2026· Annual Meeting of the Association for Computational Linguistics· pp. 23474-23484· 0 citations· 38 references
Computer Science
TL;DR
This paper introduces Search in the Model, a novel training-free framework that performs fine-grained identification and rectification of vulnerable neurons directly within the model, and develops a maximum marginal vulnerability criterion to precisely locate the top-K neurons most responsible for model vulnerability.
Abstract
While neural ranking models (NRMs) have achieved state-of-the-art performance in information retrieval, they remain highly vulnerable to imperceptible adversarial perturbations. Existing defenses are predominantly data-centric , exemplified by adversarial training, which requires constructing large collections of adversarial examples. By treating NRMs as black boxes and indiscriminately optimizing all model parameters, these methods incur substantial computational cost and often degrade performance on clean data due to over-fitting. In this paper, we advocate that adversarial vulnerability is not uniformly distributed across model parameters, but instead originates from specific internal units. We propose a paradigm shift toward a model-centric defense that addresses vulnerability at its architectural source, without requiring costly retraining or adversarial data generation. Specifically, we introduce Search in the Model , a novel training-free framework that performs fine-grained identification and rectification of vulnerable neurons directly within the model. By formulating neuron identification as a ranking problem, we develop a maximum marginal vulnerability criterion to precisely locate the top-K neurons most responsible for model vulnerability, and apply targeted neuronal inverse perturbation to correct them. Extensive experiments on MS MARCO and TREC 19 show
Trained on large corpora of image-text pairs, vision-language models (VLMs) have proven broadly useful across many applications. However, they can still make errors that humans rarely do, particularly when exposed to adversarial inputs crafted to mislead them. Traditional approaches to uncovering such vulnerabilities typically optimize a single input, such as a text prompt, to induce incorrect predictions while remaining plausible to human readers. These methods tend to identify only one or a few high-impact adversarial examples, offering a narrow view of model weaknesses. In contrast, we argue that a Quality-Diversity (QD) perspective is more informative. Rather than searching for a single best attack, QD explicitly aims to generate many high-quality adversarial prompts spanning diverse behaviors and characteristics. This allows us not only to diagnose model weaknesses, but also to characterize which prompts are robust and which are especially fragile. Our experiments show that CVT-MAP-Elites, a QD method integrated into our pipeline, discovers a richer and more diverse set of meaningful adversarial samples than quality-only optimization. Consequently, our approach achieves broader search-space coverage and provides deeper insight into VLM failure modes on text-to-image retrieval tasks in both general and medical domains.
Thai Huy Nguyen, Khoa Tran, Quan Minh Phan et al.· Annual Conference on Genetic...· 0 citations
This work comprehensively investigates computation-efficient strategies to speed up latent adversarial training from two complementary perspectives, and reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations
Neural network repair aims to correct prediction failures caused by multiple security threats—such as backdoor attacks, natural corruptions, and safety property violations—through limited adjustments to model parameters. However, most existing repair methods rely on single-sample, point-to-point correction strategies, overlooking the statistical regularities of the feature space. As a result, they are highly sensitive to the scale of faulty samples and struggle to simultaneously achieve repair generalization and original performance preservation under small-sample settings. To address these limitations, we propose a novel general neural network repair paradigm termed NCCDA (Neuron-wise Class-Conditional Distribution Alignment). The method is grounded in a key insight: prediction failures fundamentally arise from neuron-level internal representations deviating from the high-likelihood regions corresponding to their true classes. NCCDA constructs neuron-wise class-conditional distribution references and formulates the repair process as a joint optimization of distribution alignment and structure preservation. By guiding abnormal representations back to high-likelihood regions while anchoring the structure of normal samples, the method enables efficient and adaptive repair without explicit neuron localization. We theoretically prove a generalization error bound under small-sample settings based on Rademacher complexity, providing formal guarantees. Extensive experiments across 7 benchmark datasets and 38 models, covering three categories of repair tasks, demonstrate that NCCDA consistently outperforms existing methods in repair effectiveness, generalization repair capability (Gene), and original accuracy preservation.
Liming Bao, Yan Wang, Tao Sun· Proceedings of the 32nd ACM...· 0 citations
DSPrompt is proposed, a Dynamic Soft Prompt defense framework that directly reshapes the retriever's embedding semantics, without modifying the retrieval pipeline, and is consistently outperforming existing defense baselines at a fraction of their computational cost.
Chang Liu, Y. Lai, Mingyue Cui et al.· 0 citations
A collaborative adversarial fine-tuning framework that maintains multiple experts during training, enables knowledge exchange through embedding-space harmonization, and consolidates the learned knowledge into a single unified robust model.
Nguyen Duc Thai, Junhao Dong, Sua Qi Rong et al.· 0 citations
It is proved that, under an honest-majority assumption and a representation-level separation condition, RAGSentinel exactly recovers a poison-free majority-sized context.
Yueyang Quan, Anjun Gao, Yu Xia et al.· 0 citations