publications

2026

1. 

   Mitigating Distribution Shift for Adversarial Purification

   Himanshu Singh and A V Subramanyam

   2026

   Bib

   Under Review

   @misc{himanshu2026mitigating,
     title = {Mitigating Distribution Shift for Adversarial Purification},
     author = {Singh, Himanshu and Subramanyam, A V},
     year = {2026},
     booktitle = {Under review},
   }

2. 

   Learning Adversarial Manifold for Jailbreaking at Scale

   Shivank Rajput^*, Himanshu Singh^*, and A V Subramanyam

   2026

   Bib

   ^*Equal Contribution Under Review

   @misc{shivank2026,
     title = {Learning Adversarial Manifold for Jailbreaking at Scale},
     author = {Rajput, Shivank and Singh, Himanshu and Subramanyam, A V},
     year = {2026},
     booktitle = {Under review},
   }

3. EMNLP

   

   Do Prompts Guarantee Safety? Mitigating Toxicity from LLM Generations through Gradient Based Subspace Intervention

   Himanshu Singh, Ziwei Xu, A V Subramanyam, and Mohan Kankanhalli

   In Findings of the Association for Computational Linguistics: EMNLP 2026, Oct 2026

   Abs arXiv Bib

   Large Language Models (LLMs) are powerful text generators, yet they can produce toxic or harmful content even when given seemingly harmless prompts. This presents a serious safety challenge and can cause real-world harm. Toxicity is often subtle and context-dependent, making it difficult to detect at the token level or through coarse sentence-level signals. Moreover, efforts to mitigate toxicity often face a trade-off between safety and the coherence, or fluency, of the generated text. In this work, we present a targeted subspace intervention strategy based on gradient signals for identifying and suppressing hidden toxic patterns from underlying model representations, while preserving the overall ability to generate safe, fluent content. On the RealToxicityPrompts dataset, our method achieves strong mitigation performance compared to existing baselines while imposing minimal impact on inference complexity. Across LLMs, our approach reduces the toxicity of state-of-the-art detoxification systems by 8-20%, while maintaining comparable fluency. We further validate cross-benchmark generality on ToxiGen, where the same gains hold under adversarial, implicitly toxic prompts. Through extensive quantitative and qualitative analyses, we show that our approach achieves effective toxicity reduction without impairing generative performance, consistently outperforming existing baselines.

   @inproceedings{singh2026promptsguaranteesafetymitigating,
     title = {Do Prompts Guarantee Safety? Mitigating Toxicity from LLM Generations through Gradient Based Subspace Intervention},
     author = {Singh, Himanshu and Xu, Ziwei and Subramanyam, A V and Kankanhalli, Mohan},
     booktitle = {Findings of the Association for Computational Linguistics: EMNLP 2026},
     address = {Budapest, Hungary},
     month = oct,
     year = {2026},
     archiveprefix = {arXiv},
     primaryclass = {cs.CL},
     url = {https://arxiv.org/abs/2602.06623},
   }

4. IEEE TAI

   

   Nearest Neighbor Projection Removal Adversarial Training

   Himanshu Singh, A V Subramanyam, Shivank Rajput, and Mohan Kankanhalli

   IEEE Transactions on Artificial Intelligence, Apr 2026

   Abs IEEE DOI arXiv Bib Code

   Deep neural networks have exhibited impressive performance in image classification tasks but remain vulnerable to adversarial examples. Standard adversarial training enhances robustness but typically fails to explicitly address inter-class feature overlap, a significant contributor to adversarial susceptibility. In this work, we introduce a novel adversarial training framework that actively mitigates inter-class proximity by projecting out inter-class dependencies from adversarial and clean samples in the feature space. Specifically, our approach first identifies the nearest inter-class neighbors for each adversarial sample and subsequently removes projections onto these neighbors to enforce stronger feature separability. Theoretically, we demonstrate that our proposed logits correction reduces the Lipschitz constant of neural networks, thereby lowering the Rademacher complexity, which directly contributes to improved generalization and robustness. Extensive experiments across standard benchmarks including CIFAR-10, CIFAR-100, and SVHN show that our method demonstrates strong performance that is competitive with leading adversarial training techniques, highlighting significant achievements in both robust and clean accuracy. Our findings reveal the importance of addressing inter-class feature proximity explicitly to bolster adversarial robustness in DNNs.

   @article{singh2026nearestneighborprojectionremoval,
     title = {{Nearest Neighbor Projection Removal Adversarial Training}},
     author = {Singh, Himanshu and Subramanyam, A V and Rajput, Shivank and Kankanhalli, Mohan},
     journal = {IEEE Transactions on Artificial Intelligence},
     month = apr,
     url = {https://arxiv.org/abs/2509.07673},
     year = {2026},
     archiveprefix = {arXiv},
     primaryclass = {cs.CV},
     doi = {10.1109/TAI.2026.3681719},
   }

2024

1. ICASSP

   

   Language Guided Adversarial Purification

   Himanshu Singh and A V Subramanyam

   In ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Apr 2024

   Abs IEEE DOI arXiv Bib Code

   Adversarial purification using generative models demonstrates strong adversarial defense performance. These methods are classifier and attack-agnostic, making them versatile but often computationally intensive. Recent strides in diffusion and score networks have improved image generation and, by extension, adversarial purification. Another highly efficient class of adversarial defense methods known as adversarial training requires specific knowledge of attack vectors, forcing them to be trained extensively on adversarial examples. To overcome these limitations, we introduce a new framework, namely Language Guided Adversarial Purification (LGAP), utilizing pre-trained diffusion models and caption generators to defend against adversarial attacks. Given an input image, our method first generates a caption, which is then used to guide the adversarial purification process through a diffusion network. Our approach has been evaluated against strong adversarial attacks, proving its effectiveness in enhancing adversarial robustness. Our results indicate that LGAP outperforms most existing adversarial defense techniques without requiring specialized network training. This underscores the generalizability of models trained on large datasets, highlighting a promising direction for further research.

   @inproceedings{singh2023language,
     title = {{Language Guided Adversarial Purification}},
     author = {Singh, Himanshu and Subramanyam, A V},
     booktitle = {ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)},
     address = {Seoul, Korea},
     month = apr,
     url = {https://arxiv.org/abs/2309.10348},
     year = {2024},
     archiveprefix = {arXiv},
     primaryclass = {cs.LG},
     pages = {7685-7689},
     doi = {10.1109/ICASSP48485.2024.10446676},
   }