arXiv subjects

Gejian Zhao

Publications and source records attributed to Gejian Zhao.

8 recordsLinked to original sources

arXiv2026

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

Verifying the provenance of autonomous LLM agents is a critical security challenge. Existing semantic attribution is easily obfuscated by system prompts, while active watermarking conflicts with schema-constrained tool generation. We propose AgentTrace, an active framework that identifies the foundation model behind a black-box agent via observable execution traces. AgentTrace injects structurally ambiguous probes to trigger tokenization-sensitive serialization failures at rigid tool interfaces. While these initial failures provide coarse-grained separation across model families, the temporal sequence of subsequent repair operations reveals fine-grained, model-specific recovery behaviors. By modeling these multi-step trajectories with lightweight Markov chains, AgentTrace achieves 96.0% attribution accuracy under adversarial identity spoofing. Crucially, sequential repair modeling successfully distinguishes the evaluated intra-family variants sharing identical tokenizers (e.g., Llama-3 8B/70B), substantially outperforming unordered behavioral statistics while remaining robust against prompt obfuscation and temperature scaling.

cs.CR↗

arXiv2026

HiMark: Hierarchical and Controllable Multi-bit Watermarking for Large Language Models

With the rapid adoption of large language models (LLMs) in text generation applications, it has become increasingly difficult to trace generated content and assign responsibility for its use, raising concerns about provenance, copyright protection, and accountability. Multi-bit watermarking addresses these issues by embedding multi-bit provenance information into generated text, but reliable extraction remains difficult due to sparse per-bit evidence and the trade-off between watermark-extraction accuracy and text quality. To deal with these challenges, we propose HiMark, a hierarchical and controllable multi-bit watermarking framework for LLM-generated text. During watermark embedding, HiMark uses a hierarchical candidate-control mechanism, including initial candidate sampling, layer-wise tournament elimination, support-based refinement, and support-threshold filtering. During watermark detection, a model-agnostic evidence aggregation mechanism computes multi-layer support evidence for each observed token, and then accumulates these token-level votes into the corresponding information for robust watermark extraction. Experiments show that HiMark improves watermark extraction accuracy while maintaining text quality, e.g., the watermark extraction accuracy is 90.01% under the paraphrasing attack when 32 bits were embedded within a text containing 300 tokens, demonstrating its effectiveness for provenance tracking.

cs.CR↗

arXiv2026

Model-intrinsic, Weight-level, and Training-free Spectral Fingerprinting for Large Language Models

The increasing release and reuse of Large Language Models (LLMs) as open-weight checkpoints make model fingerprinting important for ownership protection and offline auditing. Existing fingerprinting methods typically construct evidence from query responses, generated outputs, or input-induced activations. Although effective in representation-based settings, they can be affected by prompt selection, decoding configuration, inference environment, and forward-pass implementation, which may limit their applicability. Here we introduce a model-intrinsic weight-level framework that derives compact fingerprints from spectral structures encoded in LLM parameters. Specifically, the framework constructs GATE spectral scalar features from the singular-value distributions of GATE projection weights in gated feed-forward networks (FFNs), and aggregates the resulting layer-wise features through depth-wise segmented pooling to form a model-level fingerprint. Such representation preserves coarse layer-depth organization while reducing dependence on strict layer-to-layer alignment, enabling comparison across LLMs with different depths. The similarity between fingerprints is computed by linear centered kernel alignment. The entire pipeline is training-free and does not require input samples, generated outputs, forward activations, or an auxiliary verifier. Experiments on representative LLM families and post-training variants have demonstrated a clear separation between source-related models and unrelated ones, and stable similarity under instruction tuning, quantization, pruning, and distillation-related modifications, which verify that spectral features are robust evidence for LLM fingerprinting.

cs.CR↗

arXiv2025

An Information Asymmetry Game for Trigger-based DNN Model Watermarking

As a valuable digital product, deep neural networks (DNNs) face increasingly severe threats to the intellectual property, making it necessary to develop effective technical measures to protect them. Trigger-based watermarking methods achieve copyright protection by embedding triggers into the host DNNs. However, the attacker may remove the watermark by pruning or fine-tuning. We model this interaction as a game under conditions of information asymmetry, namely, the defender embeds a secret watermark with private knowledge, while the attacker can only access the watermarked model and seek removal. We define strategies, costs, and utilities for both players, derive the attacker's optimal pruning budget, and establish an exponential lower bound on the accuracy of watermark detection after attack. Experimental results demonstrate the feasibility of the watermarked model, and indicate that sparse watermarking can resist removal with negligible accuracy loss. This study highlights the effectiveness of game-theoretic analysis in guiding the design of robust watermarking schemes for model copyright protection.

