Search

Alignment in large language models (LLMs) is used to enforce guidelines such as safety. Yet, alignment fails in the face of jailbreak attacks that modify inputs to induce unsafe outputs. In this paper, we present and evaluate a method to assess the robustness of LLM alignment. We observe that alignment embeds a safety classifier in the target model that is responsible for deciding between refusal and compliance. We seek to extract an approximation of this classifier, called a surrogate classifier, from the LLM. We develop an algorithm for identifying candidate classifiers from subsets of the LLM model. We evaluate the degree to which the candidate classifiers approximate the model's embedded classifier in benign (F1 score) and adversarial (using surrogates in a white-box attack) settings. Our evaluation shows that the best candidates achieve accurate agreement (an F1 score above 80%) using as little as 20% of the model architecture. Further, we find attacks mounted on the surrogate models can be transferred with high accuracy. For example, a surrogate using only 50% of the Llama 2 model achieved an attack success rate (ASR) of 70%, a substantial improvement over attacking the LLM directly, where we only observed a 22% ASR. These results show that extracting surrogate classifiers is a viable (and highly effective) means for modeling (and therein addressing) the vulnerability of aligned models to jailbreaking attacks.

Gravitational wave (GW) observations of binary black hole (BBH) coalescences provide a unique opportunity to test general relativity (GR) in the strong-field regime. To ensure the reliability of these tests, it is essential to identify and address potential sources of error, particularly those arising from missing physics in the waveform models used in GW data analysis. This paper investigates potential biases in these tests arising from strong gravitational lensing, an effect not currently incorporated into the standard framework for GR tests. In the geometric optics approximation, strong lensing produces three types of images: Type I, Type II, and Type III. While Type I and Type III images do not distort the signal, Type II images introduce a characteristic phase shift that can mimic GR deviations for signals with higher-order modes, precession, or eccentricity. We assess the response of four standard GR tests on simulated Type II lensed BBH signals, including the two parameterized tests (TIGER and FTI), the modified dispersion relation test and the inspiral-merger-ringdown consistency test. We focus on precessing waveforms for binaries with total masses of $20M_{\odot}$ and $80M_{\odot}$, and dimensionless spins of 0.5 and 0.95, considering a fixed signal-to-noise ratio of 25 using the design A+ sensitivity of the LIGO-Virgo network. Our findings indicate that more mass-asymmetric and higher-spin binaries show larger false deviations from GR in the TIGER and modified dispersion relation tests when applying GR tests to Type II lensed signals. These results highlight the risk of false GR violations as detector sensitivity improves in future observational runs. Therefore, it is crucial to consider the possibility of strong lensing before drawing conclusions about deviations from GR in GW signals.

Bias significantly undermines both the accuracy and trustworthiness of machine learning models. To date, one of the strongest biases observed in image classification models is texture bias-where models overly rely on texture information rather than shape information. Yet, existing approaches for measuring and mitigating texture bias have not been able to capture how textures impact model robustness in real-world settings. In this work, we introduce the Texture Association Value (TAV), a novel metric that quantifies how strongly models rely on the presence of specific textures when classifying objects. Leveraging TAV, we demonstrate that model accuracy and robustness are heavily influenced by texture. Our results show that texture bias explains the existence of natural adversarial examples, where over 90% of these samples contain textures that are misaligned with the learned texture of their true label, resulting in confident mispredictions., Comment: Accepted to IEEE Secure and Trustworthy Machine Learning (SaTML)

