{"id":"https://openalex.org/W7127077355","doi":"https://doi.org/10.1109/trustcom66490.2025.00079","title":"CVshield: Interpretable Black-Box Adversarial Defense for LLMs via CoT Guided Semantic Verification","display_name":"CVshield: Interpretable Black-Box Adversarial Defense for LLMs via CoT Guided Semantic Verification","publication_year":2025,"publication_date":"2025-11-14","ids":{"openalex":"https://openalex.org/W7127077355","doi":"https://doi.org/10.1109/trustcom66490.2025.00079"},"language":null,"primary_location":{"id":"doi:10.1109/trustcom66490.2025.00079","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00079","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5105937942","display_name":"Wenjing Han","orcid":null},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenjing Hu","raw_affiliation_strings":["Nanjing University of Science and Technology,School of Cyberspace Security,Nanjing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing University of Science and Technology,School of Cyberspace Security,Nanjing,China","institution_ids":["https://openalex.org/I36399199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124768783","display_name":"Weiwei Qi","orcid":null},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiwei Qi","raw_affiliation_strings":["Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124832592","display_name":"Yanlu Li","orcid":null},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanlu Li","raw_affiliation_strings":["Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":null,"display_name":"Xinzhe Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinzhe Huang","raw_affiliation_strings":["Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University,State Key Laboratory of Blockchain and Data Security,Hangzhou,China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"656","last_page":"663"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8686000108718872,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8686000108718872,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.03139999881386757,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.014800000004470348,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/perplexity","display_name":"Perplexity","score":0.8892999887466431},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.8532000184059143},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5103999972343445},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.4876999855041504},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.4447999894618988},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.3928999900817871}],"concepts":[{"id":"https://openalex.org/C100279451","wikidata":"https://www.wikidata.org/wiki/Q372193","display_name":"Perplexity","level":3,"score":0.8892999887466431},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.8532000184059143},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7555000185966492},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.567799985408783},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5103999972343445},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.4876999855041504},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.4447999894618988},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4343000054359436},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.3928999900817871},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.373199999332428},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.37279999256134033},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.3725999891757965},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3379000127315521},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.3077999949455261},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2768999934196472}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/trustcom66490.2025.00079","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00079","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.7004666328430176,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2799007037","https://openalex.org/W2799194071","https://openalex.org/W2913352150","https://openalex.org/W2963748441","https://openalex.org/W2966491090","https://openalex.org/W2971296908","https://openalex.org/W2988937804","https://openalex.org/W2996851481","https://openalex.org/W3101449015","https://openalex.org/W3105604018","https://openalex.org/W3155584966","https://openalex.org/W3158360872","https://openalex.org/W4287887196","https://openalex.org/W4295854586","https://openalex.org/W4385894687","https://openalex.org/W4388886073","https://openalex.org/W4389260541","https://openalex.org/W4402671155"],"related_works":[],"abstract_inverted_index":{"Despite":[0],"their":[1,22],"impressive":[2],"capabilities,":[3],"large":[4],"language":[5],"models":[6],"(LLMs)":[7],"remain":[8],"highly":[9],"susceptible":[10],"to":[11,57,66,86,118,148,174],"adversarial":[12,40,61,115],"perturbations,":[13,62],"often":[14],"producing":[15],"misleading":[16],"or":[17],"inconsistent":[18],"outputs,":[19],"thus":[20],"undermining":[21],"reliability.":[23],"In":[24],"this":[25],"paper,":[26],"we":[27,47,130],"propose":[28,79],"CVshield,":[29,46],"a":[30,50,80,111,133,150],"two-stage":[31],"training-free":[32],"interpretable":[33],"black-box":[34],"defense":[35],"framework":[36,44],"for":[37,197],"LLMs":[38],"against":[39],"perturbations.":[41],"Under":[42],"the":[43,64,91,96,100,107,119,126,144,168,198,211],"of":[45,52,60,110,114,128,200,208],"first":[48],"design":[49],"set":[51],"Chain-Of-Thought":[53],"(CoT)":[54],"templates":[55,98],"tailored":[56],"different":[58],"types":[59],"enabling":[63],"LLM":[65,92,102],"analyze":[67],"and":[68,99,152,162,181,193,220],"reconstruct":[69],"potentially":[70],"corrupted":[71],"inputs":[72],"from":[73,143],"multiple":[74],"semantic":[75,81,88],"perspectives.":[76],"We":[77],"then":[78],"alignment":[82],"verification":[83],"(SAV)":[84],"module":[85],"evaluate":[87],"consistency":[89],"across":[90],"outputs":[93],"generated":[94],"by":[95],"CoT":[97,121],"original":[101],"output.":[103],"Significant":[104],"discrepancies":[105],"indicate":[106],"likely":[108],"presence":[109],"specific":[112],"type":[113,127],"perturbation":[116],"corresponding":[117],"applied":[120],"template.":[122],"To":[123],"precisely":[124],"identify":[125],"disturbance,":[129],"further":[131],"introduce":[132],"decision":[134],"mechanism":[135],"based":[136],"on":[137,159,210],"Bayes\u2019":[138],"theorem,":[139],"which":[140],"integrates":[141],"evidence":[142],"SAV":[145],"comparison":[146],"process":[147],"make":[149],"robust":[151],"probabilistically":[153],"sound":[154],"detection":[155],"decision.We":[156],"evaluated":[157],"CVshield":[158,165,203],"LLaMA2-7B-Chat,":[160],"Qwen-1.5B,":[161],"Mistral-7B":[163],"models.":[164],"successfully":[166],"reduces":[167],"average":[169,206],"attack":[170,201],"success":[171],"rate":[172],"(ASR)":[173],"24.67%":[175],"in":[176],"three":[177,212],"datasets":[178],"(MIX,":[179],"SQuAD,":[180],"MedQuAD),":[182],"significantly":[183],"outperforming":[184],"baseline":[185],"methods":[186],"such":[187],"as":[188],"perplexity":[189],"(58.80%),":[190],"tokenization":[191],"(47.07%)":[192],"SmoothLLM":[194,221],"(58.76%).":[195],"Meanwhile,":[196],"identification":[199],"type,":[202],"achieved":[204],"an":[205],"precision":[207],"78.16%":[209],"datasets,":[213],"substantially":[214],"exceeding":[215],"Perplexity":[216],"(49.66%),":[217],"Retokenization":[218],"(30.65%)":[219],"(38.34%).":[222]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-02-03T00:00:00"}