Publications
2026
- Duy Nguyen, Lesly Miculicich, Bhavana Dalvi Mishra, Shuo Li, Krishnamurthy Dj Dvijotham, Mohit Bansal, Tomas Pfister, and Long T. LearXiv preprint arXiv:2610.12813, 2026
LLM agents increasingly operate over sensitive resources, such as private documents and mutable system states, which can create serious safety and security risks. Runtime guardrails should therefore make inspectable, reproducible, and deterministic allow or refuse decisions before potentially irreversible agent actions are executed. However, safety and security requirements are rarely complete before deployment, so guardrails need to keep adapting as new risks emerge. Existing adaptive guardrails learn from deployment experience, but they usually apply safety policies through LLM inference, which can lead to inconsistent decisions and ambiguous policy interpretations. Formal guardrails, on the other hand, enforce policies deterministically, but they usually rely on pre-deployment or task-specific policies and have no mechanism to adapt to newly observed risks. We introduce VEPA, a framework for the verified evolution of formal agent guardrails. VEPA represents the guardrail as a formal policy of executable symbolic rules over typed agent events. During deployment, we use an LLM guided by deployment feedback to propose policy patches that fix newly observed failures while preserving previously correct behavior. Then, a deterministic verifier only accepts policies that are structurally valid and conflict-free. Finally, an evidence-aware authority layer activates a verified rule only when it has enough supporting evidence, so uncertain updates cannot directly affect guardrail decisions. Across ASSEBench-Safety, ASSEBench-Security, and ATBench, VEPA consistently outperforms baselines while expanding the scope of deterministic formal-policy enforcement. These gains also hold under more challenging deployment conditions, including mixed streams, corrupted feedback, and longer horizons.
- AVSD: Adaptive-View Self-Distillation by Balancing Consensus and Teacher-Specific Privileged SignalsDuy Nguyen, Hanqi Xiao, Archiki Prasad, Zaid Khan, Anirban Das, Austin Zhang, Sambit Sahu, Hyunji Lee, Elias Stengel-Eskin, and Mohit BansalAdvances in Neural Information Processing Systems, 2026
Self-distillation enables language models to learn on-policy from their own trajectories by using the same model as both student and teacher, with the teacher being conditioned on privileged information unavailable to the student. Such information can come in different types or views, such as solutions, demonstrations, feedback, or final answers. This setup provides dense token-level feedback without relying on a separate external model, but creates a fundamental asymmetry: the teacher may rely on view-specific information that the student cannot access at inference time. Moreover, the best type of privileged information is often task-dependent, making it difficult to choose a single teacher view. In this work, we address both these challenges jointly by introducing AVSD, a novel method of self-distillation with multiple privileged-information views, which reconstructs token-level supervision by separating stable cross-view consensus from view-specific residual signals.
- Duy Nguyen, Archiki Prasad, Elias Stengel-Eskin, and Mohit BansalProceedings of the Annual Meeting of the Association for Computational Linguistics, 2026
Inference-time steering methods offer a lightweight alternative to fine-tuning large language models (LLMs) and vision-language models (VLMs) by modifying internal activations at test time without updating model weights. However, most existing approaches rely on fixed, global intervention vectors, overlook the causal influence of individual input tokens, and fail to leverage informative gradients from the model’s logits, particularly in multimodal settings where visual and textual inputs contribute unevenly. To address these limitations, we introduce GrAInS, an inference-time steering approach that operates across both language-only and vision-language models and tasks. GrAInS uses contrastive, gradient-based attribution via Integrated Gradients to identify the top-k most influential tokens, both positively and negatively attributed based on their contribution to preferred versus dispreferred outputs. These tokens are then used to construct directional steering vectors that capture semantic shifts from undesirable to desirable behavior. During inference, GrAInS adjusts hidden activations at transformer layers guided by token-level attribution signals, and normalizes activations to preserve representational scale. This enables fine-grained, interpretable, and modular control over model behavior, without retraining or auxiliary supervision. Empirically, GrAInS consistently outperforms both fine-tuning and existing steering baselines: it achieves a 13.22% accuracy gain on TruthfulQA using Llama-3.1-8B, reduces hallucination rates on MMHal-Bench from 0.624 to 0.514 with LLaVA-1.6-7B, and improves alignment win rates on SPA-VL by 8.11%, all while preserving the model’s fluency and general capabilities.