Retention of early career teachers is a critical issue in education, with burnout and self-efficacy serving as important precursors to teachers leaving the field. An integration of the PAX Good Behavior Game (GBG; Barrish et al., 1969) and MyTeachingPartner (MTP; Allen et al., 2015) was tested in a randomized controlled trial (RCT) to investigate whether the combined programs would improve long-term outcomes for early career teachers. However, due to the COVID-19 pandemic, there was a higher proportion of missing data and attrition in follow-up data collection than otherwise would have been expected. The current paper focused specifically on intervention impacts on teacher-reported burnout and self-efficacy through the COVID-19 pandemic and explored various approaches for addressing missing data as an illustrative example for other researchers who may similarly have faced missing data challenges due to the pandemic. Participants included in the original trial were N = 188 early career teachers (grades K-3) who were randomly assigned to either the intervention (i.e., GBG+MTP; n = 94 teachers) or control condition (n = 94) and provided baseline data. Specifically, teachers reported on their burnout and self-efficacy at pre-intervention (Fall), post-intervention (Spring), 1-year post intervention (in Fall and Spring), COVID Year 1 (Spring 2021), and COVID Year 2 (Spring 2022). We conducted a series of outcomes analyses under varying missing data assumptions (i.e., MCAR, MAR, NMAR). There were mixed findings (i.e., both null and beneficial) regarding GBG+MTP impacts on burnout, which varied across missing data assumptions; however, there were no GBG+MTP impacts on self-efficacy. This study may also provide insight for other researchers encountering similar challenges when analyzing follow-up data collected during the COVID-19 pandemic, as we highlight pros and cons of several different approaches for modeling missing data related to attrition due to the COVID-19 pandemic and related school closures. [This paper will be published in "Prevention Science."]

This work concerns an alignment problem that has applications in many geospatial problems such as resource allocation and building reliable disease maps. Here, we introduce the problem of optimally aligning $k$ collections of $m$ spatial supports over $n$ spatial units in a $d$-dimensional Euclidean space. We show that the 1-dimensional case is solvable in time polynomial in $k$, $m$ and $n$. We then show that the 2-dimensional case is NP-hard for 2 collections of 2 supports. Finally, we devise a heuristic for aligning a set of collections in the 2-dimensional case.

The vector electric-field Helmholtz equation, containing cross-polarization terms, is factored to produce both pseudo-differential and exponential operator forms of a three-dimensional, one-way, vector, wave equation for propagation through inhomogeneous media. From this operator factorization we develop a high-order approximate, vector Helmholtz propagator that correctly handles forward-arc, high-angle scattering and diffraction from inhomogeneities at all resolved length scales, and seamlessly includes evanescent waves. A rational approximation/partial fraction decomposition of the exponential operator converts the propagator into a moderate number of large, sparse, linear solves whose results are summed together at each step to advance the electric field in space. We use a new AAA-Lawson rational interpolant for this approximation, rather than the more common Pad\'{e} expansions that have appeared in the seismic and ocean acoustics literature previously. GMRES is used to solve these large systems. A direct-solve, free space propagation method proves to be an effective preconditioner for GMRES, but can also serve as a standalone propagator in homogeneous media. Scalar computational examples shown include plane wave diffraction by a circular aperture and Gaussian beam propagation through sine-product and homogeneous refractive index fields. The sine-product example compares its results to that of paraxial propagation through the same media, and demonstrates the substantial differences between these propagator paradigms when the scale of the inhomogeneities is of the order of the fundamental wavelength in the Helmholtz equation. We also examine the convergence of the homogeneous media beam results to fields generated by Clenshaw-Curtis evaluation of the first Rayleigh-Sommerfeld integral for the same initial conditions., Comment: 29 pages 15 figures

Quantum error correction (QEC) will be essential to achieve the accuracy needed for quantum computers to realise their full potential. The field has seen promising progress with demonstrations of early QEC and real-time decoded experiments. As quantum computers advance towards demonstrating a universal fault-tolerant logical gate set, implementing scalable and low-latency real-time decoding will be crucial to prevent the backlog problem, avoiding an exponential slowdown and maintaining a fast logical clock rate. Here, we demonstrate low-latency feedback with a scalable FPGA decoder integrated into the control system of a superconducting quantum processor. We perform an 8-qubit stability experiment with up to $25$ decoding rounds and a mean decoding time per round below $1$ ${\mu}s$, showing that we avoid the backlog problem even on superconducting hardware with the strictest speed requirements. We observe logical error suppression as the number of decoding rounds is increased. We also implement and time a fast-feedback experiment demonstrating a decoding response time of $9.6$ ${\mu}s$ for a total of $9$ measurement rounds. The decoder throughput and latency developed in this work, combined with continued device improvements, unlock the next generation of experiments that go beyond purely keeping logical qubits alive and into demonstrating building blocks of fault-tolerant computation, such as lattice surgery and magic state teleportation., Comment: 11 pages, 4 figures, Supplementary Information

