publications

2025

1. 

   Why LLM Safety Guardrails Collapse After Fine-tuning: A Similarity Analysis Between Alignment and Fine-tuning Datasets

   Lei Hsiung, Tianyu Pang, Yung-Chen Tang, Linyue Song, Tsung-Yi Ho, Pin-Yu Chen, and Yaoqing Yang

   In Submission, 2025

   Abs arXiv Demo

   Recent advancements in large language models (LLMs) have underscored their vulnerability to safety alignment jailbreaks, particularly when subjected to downstream fine-tuning. However, existing mitigation strategies primarily focus on reactively addressing jailbreak incidents after safety guardrails have been compromised, removing harmful gradients during fine-tuning, or continuously reinforcing safety alignment throughout fine-tuning. As such, they tend to overlook a critical upstream factor: the role of the original safety-alignment data. This paper therefore investigates the degradation of safety guardrails through the lens of representation similarity between upstream alignment datasets and downstream fine-tuning tasks. Our experiments demonstrate that high similarity between these datasets significantly weakens safety guardrails, making models more susceptible to jailbreaks. Conversely, low similarity between these two types of datasets yields substantially more robust models and thus reduces harmfulness score by up to 10.33%. By highlighting the importance of upstream dataset design in the building of durable safety guardrails and reducing real-world vulnerability to jailbreak attacks, these findings offer actionable insights for fine-tuning service providers.

2. 

   Spectral Insights into Data-Oblivious Critical Layers in Large Language Models

   Xuyuan Liu, Lei Hsiung, Yaoqing Yang, and Yujun Yan

   In Findings of the Association for Computational Linguistics (Findings of ACL), 2025

   Abs arXiv Demo

   Understanding how feature representations evolve across layers in large language models (LLMs) is crucial for enhancing their interpretability and robustness. Recent research has explored this by identifying critical layers associated with specific functions or behaviors in LLMs. However, prior work has primarily identified critical layers through data-dependent analyses of fine-tuned models, limiting their applicability to post-hoc scenarios. In contrast, we propose a data-oblivious method to pinpoint intrinsic critical layers in pre-fine-tuned LLMs by analyzing representation dynamics using Centered Kernel Alignment (CKA). We demonstrate that layers exhibiting significant changes in representation space correspond to those undergoing the most substantial modifications during fine-tuning, and we show that this phenomenon remains consistent across tasks for a given model. Furthermore, our novel spectral analysis reveals that shifts in layer representations are driven by changes in their top principal components, which govern semantic transformations from rationales to conclusions. Notably, freezing these layers during fine-tuning reduces adversarial attack success rates by 40%, enabling efficient, minimally invasive defenses. Our findings suggest that critical layers are an intrinsic property of pre-fine-tuned models, providing a unified framework for understanding LLM layer dynamics and facilitating resource-efficient adaptation strategies.

3. 

   When Does Visual Prompting Outperform Linear Probing for Vision-Language Models? A Likelihood Perspective

   Hsi-Ai Tsao, Lei Hsiung, Pin-Yu Chen, and Tsung-Yi Ho

   In 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2025

   Abs arXiv HTML Code

   Adapting pre-trained models to new tasks can exhibit varying effectiveness across datasets. Visual prompting, a state-of-the-art parameter-efficient transfer learning method, can significantly improve the performance of out-of-distribution tasks. On the other hand, linear probing, a standard transfer learning method, can sometimes become the best approach. We propose a log-likelihood ratio (LLR) approach to analyze the comparative benefits of visual prompting and linear probing. By employing the LLR score alongside resource-efficient visual prompts approximations, our cost-effective measure attains up to a 100-fold reduction in run time compared to full training, while achieving prediction accuracies up to 91%. The source code is available at VP-LLR.

2024

1. 

   AutoVP: An Automated Visual Prompting Framework and Benchmark

   Hsi-Ai Tsao*, Lei Hsiung*, Pin-Yu Chen, Sijia Liu, and Tsung-Yi Ho (* Equal Contribution)

   In Proceedings of the Twelfth International Conference on Learning Representations (ICLR), 2024

   Abs arXiv Code

   Visual prompting (VP) is an emerging parameter-efficient fine-tuning approach to adapting pre-trained vision models to solve various downstream image-classification tasks. However, there has hitherto been little systematic study of the design space of VP and no clear benchmark for evaluating its performance. To bridge this gap, we propose AutoVP, an end-to-end expandable framework for automating VP design choices, along with 12 downstream image-classification tasks that can serve as a holistic VP-performance benchmark. Our design space covers 1) the joint optimization of the prompts; 2) the selection of pre-trained models, including image classifiers and text-image encoders; and 3) model output mapping strategies, including nonparametric and trainable label mapping. Our extensive experimental results show that AutoVP outperforms the best-known current VP methods by a substantial margin, having up to 6.7% improvement in accuracy; and attains a maximum performance increase of 27.5% compared to linear-probing (LP) baseline. AutoVP thus makes a two-fold contribution: serving both as an efficient tool for hyperparameter tuning on VP design choices, and as a comprehensive benchmark that can reasonably be expected to accelerate VP’s development.

2. 

