials parameterized by $t\in\mathbb{C}$. In this article, we will show that there exists a constant $C(d)$ such that for any $a,b\in\mathbb{C}$ with $a^{d}\neq b^{d}$, the number of $t\in\mathbb{C}$ such that $a$ and $b$ are both preperiodic for $f_{t}$ is at most $C(d)$.

math.NT↗
arXiv2019

Elliptic curves with common torsion $x$-coordinates and hyperelliptic torsion packets

We establish a connection between torsion packets on curves of genus $2$ and pairs of elliptic curves realized as double covers of the projective line $\mathbb{P}_{x}^{1}$ that have many common torsion $x$-coordinates. This can be used to show that the set of common torsion $x$-coordinates has size at least $22$ infinitely often and has $34$ elements in some cases. We also explain how we obtained the current record example of a hyperelliptic torsion packet on a genus $2$ curve.

math.AG↗
arXiv2019

Projective Equivalence for the Roots of Unity

Let $\mu_{\infty}\subseteq\mathbb{C}$ be the collection of roots of unity and $\mathcal{C}_{n}:=\{(s_{1},\cdots,s_{n})\in\mu_{\infty}^{n}:s_{i}\neq s_{j}\text{ for any }1\leq i<j\leq n\}$. Two elements $(s_{1},\cdots,s_{n})$ and $(t_{1},\cdots,t_{n})$ of $\mathcal{C}_{n}$ are said to be projectively equivalent if there exists $\gamma\in\text{PGL}(2,\mathbb{C})$ such that $\gamma(s_{i})=t_{i}$ for any $1\leq i\leq n$. In this article, we will give a complete classification for the projectively equivalent pairs. As a consequence, we will show that the maximal length for the nontrivial projectively equivalent pairs is $14$.

math.NT↗
arXiv2019

On the $\text{PGL}_{2}$-invariant quadruples of torsion points of elliptic curves

Let $E$ be an elliptic curve and $\pi:E\to\mathbb{P}^{1}$ a standard double cover identifying $\pm P\in E$. It is known that for some torsion points $P_{i}\in E$, $1\leq i\leq4$, the cross ratio of $\{\pi(P_{i})\}_{i=1}^{4}$ is independent of $E$. In this article, we will give a complete classification of such quadruples.

math.AG↗
arXiv2018

Noether's problem for some subgroups of $S_{14}$: the modular case

Let $G$ be a subgroup of $S_{n}$, the symmetric group of degree $n$. For any field $k$, $G$ acts naturally on the rational function field $k(x_{1},\cdots,x_{n})$ via $k$-automorphisms defined by $\sigma\cdot x_{i}:=x_{\sigma\cdot i}$ for any $\sigma\in G$ and $1\leq i\leq n$. In this article, we will show that if $G$ is a solvable transitive subgroup of $S_{14}$ and $\text{char}(k)=7$, then the fixed subfield $k(x_{1},\cdots,x_{14})^{G}$ is rational (i.e., purely transcendental) over $k$. In proving the above theorem, we rely on the Kuniyoshi-Gasch\"utz Theorem or some ideas in its proof.

math.AG↗