arXiv subjects

Zhibo Liang

Publications and source records attributed to Zhibo Liang.

3 recordsLinked to original sources

arXiv2026

SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection

Large Language Models (LLMs) are increasingly used as the core of agentic systems due to their strong reasoning, planning, and tool-use capabilities. By interacting with external environments, LLM agents can execute real-world tasks on behalf of users rather than merely generate text. This expanded capability also amplifies the threat of indirect prompt injection (IPI), where malicious external content can manipulate agent behavior and trigger unauthorized actions, privacy leakage, or financial loss. Existing defenses generally follow two approaches. Plan- or rule-based methods constrain agent execution using predefined plans or execution rules, but may block legitimate actions that arise from dynamic runtime context. Semantic auditing methods offer greater flexibility, yet repeatedly re-evaluating proposed actions incurs substantial token and latency overhead. These limitations motivate a selective verification strategy that applies deterministic checks whenever reliable structural evidence is available and escalates only ambiguous cases. Accordingly, we propose SIEVE, which verifies tool transitions and argument sources against an Intent Graph, escalating actions that cannot pass deterministic verification to semantic adjudication. This selective design preserves flexibility while avoiding continuous semantic auditing. We evaluate SIEVE on AgentLure and AgentDojo against MELON, DRIFT, IPIGuard, and ARGUS. SIEVE achieves 5.94% ASR with 97.5% clean utility on AgentLure, and 0.34% ASR with 87.63% clean utility on AgentDojo. Compared with DRIFT and ARGUS, SIEVE incurs the lowest token consumption and the fewest API calls.

cs.AI↗

arXiv2026

HyperOffload: Graph-Driven Hierarchical Memory Management for Large Language Models on SuperNode Architectures

The rapid evolution of Large Language Models (LLMs) towards long-context reasoning and sparse architectures has pushed memory requirements far beyond the capacity of individual device HBM. While emerging supernode architectures offer terabyte-scale shared memory pools via high-bandwidth interconnects, existing software stacks fail to exploit this hardware effectively. Current runtime-based offloading and swapping techniques operate with a local view, leading to reactive scheduling and exposed communication latency that stall the computation pipeline. In this paper, we propose the SuperNode Memory Management Framework (\textbf{HyperOffload}). It employs a compiler-assisted approach that leverages graph-driven memory management to treat remote memory access as explicit operations in the computation graph, specifically designed for hierarchical SuperNode architectures. Unlike reactive runtime systems, SuperNode represents data movement using cache operators within the compiler's Intermediate Representation (IR). This design enables a global, compile-time analysis of tensor lifetimes and execution dependencies. Leveraging this visibility, we develop a global execution-order refinement algorithm that statically schedules data transfers to hide remote memory latency behind compute-intensive regions. We implement SuperNode within the production deep learning framework MindSpore, adding a remote memory backend and specialized compiler passes. Evaluation on representative LLM workloads shows that SuperNode reduces peak device memory usage by up to 26\% for inference while maintaining end-to-end performance. Our work demonstrates that integrating memory-augmented hardware into the compiler's optimization framework is essential for scaling next-generation AI workloads.

cs.DC↗

arXiv2025

CloneShield: A Framework for Universal Perturbation Against Zero-Shot Voice Cloning

Recent breakthroughs in text-to-speech (TTS) voice cloning have raised serious privacy concerns, allowing highly accurate vocal identity replication from just a few seconds of reference audio, while retaining the speaker's vocal authenticity. In this paper, we introduce CloneShield, a universal time-domain adversarial perturbation framework specifically designed to defend against zero-shot voice cloning. Our method provides protection that is robust across speakers and utterances, without requiring any prior knowledge of the synthesized text. We formulate perturbation generation as a multi-objective optimization problem, and propose Multi-Gradient Descent Algorithm (MGDA) to ensure the robust protection across diverse utterances. To preserve natural auditory perception for users, we decompose the adversarial perturbation via Mel-spectrogram representations and fine-tune it for each sample. This design ensures imperceptibility while maintaining strong degradation effects on zero-shot cloned outputs. Experiments on three state-of-the-art zero-shot TTS systems, five benchmark datasets and evaluations from 60 human listeners demonstrate that our method preserves near-original audio quality in protected inputs (PESQ = 3.90, SRS = 0.93) while substantially degrading both speaker similarity and speech quality in cloned samples (PESQ = 1.07, SRS = 0.08).

cs.SD↗