arXiv subjects

Junxi Chen

Publications and source records attributed to Junxi Chen.

6 recordsLinked to original sources

arXiv2026

Adaptive Probe-based Steering for Robust LLM Jailbreaking

Recent work has demonstrated the potential of contrastive steering for jailbreaking Large Language Models (LLMs). However, existing methods rely on limited and inherently biased contrastive prompts and require laborious manual tuning of steering strength, limiting their robustness and effectiveness. In this paper, we leverage the idea of model extraction to guide the learned steering vectors to approximate the ideal one and propose tuning the steering strength adaptively based on contrastive activations' statistics. Experiments demonstrate that our method notably improves the effectiveness and robustness of probe-based steering, without any extra contrastive prompts or laborious manual tuning. Being an attack paper, this paper focuses on revealing the breakdown of fortified LLMs, raising the average harmfulness score from 6\% to 70\%. Our code is available at https://github.com/fhdnskfbeuv/adaptiveSteering.

cs.CR↗

arXiv2026

Quantum Spin Liquid State of a Dual-Species Atomic Array on Kagome Lattice

Dual-species arrays of ultracold neutral atoms have recently attracted increased interest due to the ability to independently control different atomic species and tune the interatomic interactions. This capability provides additional flexibility essential for both quantum computing and quantum simulation. In this work we theoretically investigate a quantum spin liquid (QSL) state to be simulated on a programmable quantum simulator based on a dual-species atomic array, arranged on a Kagome lattice. The Kagome lattice is formed by corner sharing triangles. This specific spatial arrangement enhances the competing interactions between atoms and is often considered as a model for realizing QSL states. When the atoms are excited into Rydberg states, long-range interactions result in Rydberg blockade. The geometric frustration of the Kagome lattice, combined with the Rydberg blockade, drives the system into exotic phases with topological order and long-range entanglement. To drive an array into the QSL state, we use a sweep-hold-sweep protocol, when the atoms are quasi-adiabatically excited into Rydberg state with individually controlled detuning from the resonance for each atomic species. The filling fraction, indicating emergence of a QSL state, is represented by a density of Rydberg excitations. We identified the conditions required for QSL state in a dual-species array with non-uniform interaction energies. We calculated the correlation length and studied the mutual information as a function of the size of the subset of the system. The existence of a topological order was proved by estimating the Kitaev-Preskill topological quantum entanglement entropy, and further confirmed by evaluating diagonal and off-diagonal topological string operators, which respectively probe the classical dimer-covering structure and the quantum coherence between distinct dimer configurations.

quant-ph↗

arXiv2025

Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreaking

Recently, the Image Prompt Adapter (IP-Adapter) has been increasingly integrated into text-to-image diffusion models (T2I-DMs) to improve controllability. However, in this paper, we reveal that T2I-DMs equipped with the IP-Adapter (T2I-IP-DMs) enable a new jailbreak attack named the hijacking attack. We demonstrate that, by uploading imperceptible image-space adversarial examples (AEs), the adversary can hijack massive benign users to jailbreak an Image Generation Service (IGS) driven by T2I-IP-DMs and mislead the public to discredit the service provider. Worse still, the IP-Adapter's dependency on open-source image encoders reduces the knowledge required to craft AEs. Extensive experiments verify the technical feasibility of the hijacking attack. In light of the revealed threat, we investigate several existing defenses and explore combining the IP-Adapter with adversarially trained models to overcome existing defenses' limitations. Our code is available at https://github.com/fhdnskfbeuv/attackIPA.

cs.CV↗

arXiv2024

Exploring Adversarial Attacks against Latent Diffusion Model from the Perspective of Adversarial Transferability

Recently, many studies utilized adversarial examples (AEs) to raise the cost of malicious image editing and copyright violation powered by latent diffusion models (LDMs). Despite their successes, a few have studied the surrogate model they used to generate AEs. In this paper, from the perspective of adversarial transferability, we investigate how the surrogate model's property influences the performance of AEs for LDMs. Specifically, we view the time-step sampling in the Monte-Carlo-based (MC-based) adversarial attack as selecting surrogate models. We find that the smoothness of surrogate models at different time steps differs, and we substantially improve the performance of the MC-based AEs by selecting smoother surrogate models. In the light of the theoretical framework on adversarial transferability in image classification, we also conduct a theoretical analysis to explain why smooth surrogate models can also boost AEs for LDMs.

cs.CV↗

arXiv2023

Releasing Inequality Phenomenon in $\ell_{\infty}$-norm Adversarial Training via Input Gradient Distillation

Adversarial training (AT) is considered the most effective defense against adversarial attacks. However, a recent study revealed that $\ell_{\infty}$-norm adversarial training ($\ell_{\infty}$-AT) will also induce unevenly distributed input gradients, which is called the inequality phenomenon. This phenomenon makes the $\ell_{\infty}$-norm adversarially trained model more vulnerable than the standard-trained model when high-attribution or randomly selected pixels are perturbed, enabling robust and practical black-box attacks against $\ell_{\infty}$-adversarially trained models. In this paper, we propose a simple yet effective method called Input Gradient Distillation (IGD) to release the inequality phenomenon in $\ell_{\infty}$-AT. IGD distills the standard-trained teacher model's equal decision pattern into the $\ell_{\infty}$-adversarially trained student model by aligning input gradients of the student model and the standard-trained model with the Cosine Similarity. Experiments show that IGD can mitigate the inequality phenomenon and its threats while preserving adversarial robustness. Compared to vanilla $\ell_{\infty}$-AT, IGD reduces error rates against inductive noise, inductive occlusion, random noise, and noisy images in ImageNet-C by up to 60\%, 16\%, 50\%, and 21\%, respectively. Other than empirical experiments, we also conduct a theoretical analysis to explain why releasing the inequality phenomenon can improve such robustness and discuss why the severity of the inequality phenomenon varies according to the dataset's image resolution. Our code is available at https://github.com/fhdnskfbeuv/Inuput-Gradient-Distillation

cs.CV↗

arXiv2023

Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges

Deep learning techniques have achieved superior performance in computer-aided medical image analysis, yet they are still vulnerable to imperceptible adversarial attacks, resulting in potential misdiagnosis in clinical practice. Oppositely, recent years have also witnessed remarkable progress in defense against these tailored adversarial examples in deep medical diagnosis systems. In this exposition, we present a comprehensive survey on recent advances in adversarial attacks and defenses for medical image analysis with a systematic taxonomy in terms of the application scenario. We also provide a unified framework for different types of adversarial attack and defense methods in the context of medical image analysis. For a fair comparison, we establish a new benchmark for adversarially robust medical diagnosis models obtained by adversarial training under various scenarios. To the best of our knowledge, this is the first survey paper that provides a thorough evaluation of adversarially robust medical diagnosis models. By analyzing qualitative and quantitative results, we conclude this survey with a detailed discussion of current challenges for adversarial attack and defense in medical image analysis systems to shed light on future research directions. Code is available on \href{https://github.com/tomvii/Adv_MIA}{\color{red}{GitHub}}.

eess.IV↗