Xiaojing Liao

Open-source uncensored large language models (ULLMs) are increasingly available in public LLM ecosystems. By removing or weakening safety guardrails, these models can comply with harmful requests, generate unsafe content, and be readily reused in downstream systems. While prior work has demonstrated the misuse potential of individual uncensored models, little has been done to systematically understand the ULLM ecosystem in real-world settings. In this paper, we present a systematic study of the open-source ULLM ecosystem. We analyzed 22,096 ULLMs collected from five major LLM hosting platforms and examined them across five interconnected components: artifacts, development, propagation, governance, and adoption. Our analysis shows that ULLMs are produced through four major methods, supported by a rich ecosystem of publicly available tools and uncensored datasets. We further found that ULLMs propagate widely across platforms, forming 4,457 cross-platform clusters comprising 11,094 models, with Hugging Face serving as the dominant upstream source. We uncovered systemic governance and security gaps, including inconsistent moderation labels applied to ULLMs across platforms, cross-platform propagation of ULLMs flagged with threat indicators, and frequent violations of base-model licensing constraints. ULLMs are also actively deployed in diverse real-world settings, including web applications, GitHub projects, underground forums, and model routing platforms, significantly lowering the barrier to harmful use. Our findings indicate that ULLMs are not isolated model artifacts but components of a broader ecosystem in which supply-chain dynamics, weak governance, and diverse downstream deployments jointly amplify risks.

Legal professionals are essential in analyzing data breach incident reports and guiding the response to comply with data privacy laws and regulations. Their expertise helps mitigate privacy and security risks and prevents failures in privacy compliance. However, little research has been done to understand how legal professionals perceive, react to, and face challenges within the data breach incident reporting procedure. In this study, we conducted a simulated incident report assessment experiment and semi-structured interviews with 33 legal professionals who varied in age, gender, and legal background. We reported the criteria used by legal professionals to identify privacy-related items and also uncovered that the agreement among legal professionals on the concepts of privacy-related items is low. Furthermore, we presented findings regarding the perceptions and strategies of legal professionals concerning legal and regulatory compliance, as well as the key features of incident responses that facilitate efficient analysis of data privacy and security law compliance. After taking into account the challenges and suggestions provided by legal professionals, we concluded this study with recommendations for enhancing the effectiveness of legal compliance analysis for incident responses.

The promotion of illegal drugs has become increasingly prevalent on popular social media platforms such as TikTok, Instagram, and YouTube. Within this ecosystem, miscreants utilize cross-platform referral traffic to advertise and promote illicit drugs. They start by posting illicit drug-promoting comments on upstream social media platforms, attracting potential drug buyers, and then redirecting these buyers to downstream platforms where the actual drug sales take place. To the best of our knowledge, little has been done so far to understand this cross-platform referral traffic for illicit drug promotion and selling on social media platforms, not to mention any effort to systematically identify such referral traffic on social media platforms. In this paper, we designed an automated pipeline for detecting illicit referral traffic and identified 154,753 drug-referral comments and 3,253 drug sellers. Based upon the dataset, we presented the first systematic study on the ecosystem of such cross-platform illicit drug promotion and selling businesses, which sheds light on the strategies and campaigns of illicit drug promotion. These findings provide valuable insights into the broader impact of illicit drug trading activities and highlight the need for increased attention to addressing the associated security concerns in social media platforms.

Thanks to recent advances in machine learning (ML) techniques, Autonomous Driving (AD) has seen significant breakthroughs with enhanced capabilities. However, the susceptibility of ML models to adversarial evasion attacks poses a critical threat, undermining the reliability of autonomous driving systems. Despite efforts by researchers to mitigate these attacks within the AD context, unfortunately, a significant gap persists in fully understanding such adversarial maneuvers, particularly from a driver's perspective. To bridge this gap, we propose Avara, the first unified evaluation platform for assessing human drivers' perceptibility to adversarial attacks in AD contexts. Leveraging Virtual Reality (VR) and eye-tracking technology, Avara captures multi-modal driver awareness data, enabling detailed assessments of driver perception. Our approach integrates three distinct sources of multi-modal awareness evaluation metrics, addressing gaps inherent in previous evaluation strategies. The effectiveness and usability of Avara were validated through a human subject study, where participants engaged actively with the platform and provided extensive feedback on their perception and response to adversarial evasion attacks. Utilizing Avara, we identify an intriguing discovery that the current imperceptibility metrics for adversarial attacks fail to accurately reflect the autonomous vehicle driver's perceptibility.

Privacy label disclosure guideline, which specifies the data usage practices of third-party libraries (TPL), is a valuable resource for iOS app developers to accurately complete their iOS privacy labels. This is particularly important given the mandatory requirement for all apps on the App Store to disclose their data practices via privacy labels. However, it is essential to ensure the accuracy and compliance of these guidelines to ensure that accurate TPL data usage has been provided to app developers. Despite the significance of these guidelines, there is little understanding of how accurate and compliant they are in reflecting the actual data practices of third-party libraries used in iOS apps. To address this issue, our study implements a tool called Colaine to automatically check the compliance of privacy label disclosure guidelines, taking into account the configurable data practices in TPLs. Colaine analyzed 107 TPLs associated with 1,605 different configurations, shedding light on the prevalence and seriousness of privacy label disclosure guideline non-compliance issues.

Third-party libraries (TPLs) are extensively integrated into mobile apps for functionalities such as analytics, advertising, app monetization, and single-sign-on. While these libraries enhance app capabilities, they also introduce privacy risks and compliance issues. Existing privacy disclosures for TPLs, including privacy policies, privacy label guidelines, and privacy manifests, often lack uniformity, fine granularity, and timeliness, and fail to comprehensively disclose TPL data practices. We propose the Privacy Bill of Materials (PBOM), inspired by the Software Bill of Materials (SBOM), to enhance transparency, traceability, and accountability of TPLs. Our contributions include designing PBOM specifications, creating an automated PBOM generation pipeline, and conducting case studies to demonstrate PBOM's effectiveness in improving TPL transparency and accountability.

Verifiable robust machine learning, as a new trend of ML security defense, enforces security properties (e.g., Lipschitzness, Monotonicity) on machine learning models and achieves satisfying accuracy-security trade-off. Such security properties identify a series of evasion strategies of ML security attackers and specify logical constraints on their effects on a classifier (e.g., the classifier is monotonically increasing along some feature dimensions). However, little has been done so far to understand the side effect of those security properties on the model privacy. In this paper, we aim at better understanding the privacy impacts on security properties of robust ML models. Particularly, we report the first measurement study to investigate the model stolen risks of robust models satisfying four security properties (i.e., LocalInvariance, Lipschitzness, SmallNeighborhood, and Monotonicity). Our findings bring to light the factors that influence model stealing attacks and defense performance on models trained with security properties. In addition, to train an ML model satisfying goals in accuracy, security, and privacy, we propose a novel technique, called BoundaryFuzz, which introduces a privacy property into verifiable robust training frameworks to defend against model stealing attacks on robust models. Experimental results demonstrate the defense effectiveness of BoundaryFuzz.