In this paper, we propose AutoDAN-Turbo, a black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch, without any human intervention or predefined scopes (e.g., specified candidate strategies), and use them for red-teaming. As a result, AutoDAN-Turbo can significantly outperform baseline methods, achieving a 74.3% higher average attack success rate on public benchmarks. Notably, AutoDAN-Turbo achieves an 88.5 attack success rate on GPT-4-1106-turbo. In addition, AutoDAN-Turbo is a unified framework that can incorporate existing human-designed jailbreak strategies in a plug-and-play manner. By integrating human-designed strategies, AutoDAN-Turbo can even achieve a higher attack success rate of 93.4 on GPT-4-1106-turbo., Comment: Pre-print. Project Page: https://autodans.github.io/AutoDAN-Turbo Code: https://github.com/SaFoLab-WISC/AutoDAN-Turbo

Social media posts are frequently identified as a valuable source of open-source intelligence for disaster response, and pre-LLM NLP techniques have been evaluated on datasets of crisis tweets. We assess three commercial large language models (OpenAI GPT-4o, Gemini 1.5-flash-001 and Anthropic Claude-3-5 Sonnet) capabilities in zero-shot classification of short social media posts. In one prompt, the models are asked to perform two classification tasks: 1) identify if the post is informative in a humanitarian context; and 2) rank and provide probabilities for the post in relation to 16 possible humanitarian classes. The posts being classified are from the consolidated crisis tweet dataset, CrisisBench. Results are evaluated using macro, weighted, and binary F1-scores. The informative classification task, generally performed better without extra information, while for the humanitarian label classification providing the event that occurred during which the tweet was mined, resulted in better performance. Further, we found that the models have significantly varying performance by dataset, which raises questions about dataset quality.

The spectroscopic redshift measurement of BL Lac, a class of blazar, is challenging because its spectrum has no or weak emission lines ($\leqslant5\AA$). We estimate the redshift by the photometric dropout technique for a sample of 64 blazars (59 BL Lacs and five blazar candidates of uncertainty type). Two telescopes are utilized to observe the sample: the {\it Swift} space telescope observes sources in $uvw2,\ uvm2,\ uvw1,\ u,\ b,\ v$ filters, while the ground-based telescopes SARA-CT/RM observed sources in $g',\ r,' \ i',\ z'$ filters. The photometric data are obtained using the {\it photozpy} package. We fit the photometric data by the LePhare package and report four new high-$z$ ($z>1.3$) BL Lacs at $2.03^{+0.07}_{-0.05}$, $1.84^{+0.10}_{-0.03}$, $2.04^{+0.16}_{-0.14}$, $2.93^{+0.01}_{-0.04}$ as well as upper limits for 50 sources. The work increased the number of high-$z$ BL Lacs found by this method up to 23. The high-$z$ sources are discussed in the context of the cosmic gamma-ray horizon, blazar sequence, Fermi blazar divide, and masquerading BL Lacs., Comment: Updated the CGRH plot

The influence of textures on machine learning models has been an ongoing investigation, specifically in texture bias/learning, interpretability, and robustness. However, due to the lack of large and diverse texture data available, the findings in these works have been limited, as more comprehensive evaluations have not been feasible. Image generative models are able to provide data creation at scale, but utilizing these models for texture synthesis has been unexplored and poses additional challenges both in creating accurate texture images and validating those images. In this work, we introduce an extensible methodology and corresponding new dataset for generating high-quality, diverse texture images capable of supporting a broad set of texture-based tasks. Our pipeline consists of: (1) developing prompts from a range of descriptors to serve as input to text-to-image models, (2) adopting and adapting Stable Diffusion pipelines to generate and filter the corresponding images, and (3) further filtering down to the highest quality images. Through this, we create the Prompted Textures Dataset (PTD), a dataset of 362,880 texture images that span 56 textures. During the process of generating images, we find that NSFW safety filters in image generation pipelines are highly sensitive to texture (and flag up to 60\% of our texture images), uncovering a potential bias in these models and presenting unique challenges when working with texture data. Through both standard metrics and a human evaluation, we find that our dataset is high quality and diverse.

