Yuwei Li

Existing architectural backdoors embed malicious logic directly into model structures to persist after clean training, but they typically rely on handcrafted trigger patterns vulnerable to preprocessing and lack the mechanism to dynamically update attack targets. Addressing these limitations, this paper proposes ArchLock, a dynamic-target architectural backdoor framework designed exclusively for stateful inference deployments that maintain persistent mutable state across requests. ArchLock comprises two core components: a correlation-based statistical trigger detector that utilizes local red-green channel Pearson correlations as the activation signal, thereby reducing dependence on absolute pixel values and exhibiting theoretical invariance to linear transformations; and an Adaptive Confidence Calibration module, which maintains a persistent memory buffer to enable post-deployment target switching through a two-phase protocol. Extensive experiments on CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100 demonstrate that ArchLock achieves a dynamic target success rate exceeding 90% while preserving clean accuracy. Furthermore, the method exhibits robustness against fine-tuning and pruning and evades three behavioral detectors under the stated stateful deployment assumptions. This work highlights the security risks of mutable architectural components in stateful inference services while explicitly discussing the limitations of the proposed approach under stateless deployment and aggressive preprocessing conditions.

Mixture-of-experts (MoE) architectures have become the dominant paradigm for scaling open-source large language models, yet their security implications remain insufficiently understood. Recent studies reveal that MoE safety alignment is concentrated in specific ``safety experts'' and ``safety neurons'', but existing methods require modifying model internals, limiting practical applicability. We identify that a small number of critical tokens in harmful prompts disproportionately activate safety experts at specific layers. Motivated by this insight, we propose ClearCut, a prefix-based jailbreak method that exploits this architectural vulnerability through input manipulation alone while remaining mechanistically interpretable. Specifically, ClearCut optimizes a short, semantically natural prefix with a hybrid contrastive-suppression loss that redirects these tokens away from safety experts, bypassing safety alignment without any modification to model weights. Across six mainstream MoE models, ClearCut achieves an average success rate of 64.6\%, outperforming GCG (45.1\%) and AutoDAN (51.2\%), while approaching GateBreaker (61.5\%) which requires model modification. The prefix averages only 5.77 tokens, substantially shorter than existing approaches. By identifying critical tokens and tracking routing changes, ClearCut provides interpretable pathways that reveal how MoE safety mechanisms function. This work exposes a fundamental security risk in MoE architectures, that safety experts can be disproportionately activated and manipulated by a small number of critical tokens. Beyond identifying this vulnerability, we provide ClearCut as a practical tool for security evaluation.

Large language models (LLMs) have demonstrated significant utility in a wide range of applications; however, their deployment is plagued by security vulnerabilities, notably jailbreak attacks. These attacks manipulate LLMs to generate harmful or unethical content by crafting adversarial prompts. While much of the current research on jailbreak attacks has focused on single-turn interactions, it has largely overlooked the impact of historical dialogues on model behavior. Although recent studies have explored multi-turn jailbreak attacks, they generally assume that the attacker can only manipulate the user prompt. In contrast, we highlight that an attacker can also control the model’s previous outputs. To this end, we introduce DIA, a new paradigm that leverages fabricated dialogue history to enhance jailbreak effectiveness. DIA operates in a black-box setting, requiring only access to the chat API or knowledge of the LLM’s chat template. We propose two methods for constructing adversarial historical dialogues: one adapts gray-box prefilling attacks, and the other exploits deferred responses. Our experiments demonstrate that DIA achieves state-of-the-art attack success rates on recent LLMs, including Llama-3.1 and GPT-4o. Additionally, we show that DIA can bypass 6 different defense mechanisms, highlighting its robustness.

