arXiv subjects

Huilin Zhou

Publications and source records attributed to Huilin Zhou.

12 recordsLinked to original sources

arXiv2026

Never compromise with vulnerabilities: a comprehensive survey on AI governance

The rapid advancement of AI has expanded its capabilities across domains, yet introduced critical technical vulnerabilities, such as algorithmic bias and adversarial sensitivity, that pose significant societal risks, including misinformation, inequity, security breaches, physical harm, and eroded public trust. These challenges highlight the urgent need for robust AI governance. We propose a comprehensive framework integrating technical and societal dimensions, structured around three interconnected pillars: Intrinsic Security (system reliability), Derivative Security (real-world harm mitigation), and Social Ethics (value alignment and accountability). Uniquely, our approach unifies technical methods, emerging evaluation benchmarks, and policy insights to promote transparency, accountability, and trust in AI systems. Through a systematic review of over 300 studies, we identify three core challenges: (1) the generalization gap, where defenses fail against evolving threats; (2) inadequate evaluation protocols that overlook real-world risks; and (3) fragmented regulations leading to inconsistent oversight. These shortcomings stem from treating governance as an afterthought, rather than a foundational design principle, resulting in reactive, siloed efforts that fail to address the interdependence of technical integrity and societal trust. To overcome this, we present an integrated research agenda that bridges technical rigor with social responsibility. Our framework offers actionable guidance for researchers, engineers, and policymakers to develop AI systems that are not only robust and secure but also ethically aligned and publicly trustworthy. The accompanying repository is available at https://github.com/Tele-EVOL/AI-Governance.

cs.CR↗

arXiv2026

Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization

Red teaming is critical for uncovering vulnerabilities in Large Language Models (LLMs). While automated methods have improved scalability, existing approaches often rely on static heuristics or stochastic search, rendering them brittle against advanced safety alignment. To address this, we introduce Metis, a framework that reformulates jailbreaking as inference-time policy optimization within an adversarial Partially Observable Markov Decision Process (POMDP). Metis employs a self-evolving metacognitive loop to perform causal diagnosis of a target's defense logic and leverages structured feedback as a semantic gradient to refine its policy, offering enhanced interpretability through transparent reasoning traces. Extensive evaluations across 10 diverse models demonstrate that Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation. By replacing redundant exploration with directed optimization, Metis reduces token costs by an average of 8.2x and up to 11.4x. Our analysis reveals that current defenses remain vulnerable to internally-steered, closed-loop reasoning trajectories under the tested settings, highlighting a critical need for next-generation defenses capable of reasoning about safety dynamically during inference.

cs.LG↗

arXiv2026

Model-Driven GPR Inversion Network With Surrogate Forward Solver

Data-driven deep learning is considered a promising solution for ground-penetrating radar (GPR) full-waveform inversion (FWI), while its generalization ability is limited due to the heavy reliance on abundant labeled samples. In contrast, Deep unfolding network (DUN) usually exhibits better generalization by integrating model-driven and data-driven approaches, yet its application to GPR FWI remains challenging due to the high computational cost associated with forward simulations. In this paper, we integrate a deep learning-based (DL-based) forward solver within an unfolding framework to form a fully neural-network-based architecture, UA-Net, for GPR FWI. The forward solver rapidly predicts B-scans given permittivity and conductivity models and enables automatic differentiation to compute gradients for inversion. In the inversion stage, an optimization process based on the Alternating Direction Method of Multipliers (ADMM) is unfolded into a multi-stage network with three interconnected modules: data fitting, regularization, and multiplier update. Specifically, the regularization module is trained end-to-end for adaptive learning of sparse target features. Experimental results demonstrate that UA-Net outperforms classical FWI and data-driven methods in reconstruction accuracy. Moreover, by employing transfer learning to fine-tune the network, UA-Net can be effectively applied to field data and produce reliable results.

physics.geo-ph↗

arXiv2025

TeleAI-Safety: A comprehensive LLM jailbreaking benchmark towards attacks, defenses, and evaluations