- Duy Nguyen, Hanqi Xiao, Archiki Prasad, Elias Stengel-Eskin, Hyunji Lee, and Mohit BansalarXiv preprint arXiv:2602.03696, 2026
Large language models rely on internal knowledge to solve many downstream tasks, making it crucial to keep them up to date. Since full retraining is expensive, prior work has explored efficient alternatives such as model editing and parameter-efficient fine-tuning. However, these approaches often break down in practice due to poor generalization across inputs, limited stability, and knowledge conflict. To address these limitations, we propose CoRSA, a parameter-efficient, holistic training framework for knowledge editing with multiple updates. CoRSA improves generalization to different input forms, enhances stability across multiple updates by minimizing loss curvature, and resolves conflicts by maximizing the margin between new and prior knowledge.
2025
- Duy Nguyen*, Archiki Prasad*, Elias Stengel-Eskin, and Mohit BansalAdvances in Neural Information Processing Systems, 2025
Reward Models (RMs) are crucial to aligning large language models (LLMs), but the degree to which an RM specialized to one task generalizes to new tasks is often not known a priori, often making using only one fixed RM to train LLMs suboptimal. However, optimizing LLMs with multiple RMs simultaneously can incur a prohibitively high computational cost and lead to conflicting signals from different RMs that may degrade performance. To address these challenges, we introduce LASeR, which frames reward model selection as a multi-armed bandit problem, efficiently and iteratively training LLMs using multiple RMs by selecting the most well-suited RM for each instance. On commonsense and math reasoning tasks, LASeR boosts iterative LLM training, improving the absolute average accuracy of Llama-3-8B over three datasets by 2.67% over an ensemble of RM scores while also showing superior efficiency. On WildChat, LASeR leads to a 72.69% AlpacaEval win rate over the RM score ensemble baseline. Extending to long-context generation, LASeR improves by 2.96 F1 points on single-document QA tasks and 2.97 F1 points on few-shot learning over the RM score ensemble baseline with best-of-n sampling.
- Duy Nguyen, Archiki Prasad, Elias Stengel-Eskin, and Mohit BansalProceedings of the Annual Meeting of the Association for Computational Linguistics, 2025
Inference-time intervention (ITI) has emerged as a promising method for steering large language model behavior in a particular direction by intervening on token representations without costly updates to the model’s parameters. However, existing ITI approaches fail to scale to multi-attribute settings with conflicts, such as enhancing helpfulness while also reducing toxicity. To address this, we introduce Multi-Attribute Targeted Steering (MAT-Steer), a steering framework designed for selective token-level intervention across multiple attributes. We achieve this by learning steering vectors using an alignment objective that shifts the model’s internal representations of undesirable outputs closer to desirable ones while enforcing sparsity and orthogonality among vectors for different attributes, thereby reducing inter-attribute conflicts. MAT-Steer outperforms existing ITI and parameter-efficient fine-tuning approaches across question answering and generative tasks.
- Bao Nguyen, Binh Nguyen, Duy Nguyen, and Viet Anh NguyenFindings of the Conference on Empirical Methods in Natural Language Processing, 2025
Language models are prone to occasionally undesirable generations, such as harmful or toxic content, despite their impressive capability to produce texts that appear accurate and coherent. This paper presents a two-stage approach to detect and mitigate undesirable content generations by rectifying activations. First, we train an ensemble of layerwise classifiers to detect undesirable content using activations by minimizing a smooth surrogate of the risk-aware score. Then, for contents that are detected as undesirable, we propose layerwise distributional intervention policies that perturb attention heads minimally while guaranteeing probabilistically the effectiveness of the intervention. Benchmarks on several language models and datasets show that our method outperforms baselines in reducing undesirable output.
- Ngoc Bui, Duy Nguyen, Man-Chung Yue, and Viet Anh NguyenOperations Research, 2025
Algorithmic recourse is a prominent technique to promote explainability, transparency, and ethics of machine learning models. Existing algorithmic recourse approaches often assume an invariant predictive model; however, the predictive model is usually updated when new data arrives. Thus, a recourse that is valid with respect to the present model may become invalid for the future model. To resolve this issue, we propose a framework to generate model-agnostic recourse that is robust to model shifts. Our framework first builds a coverage-validity-aware linear surrogate of the nonlinear model, then generates recourse with respect to the linear surrogate. We establish a theoretical connection between this surrogate and minimax probability machines and demonstrate the usefulness and robustness of the framework.