Internet of Things (IoT) devices, now integral to our daily routines, offer unparalleled convenience but also face mounting security threats. Embedded web services, prevalent in public networks, pose a major risk to these devices. While research has focused on detecting vulnerabilities in IoT embedded web services, it has overlooked the presence of invisible interfaces, which have emerged as significant security threats. In this article, we propose InvRadar, a novel framework for detecting vulnerabilities in invisible interfaces of embedded web services in IoT devices. Specifically, InvRadar identifies invisible interfaces by analyzing the differences between the front-end visible interface keywords and the back-end interface keywords through a correlation analysis method. Subsequently, InvRadar uses a static taint analysis method to detect the vulnerabilities that can be triggered by the invisible interfaces. To validate the performance of InvRadar, we conduct extensive experiments and compare InvRadar with the state-of-the-art methods. In testing 13-device firmware, InvRadar identifies 1793 invisible interfaces and detects 124 vulnerabilities, including 53 newly discovered ones, with 34 receiving new CVE/CNVD IDs. In addition, InvRadar outperforms the state-of-the-art methods in interface keyword extraction, border binary, and data ingestion function identification.

Identifying network protocol vulnerabilities is critical for cyberspace security. Generation-based black-box protocol fuzzing is widely used but faces challenges: over-reliance on manual protocol analysis and script writing, single-threaded fuzzing, and lack of dynamic fuzzing strategy optimization. To address these, we propose LLM-Boofuzz, a generation-based black-box protocol fuzzing framework via Large Language Models (LLMs). It leverages LLMs to parse real traffic to extract protocol information, guides LLMs to generate executable scripts with a repair mechanism, and enables multi-script iterative fuzzing via an LLM-based agent. Experiments show that LLM-Boofuzz outperforms state-of-the-art tools: it triggers all 15 test vulnerabilities (vs. 8/7/7 for Boofuzz/Snipuzz/AFLNet) and achieves an average 53.4% code line coverage on two protocol programs (vs. 30.65%/31.95%/41.65%), providing an efficient solution for network protocol fuzzing.

Deep learning (DL) frameworks serve as the backbone for a wide range of artificial intelligence applications. However, bugs within DL frameworks can cascade into critical issues in higher-level applications, jeopardizing reliability and security. While numerous techniques have been proposed to detect bugs in DL frameworks, research exploring common API patterns across frameworks and the potential risks they entail remains limited. Notably, many DL frameworks expose similar APIs with overlapping input parameters and functionalities, rendering them vulnerable to shared bugs, where a flaw in one API may extend to analogous APIs in other frameworks. To address this challenge, we propose MirrorFuzz, an automated API fuzzing solution to discover shared bugs in DL frameworks. MirrorFuzz operates in three stages: First, MirrorFuzz collects historical bug data for each API within a DL framework to identify potentially buggy APIs. Second, it matches each buggy API in a specific framework with similar APIs within and across other DL frameworks. Third, it employs large language models (LLMs) to synthesize code for the API under test, leveraging the historical bug data of similar APIs to trigger analogous bugs across APIs. We implement MirrorFuzz and evaluate it on four popular DL frameworks (TensorFlow, PyTorch, OneFlow, and Jittor). Extensive evaluation demonstrates that MirrorFuzz improves code coverage by 39.92% and 98.20% compared to state-of-the-art methods on TensorFlow and PyTorch, respectively. Moreover, MirrorFuzz discovers 315 bugs, 262 of which are newly found, and 80 bugs are fixed, with 52 of these bugs assigned CNVD IDs.

Cyberspace search engines (CSEs) are systems designed to search and index information about cyberspace assets. Effectively mining data across diverse platforms is hindered by the complexity and diversity of different CSE syntaxes. While Text-to-CSEQL offers a promising solution by translating natural language (NL) questions into cyberspace search engine query language (CSEQL), existing prompt-based methods still struggle due to the platform-specific intricacies of CSEQL. To address this limitation, we propose an LLM-based approach leveraging Retrieval-Augmented Generation (RAG). Specifically, to overcome the inability of traditional methods to retrieve relevant syntax fields effectively, we propose a novel hybrid retrieval mechanism combining keyword and dense retrieval, leveraging both field values and their semantic descriptions. Furthermore, we integrate these retrieved fields and the relevant few-shot examples into a redesigned prompt template adapted from the COSTAR framework. For comprehensive evaluation, we construct a Text-to-CSEQL dataset and introduce a new domain-specific metric, field match (FM). Extensive experiments demonstrate our method’s ability to adapt to platform-specific characteristics. Compared to prompt-based methods, it achieves an average accuracy improvement of 43.15% when generating CSEQL queries for diverse platforms. Moreover, our method also outperforms techniques designed for single-platform CSEQL generation.