While the deployment of large language models (LLMs) in high-value industries continues to expand, the systematic assessment of their safety against jailbreak and prompt-based attacks remains insufficient. Existing safety evaluation benchmarks and frameworks are often limited by an imbalanced integration of core components (attack, defense, and evaluation methods) and an isolation between flexible evaluation frameworks and standardized benchmarking capabilities. These limitations hinder reliable cross-study comparisons and create unnecessary overhead for comprehensive risk assessment. To address these gaps, we present TeleAI-Safety, a modular and reproducible framework coupled with a systematic benchmark for rigorous LLM safety evaluation. Our framework integrates a broad collection of 19 attack methods (including one self-developed method), 29 defense methods, and 19 evaluation methods (including one self-developed method). With a curated attack corpus of 342 samples spanning 12 distinct risk categories, the TeleAI-Safety benchmark conducts extensive evaluations across 14 target models. The results reveal systematic vulnerabilities and model-specific failure cases, highlighting critical trade-offs between safety and utility, and identifying potential defense patterns for future optimization. In practical scenarios, TeleAI-Safety can be flexibly adjusted with customized attack, defense, and evaluation combinations to meet specific demands. We release our complete code and evaluation results to facilitate reproducible research and establish unified safety baselines.

cs.CR↗

arXiv2025

RADAR: A Risk-Aware Dynamic Multi-Agent Framework for LLM Safety Evaluation via Role-Specialized Collaboration

Existing safety evaluation methods for large language models (LLMs) suffer from inherent limitations, including evaluator bias and detection failures arising from model homogeneity, which collectively undermine the robustness of risk evaluation processes. This paper seeks to re-examine the risk evaluation paradigm by introducing a theoretical framework that reconstructs the underlying risk concept space. Specifically, we decompose the latent risk concept space into three mutually exclusive subspaces: the explicit risk subspace (encompassing direct violations of safety guidelines), the implicit risk subspace (capturing potential malicious content that requires contextual reasoning for identification), and the non-risk subspace. Furthermore, we propose RADAR, a multi-agent collaborative evaluation framework that leverages multi-round debate mechanisms through four specialized complementary roles and employs dynamic update mechanisms to achieve self-evolution of risk concept distributions. This approach enables comprehensive coverage of both explicit and implicit risks while mitigating evaluator bias. To validate the effectiveness of our framework, we construct an evaluation dataset comprising 800 challenging cases. Extensive experiments on our challenging testset and public benchmarks demonstrate that RADAR significantly outperforms baseline evaluation methods across multiple dimensions, including accuracy, stability, and self-evaluation risk sensitivity. Notably, RADAR achieves a 28.87% improvement in risk identification accuracy compared to the strongest baseline evaluation method.

cs.AI↗

arXiv2024

Explaining Generalization Power of a DNN Using Interactive Concepts

This paper explains the generalization power of a deep neural network (DNN) from the perspective of interactions. Although there is no universally accepted definition of the concepts encoded by a DNN, the sparsity of interactions in a DNN has been proved, i.e., the output score of a DNN can be well explained by a small number of interactions between input variables. In this way, to some extent, we can consider such interactions as interactive concepts encoded by the DNN. Therefore, in this paper, we derive an analytic explanation of inconsistency of concepts of different complexities. This may shed new lights on using the generalization power of concepts to explain the generalization power of the entire DNN. Besides, we discover that the DNN with stronger generalization power usually learns simple concepts more quickly and encodes fewer complex concepts. We also discover the detouring dynamics of learning complex concepts, which explains both the high learning difficulty and the low generalization power of complex concepts. The code will be released when the paper is accepted.

cs.LG↗

arXiv2023

Explaining How a Neural Network Play the Go Game and Let People Learn

The AI model has surpassed human players in the game of Go, and it is widely believed that the AI model has encoded new knowledge about the Go game beyond human players. In this way, explaining the knowledge encoded by the AI model and using it to teach human players represent a promising-yet-challenging issue in explainable AI. To this end, mathematical supports are required to ensure that human players can learn accurate and verifiable knowledge, rather than specious intuitive analysis. Thus, in this paper, we extract interaction primitives between stones encoded by the value network for the Go game, so as to enable people to learn from the value network. Experiments show the effectiveness of our method.