The proliferation of open source software (OSS) and different types of reuse has made it incredibly difficult to perform an essential legal and compliance task of accurate license identification within the software supply chain. This study presents a reusable and comprehensive dataset of OSS licenses, created using the World of Code (WoC) infrastructure. By scanning all files containing "license" in their file paths, and applying the approximate matching via winnowing algorithm to identify the most similar license from the SPDX list, we found and identified 5.5 million distinct license blobs in OSS projects. The dataset includes a detailed project-to-license (P2L) map with commit timestamps, enabling dynamic analysis of license adoption and changes over time. To verify the accuracy of the dataset we use stratified sampling and manual review, achieving a final accuracy of 92.08%, with precision of 87.14%, recall of 95.45%, and an F1 score of 91.11%. This dataset is intended to support a range of research and practical tasks, including the detection of license noncompliance, the investigations of license changes, study of licensing trends, and the development of compliance tools. The dataset is open, providing a valuable resource for developers, researchers, and legal professionals in the OSS community.

The Tor anonymity network allows users such as political activists and those under repressive governments to protect their privacy when communicating over the internet. At the same time, Tor has been demonstrated to be vulnerable to several classes of deanonymizing attacks that expose user behavior and identities. Prior work has shown that these threats can be mitigated by leveraging trusted execution environments (TEEs). However, previous proposals assume that all relays in the network will be TEE-based-which as a practical matter is unrealistic. In this work, we introduce ParTEETor, a Tor-variant system, which leverages partial deployments of TEEs to thwart known attacks. We study two modes of operation: non-policy and policy. Non-policy mode uses the existing Tor relay selection algorithm to provide users incident security. Policy mode extends the relay selection algorithm to address the classes of attacks by enforcing a specific TEE circuit configuration. We evaluate ParTEETor for security, performance, and privacy. Our evaluation demonstrates that at even a small TEE penetration (e.g., 10% of relays are TEE-based), users can reach performance of Tor today while enforcing a security policy to guarantee protection from at least two classes of attacks. Overall, we find that partial deployments of TEEs can substantially improve the security of Tor, without a significant impact on performance or privacy.

For proposed third-generation gravitational-wave detectors such as the Einstein Telescope and Cosmic Explorer, whose sensitive bands are proposed to extend down to 5 Hz or below, the signals of low-mass compact binaries such as binary neutron stars remain in the detector's sensitive band long enough (up to a few days for the smallest proposed low-frequency cutoff of 1 Hz) that one cannot neglect the effects of the Earth's rotation on the detector's response and the changing Doppler shift of the signal. In the latter case, one also needs to consider the effects of the Earth's orbital motion, which is currently only included in analyses of compact binary signals using continuous wave techniques. These effects are also relevant for current detectors and signals from putative subsolar-mass binaries. Here we present simple Fourier series methods for computing these effects in the frequency domain, giving explicit expressions for the Earth's orbital motion in terms of low-order Fourier series, which will be sufficiently accurate for all compact binary signals except for those from very low-mass subsolar-mass binaries. The expression for the effects of the Earth's rotation on the antenna pattern functions does not use the stationary phase approximation (SPA), so we are able to show that the SPA is indeed quite accurate in these situations and present a Fourier series expression equivalent to it which is an order of magnitude faster. We also provide illustrations of these effects on detector sensitivity and the accumulation of information about various binary parameters with frequency., Comment: 31 pages, 11 figures

