TraceSafe: TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
Conference on Language Modeling (COLM 2026, San Francisco, CA)
Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang, Yun-Nung Chen.
[PDF] | [CODE]
Abstract: As LLMs evolve from static chatbots into autonomous agents, the primary vulnerability surface shifts from final outputs to intermediate execution traces. We introduce TraceSafe-Bench, the first benchmark for mid-trajectory safety: 12 risk categories spanning security threats (prompt injection, privacy leaks) and operational failures (hallucinations, interface inconsistencies) across 1,000+ execution instances. Evaluating 13 LLM-as-a-guard models and 7 specialized guardrails, we find efficacy is driven more by structural data competence than by semantic safety alignment, and that architecture matters more than scale. ... See More

Latent-Mark: Latent-Mark: An Audio Watermark Robust to Neural Resynthesis
Interspeech 2026 (Sydney, Australia)
Yen-Shan Chen*, Shih-Yu Lai*, Ying-Jung Tsou, Yi-Cheng Lin, Bing-Yu Chen, Yun-Nung Chen, Hung-yi Lee, Shang-Tse Chen.
* equal contribution
[PDF]
Abstract: Existing audio watermarking techniques achieve strong robustness against traditional DSP attacks but remain vulnerable to neural resynthesis, as modern neural audio codecs act as semantic filters that discard the imperceptible waveform variations prior methods rely on. We present Latent-Mark, the first zero-bit audio watermarking framework designed to survive semantic compression, embedding the watermark within the codec's invariant latent space rather than the waveform. Cross-Codec Optimization jointly optimizes across multiple surrogate codecs, yielding zero-shot transferability to unseen neural codecs and state-of-the-art resilience to DSP attacks while preserving imperceptibility. ... See More

Eyes-on-Me: Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
Forty-Third International Conference on Machine Learning (ICML 2026, Seoul)
Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang, Yun-Nung Chen.
[PDF]
Abstract: Existing data poisoning attacks on retrieval-augmented generation (RAG) systems scale poorly, as they require costly optimization of poisoned documents for each target phrase. We introduce Eyes-on-Me, a modular attack that decomposes an adversarial document into reusable Attention Attractors and Focus Regions, adapting to new targets at near-zero cost by steering a small subset of attention heads correlated with attack success. Across 18 end-to-end RAG settings, it raises average attack success rates from 21.9 to 57.8 (2.6x over prior work), and a single optimized attractor transfers to unseen black-box retrievers and generators without retraining. ... See More

Expected Harm: Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMs
arXiv preprint arXiv:2602.01600 [Preprint]
Yen-Shan Chen*, Zhi Rui Tam*, Cheng-Kuang Wu, Yun-Nung Chen.
* equal contribution
[PDF] | [CODE]
Abstract: Severity-based taxonomies dominate current LLM safety evaluation, but they assume uniform risk across malicious queries and ignore Execution Likelihood: the conditional probability of a threat actually being realized given the model's response. We propose Expected Harm, a metric that weights a jailbreak's severity by its execution likelihood. Empirical analysis reveals Inverse Risk Calibration: models refuse low-likelihood (high-cost) threats while remaining vulnerable to high-likelihood (low-cost) queries, a structural gap that raises existing jailbreak success rates by up to 2x. Linear probing shows models encode severity in their latent space but have no distinguishable internal representation of execution cost. ... See More

LLMs are Biased Evaluators But Not Biased for Fact-Centric Retrieval Augmented Generation
Findings of the Association for Computational Linguistics (ACL 2025, Vienna, Austria)
Yen-Shan Chen*, Jing Jin*, Peng-Ting Kuo, Chao-Wei Huang, Yun-Nung Chen.
* equal contribution
[PDF]
Abstract: LLM self-preference bias is well documented, but the extent to which it manifests in fact-oriented tasks, especially RAG frameworks where keyword extraction and factual accuracy matter more than stylistic elements, remains unclear. We simulate two phases of the RAG pipeline: pointwise reranking of human-authored versus model-generated passages, and pairwise reading comprehension for generation. Contrary to prior findings of self-preference in rating tasks, we observe no significant self-preference effect in RAG; instead, factual accuracy drives LLM output even without prior knowledge. Results hold across three QA datasets and five widely adopted models. ... See More