cs.AI↗

arXiv2021

Building Interpretable Interaction Trees for Deep NLP Models

This paper proposes a method to disentangle and quantify interactions among words that are encoded inside a DNN for natural language processing. We construct a tree to encode salient interactions extracted by the DNN. Six metrics are proposed to analyze properties of interactions between constituents in a sentence. The interaction is defined based on Shapley values of words, which are considered as an unbiased estimation of word contributions to the network prediction. Our method is used to quantify word interactions encoded inside the BERT, ELMo, LSTM, CNN, and Transformer networks. Experimental results have provided a new perspective to understand these DNNs, and have demonstrated the effectiveness of our method.

cs.CL↗

arXiv2020

Linear-Model-inspired Neural Network for Electromagnetic Inverse Scattering

Electromagnetic inverse scattering problems (ISPs) aim to retrieve permittivities of dielectric scatterers from the scattering measurement. It is often highly nonlinear, caus-ing the problem to be very difficult to solve. To alleviate the issue, this letter exploits a linear model-based network (LMN) learning strategy, which benefits from both model complexity and data learning. By introducing a linear model for ISPs, a new model with network-driven regular-izer is proposed. For attaining efficient end-to-end learning, the network architecture and hyper-parameter estimation are presented. Experimental results validate its superiority to some state-of-the-arts.

eess.IV↗

arXiv2020

Interpretable CNNs for Object Classification

This paper proposes a generic method to learn interpretable convolutional filters in a deep convolutional neural network (CNN) for object classification, where each interpretable filter encodes features of a specific object part. Our method does not require additional annotations of object parts or textures for supervision. Instead, we use the same training data as traditional CNNs. Our method automatically assigns each interpretable filter in a high conv-layer with an object part of a certain category during the learning process. Such explicit knowledge representations in conv-layers of CNN help people clarify the logic encoded in the CNN, i.e., answering what patterns the CNN extracts from an input image and uses for prediction. We have tested our method using different benchmark CNNs with various structures to demonstrate the broad applicability of our method. Experiments have shown that our interpretable filters are much more semantically meaningful than traditional filters.

cs.LG↗

arXiv2020

Robust Trajectory and Transmit Power Optimization for Secure UAV-Enabled Cognitive Radio Networks

Cognitive radio is a promising technology to improve spectral efficiency. However, the secure performance of a secondary network achieved by using physical layer security techniques is limited by its transmit power and channel fading. In order to tackle this issue, a cognitive unmanned aerial vehicle (UAV) communication network is studied by exploiting the high flexibility of a UAV and the possibility of establishing line-of-sight links. The average secrecy rate of the secondary network is maximized by robustly optimizing the UAV's trajectory and transmit power. Our problem formulation takes into account two practical inaccurate location estimation cases, namely, the worst case and the outage-constrained case. In order to solve those challenging non-convex problems, an iterative algorithm based on $\mathcal{S}$-Procedure is proposed for the worst case while an iterative algorithm based on Bernstein-type inequalities is proposed for the outage-constrained case. The proposed algorithms can obtain effective suboptimal solutions of the corresponding problems. Our simulation results demonstrate that the algorithm under the outage-constrained case can achieve a higher average secrecy rate with a low computational complexity compared to that of the algorithm under the worst case. Moreover, the proposed schemes can improve the secure communication performance significantly compared to other benchmark schemes.

cs.IT↗

arXiv2018

Resource Allocation for a Wireless Powered Integrated Radar and Communication System

The integrated radar and communication system is promising in the next generation wireless communication networks. However, its performance is confined by the limited energy. In order to overcome it, a wireless powered integrated radar and communication system is proposed. An energy minimization problem is formulated subject to constraints on the radar and communication performances. The energy beamforming and radar-communication waveform are jointly optimized to minimize the consumption energy. The challenging non-convex problem is solved by using semidefinite relaxation and auxiliary variable methods. It is proved that the optimal solution can be obtained. Simulation results demonstrate that our proposed optimal design outperforms the benchmark scheme.

eess.SP↗