The observation of gravitational waves from compact binary coalescences is a promising tool to test the validity of general relativity (GR) in a highly dynamical strong-field regime. There are now a variety of tests of GR performed on the observed compact binary signals. In this paper, we propose a new test of GR that compares the results of these individual tests. This meta inspiral-merger-ringdown consistency test (IMRCT) involves inferring the final mass and spin of the remnant black hole obtained from the analyses of two different tests of GR and checking for consistency. If there is a deviation from GR, we expect that different tests of GR will recover different values for the final mass and spin, in general. We check the performance of the meta IMRCT using a standard set of null tests used in various gravitational-wave analyses: the original IMRCT, parameterized phasing tests (TIGER and FTI) and the modified dispersion test. However, the meta IMRCT is applicable to any tests of GR that infer the initial masses and spins or the final mass and spin, including ones that are applied to binary neutron star or neutron star--black hole signals. We apply the meta IMRCT to simulated quasi-circular GR and non-GR binary black hole (BBH) signals as well as to eccentric BBH signals in GR (analyzed with quasicircular waveforms). We find that the meta IMRCT gives consistency with GR for the quasi-circular GR signals and picks up a deviation from GR in the other cases, as do other tests. In some cases, the meta IMRCT finds a significant GR deviation for a given pair of tests (and specific testing parameters) while the individual tests do not, showing that it is more sensitive than the individual tests to certain types of deviations. In addition, we also apply this test to a few selected real compact binary signals and find them consistent with GR., Comment: 27 pages, 30 figures

Merkle hash trees are the standard method to protect the integrity and freshness of stored data. However, hash trees introduce additional compute and I/O costs on the I/O critical path, and prior efforts have not fully characterized these costs. In this paper, we quantify performance overheads of storage-level hash trees in realistic settings. We then design an optimized tree structure called Dynamic Merkle Trees (DMTs) based on an analysis of root causes of overheads. DMTs exploit patterns in workloads to deliver up to a 2.2x throughput and latency improvement over the state of the art. Our novel approach provides a promising new direction to achieve integrity guarantees in storage efficiently and at scale., Comment: Published in the 23rd USENIX Conference on File and Storage Technologies (FAST '25)

General relativity (GR) has proven to be a highly successful theory of gravity since its inception. The theory has thrivingly passed numerous experimental tests, predominantly in weak gravity, low relative speeds, and linear regimes, but also in the strong-field and very low-speed regimes with binary pulsars. Observable gravitational waves (GWs) originate from regions of spacetime where gravity is extremely strong, making them a unique tool for testing GR, in previously inaccessible regions of large curvature, relativistic speeds, and strong gravity. Since their first detection, GWs have been extensively used to test GR, but no deviations have been found so far. Given GR's tremendous success in explaining current astronomical observations and laboratory experiments, accepting any deviation from it requires a very high level of statistical confidence and consistency of the deviation across GW sources. In this paper, we compile a comprehensive list of potential causes that can lead to a false identification of a GR violation in standard tests of GR on data from current and future ground-based GW detectors. These causes include detector noise, signal overlaps, gaps in the data, detector calibration, source model inaccuracy, missing physics in the source and in the underlying environment model, source misidentification, and mismodeling of the astrophysical population. We also provide a rough estimate of when each of these causes will become important for tests of GR for different detector sensitivities. We argue that each of these causes should be thoroughly investigated, quantified, and ruled out before claiming a GR violation in GW observations., Comment: Review article; 1 figure; 1 table; comments welcome

We study a certain two-parameter family of non-standard graded complete intersections $A(m,n)$. In case $n=2$, we show that $A(m,2)$ has the strong Lefschetz property and the complex Hodge-Riemann property if and only if $m$ is even. This supports a strengthening of a conjecture of Almkvist on the unimodality of the Hilbert function of $A(m,n)$., Comment: 25 pages, 3 figures

We report the observation of a coalescing compact binary with component masses $2.5\text{-}4.5~M_\odot$ and $1.2\text{-}2.0~M_\odot$ (all measurements quoted at the 90% credible level). The gravitational-wave signal GW230529_181500 was observed during the fourth observing run of the LIGO-Virgo-KAGRA detector network on 2023 May 29 by the LIGO Livingston Observatory. The primary component of the source has a mass less than $5~M_\odot$ at 99% credibility. We cannot definitively determine from gravitational-wave data alone whether either component of the source is a neutron star or a black hole. However, given existing estimates of the maximum neutron star mass, we find the most probable interpretation of the source to be the coalescence of a neutron star with a black hole that has a mass between the most massive neutron stars and the least massive black holes observed in the Galaxy. We provisionally estimate a merger rate density of $55^{+127}_{-47}~\text{Gpc}^{-3}\,\text{yr}^{-1}$ for compact binary coalescences with properties similar to the source of GW230529_181500; assuming that the source is a neutron star-black hole merger, GW230529_181500-like sources constitute about 60% of the total merger rate inferred for neutron star-black hole coalescences. The discovery of this system implies an increase in the expected rate of neutron star-black hole mergers with electromagnetic counterparts and provides further evidence for compact objects existing within the purported lower mass gap., Comment: 45 pages (10 pages author list, 13 pages main text, 1 page acknowledgements, 13 pages appendices, 8 pages bibliography), 17 figures, 16 tables. Update to match version published in The Astrophysical Journal Letters. Data products available from https://zenodo.org/records/10845779