2024
- Hieu Nguyen, Duy Nguyen, Khoa Doan, and Viet Anh NguyenProceedings of the Conference on Uncertainty in Artificial Intelligence, 2024
Rating elicitation is important for recommender systems to perform well at cold-starting, where systems need to recommend items to a newly arrived user with no prior knowledge about the user’s preference. Existing elicitation methods employ a fixed set of items to learn the user’s preference and then infer preferences on the remaining items. Using a fixed seed set can limit recommendation performance because the seed set is unlikely optimal for all new users with diverse preferences. This paper addresses this challenge using a two-phase, personalized elicitation scheme. The system asks users to rate popular items in a burn-in phase, then sequentially asks the user to rate adaptive items to refine the preference and user representation. The system represents the user’s embedding value by a region estimate and generates recommendations by considering the user’s preference region.
- Duy Nguyen, Bao Nguyen, and Viet Anh NguyenarXiv preprint arXiv:2402.15073, 2024
Algorithmic recourse recommends a cost-efficient action to a subject to reverse an unfavorable machine learning classification decision. Most existing methods generate recourse under the assumption of complete knowledge about the cost function. In real-world practice, subjects could have distinct preferences, leading to incomplete information about the underlying cost function. This paper proposes a two-step approach integrating preference learning into the recourse generation problem. First, we design a question-answering framework to refine the confidence set of the subject’s Mahalanobis matrix cost sequentially. Then, we generate recourse using gradient-based and graph-based cost-adaptive methods that ensure validity while considering the whole confidence set of the cost matrix.
2023
- Duy Nguyen, Ngoc Bui, and Viet Anh NguyenProceedings of the International Conference on Learning Representations, 2023Honorable Mention, INFORMS Undergraduate Operations Research Prize
A recourse action aims to explain an algorithmic decision by showing one way in which an instance could be modified to receive an alternate outcome. Existing recourse generation methods often assume that the machine learning model does not change over time. This assumption does not always hold in practice because of data distribution shifts, and the recourse action may become invalid. We propose the Distributionally Robust Recourse Action framework, which generates a recourse action that has high probability of being valid under a mixture of model shifts. We formulate the robustified recourse setup as a min-max optimization problem and suggest a projected gradient descent algorithm to find robust recourse.
- Duy Nguyen, Ngoc Bui, and Viet Anh NguyenProceedings of the International Conference on Artificial Intelligence and Statistics, 2023
Explaining algorithmic decisions and recommending actionable feedback is increasingly important for machine learning applications. Significant efforts have been invested in finding diverse sets of recourses to cover the wide spectrum of users’ preferences, but existing work often neglects the requirement that recourses should be close to the data manifold. We propose an approach that explicitly directs a diverse set of actionable recourses toward the data manifold. We find a diverse set of prototypes in the favorable class, construct an actionability graph, and find feasible paths to each prototype. Experimental results show that the method produces recourses close to the data manifold while delivering a better cost-diversity trade-off than existing approaches.
2022
- Tuan-Duy H. Nguyen, Ngoc Bui, Duy Nguyen, Man-Chung Yue, and Viet Anh NguyenProceedings of the Conference on Uncertainty in Artificial Intelligence, 2022
Algorithmic recourse aims to recommend informative feedback to overturn an unfavorable machine learning decision. We introduce Bayesian recourse, a model-agnostic recourse that minimizes the posterior probability odds ratio. We also present its min-max robust counterpart to hedge against future changes in machine learning model parameters. The robust counterpart explicitly takes possible perturbations of data into account in a Gaussian mixture ambiguity set prescribed using optimal transport distance. We show that the worst-case objective can be decomposed into a series of two-dimensional optimization subproblems, making the min-max recourse problem amenable to gradient descent.
- Ngoc Bui, Duy Nguyen, and Viet Anh NguyenProceedings of the International Conference on Learning Representations, 2022
Counterfactual explanations are attracting significant attention due to the applications of machine learning models in consequential domains. A counterfactual plan consists of multiple possibilities to modify an instance so that the model’s prediction will be altered. As the predictive model can be updated with future data, a counterfactual plan may become ineffective or infeasible with respect to future model parameters. We study counterfactual plans under model uncertainty, where the distribution of model parameters is partially prescribed using first- and second-moment information. We propose tools to bound the probability of feasibility for a given counterfactual plan and provide corrective methods to improve feasibility.