The rapid maturation of zero-shot Text-to-Speech (TTS) models has turned high-quality voice cloning into a widely available capability, raising acute concerns over unauthorised replication, fine-tuning and resale of proprietary speech models. Yet ownership verification for TTS remains largely open: speech is a continuous waveform whose perturbations are easily destroyed by routine signal processing, and the human auditory system imposes a much tighter perceptual budget than vision. We present TTS-Guard, a black-box ownership verification framework for TTS models built on adversarial speaker-pair fingerprints. TTS-Guard(i) selects key speaker pairs in a dual embedding space for architecture-agnostic stealth;(ii) optimises a perturbation through an adaptive curriculum of shadow models covering fine-tuning, pruning, quantisation and distillation; and (iii) aggregates black-box queries into a calibrated Verification Confidence Score. On five mainstream TTS systems, TTS-Guard reaches an average Fingerprint Success Rate of 96.4% at a False Positive Rate of 5.8%, while preserving intelligibility and naturalness. The fingerprint remains effective against ten audio attacks, six model modifications, and two state-of-the-art adversarial purifiers.

When a language model hallucinates, the final answer is wrong, but the mistake is not necessarily invisible inside the model. Different internal pathways may remain uncertain, disagree in how quickly they sharpen, or commit to competing continuations before the output is produced. We introduce TriLens, a white-box detector that turns this intuition into a compact representation: at every layer, it reads the multi-head self-attention output, the feed-forward output, and the residual stream through the model’s own logit lens, then records only the entropy of each readout. The resulting 3L-dimensional trajectory describes how certainty forms across depth and across modules, without storing high-dimensional hidden states or sampling multiple generations. This simple signal yields a strong detector across instruction-tuned LLMs and QA benchmarks, and our analyses show that the three module-wise entropy trajectories provide complementary evidence. TriLens suggests that hallucination detection can benefit from tracking how internal computation settles, not only what the final layer predicts. The code is available at https://tosakaucw.github.io/TriLens/.

A model can know when two events occurred yet still answer which came first incorrectly. Multi-hop QA accuracy conflates such composition errors with missing facts. We introduce a double-gate protocol for temporal factual chains and evaluate a case for composition only if the model (i) answers every constituent fact correctly across paraphrased probes and (ii) answers every aligned sub-question correctly in isolation. If the original multi-hop answer remains incorrect, the case is a residual composition failure; we call the systematic occurrence of such failures composition collapse. On D4v2, a benchmark of 390 temporal chains, two post-trained models differ by only 0.3 percentage points in atomic stability yet by 47.4 points in depth-2 (two-fact) residual failure. In a controlled same-base comparison, outcome-verified reinforcement learning reduces depth-4 residual failure by 54 points relative to reasoning-trace SFT under matched data and LoRA budget. On 80 examples that pass both gates for every GRPO variant, failure decreases monotonically, showing that model-specific gate subsets are unlikely to drive the trend. Finally, chain-of-thought decoding recovers 70–75% of gate-passing failures, consistent with an important role for inference-time computation. These results motivate reporting atomic stability and gate-controlled composition separately when evaluating multi-hop reasoning.

While Large Language Models (LLMs) have achieved remarkable performance, they remain vulnerable to jailbreak. The integration of Large Language Models (LLMs) with external tools via protocols such as the Model Context Protocol (MCP) introduces critical security vulnerabilities, including prompt injection, data exfiltration, and other threats. To counter these challenges, we propose MCP-Guard, a robust, layered defense architecture designed for LLM–tool interactions. MCP-Guard employs a three-stage detection pipeline that balances efficiency with accuracy: it progresses from lightweight static scanning for overt threats and a deep neural detector for semantic attacks, to our fine-tuned E5-based model achieves 96.01% accuracy in identifying adversarial prompts. Finally, an LLM arbitrator synthesizes these signals to deliver the final decision. To enable rigorous training and evaluation, we introduce MCP-AttackBench, a comprehensive benchmark comprising 70,448 samples augmented by GPT-4. This benchmark simulates diverse real-world attack vectors that circumvent conventional defenses in the MCP paradigm, thereby laying a solid foundation for future research on securing LLM-tool ecosystems.

While Large Language Models (LLMs) have achieved remarkable performance, they remain vulnerable to jailbreak attacks that circumvent safety constraints. Existing strategies, ranging from heuristic prompt engineering to computationally intensive optimization, often face significant trade-offs between effectiveness and efficiency. In this work, we propose Contextual Representation Ablation (CRA), a novel inference-time intervention framework designed to dynamically silence model guardrails. Predicated on the geometric insight that refusal behaviors are mediated by specific low-rank subspaces within the model’s hidden states, CRA identifies and suppresses these refusal-inducing activation patterns during decoding without requiring expensive parameter updates or training. Empirical evaluation across multiple safety-aligned open-source LLMs demonstrates that CRA significantly outperforms baselines. By revealing that safety constraints can be surgically ablated from internal representations, our findings expose the intrinsic fragility of current alignment mechanisms and underscore the urgent need for more robust latent-space defenses.

The protection of Intellectual Property (IP) for Large Language Models (LLMs) has become a critical concern as model theft and unauthorized commercialization escalate. While adversarial fingerprinting offers a promising black-box solution for ownership verification, existing methods suffer from significant limitations: they are fragile against downstream model modifications, sensitive to system prompt variations, and easily detectable due to high-perplexity input patterns. In this paper, we propose SRAF, a stealthy and robust adversarial fingerprinting framework. SRAF employs a synergistic joint optimization strategy across homologous model variants and diverse chat templates, forcing the fingerprint to anchor onto the invariant intrinsic comprehension features of the model family. Furthermore, we introduce a Perplexity Hiding technique that embeds adversarial perturbations within Markdown tables, effectively aligning the prompt’s statistics with natural language to evade perplexity-based detection. Extensive experiments across multiple model families and parameter scales demonstrate that SRAF significantly enhances robustness against fine-tuning, alignment, pruning, merging, and input perturbations while maintaining exceptional stealthiness and low false-positive rates, offering a practical and resilient black-box solution for LLM ownership verification.