   NeuralFuse: Learning to Recover the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes

   Hao-Lun Sun, Lei Hsiung, Nandhini Chandramoorthy, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS), 2024

   Abs arXiv Code

   Deep neural networks (DNNs) have become ubiquitous in machine learning, but their energy consumption remains problematically high. An effective strategy for reducing such consumption is supply-voltage reduction, but if done too aggressively, it can lead to accuracy degradation. This is due to random bit-flips in static random access memory (SRAM), where model parameters are stored. To address this challenge, we have developed NeuralFuse, a novel add-on module that handles the energy-accuracy tradeoff in low-voltage regimes by learning input transformations and using them to generate error-resistant data representations, thereby protecting DNN accuracy in both nominal and low-voltage scenarios. As well as being easy to implement, NeuralFuse can be readily applied to DNNs with limited access, such cloud-based APIs that are accessed remotely or non-configurable hardware. Our experimental results demonstrate that, at a 1% bit-error rate, NeuralFuse can reduce SRAM access energy by up to 24% while recovering accuracy by up to 57%. To the best of our knowledge, this is the first approach to addressing low-voltage-induced bit errors that requires no model retraining.

2023

1. 

   Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations

   Lei Hsiung, Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023

   Abs arXiv Code Demo

   Model robustness against adversarial examples of single perturbation type such as the \(\ell_p\)-norm has been widely studied, yet its generalization to more realistic scenarios involving multiple semantic perturbations and their composition remains largely unexplored. In this paper, we first propose a novel method for generating composite adversarial examples. Our method can find the optimal attack composition by utilizing component-wise projected gradient descent and automatic attack-order scheduling. We then propose generalized adversarial training (GAT) to extend model robustness from \(\ell_p\)-ball to composite semantic perturbations, such as the combination of Hue, Saturation, Brightness, Contrast, and Rotation. Results obtained using ImageNet and CIFAR-10 datasets indicate that GAT can be robust not only to all the tested types of a single attack, but also to any combination of such attacks. GAT also outperforms baseline \(\ell_∞\)-norm bounded adversarial training approaches by a significant margin.

2. 

   NCTV: Neural Clamping Toolkit and Visualization for Neural Network Calibration

   Lei Hsiung, Yung-Chen Tang, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the 37th AAAI Conference on Artificial Intelligence (AAAI), 2023

   Abs arXiv Code Demo

   With the advancement of deep learning technology, neural networks have demonstrated their excellent ability to provide accurate predictions in many tasks. However, a lack of consideration for neural network calibration will not gain trust from humans, even for high-accuracy models. In this regard, the gap between the confidence of the model’s predictions and the actual correctness likelihood must be bridged to derive a well-calibrated model. In this paper, we introduce the Neural Clamping Toolkit, the first open-source framework designed to help developers employ state-of-the-art model-agnostic calibrated models. Furthermore, we provide animations and interactive sections in the demonstration to familiarize researchers with calibration in neural networks. A Colab tutorial on utilizing our toolkit is also introduced.

3. 

   Reducing surgical site infections after spine surgery: the optimal amount of normal saline for intra-wound irrigation

   Wei Hsiung, Yu-Cheng Yao, Hsi-Hsien Lin, Shih-Tien Wang, Lei Hsiung, Kuan-Jung Chen, Ming-Chau Chang, and Po-Hsin Chou

   The Spine Journal, 2023

   SpineWeek 2023 Best Paper Finalists.

   TL;DR HTML

   This study investigated the impact of intraoperative wound irrigation with saline solution on surgical site infections (SSI) following lumbar surgery. It found that insufficient irrigation and diabetes were risk factors for SSI, recommending at least 1,400 mL/hour of saline irrigation to reduce SSI in lumbar spine surgery.

2022

1. 

   A Lab-Based Investigation of Reaction Time and Reading Performance Using Different In-Vehicle Reading Interfaces during Self-Driving

   Lei Hsiung, Yung-Ju Chang, Wei-Ko Li, Tsung-Yi Ho, and Shan-Hung Wu

   In Proceedings of the 14th International ACM Conference on Automotive User Interfaces and Interactive Vehicular Applications (AutomotiveUI), 2022

   Abs PDF

   The demand for autonomous vehicles (AVs) is rapidly growing these years. As AVs have a potential to free drivers’ cognitive resources from driving to other tasks, reading is one of the common activities users conduct in travel multitasking. Nevertheless, ways to supporting reading in AVs have been little explored. To fill this gap, we explored the design of an in-vehicle reader on a windshield in AVs along three dimensions: dynamics, position, and text segmentation. We conducted two in-lab within-subject experiments to examine the eight kinds of in-car reading modalities that represented the combinations of the three dimensions in terms of drivers’ reaction time and reading comprehension. Our results show a case where an adaptive positioning would be particularly beneficial for supporting reading in AVs. And our general suggestion is to use a static reading zone presented on-sky and in sentences because it leads to faster reaction and better reading comprehension.

2. 

   CARBEN: Composite Adversarial Robustness Benchmark

   Lei Hsiung, Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI), 2022

   Abs arXiv Demo Poster

   Prior literature on adversarial attack methods has mainly focused on attacking with and defending against a single threat model, e.g., perturbations bounded in Lp ball. However, multiple threat models can be combined into composite perturbations. One such approach, composite adversarial attack (CAA), not only expands the perturbable space of the image, but also may be overlooked by current modes of robustness evaluation. This paper demonstrates how CAA’s attack order affects the resulting image, and provides real-time inferences of different models, which will facilitate users’ configuration of the parameters of the attack level and their rapid evaluation of model prediction. A leaderboard to benchmark adversarial robustness against CAA is also introduced.