arXiv subjects

Lihua Yin

Publications and source records attributed to Lihua Yin.

10 recordsLinked to original sources

arXiv2026

PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis

Large language models (LLMs) are increasingly deployed as purpose-specific agents to handle domain-specific tasks such as customer service and code generation. These agents are expected to comply with not only generic safety guardrails but also purpose-specific restrictions tailored to their designated roles. Such additional restrictions enlarge the attack surface, particularly to prompt injection (PI) attacks. To defend against such attacks, existing detection methods primarily rely on analyzing input-output patterns, yet yield limited effectiveness. To address this limitation, we turn to analyzing the hidden activation space and discover that LLMs inherently retain latent policy-violation (PV) concepts when prompted with requests beyond their designated purpose. Particularly, PV concepts capture the semantics of conflicts between user queries and predefined restrictions, implicitly reflecting LLMs' intrinsic awareness of recognizing policy violations. Building on this insight, we propose PVDetector, a training-free framework that detects PI attacks during LLM inference by measuring hidden-state alignment with PV concepts, which are derived offline from the contrastive pairs of policy-violating and policy-compliant prompts. Experiments across multiple LLMs and datasets show that PVDetector achieves <1\% false negative rate with minimal auxiliary overhead, consistently outperforming state-of-the-art methods. Our code is available at https://github.com/Claresigle/PVDetector .

cs.CR↗

arXiv2026

The ground ytterbium doublet in h-YbMnO3 and the related low-temperature peculiarities of the compound

We have performed detailed temperature-dependent study of optical f-f transitions of the Yb3+ ions in h-YbMnO3 by means of Fourier-transform spectroscopy. The splitting of the ground Kramers doublet as a function of temperature, D0(T), for the Yb3+ ion at 4b site was determined. The D0(T) function follows the dynamics of the manganese magnetic moment below TN = 87 K, indicating, that the ytterbium subsystem is magnetized by the magnetic field generated by an ordered manganese subsystem, which is consistent with the results of previous studies. Excitation of the upper component of the split ground doublet plays a significant role in low-temperature dynamics of the h-YbMnO3 crystal. Using the D0(T) function we calculated the temperature behavior of the of the Yb(4b) magnetic moment: it is in clear agreement with the neutron data [Phys. Rev. B 98, 134413, 2018]. The calculated contribution of Yb(4b) to heat capacity definitely explains the origin of the Schottky anomaly in the CP(T) dependence. A scenario for phase transitions in h-YbMnO3 is proposed in which the energy gain in the ytterbium system plays a key role.

cond-mat.str-el↗

arXiv2026

Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction

Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.

cs.CR↗

arXiv2025

CoSIFL: Collaborative Secure and Incentivized Federated Learning with Differential Privacy

Federated learning (FL) has emerged as a promising paradigm for collaborative model training while preserving data locality. However, it still faces challenges from malicious or compromised clients, as well as difficulties in incentivizing participants to contribute high-quality data under strict privacy requirements. Motivated by these considerations, we propose CoSIFL, a novel framework that integrates proactive alarming for robust security and local differential privacy (LDP) for inference attacks, together with a Stackelberg-based incentive scheme to encourage client participation and data sharing. Specifically, CoSIFL uses an active alarming mechanism and robust aggregation to defend against Byzantine and inference attacks, while a Tullock contest-inspired incentive module rewards honest clients for both data contributions and reliable alarm triggers. We formulate the interplay between the server and clients as a two-stage game: in the first stage, the server determines total rewards, selects participants, and fixes global iteration settings, whereas in the second stage, each client decides its mini-batch size, privacy noise scale, and alerting strategy. We prove that the server-client game admits a unique equilibrium, and analyze how clients' multi-dimensional attributes - such as non-IID degrees and privacy budgets - jointly affect system efficiency. Experimental results on standard benchmarks demonstrate that CoSIFL outperforms state-of-the-art solutions in improving model robustness and reducing total server costs, highlighting the effectiveness of our integrated design.

cs.LG↗

arXiv2024

Private and Communication-Efficient Federated Learning based on Differentially Private Sketches

Federated learning (FL) faces two primary challenges: the risk of privacy leakage due to parameter sharing and communication inefficiencies. To address these challenges, we propose DPSFL, a federated learning method that utilizes differentially private sketches. DPSFL compresses the local gradients of each client using a count sketch, thereby improving communication efficiency, while adding noise to the sketches to ensure differential privacy (DP). We provide a theoretical analysis of privacy and convergence for the proposed method. Gradient clipping is essential in DP learning to limit sensitivity and constrain the addition of noise. However, clipping introduces bias into the gradients, negatively impacting FL performance. To mitigate the impact of clipping, we propose an enhanced method, DPSFL-AC, which employs an adaptive clipping strategy. Experimental comparisons with existing techniques demonstrate the superiority of our methods concerning privacy preservation, communication efficiency, and model accuracy.

