2026
Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors
Zi Li, Tian Zhou, Wenze Li, Jingyu Hua#, Yunlong Mao#, Sheng Zhong (# corresponding author)
Proceedings of EMNLP 2026 (Main Conference)
Local offline fine-tuning is often seen as a privacy boundary. We show that malicious model code shipped with open-source weights can hijack training and force the model to memorize secrets in the private data, such as API keys, which the attacker later recovers and verifies through black-box queries. The attack reaches over 98% strict attack success rate under LoRA while evading safety filtering, code auditing, and perplexity-based detection.
Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors
Zi Li, Tian Zhou, Wenze Li, Jingyu Hua#, Yunlong Mao#, Sheng Zhong (# corresponding author)
Proceedings of EMNLP 2026 (Main Conference)
Local offline fine-tuning is often seen as a privacy boundary. We show that malicious model code shipped with open-source weights can hijack training and force the model to memorize secrets in the private data, such as API keys, which the attacker later recovers and verifies through black-box queries. The attack reaches over 98% strict attack success rate under LoRA while evading safety filtering, code auditing, and perplexity-based detection.
PeerReveal: Learning to Generalize in AI Peer Review Detection
Zi Li, André V. Duarte, Lei Li
Under review at ICLR 2027
PeerReveal is a three-class detector that separates human-written, AI-rewritten, and fully AI-generated peer reviews by learning how a review's claims relate to AI-generated reference reviews of the same paper. We build PeerShift, a 5,430-review test set spanning machine learning, life sciences, and social sciences with diverse AI review workflows, and use adversarial training with a small local generator to raise pooled Macro-F1 from 70.52% to 82.40%.
PeerReveal: Learning to Generalize in AI Peer Review Detection
Zi Li, André V. Duarte, Lei Li
Under review at ICLR 2027
PeerReveal is a three-class detector that separates human-written, AI-rewritten, and fully AI-generated peer reviews by learning how a review's claims relate to AI-generated reference reviews of the same paper. We build PeerShift, a 5,430-review test set spanning machine learning, life sciences, and social sciences with diverse AI review workflows, and use adversarial training with a small local generator to raise pooled Macro-F1 from 70.52% to 82.40%.
Baker: A Privacy-Preserving, NIZK-free and Efficient Payment Channel Hub Supporting Bidirectional Channels
Wenjing Li, Zi Li, Yuan Zhang, Sheng Zhong
Proceedings of SRDS 2026
Baker is the first bidirectional, privacy-preserving, and NIZK-free payment channel hub, built on Aggregatable Adaptor Signatures for atomic signature exchange and aggregation. Compared with prior hubs, it cuts off-chain communication and computation to 0.0036% and 7% of BlindHub's, at 80% of Accio's on-chain cost and with a 25% higher average success rate.
Baker: A Privacy-Preserving, NIZK-free and Efficient Payment Channel Hub Supporting Bidirectional Channels
Wenjing Li, Zi Li, Yuan Zhang, Sheng Zhong
Proceedings of SRDS 2026
Baker is the first bidirectional, privacy-preserving, and NIZK-free payment channel hub, built on Aggregatable Adaptor Signatures for atomic signature exchange and aggregation. Compared with prior hubs, it cuts off-chain communication and computation to 0.0036% and 7% of BlindHub's, at 80% of Accio's on-chain cost and with a 25% higher average success rate.