Trigger stealthiness is crucial to the effectiveness of backdoor attacks in Large Language Models (LLMs). Current attacks construct triggers at word level, leading to poor stealthiness since removing critical words can drastically alter model output logits, as we observed. This significant fluctuation is different from the stable output on normal data, and thus may expose backdoor attacks. To achieve greater stealthiness, we formalize this observation as a new stealthiness metric, termed Logit Fluctuation (LF), and derive a sufficient condition for stealthy backdoor attack bounded by LF. We then introduce a simple yet effective backdoor attack method, termed BadFreq, which satisfies the stealthiness bound. BadFreq launches an attack at a fine-grained letter level, which is activated when the frequency of letter ‘z’ in the input exceeds a predefined threshold. This method distributes triggers across letters rather than specific words, thereby avoiding reliance on critical words and enhancing stealthiness. We test three LLMs, evaluating five attackers against three defenders across three pattern recognition tasks under seven metrics. BadFreq achieves superior attack performance and the best stealthiness in all metrics, outperforming the second-best attacker by 49% in LF-averaged stealth[Code in <https://anonymous.4open.science/r/BadFreq-5836>.].

Providing extensive context via prompting is vital for leveraging the capabilities of Large Language Models (LLMs). However, lengthy contexts significantly increase inference latency. To mitigate this issue, context compression—particularly soft prompt compression—has emerged as a widely studied solution, which converts long contexts into shorter memory embeddings via a trained compressor. Existing methods typically compress the entire context indiscriminately into a set of memory tokens, requiring the compressor to capture global dependencies and necessitating extensive pre-training data to learn effective patterns. Inspired by the chunking mechanism in human working memory and our empirical observation of spatial specialization within memory embeddings, we propose Parallelized Iterative Compression (PIC). By simply modifying the Transformer’s attention mask, PIC explicitly restricts the receptive field of memory tokens to sequential local chunks, thereby significantly reducing the difficulty of compressor training. Experiments across multiple downstream tasks demonstrate that PIC outperforms competitive baselines while dramatically expediting the training process. Finally, we provide an investigation into the emergence of spatial specialization, revealing how tuning strategies and explicit structural priors shape the latent structure of the memory embeddings.

Large language models (LLMs) generate human-aligned content under certain safety constraints. However, the current known technique “jailbreak prompt” can circumvent safety-aligned measures and induce LLMs to output malicious content. Research on Jailbreaking can help identify vulnerabilities in LLMs and guide the development of robust security frameworks. To circumvent the issue of attack templates becoming obsolete as models evolve, existing methods adopt iterative mutation and dynamic optimization to facilitate more automated jailbreak attacks. However, these methods face two challenges: inefficiency and repetitive optimization, as they overlook the value of past attack experiences. To better integrate past attack experiences to assist current jailbreak attempts, we propose the JailExpert, an automated jailbreak framework, which is the first to achieve a formal representation of experience structure, group experiences based on semantic drift, and support the dynamic updating of the experience pool. Extensive experiments demonstrate that JailExpert significantly improves both attack effectiveness and efficiency. Compared to the current state-of-the-art black-box jailbreak method, JailExpert achieves an average increase of 24% in attack success rate and 2.7 times improvement in attack efficiency.