cs.LG↗

arXiv2024

Sketches-based join size estimation under local differential privacy

Join size estimation on sensitive data poses a risk of privacy leakage. Local differential privacy (LDP) is a solution to preserve privacy while collecting sensitive data, but it introduces significant noise when dealing with sensitive join attributes that have large domains. Employing probabilistic structures such as sketches is a way to handle large domains, but it leads to hash-collision errors. To achieve accurate estimations, it is necessary to reduce both the noise error and hash-collision error. To tackle the noise error caused by protecting sensitive join values with large domains, we introduce a novel algorithm called LDPJoinSketch for sketch-based join size estimation under LDP. Additionally, to address the inherent hash-collision errors in sketches under LDP, we propose an enhanced method called LDPJoinSketch+. It utilizes a frequency-aware perturbation mechanism that effectively separates high-frequency and low-frequency items without compromising privacy. The proposed methods satisfy LDP, and the estimation error is bounded. Experimental results show that our method outperforms existing methods, effectively enhancing the accuracy of join size estimation under LDP.

cs.DB↗

arXiv2023

Partition-based differentially private synthetic data generation

Private synthetic data sharing is preferred as it keeps the distribution and nuances of original data compared to summary statistics. The state-of-the-art methods adopt a select-measure-generate paradigm, but measuring large domain marginals still results in much error and allocating privacy budget iteratively is still difficult. To address these issues, our method employs a partition-based approach that effectively reduces errors and improves the quality of synthetic data, even with a limited privacy budget. Results from our experiments demonstrate the superiority of our method over existing approaches. The synthetic data produced using our approach exhibits improved quality and utility, making it a preferable choice for private synthetic data sharing.

cs.CR↗

arXiv2023

Sensitivity estimation for differentially private query processing

Differential privacy has become a popular privacy-preserving method in data analysis, query processing, and machine learning, which adds noise to the query result to avoid leaking privacy. Sensitivity, or the maximum impact of deleting or inserting a tuple on query results, determines the amount of noise added. Computing the sensitivity of some simple queries such as counting query is easy, however, computing the sensitivity of complex queries containing join operations is challenging. Global sensitivity of such a query is unboundedly large, which corrupts the accuracy of the query answer. Elastic sensitivity and residual sensitivity offer upper bounds of local sensitivity to reduce the noise, but they suffer from either low accuracy or high computational overhead. We propose two fast query sensitivity estimation methods based on sampling and sketch respectively, offering competitive accuracy and higher efficiency compared to the state-of-the-art methods.

cs.DB↗

arXiv2022

Local Differentially Private Frequency Estimation based on Learned Sketches

Sketches are widely used for frequency estimation of data with a large domain. However, sketches-based frequency estimation faces more challenges when considering privacy. Local differential privacy (LDP) is a solution to frequency estimation on sensitive data while preserving the privacy. LDP enables each user to perturb its data on the client-side to protect the privacy, but it also introduces errors to the frequency estimations. The hash collisions in the sketches make the estimations for low-frequent items even worse. In this paper, we propose a two-phase frequency estimation framework for data with a large domain based on an LDP learned sketch, which separates the high-frequent and low-frequent items to avoid the errors caused by hash collisions. We theoretically proved that the proposed method satisfies LDP and it is more accurate than the state-of-the-art frequency estimation methods including Apple-CMS, Apple-HCMS and FLH. The experimental results verify the performance of our method.

cs.CR↗

arXiv2020

Polar Rectification Effect in Electro-Fatigued SrTiO3 Based Junctions

Rectifying semiconductor junctions are crucial to electronic devices. They convert alternating current into direct one by allowing unidirectional charge flows. In analogy to the current-flow rectification for itinerary electrons, here, a polar rectification that based on the localized oxygen vacancies (OVs) in a Ti/fatigued-SrTiO3 (fSTO) Schottky junction is first demonstrated. The fSTO with OVs is produced by an electro-degradation process. The different movability of localized OVs and itinerary electrons in the fSTO yield a unidirectional electric polarization at the interface of the junction under the coaction of external and built-in electric fields. Moreover, the fSTO displays a pre-ferroelectric state located between paraelectric and ferroelectric phases. The pre-ferroelectric state has three sub-states and can be easily driven into a ferroelectric state by external electric field. These observations open up opportunities for potential polar devices and may underpin many useful polar-triggered electronic phenomena.

physics.app-ph↗