Recent results from numerical simulations and models of galaxy formation suggest that recently discovered ultra-faint compact stellar systems (UFCSs) in the halo of the Milky Way (MW) may be some of the smallest and faintest galaxies. If this is the case, these systems would be attractive targets for indirect searches of weakly interacting massive particle (WIMP) dark matter (DM) annihilation due to their relative proximity and high expected DM content. In this study, we analyze 14.3 years of gamma-ray data collected by the Fermi-LAT coincident with 26 UFCSs. No significant excess gamma-ray emission is detected, and we present gamma-ray flux upper limits for these systems. Assuming that the UFCSs are dark-matter-dominated galaxies consistent with being among the faintest and least massive MW dwarf spheroidal (dSphs) satellite galaxies, we derive the projected sensitivity for a dark matter annihilation signal. We find that observations of UFCSs have the potential to yield some of the most powerful constraints on DM annihilation, with sensitivity comparable to observations of known dSphs and the Galactic center. This result emphasizes the importance of precise kinematic studies of UFCSs to empirically determine their DM content., Comment: 12 pages, 4 figures, 1 table, accepted for publication on ApJL

Prior research has established associations between individuals' language usage and their personal traits; our linguistic patterns reveal information about our personalities, emotional states, and beliefs. However, with the increasing adoption of Large Language Models (LLMs) as writing assistants in everyday writing, a critical question emerges: are authors' linguistic patterns still predictive of their personal traits when LLMs are involved in the writing process? We investigate the impact of LLMs on the linguistic markers of demographic and psychological traits, specifically examining three LLMs - GPT3.5, Llama 2, and Gemini - across six different traits: gender, age, political affiliation, personality, empathy, and morality. Our findings indicate that although the use of LLMs slightly reduces the predictive power of linguistic patterns over authors' personal traits, the significant changes are infrequent, and the use of LLMs does not fully diminish the predictive power of authors' linguistic patterns over their personal traits. We also note that some theoretically established lexical-based linguistic markers lose their reliability as predictors when LLMs are used in the writing process. Our findings have important implications for the study of linguistic markers of personal traits in the age of LLMs.

The Topics API for the web is Google's privacy-enhancing alternative to replace third-party cookies. Results of prior work have led to an ongoing discussion between Google and research communities about the capability of Topics to trade off both utility and privacy. The central point of contention is largely around the realism of the datasets used in these analyses and their reproducibility; researchers using data collected on a small sample of users or generating synthetic datasets, while Google's results are inferred from a private dataset. In this paper, we complement prior research by performing a reproducible assessment of the latest version of the Topics API on the largest and publicly available dataset of real browsing histories. First, we measure how unique and stable real users' interests are over time. Then, we evaluate if Topics can be used to fingerprint the users from these real browsing traces by adapting methodologies from prior privacy studies. Finally, we call on web actors to perform and enable reproducible evaluations by releasing anonymized distributions. We find that for the 1207 real users in this dataset, the probability of being re-identified across websites is of 2%, 3%, and 4% after 1, 2, and 3 observations of their topics by advertisers, respectively. This paper shows on real data that Topics does not provide the same privacy guarantees to all users and that the information leakage worsens over time, further highlighting the need for public and reproducible evaluations of the claims made by new web proposals., Comment: Accepted at SecWeb 2024: Workshop on Designing Security for the Web ---- Revisions: simulation bug fixed and new Topics classifier (v5), refer to the updated quantitative results in the latest version