cs.CR↗

arXiv2025

Trigger Where It Hurts: Unveiling Hidden Backdoors through Sensitivity with Sensitron

Backdoor attacks pose a significant security threat to natural language processing (NLP) systems, but existing methods lack explainable trigger mechanisms and fail to quantitatively model vulnerability patterns. This work pioneers the quantitative connection between explainable artificial intelligence (XAI) and backdoor attacks, introducing Sensitron, a novel modular framework for crafting stealthy and robust backdoor triggers. Sensitron employs a progressive refinement approach where Dynamic Meta-Sensitivity Analysis (DMSA) first identifies potentially vulnerable input tokens, Hierarchical SHAP Estimation (H-SHAP) then provides explainable attribution to precisely pinpoint the most influential tokens, and finally a Plug-and-Rank mechanism that generates contextually appropriate triggers. We establish the first mathematical correlation (Sensitivity Ranking Correlation, SRC=0.83) between explainability scores and empirical attack success, enabling precise targeting of model vulnerabilities. Sensitron achieves 97.8% Attack Success Rate (ASR) (+5.8% over state-of-the-art (SOTA)) with 85.4% ASR at 0.1% poisoning rate, demonstrating robust resistance against multiple SOTA defenses. This work reveals fundamental NLP vulnerabilities and provides new attack vectors through weaponized explainability.

cs.CR↗

arXiv2025

ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs

Chain-of-Thought (CoT) enhances an LLM's ability to perform complex reasoning tasks, but it also introduces new security issues. In this work, we present ShadowCoT, a novel backdoor attack framework that targets the internal reasoning mechanism of LLMs. Unlike prior token-level or prompt-based attacks, ShadowCoT directly manipulates the model's cognitive reasoning path, enabling it to hijack multi-step reasoning chains and produce logically coherent but adversarial outcomes. By conditioning on internal reasoning states, ShadowCoT learns to recognize and selectively disrupt key reasoning steps, effectively mounting a self-reflective cognitive attack within the target model. Our approach introduces a lightweight yet effective multi-stage injection pipeline, which selectively rewires attention pathways and perturbs intermediate representations with minimal parameter overhead (only 0.15% updated). ShadowCoT further leverages reinforcement learning and reasoning chain pollution (RCP) to autonomously synthesize stealthy adversarial CoTs that remain undetectable to advanced defenses. Extensive experiments across diverse reasoning benchmarks and LLMs show that ShadowCoT consistently achieves high Attack Success Rate (94.4%) and Hijacking Success Rate (88.4%) while preserving benign performance. These results reveal an emergent class of cognition-level threats and highlight the urgent need for defenses beyond shallow surface-level consistency.

cs.CR↗

arXiv2017

Above 400 K Robust Perpendicular Ferromagnetic Phase in a Topological Insulator

The quantum anomalous Hall effect (QAHE) that emerges under broken time-reversal symmetry in topological insulators (TI) exhibits many fascinating physical properties for potential applications in nano-electronics and spintronics. However, in transition-metal doped TI, the only experimentally demonstrated QAHE system to date, the effect is lost at practically relevant temperatures. This constraint is imposed by the relatively low Curie temperature (Tc) and inherent spin disorder associated with the random magnetic dopants. Here we demonstrate drastically enhanced Tc by exchange coupling TI to Tm3Fe5O12, a high-Tc magnetic insulator with perpendicular magnetic anisotropy. Signatures that the TI surface states acquire robust ferromagnetism are revealed by distinct squared anomalous Hall hysteresis loops at 400 K. Point-contact Andreev reflection spectroscopy confirms that the TI surface is indeed spin-polarized. The greatly enhanced Tc, absence of spin disorder, and perpendicular anisotropy are all essential to the occurrence of the QAHE at high temperatures.

cond-mat.mtrl-sci↗

arXiv2015

Unconventional interfacial superconductivity in epitaxial Bi/Ni heterostructures

Superconductivity (SC) is one of the most intriguing physical phenomena in nature. Nucleation of SC has long been considered highly unfavorable if not impossible near ferromagnetism, in low dimensionality and, above all, out of non-superconductor. Here we report observation of SC with TC near 4 K in Ni/Bi bilayers that defies all known paradigms of superconductivity, where neither ferromagnetic Ni film nor rhombohedra Bi film is superconducting in isolation. This highly unusual SC is independent of the growth order (Ni/Bi or Bi/Ni), but highly sensitive to the constituent layer thicknesses. Most importantly, the SC, distinctively non-s pairing, is triggered from, but does not occur at, the Bi/Ni interface. Using point contact Andreev reflection, we show evidences that the unique SC, naturally compatible with magnetism, is triplet p-wave pairing. This new revelation may lead to unconventional avenues to explore novel SC for applications in superconducting spintronics.

cond-mat.supr-con↗