Cryptography and Security
Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
Benlei Cui, Shen Pang, Yuke Wang et al. (+7 more)
The safety of large
vision-
language models is increasingly stress-tested by
multimodal jailbreaks, yet existing attacks remain largely static at the meta level: template-based attacks freeze the image-text layout, while iterative attacks adapt only the image-text content with fixed attack strategies and frozen attacker parameters. We propose Meta-Adaptive
Multimodal Jailbreaking (MAMJ), which instead optimizes the attacker itself along two axes: an attack strategy
prompt (ASP) governing attack iteration and attacker model weights determining attack effectiveness. Across groups of
multimodal attack trajectories, an LLM-based critique first refines the ASP, after which group-aggregated attack success rate (ASR) rewards update those weights. On MM-SafetyBench, MAMJ achieves 81.0%, 78.9%, and 82.3% ASR against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, respectively, outperforming the strongest sample-level baseline by up to 24.1 percentage points. The learned attacker, comprising the optimized ASP and attacker weights, also transfers without retraining to unseen victims and remains effective under representative defenses. These results reveal a systemic vulnerability of frontier VLMs to meta-adaptive jailbreaks and motivate defenses against meta-level adversaries. Code is available at https://github.com/Alibaba-VELLDEPTH/MetaJailbreak-VLM.
Read the full abstract ▾
All authors Benlei Cui, Shen Pang, Yuke Wang, Xuemei Dong, Yuwen Zhai, