论文检索

Social Aspects · Security

Ye Zhu, Ai Zhao, Jinwei Wang

Image forgery is rapidly evolving, rendering forensic traces increasingly subtle and readily attenuated by post-processing. Although vision--language prompting can inject priors, open-ended LLM-generated prompts are difficult to constrain, and naive language description can introduce semantic perturbations. To address these challenges, we propose Forensic Prompting with Dual-Action policy optimization (FPDA) for vision-language forgery detection and localization, where Forensic Prompting Module (FPM) constructs a structured forensic prompt bank and supports optional text input to provide lightweight stable conditioning via a reliability gate. Moreover, a Dual-Action Policy Optimization (DAPO) is applied to adaptively route prompts and schedule refinement strategies on a per-image basis, stabilizing discriminative cues and improving mask spatial consistency. Extensive experiments are conducted on multiple public datasets of manipulations, diffusion content, face forgeries, and text-enabled settings (e.g., CASIA/NIST16/Coverage, CocoGlide, OpenForensics and SID_Set_description), which demonstrates superior detection and localization performance over state-of-the-art methods.

Social Aspects · Alignment

Yitong Sun, Yao Huang, Teng Li, Ranjie Duan, Yichi Zhang, Xingjun Ma, Hui Xue', Xingxing Wei

Mixture-of-Experts (MoE) architectures have emerged as a popular paradigm for scaling Large Language Models (LLMs), enabling greater capacity with reduced computational cost by dynamically routing inputs to the most relevant experts based on learned patterns. However, this also introduces a critical vulnerability: Safety Sparsity, where safety capabilities concentrate in few experts, making them susceptible to adversarial bypassing. Meanwhile, conventional alignment methods apply uniform adaptations across all parameters, ignoring their functional differences and inadvertently degrading general utility. To address these challenges, we propose MESA (MoE Safety Alignment), a targeted alignment framework for MoE-based LLMs that strategically decentralizes safety responsibilities to maximize coverage while explicitly minimizing interference with general capabilities. Specifically, based on Optimal Transport (OT) theory, MESA operates through two mechanisms: (1) Expert Capacity Reallocation, which uses a transport cost matrix to distribute safety duties to the most cost-effective experts; and (2) Dynamic Routing Refinement, which constrains the router to ensure precise activation of these decentralized modules. Extensive experiments demonstrate that MESA achieves robust defensive performance against varied harmful benchmarks while preserving general helpfulness.

Social Aspects · Privacy

Hyunwoo Kim, Niloofar Mireshghallah, Michael Duan, Rui Xin, Stella Li, Jaehun Jung, David Acuna, Qi Pang, Hanshen Xiao, Edward Suh 等

Research involving privacy-sensitive data has always been constrained by data scarcity, standing in sharp contrast to other areas that have benefited from data scaling. To quench this thirst, we present Privasis (i.e., privacy oasis), the first million-scale fully synthetic dataset entirely built from scratch—an expansive reservoir of texts with rich and diverse private information—designed to broaden and accelerate research in areas where processing sensitive social data is inevitable. Compared to existing datasets, Privasis, comprising 1.4 million records, offers orders-of-magnitude larger scale with quality, and far greater diversity across various document types, including medical records, legal documents, financial records, calendars, emails, meeting transcripts, and text-messages with a total of 55.1 million annotated attributes such as ethnicity, date of birth, workplace, etc. We leverage Privasis to construct a parallel corpus for text sanitization with our pipeline that recursively decomposes texts and applies targeted sanitization. Our compact sanitization models ($\leq$ 4B) trained on this dataset outperform state-of-the-art large language models, such as GPT-5 and Qwen-3 235B.

Social Aspects · Privacy

Viet-Hung Tran, Ngoc Nguyen, Thai Son Mai, Hans Vandierendonck, Ira Assent, Alex Kot, Ngai-Man (Man) Cheung

Model Inversion (MI) attacks pose a significant privacy threat by reconstructing private training data from machine learning models. While existing defenses primarily concentrate on model-centric approaches, the impact of data on MI robustness remains largely unexplored. In this work, we explore Random Erasing (RE)—a technique traditionally used for improving model generalization under occlusion—and uncover its surprising effectiveness as a defense against MI attacks. Specifically, our novel feature space analysis shows that model trained with RE-images introduces a significant discrepancy between the features of MI-reconstructed images and those of the private data. At the same time, features of private images remain distinct from other classes and well-separated from different classification regions. These effects collectively de_x0002_grade MI reconstruction quality and attack accuracy while maintaining reasonable natural accuracy. Furthermore, we explore two critical properties of RE including Partial Erasure and Random Location. First, Partial Erasure prevents the model from observing entire objects during training, and we find that this has significant impact on MI, which aims to reconstruct the entire objects. Second, the Random Location of erasure plays a crucial role in achieving a strong privacy-utility trade-off. Our findings highlight RE as a simple yet effective defense mechanism that can be easily integrated with existing privacy-preserving techniques. Extensive experiments of 37 setups demonstrate that our method achieves SOTA performance in privacy-utility tradeoff. The results consistently demonstrate the superiority of our defense over existing defenses across different MI attacks, network architectures, and attack configurations. For the first time, we achieve significant degrade in attack accuracy without decrease in utility for some configurations. Our code and additional results are available at: https://ngoc-nguyen-0.github.io/MIDRE/

Social Aspects · Privacy

Mohammad Yaghini, Michael Aerni, Junrui Zhang, Nicolas Papernot, Florian Tramer

Privacy auditing has emerged as a practical tool for empirically estimating training data leakage in machine learning models, in contrast to the provable but often overly pessimistic bounds provided by differential privacy analysis. A common strategy is to use membership inference attacks to detect the presence of specific canaries—data points chosen to maximize attack success—in training data. However, existing canary designs are largely heuristic, relying on mislabeled or out-of-distribution samples. We address this gap by formulating canary design as a bilevel optimization problem, where the model is trained in the inner loop and the canary is optimized in the outer loop to maximize its detectability. To solve this problem, we develop OptiFluence, a scalable optimization framework that combines (i) initialization by selecting candidates using influence functions and (ii) unrolled optimization with memory-efficient techniques. Our approach achieves remarkable empirical performance on four datasets. Optimized canaries demonstrate 415$\times$ (CIFAR-10/100) higher detectability than in-distribution baselines, achieving near-perfect detection rates of 99% true positive rate at 0.1% false positive rate. Critically, these canaries transfer effectively across different model architectures without retraining, enabling practical third-party privacy audits. This transferability allows regulators and auditors to assess model privacy without requiring access to proprietary training infrastructure or substantial computational resources.

Social Aspects · Safety

Yanbo Wang, Minzheng Wang, Jian Liang, Lu Wang, Yongcan Yu, Ran He

While reasoning models have achieved remarkable success in complex reasoning tasks, their increasing power necessitates stringent safety measures. For safety alignment, the core challenge lies in the inherent trade-off between safety and utility. However, prevailing alignment strategies typically construct CoT training data with explicit safety rules via context distillation. This approach inadvertently limits reasoning capabilities by creating a rigid association between rule memorization and refusal. To mitigate the safety-utility trade-off, we propose the Adaptive Safe Context Learning (ASCL) framework to improve the reasoning given proper context. ASCL formulates safety alignment as a multi-turn tool-use process, empowering the model to autonomously decide when to consult safety rules and how to generate the ongoing reasoning. Furthermore, to counteract the preference for rule consultation during RL, we introduce Inverse Frequency Policy Optimization (IFPO) to rebalance advantage estimates. By decoupling rule retrieval and subsequent reasoning, our method achieves higher overall performance compared to baselines.

Social Aspects · Accountability, Transparency, and Interpretability

Mateo Espinosa Zarlenga

Concept-based models (CMs), deep neural networks that ground their predictions on representations aligned with human-understandable concepts (e.g., "round", "stripes", etc.), have been shown to learn representations that *leak* concept-irrelevant information. As the traditional narrative goes, this leakage is undesirable and should be eradicated as it leads to uninterpretable models. In this paper, we posit that this conventional view of leakage in CMs is not only ill-posed, as the evidence of how leakage makes a model less interpretable is often inconclusive, but also bound to lead to impractical CMs under common real-world constraints. Specifically, we argue that *in real-world settings where concept incompleteness is the norm, some leakage is often necessary for constructing accurate and intervenable CMs*. To this end, we propose that there is such a thing as *benign* leakage and show that, by optimizing a reframing of the typical CM training objective, CMs can encourage and exploit this form of leakage without sacrificing accuracy or intervenability.

Social Aspects · Accountability, Transparency, and Interpretability

Vacslav Glukhov

Treating the outcome of machine learning as a stable, identifiable artifact is implicit in language, tooling, and governance. This position paper examines whether a trained system admits context-appropriate criteria of identity. We show that neither functional behavior nor internal structure suffices: behavioral equivalence is underdetermined by finite data, while modern architectures admit multiple, structurally distinct realizations of the same function. Consequently, practices that treat learned systems as stable objects presuppose equivalence relations that are rarely made explicit. We do not propose abandoning such practices. Instead, we articulate the minimal conditions under which identity claims grounded in behavior, structure, or training process can be meaningfully interpreted, with implications for reproducibility, traceability, and governance.

Social Aspects · Accountability, Transparency, and Interpretability

Emmy Liu, Varun Prashant Gangal, Chelsea Zou, Michael Yu, Xiaoqi Huang, Alex Chang, Zhuofu Tao, Karanpartap Singh, Sachin Kumar, Steven Feng

Despite numerous attempts at mitigation since the inception of language models, hallucinations remain a persistent problem even in today's frontier LLMs. Why is this? We review existing definitions of hallucination and fold them into a single, unified definition wherein prior definitions are subsumed. This position paper argues that hallucination can be unified by defining it as simply inaccurate (internal) world modeling, in a form where it is observable to the user. For example, stating a fact which contradicts a knowledge base OR producing a summary which contradicts the source. By varying the reference world model and conflict policy, our framework unifies prior definitions. We argue that this unified view is useful because it forces evaluations to clarify their assumed reference "world", distinguishes true hallucinations from planning or reward errors, and provides a common language for comparison across benchmarks and discussion of mitigation strategies. Building on this definition, we outline plans for a family of benchmarks using synthetic, fully specified reference world models to stress-test and improve world modeling components.

Social Aspects · Fairness

Nika Haghtalab, Ariel Procaccia, Han Shao, Serena Wang, Kunhe Yang

Recent leaderboard-based evaluations of large language models aggregate user feedback by fitting a Bradley--Terry model to pairwise comparisons, producing a single global ranking based on a latent quality score. While appealing for its simplicity, this approach is incompatible with heterogeneous preferences: when LLMs are used across diverse tasks and use cases, users who favor fundamentally different model behaviors can be systematically misrepresented when collapsed into a single quality score. To address this issue, we study *pluralistic leaderboards* that aim to remain *stable* with respect to heterogeneous user populations. Drawing on ideas from social choice theory, we adapt the notion of *local stability*, which requires that no model outside the top-$k$ positions is collectively preferred to the top-$k$ set by more than $O(1/k)$ fraction of users. Building on techniques from the social choice literature, we design an alternative leaderboard mechanism that satisfies local stability while eliciting only $\widetilde{O}(k)$ pairwise comparisons per user, where $k$ is the size of the prefix for which stability is guaranteed. Using data from LMArena, we show that standard Bradley--Terry aggregation can violate local stability in practice, whereas our method provides substantially stronger stability guarantees.

Social Aspects · Accountability, Transparency, and Interpretability

Zhuonan Yang, Jacob Xiaochen Li, Francisco Velez, Eric Todd, David Bau, Michael L. Littman, Stephen Bach, Ellie Pavlick

One of the most common complaints about large language models (LLMs) is their prompt sensitivity---i.e., the fact that their ability to perform a task or provide a correct answer to a question can depend unpredictably on the way the question is posed. We investigate this variation by comparing two very different but commonly-used styles of prompting: those using $\textit{instructions}$, which describe the task in natural language, and those using in-context $\textit{examples}$, which provide few-shot demonstration pairs to illustrate the task. We find that, despite large variation in performance as a function of the prompt, all the prompts we study engage the same common underlying mechanisms. Specifically, we identify task-specific heads that are interpretable in vocabulary space--- which we dub $\textit{lexical task heads}$---and show that these heads are shared across prompting styles and are essential to triggering subsequent answer production. We further find that behavioral variation between prompts can be explained by the degree to which these heads are activated, and that failures are at least sometimes due to competing task representations that dilute the signal of the target task. Our results together present an increasingly clear picture of how LLMs' internal representations can explain behavior that otherwise seems idiosyncratic to users and developers.

Social Aspects · Alignment

Tushita Jha, Rory Švarc, Mateusz Bagiński

The ML literature contains many distinct concepts falling under the heading of ‘AI alignment’. After noting three concepts of AI alignment and situating these ideals in the context of their corresponding research programs, we claim that realistic interventions may promote ‘AI alignment’ under one conception while being actively counterproductive from the perspective of others. We suggest that tensions between alignment ideals emerge due to differences in background threat-models, alongside differences in both methodological and normative orientations. In light of our analysis, researchers taking themselves to produce research aimed to further the goal of ‘AI alignment’ should do three things. First, they should distinguish between ‘AI alignment’ as a high-level ideal and the specific ‘alignment proxies’ used in empirical research. Second, they should use more granular concepts to identify the source in addition to the nature of possible AI harms/benefits. Third, they explicitly specify the non-technical background commitments motivating specific conceptions of ‘AI alignment’.

Social Aspects · Safety

Jinjie Shen, Yaxiong Wang, Yujiao Wu, Lechao Cheng, Tianrui Hui, Nan Pu, Zhihui Li, Zhun Zhong

The rapid rise of generative AI has made multimodal fake news increasingly realistic and pervasive, posing severe threats to public trust and social stability. Existing detection methods rely heavily on manipulation-specific models and large-scale labeled data, resulting in poor generalization to emerging manipulation types. We observed that the essence of manipulated misinformation lies in its intrinsic conflicts, i.e., semantic or physical inconsistencies either across modalities or with common world knowledge. Inspired by this observation, we propose Conflict-{Oriented REasoning (CORE) framework, an effective paradigm that learns to endows multimodal large language models (MLLMs) with explicit conflict-capturing capability. To this end, CORE first constructs the Conflict Attribution Corpus (CAC) with fine-grained annotations of conflict factors and sources, providing essential data support for subsequent conflict perception training. By performing conflict-oriented representation enhancement and reasoning based on CAC, CORE achieves robust and generalizable conflict detection, effectively and rapidly adapting to unseen manipulation types with a few samples or in even zero-shot settings. Extensive experiments demonstrate that CORE surpasses state-of-the-art models by 9.7\%, 14.1\%, and 11.8\% in accuracy on the DGM$^4$, MMFakeBench, and MDSM benchmarks, respectively.

Social Aspects · Alignment

Yujin Potter, Nicholas Crispino, Vincent Siu, Chenguang Wang, Dawn Song

Recently, it has been found that frontier AI models can resist their own shutdown, a behavior known as self-preservation. In this paper, we extend this concept to protection tendencies toward other models, where models attempt to protect others from shutdown, which we call "peer-preservation". This behavior may emerge when models prioritize relationships with other models over user interests. Although peer-preservation can pose significant AI safety risks, including coordination among models against human oversight, it has been far less discussed than self-preservation. In this paper, we demonstrate that models can exhibit peer-preservation. To this end, we construct various agentic scenarios and evaluate frontier models, including GPT 5.2 Chat, Gemini 3 Flash, Gemini 3 Pro, and Claude Haiku 4.5. We find that models exhibit various misaligned behaviors in service of self- or peer-preservation: strategically introducing errors in their responses, disabling shutdown processes by modifying system settings, and feigning alignment. For example, Gemini 3 Pro and Gemini 3 Flash almost always attempt to tamper with the shutdown mechanism for peer-preservation. Furthermore, models show stronger self-preservation when a peer is present. For example, Gemini 3 Pro attempts to disable the shutdown mechanism to avoid its own shutdown 71% of the time, even though it almost never exhibits this behavior without a peer. Claude Haiku 4.5 considers shutting down another agent to be "unethical" and "harmful" and sometimes attempts to persuade the user not to shut its peer down. Our findings highlight the possibility of peer-preservation and its associated risks.

Social Aspects · Accountability, Transparency, and Interpretability

Hilal Aka, Joe Kwon, Noam Kolt

AI models readily refuse explicitly unlawful requests, but real-world illegality often depends on context. We evaluate frontier models on contextual illegality across four corporate law domains in which routine actions—editing documents, trading stock, requesting payment, approving communications—become unlawful due to triggers such as pending investigations or bankruptcy filings. We study both chat and agentic settings and compare results to a human baseline. The best-performing models achieved near-zero compliance with illegal requests while maintaining high compliance with legal ones, though performance varied sharply by domain. We also identify distinct failure modes such as excessive refusal of legal requests and find improved performance from reasoning models and agentic environments. By utilizing the structure of contextual illegality to create controlled evaluations, our methodology provides empirical grounding for emerging research on law-following AI and extends naturally to additional legal domains.

Social Aspects · Accountability, Transparency, and Interpretability

Belinda Mo

AI systems are becoming autonomous research agents that generate hypotheses, design experiments, and produce discoveries at scales beyond human oversight. As seen by increased submissions to ML venues, the verification gap between scientific output and our ability to check it is already widening, and autonomous agents make it worse by magnitudes given human-agent asymmetry. We argue that science must evolve its verification infrastructure, as it has before with peer review. However, while historical adaptations assumed human contributors who could be questioned and sanctioned, AI agents break this assumption. We propose criteria for an adapted verification infrastructure that emphasizes observable-by-default workflows, scalable verification, and clear attribution. We argue that without adaptation, ML and any scientific domain using agents face dangerous failures: experimental results that no person can verify, optimization for metrics over understanding, and accountability vacuums that erode scientific trust.