In this work, we investigate \textit{texture learning}: the identification of textures learned by object classification models, and the extent to which they rely on these textures. We build texture-object associations that uncover new insights about the relationships between texture and object classes in CNNs and find three classes of results: associations that are strong and expected, strong and not expected, and expected but not present. Our analysis demonstrates that investigations in texture learning enable new methods for interpretability and have the potential to uncover unexpected biases., Comment: Accepted to ICLR 2024, Tiny Papers Track

As the gravitational wave detector network is upgraded and the sensitivity of the detectors improves, novel scientific avenues open for exploration. For example, tests of general relativity will become more accurate as smaller deviations can be probed. Additionally, the detection of lensed gravitational waves becomes more likely. However, these new avenues could also interact with each other, and a gravitational wave event presenting deviations from general relativity could be mistaken for a lensed one. Here, we explore how phenomenological deviations from general relativity or binaries of exotic compact objects could impact those lensing searches focusing on a single event. We consider strong lensing, millilensing, and microlensing and find that certain phenomenological deviations from general relativity may be mistaken for all of these types of lensing. Therefore, our study shows that future candidate lensing events would need to be carefully examined to avoid a false claim of lensing where instead a deviation from general relativity has been seen.

Large Language Model (LLM) systems are inherently compositional, with individual LLM serving as the core foundation with additional layers of objects such as plugins, sandbox, and so on. Along with the great potential, there are also increasing concerns over the security of such probabilistic intelligent systems. However, existing studies on LLM security often focus on individual LLM, but without examining the ecosystem through the lens of LLM systems with other objects (e.g., Frontend, Webtool, Sandbox, and so on). In this paper, we systematically analyze the security of LLM systems, instead of focusing on the individual LLMs. To do so, we build on top of the information flow and formulate the security of LLM systems as constraints on the alignment of the information flow within LLM and between LLM and other objects. Based on this construction and the unique probabilistic nature of LLM, the attack surface of the LLM system can be decomposed into three key components: (1) multi-layer security analysis, (2) analysis of the existence of constraints, and (3) analysis of the robustness of these constraints. To ground this new attack surface, we propose a multi-layer and multi-step approach and apply it to the state-of-art LLM system, OpenAI GPT4. Our investigation exposes several security issues, not just within the LLM model itself but also in its integration with other components. We found that although the OpenAI GPT4 has designed numerous safety constraints to improve its safety features, these safety constraints are still vulnerable to attackers. To further demonstrate the real-world threats of our discovered vulnerabilities, we construct an end-to-end attack where an adversary can illicitly acquire the user's chat history, all without the need to manipulate the user's input or gain direct access to OpenAI GPT4. Our demo is in the link: https://fzwark.github.io/LLM-System-Attack-Demo/

Despite the general capabilities of Large Language Models (LLM), these models still request fine-tuning or adaptation with customized data when meeting specific business demands. However, this process inevitably introduces new threats, particularly against the Fine-tuning based Jailbreak Attack (FJAttack) under the setting of Language-Model-as-a-Service (LMaaS), where the model's safety has been significantly compromised by fine-tuning users' uploaded examples contain just a few harmful examples. Though potential defenses have been proposed that the service providers can integrate safety examples into the fine-tuning dataset to reduce safety issues, such approaches require incorporating a substantial amount of data, making it inefficient. To effectively defend against the FJAttack with limited safety examples under LMaaS, we propose the Backdoor Enhanced Safety Alignment method inspired by an analogy with the concept of backdoor attacks. In particular, service providers will construct prefixed safety examples with a secret prompt, acting as a "backdoor trigger". By integrating prefixed safety examples into the fine-tuning dataset, the subsequent fine-tuning process effectively acts as the "backdoor attack", establishing a strong correlation between the secret prompt and safety generations. Consequently, safe responses are ensured once service providers prepend this secret prompt ahead of any user input during inference. Our comprehensive experiments demonstrate that through the Backdoor Enhanced Safety Alignment with adding as few as 11 prefixed safety examples, the maliciously fine-tuned LLMs will achieve similar safety performance as the original aligned models without harming the benign performance. Furthermore, we also present the effectiveness of our method in a more practical setting where the fine-tuning data consists of both FJAttack examples and the fine-tuning task data.