LLM-based fact-checking verifies complex claims through decomposition, retrieval, and reasoning aggregation. Existing methods expand verification inputs to cover more factual conditions, but added fragments can be redundant or misleading, compete with decisive evidence, and bias predictions toward surface relevance. Debiasing methods mitigate this bias by estimating shortcut effects from claim-side cues or biased signals in constructed inputs. However, because they calibrate verifier predictions after input construction, they are not designed to repair missing or noisy verification states. Thus, complex fact-checking should balance factual coverage and noise control during verification-state construction. We propose ERGA, an Explorer–Refiner Game with Backdoor-Adjusted Verdict Aggregation. ERGA formulates verification as editable state construction, initializing the state from decomposed verification units, retrieved evidence, and local analyses. It then runs an adversarial Explorer–Refiner game over this state: the Explorer strengthens under-covered factual signals, while the Refiner merges redundancy and separates weak or misleading fragments. Through this game interaction, ERGA obtains a refined state with a better coverage–noise balance and a removed fragment record. For verdict aggregation, ERGA uses the removed-fragment record to condition verifier predictions and aggregates them in a backdoor-adjusted form to reduce residual shortcut effects. Experiments on HoVer and FEVEROUS-S show that ERGA outperforms strong baselines.

Large language model agents in social deduction games must reason and speak under hidden roles, shifting public beliefs, and social pressure. Existing methods mainly target final win rate through strategic prompting, belief modeling, or reinforcement learning, but they leave the utterance-level trade-off between belief correction and social risk largely implicit. In false-consensus intervention, useful private information can move the group toward the truth, while poorly timed or overly direct speech can trigger suspicion or rejection. We propose PACR-Pro, a risk-aware rhetorical decision framework for false-consensus intervention. PACR-Pro maps each speaking step to consensus-conflict encoding, structured candidate-action generation, Pareto-based selection, and risk-adaptive utterance realization. A dual-branch Epistemic-Social Critic scores candidate actions, and a state-conditioned 𝜆 policy adjusts the trade-off between epistemic value and social safety. We train these decision modules offline from historical games and evaluate PACR-Pro on One Night Ultimate Werewolf (ONUW) as the test platform. Experiments on standard ONUW games and the Wolf-Pack Induction Benchmark show that PACR-Pro achieves the best mixed-agent win rate, the highest attack win rate, the lowest attack vote rate, and the smallest attack-control win-rate gap among all baselines.

Text understanding application often suffers from domain shifts. To handle testing domains, domain adaptation (DA) is trained to adapt to a fixed and observed testing domain; a more challenging paradigm, test-time adaptation (TTA), cannot access the testing domain during training and online adapts to the testing samples during testing, where the samples are from a fixed domain. We aim to explore a more practical and underexplored scenario, continual test-time adaptation (CTTA) for text understanding, which involves a sequence of testing (unobserved) domains in testing. Current CTTA methods struggle in reducing error accumulation over domains and enhancing generalization to handle unobserved domains: 1) Noise-filtering reduces accumulated errors but discards useful information, and 2) accumulating historical domains enhances generalization, but it is hard to achieve adaptive accumulation. In this paper, we propose a CTTA-T (continual test-time adaptation for text understanding) framework adaptable to evolving target domains: CTTA-T adopts a teacher-student framework, where the teacher is equipped with domain awareness and generalization for evolving domains. To improve teacher predictions, we propose a refine-then-filter based on dropout-driven consistency, which calibrates predictions and removes unreliable guidance. For the adaptation–generalization trade-off, we construct a domain-aware teacher by dynamically accumulating cross-domain semantics via incremental PCA, which continuously tracks domain shifts. Experiments show CTTA-T excels baselines.

LLMs demonstrate remarkable utility but remain vulnerable to jailbreak attacks that aim to elicit harmful responses. Existing defenses, including post-training alignment and prompt engineering, rely on training on safety-annotated datasets and safe prompt templates, struggling with adaptability to out-of-distribution (OOD) attacks. Steering internal representations of LLMs provides real-time adjustments to defend against OOD attacks. However, it struggles with maintaining model utility, since modifying the representation disrupts the forward pass of inference. It barely considers the competitive objectives of helpfulness and harmlessness in LLMs. We argue that adversarial game-based approaches promise a solution for conflicts between the two objectives. In this paper, we propose Adversarial Game Defense (AGD), an adversarial game-based defense method that dynamically adjusts LLMs’ internal representations to achieve a balanced trade-off between helpfulness and harmlessness. AGD first proposes an interquartile range (IQR) method to detect abnormal attention weights and correct the abnormal weights via adversarial training. AGD adopts a bi-level optimization to play a two-player variable-sum game to approach Nash Equilibrium (NE), where the two players adversarially refine head activations for helpfulness and harmlessness respectively. Furthermore, AGD applies an expert model to next-token sampling to generate safer responses. Experiments show that AGD significantly improves LLMs’ safety over all baselines.