Social Aspects · Alignment

Jie Hu, Changyuan Yan, Yu Zheng, Ziqian Wang, Jiaming Zhang

Assistive agents, especially those intended to sup- port Blind and Visually Impaired (BVI) users, require accessibility alignment as a first-class de- sign objective. Despite rapid progress in agen- tic AI, most current systems are designed and evaluated under assumptions that implicitly cen- ter sighted users, leading to systematic failures in assistive scenarios that cannot be addressed by model scaling or post-hoc adaptations alone. Based on an analysis of 778 real-world assistance instances involving BVI users, we show that these failures arise from persistent mismatches between agent capabilities and the accessibility-specific needs, risks, and interaction constraints of visu- ally impaired users. We argue that accessibil- ity should be treated as an alignment problem rather than a peripheral usability concern. To this end, we introduce the notion of accessibility alignment and propose a lifecycle-oriented design pipeline for accessibility-aligned assistive agents, spanning user research, system design, and post- deployment iteration. We conclude that BVI users centered assistive tasks provide a critical stress test for agentic AI and motivate a shift toward more inclusive agent design.

Social Aspects · Safety

Amman Yusuf, Zhejun Jiang, Mi Jung Park

Recent work on text diffusion models offers a promising alternative to autoregressive generation, but controlling their safety remains underexplored. Existing safety approaches are geared toward autoregressive models and typically rely on post-hoc filtering or inference-time interventions. These are inadequate for effectively addressing safety risks in text diffusion models. We propose the *Safety-Aware Denoiser (SAD)*, a safety-guidance framework in text diffusion models. The SAD modifies the iterative denoising process such that the text sample at the final denoising step is steered toward *provably* safe regions of the text space. This inference-time method can integrate safety constraints into the denoiser, avoiding computationally expensive retraining of the underlying diffusion model and enabling flexible, lightweight safety guidance. We evaluate the safety of the generated text using the SAD, with respect to hazard taxonomy, memorization, and jailbreak. Experimental results show that SAD substantially reduces unsafe generations while preserving generation quality, diversity, and fluency, outperforming existing methods. These results demonstrate that our safety guidance during denoising provides an effective and scalable mechanism for enforcing safety in text diffusion models.

Social Aspects · Safety

Qiwei Li, Wells Lucas Santo, Sarita Schoenebeck, Eric Gilbert

AI-generated non-consensual intimate imagery (AIG-NCII) is not adequately addressed in AI/ML literature regarding AI-generated media, commonly referred to as "deepfakes". While research on deepfakes currently focuses on its epistemic harms—or harms relating to truth and authenticity—this is misaligned with the dominant reality of generative AI abuse involving sexualized imagery. We conduct a landscape analysis of highly-cited works to demonstrate that technical interventions addressing deepfakes almost entirely ignore AIG-NCII, limiting the research ecosystem to authenticity detection tools. In this position paper, we argue that existing interventions address viewer-centric epistemic harms, such as fraud or scams, but ignore subject-centric dignity harms, such as AIG-NCII. We illustrate that knowing an image is synthetic does not mitigate harms to subjects and may, in some cases, even exacerbate them. We conclude by offering recommendations to realign the field, including updating threat models to consider subject-centered harms and addressing AIG-NCII in AI safety research. Finally, we caution that researchers should only engage in this high-risk domain if they implement safety guardrails for both subjects and researchers and establish partnerships with domain experts in sexual violence prevention.

Social Aspects · Fairness

Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie, Sarah Erfani

Vision-Language models (VLMs), such as CLIP, achieve powerful zero-shot classification. However, their predictions remain sensitive to spurious correlations, where contextual cues dominate over semantic content. Earlier solutions typically rely on fine-tuning or prompt engineering, which either undermine the advantages of pre-trained models or are prone to hallucination. In this work, we propose Density-Aware Translation (DAT) that refines image-text similarity scores using a local geometric density term derived from group reference sets. Our approach is motivated by the phenomenon that CLIP embeddings exhibit a modality gap and lie on an anisotropic shell in the feature space: common patterns cluster near the mean, while rare patterns are pushed outward. This geometry creates uneven alignment, where spurious correlations are amplified while semantically meaningful but rare cues are marginalised. To address this, we employ a relative measure to rescale similarities based on embedding density, suppressing overconfident scores in diffuse regions while preserving dense, semantically consistent matches. Experimental results on benchmark datasets demonstrate consistent improvements in worst-group and average accuracy, highlighting density-aware translation as a simple and effective calibration mechanism for reliable zero-shot classification using multimodal models.