From model mechanisms to reliable systems.

NeurIPS 2026

Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning

Quan Minh Nguyen, Min-Seon Kim, Hoang M. Ngo, Trong Nghia Hoang, Hyuk-Yoon Kwon, My T. Thai

Federated prompt-tuning adapts a shared foundation model by training small prompts on each client, and it opens a new privacy hole. In PromptMIA, a malicious server plants adversarial prompts in the shared prompt pool, crafted to match one target sample. If that sample is in a client's private data, the client selects and updates every planted prompt, and the server reads membership from which prompts changed. The attack needs no shadow model or extra data and works within a single round, and the paper gives a theoretical lower bound on its advantage.

Over 90% attack success rate on every dataset tested (CIFAR-10, CIFAR-100, TinyImageNet and a four-dataset mix), with ViT-B/32, ConViT and DeiT backbones. Standard defenses such as outlier detection did not stop it.

arXivPDF

NeurIPS 2026

Semantic Optimal Transport for Sparse Autoencoder Feature Matching and Circuit Compression

Tue M. Cao*, Nguyen Do*, My T. Thai (*equal contribution)

Sparse autoencoders (SAEs) are a main tool for interpreting language models, but matching similar features across layers and compressing large feature circuits into readable groups do not scale well. The paper treats both as one problem: measuring the semantic distance between features that live on different activation manifolds. Each feature is represented by the distribution of hidden states that activate it, and distributions are compared with Wasserstein distance. The method outperforms decoder-vector and LLM-based baselines and compresses circuits into interpretable supernodes automatically.

Publisher pagearXivPDF

USENIX Security 2026Distinguished Paper Award, Runner-Up

NOIR: Privacy-Preserving Generation of Code with Open-Source LLMs

Khoa Nguyen, Khiem Ton, NhatHai Phan, Issa Khalil, Khang Tran, Cristian Borcea, Ruoming Jin, Abdallah Khreishah, My T. Thai

Cloud code assistants see every prompt and every line of code a company writes. NOIR keeps both private: the client encodes the prompt into embeddings, an open-source LLM in the cloud enriches them, and the client decodes the code locally. Local differential privacy at the token-embedding level and a randomized tokenizer keep the cloud from reading either.

• An honest-but-curious cloud can try to reconstruct the prompt from embeddings, or to match token frequencies against public code. NOIR is built to withstand both reconstruction and frequency-analysis attacks.
• It is the first framework to protect both the prompt and the generated code from the cloud provider, and it runs on open-source LLMs.

Pass@1 of 76.7 on MBPP and 77.4 on HumanEval (EvalPlus), and 38.7 on BigCodeBench, only 1.77% below the original LLM, under strong privacy against the attacks tested.

Publisher pagearXivPDFOppyAI

NeurIPS 2025

Advancing Interpretability of CLIP Representations with Concept Surrogate Model

Nhat Hoang-Xuan, Xiyuan Wei, Wanli Xing, Tianbao Yang, My T. Thai

CLIP's image embeddings are used everywhere but are hard to interpret. This paper trains a surrogate model that mimics CLIP's similarity between instances and writes each embedding as a combination of human-understandable concepts found in the image (the method is called Explain-R). The concept scores are the explanation. They are more faithful than a baseline on several datasets, and users rated them more relevant, complete and useful.

Publisher pagePDF

NeurIPS 2025

Hephaestus: Mixture Generative Modeling with Energy Guidance for Large-scale QoS Degradation

Nguyen Do*, Bach Ngo*, Youval Kashuv, Canh V. Pham, Hanghang Tong, My T. Thai (*equal contribution)

An attacker who slows down links, without cutting them, can degrade service on many routes at once. Hephaestus finds cheap, hard-to-spot ways to do this on large networks, including when delay grows non-linearly. It combines a path-stressing algorithm with an approximation guarantee, a mixture of generative models guided by an energy model, and a reinforcement-learning refinement step.

• The quality-of-service degradation problem asks how cheaply an attacker can push every critical route past a delay threshold. The same model covers delayed blockchain transactions, congested traffic signals and corrupted message passing in graph neural networks.
• Hephaestus is the first end-to-end generative method for this problem, with a theoretical guarantee for each of its three stages: Forge, Morph and Refine.

On the two largest real networks tested, it cut attack cost by 28.1% (Skitter) and 16.8% (RoadCA) against the strongest baseline, with linear edge weights at the highest threshold (260%).

Publisher pagearXivPDF

ICML 2025

Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models

Quan Nguyen, Minh N. Vu, Truc Nguyen, My T. Thai

Federated learning is often paired with local differential privacy (LDP) to protect clients. The paper proves lower bounds on how often low-polynomial-time membership inference attacks succeed against LDP-protected clients in federated vision models. Privacy risk persists and depends on the privacy budget, and the noise needed to stop these attacks noticeably degrades model utility.

Publisher pagearXivPDF

ICLR 2025

Swift Hydra: Self-Reinforcing Generative Framework for Anomaly Detection with Multiple Mamba Models

Nguyen Do, Truc Nguyen, Malik Hassanaly, Raed Alharbi, Jung Taek Seo, My T. Thai

Anomaly detectors struggle with anomalies they have never seen. Swift Hydra uses a reinforcement-learning policy over the latent space of a generative model to synthesize new, diverse anomalies that fool the detector, then trains on them. Mamba models arranged as a mixture of experts keep inference fast. It outperforms state-of-the-art detectors on the ADBench benchmark.

Publisher pagearXivPDF

ICLR 2025

NeurFlow: Interpreting Neural Networks through Neuron Groups and Functional Interactions

Tue M. Cao, Nhat X. Hoang, Hieu H. Pham, Phi Le Nguyen, My T. Thai

Instead of studying single neurons, NeurFlow finds core neurons, clusters them into groups with shared function, and builds a hierarchical circuit that shows how the groups interact across layers. The result is a more coherent view of the network that lowers computational cost, and it supports applications such as image debugging and automatic concept labeling.

Publisher pagearXivPDF

AAAI 2023Distinguished Paper Award

XRand: Differentially Private Defense against Explanation-Guided Attacks

Truc Nguyen, Phung Lai, NhatHai Phan, My T. Thai

Explanations such as SHAP help users trust a model, but they also reveal its most important features, which attackers have used to craft backdoor triggers against malware classifiers. XRand applies local differential privacy to the explanation itself. It limits what an adversary can learn about the top features while keeping the explanation faithful.

Publisher pagearXivPDF

NeurIPS 2020

PGM-Explainer: Probabilistic Graphical Model Explanations for Graph Neural Networks

Minh N. Vu, My T. Thai

PGM-Explainer explains a graph neural network prediction with a small probabilistic graphical model that shows how the important nodes depend on one another, rather than only a list of weights. The paper proves that the explanation contains the Markov blanket of the target prediction, and it outperforms existing explainers on several benchmark tasks.

Publisher pagearXivPDF