arXiv subjects

Xuxing Lu

Publications and source records attributed to Xuxing Lu.

4 recordsLinked to original sources

arXiv2026

Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking

Cryptographic watermarking is a leading defense for attributing text generated by large language models (LLMs). Existing schemes, including KGW, Unigram, and DipMark, derive their security guarantees from the assumption that the underlying pseudo-random number generator (PRNG) is trustworthy. This work introduces SeedHijack, the first supply-chain attack on LLM watermarking that is simultaneously (i) blind -- requiring no knowledge of the watermark key, detector, or model logits, (ii) integrity-preserving -- amplifying rather than erasing the watermark signal, and (iii) orthogonal to detection -- the attack-induced bias is statistically independent of all content-side detector statistics, ensuring that amplification and evasion coexist without trade-off. Rather than perturbing generated text, SeedHijack replaces the PRNG at the supply-chain layer, biasing green-list selection without altering output tokens or degrading text quality. Across three watermarking schemes and three open-source LLMs, the attack triggers 0/6 state-of-the-art content-side statistical detectors while inflating the watermark z-score up to 2.42x (system-level defenses such as entropy-source attestation remain orthogonal and complementary). A quantum random number generator (QRNG) countermeasure is shown to fully neutralize the attack while preserving benign watermarking utility. These findings establish PRNG integrity as a first-class security requirement for cryptographic content-provenance systems.

cs.CR↗

arXiv2026

DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defense

Diffusion models depend on pseudo-random number generators (PRNGs) for latent noise sampling. We present DiffusionHijack, a supply-chain backdoor attack that hijacks the PRNG to deterministically control generated images. A malicious PRNG, injected via compromised packages, forces pixel-perfect reproduction of attacker-chosen content (SSIM = 1.00, N = 100 trials) on Stable Diffusion v1.4, v1.5, and SDXL -- without modifying model weights. The attack is inherently undetectable by existing model auditing and content moderation mechanisms, as it operates entirely outside the neural network computation graph. The attack remains effective under stochastic sampling (eta > 0), bypasses CLIP-based safety checkers (98-100% success), and operates independently of the user's prompt. As a countermeasure, we replace the PRNG with a quantum random number generator (QRNG), which provides information-theoretic unpredictability. Across N = 100 prompt-model combinations, QRNG defense completely neutralizes the attack, reducing output similarity to random baseline levels (SSIM < 0.20 for SD 1.x models, < 0.45 for SDXL). This work exposes a previously overlooked supply-chain vulnerability and offers a hardware-level fundamental mitigation for generative AI systems.

cs.CR↗

arXiv2026

Seed Hijacking of LLM Sampling and Quantum Random Number Defense

Large language models (LLMs) rely on deterministic pseudorandom number generators (PRNGs) for autoregressive sampling, creating a critical supply-chain attack surface overlooked by existing defenses. We present SeedHijack, a backdoor attack that manipulates PRNG outputs to force attacker-specified token selection without altering model logits. In a 540-trial benchmark on GPT-2 (124M), the attack achieves 99.6% exact token injection across 9 sampling configurations; it reaches 100% success on four aligned models (1.5B-7B, RLHF/SFT/reasoning distillation) and bypasses all alignment methods tested in this work. We further propose a defense based on a hardware quantum random number generator (QRNG), which neutralizes the attack in our evaluated threat model with negligible median overhead (+0.6% latency, +7.7 MB memory). Our work identifies a critical sampling-layer vulnerability and provides a practical, deployable QRNG-based defense.

cs.CR↗

arXiv2020

Collective resonance in helical superstructures of gold nanorods

Chiroptical responses of helical superstructures are determined by collective behaviors of the individual building blocks. In this paper, we present a full theoretical description of the collective resonance in superstructures. We use the gold nanorods as individual building blocks and arrange them helically along an axis in an end-to-end fashion. Numerical simulations on single-unit cells reveal that the plasmonic coupling between the nanorods produces hybridized resonances, whose intensity is strongly dependent on the excitation light with left- or right-handed circular polarizations (LCP or RCP). A node-mode criterion is proposed on the basis of the microscopic mechanism, which successfully explains the difference between LCP and RCP. We further demonstrate, by repeating the unit cell from 1 to infinity along the helical axis, the multiple hybridized resonances gradually evolve and merge into a single collective resonance, whose energy is also dependent on LCP and RCP. An analytical description is provided for the collective resonance of the helical superstructure on the basis of the coupled dipole approximation method. Our theory shows that n collective resonance modes are present in the helical superstructure with the unit cell consisting of $n$ nanorods. Strikingly, only one resonance can be excited by the incident light with certain circular polarization. We propose a universal selection rule for such selective excitation of the collective resonances by analyzing the symmetry of the helical superstructures. The new insights provided in this work may shed light on future designs and fabrications of helical superstructures using plasmonic building blocks.

physics.optics↗