When retrieved evidence contradicts parametric memory, language models frequently ignore the context and revert to memorized priors—a failure that undermines the purpose of retrieval augmentation. Contrastive decoding amplifies context-conditioned output to suppress parametric bias, but fixed coefficients cannot track changing disagreement, while output-only adaptive coefficients observe only the final prediction distributions. We propose FIDES (Faithful Inference via Deep Evidence Signals), a training-free decoder that combines signals from output distributions, hidden representations, and prediction trajectories to recompute contrastive intervention strength at every step. A matched, formula-verified audit on 128 NQ-Swap pairs shows that conflict raises Opposition by 0.0969 and the resulting coefficient α by 0.0727 at the same answer-prediction position (both p < 10⁻⁴). The audit also finds only a small Shift effect and saturated clipped Noise, clarifying the limits of the mechanism interpretation. Across three benchmarks and six backbones—four primary 7B/8B models and two scaling backbones up to 70B—FIDES achieves the best context fidelity in all 18 settings, outperforming the strongest training-free baseline by +3 to +13 points. At 70B, fidelity reaches 92–94% while F1 reaches 62–63%, showing that multi-depth stepwise contrast can preserve generation utility while improving evidence following.

This paper studies the problem of misclassification detection for vision-language models (VLMs), which aims to identify samples wrongly assigned by the pre-trained VLM. Previous works usually focus on exploring the latent space and measuring pairwise similarity scores for confidence estimation. However, these similarity scores can be biased for boundary points with different fine-grained features. To address this issue, this paper proposes an approach named Distribution-aware Prototypical Calibration with Fine-grained Voting (DECENT). The core idea of DECENT is to utilize probabilistic distributions to characterize both the semantics of the test image and its corresponding class prototype. Specifically, we first conduct clustering within each class in the latent space to construct a distribution of fine grained prototypes. More importantly, multiple augmented views of the test image are considered as samples from its underlying semantic distribution. Then, we measure the distribution distance between the image’s underlying semantic distribution and its neighboring fine grained prototype distributions, which is aggregated via fine-grained voting into a distributional score. This score can be fused with the VLM’s semantic alignment score to significantly enhance misclassification detection sensitivity, or to improve overall classification robustness. Extensive experiments on benchmark datasets validate the dual effectiveness of the proposed DECENT.

Addressing the intellectual property protection challenges in commercial deployment of large language models (LLMs), existing black-box fingerprinting techniques face dual challenges from incremental fine-tuning erasure and feature-space defense due to their reliance on overfitting high-perplexity trigger patterns. We firstly reveal that, model editing in the fingerprint domain exhibits unique advantages including significantly lower false positive rates, enhanced harmlessness, and superior robustness. Building on this foundation, this paper innovatively proposes a Prefix-enhanced Fingerprint Editing Framework (PREE), which encodes copyright information into parameter offsets through dual-channel knowledge edit to achieve covert embedding of fingerprint features. Experimental results demonstrate that the proposed solution achieves the 90% trigger precision in mainstream architectures including LLaMA-3 and Qwen-2.5. The minimal parameter offset (change rate < 0.03) effectively preserves original knowledge representation while demonstrating strong robustness against incremental fine-tuning and multi-dimensional defense strategies, maintaining zero false positive rate throughout evaluations.

The proliferation of large language models (LLMs) has intensified concerns over model theft and license violations, necessitating robust and stealthy ownership verification. Existing fingerprinting methods either require impractical white-box access or introduce detectable statistical anomalies. We propose EverTracer, a novel gray-box fingerprinting framework that ensures stealthy and robust model provenance tracing. EverTracer is the first to repurpose Membership Inference Attacks (MIAs) for defensive use, embedding ownership signals via memorization instead of artificial trigger-output overfitting. It consists of Fingerprint Injection, which fine-tunes the model on any natural language data without detectable artifacts, and Verification, which leverages calibrated probability variation signal to distinguish fingerprinted models. This approach remains robust against adaptive adversaries, including input level modification, and model-level modifications. Extensive experiments across architectures demonstrate EverTracer’s state-of-the-art effectiveness, stealthness, and resilience, establishing it as a practical solution for securing LLM intellectual property.

Large Language Models (LLMs) have become increasingly prevalent across various sectors, raising critical concerns about model ownership and intellectual property protection. Although backdoor-based fingerprinting has emerged as a promising solution for model authentication, effective attacks for removing these fingerprints remain largely unexplored. Therefore, We present Mismatched Eraser (MEraser), a novel method for effectively removing backdoor-based fingerprints from LLMs while maintaining model performance. Our approach leverages a two-phase fine-tuning strategy utilizing carefully constructed mismatched and clean datasets. Through extensive evaluation across multiple LLM architectures and fingerprinting methods, we demonstrate that MEraser achieves complete fingerprinting removal while maintaining model performance with minimal training data of fewer than 1,000 samples. Furthermore, we introduce a transferable erasure mechanism that enables effective fingerprinting removal across different models without repeated training. In conclusion, our approach provides a practical solution for fingerprinting removal in LLMs, reveals critical vulnerabilities in current fingerprinting techniques, and establishes comprehensive evaluation benchmarks for developing more resilient model protection methods in the future.