arXiv subjects

Shiqian Zhao

Publications and source records attributed to Shiqian Zhao.

22 records · Page 2Linked to original sources

arXiv2025

Three Minds, One Legend: Jailbreak Large Reasoning Model with Adaptive Stacked Ciphers

Recently, Large Reasoning Models (LRMs) have demonstrated superior logical capabilities compared to traditional Large Language Models (LLMs), gaining significant attention. Despite their impressive performance, the potential for stronger reasoning abilities to introduce more severe security vulnerabilities remains largely underexplored. Existing jailbreak methods often struggle to balance effectiveness with robustness against adaptive safety mechanisms. In this work, we propose SEAL, a novel jailbreak attack that targets LRMs through an adaptive encryption pipeline designed to override their reasoning processes and evade potential adaptive alignment. Specifically, SEAL introduces a stacked encryption approach that combines multiple ciphers to overwhelm the models reasoning capabilities, effectively bypassing built-in safety mechanisms. To further prevent LRMs from developing countermeasures, we incorporate two dynamic strategies - random and adaptive - that adjust the cipher length, order, and combination. Extensive experiments on real-world reasoning models, including DeepSeek-R1, Claude Sonnet, and OpenAI GPT-o4, validate the effectiveness of our approach. Notably, SEAL achieves an attack success rate of 80.8% on GPT o4-mini, outperforming state-of-the-art baselines by a significant margin of 27.2%. Warning: This paper contains examples of inappropriate, offensive, and harmful content.

cs.CL↗

arXiv2025

Search for Fast Radio Bursts and radio pulsars from pulsing Ultraluminous X-ray Sources

We conducted targeted fast radio burst (FRB) and pulsar searches on eight pulsing ultraluminous X-ray sources (PULXs) using the Five-hundred-meter Aperture Spherical Radio Telescope (FAST) and the Parkes 64-meter Radio Telescope (Murriyang) to investigate whether PULXs could be progenitors of FRBs. FAST carried out 12 observations of four PULXs, totaling 8 hours, while Parkes conducted 12 observations of the remaining four PULXs, totaling 11 hours. No significant signals were detected through single-pulse and periodic searches, covering a dispersion measure (DM) range of 0-5000 pc cm$^{-3}$, placing stringent upper limits on the radio flux density from these sources. The results imply that accretion processes and dense stellar winds in PULXs likely suppress or attenuate potential coherent emission in radio band. Additionally, the beaming factor and luminosity of FRBs associated with PULXs, as well as the highly relativistic and magnetized nature of their outflows, may limit detectability. Non-detection yielded from the observations covering the full orbital phases of PULXs can also constrain the theoretical models that link FRB emission to highly magnetized neutron stars in binary systems.

astro-ph.HE↗

arXiv2024

SAME: Sample Reconstruction against Model Extraction Attacks

While deep learning models have shown significant performance across various domains, their deployment needs extensive resources and advanced computing infrastructure. As a solution, Machine Learning as a Service (MLaaS) has emerged, lowering the barriers for users to release or productize their deep learning models. However, previous studies have highlighted potential privacy and security concerns associated with MLaaS, and one primary threat is model extraction attacks. To address this, there are many defense solutions but they suffer from unrealistic assumptions and generalization issues, making them less practical for reliable protection. Driven by these limitations, we introduce a novel defense mechanism, SAME, based on the concept of sample reconstruction. This strategy imposes minimal prerequisites on the defender's capabilities, eliminating the need for auxiliary Out-of-Distribution (OOD) datasets, user query history, white-box model access, and additional intervention during model training. It is compatible with existing active defense methods. Our extensive experiments corroborate the superior efficacy of SAME over state-of-the-art solutions. Our code is available at https://github.com/xythink/SAME.

cs.CR↗

arXiv2023

Extracting Cloud-based Model with Prior Knowledge

Machine Learning-as-a-Service, a pay-as-you-go business pattern, is widely accepted by third-party users and developers. However, the open inference APIs may be utilized by malicious customers to conduct model extraction attacks, i.e., attackers can replicate a cloud-based black-box model merely via querying malicious examples. Existing model extraction attacks mainly depend on the posterior knowledge (i.e., predictions of query samples) from Oracle. Thus, they either require high query overhead to simulate the decision boundary, or suffer from generalization errors and overfitting problems due to query budget limitations. To mitigate it, this work proposes an efficient model extraction attack based on prior knowledge for the first time. The insight is that prior knowledge of unlabeled proxy datasets is conducive to the search for the decision boundary (e.g., informative samples). Specifically, we leverage self-supervised learning including autoencoder and contrastive learning to pre-compile the prior knowledge of the proxy dataset into the feature extractor of the substitute model. Then we adopt entropy to measure and sample the most informative examples to query the target model. Our design leverages both prior and posterior knowledge to extract the model and thus eliminates generalizability errors and overfitting problems. We conduct extensive experiments on open APIs like Traffic Recognition, Flower Recognition, Moderation Recognition, and NSFW Recognition from real-world platforms, Azure and Clarifai. The experimental results demonstrate the effectiveness and efficiency of our attack. For example, our attack achieves 95.1% fidelity with merely 1.8K queries (cost 2.16$) on the NSFW Recognition API. Also, the adversarial examples generated with our substitute model have better transferability than others, which reveals that our scheme is more conducive to downstream attacks.

cs.CR↗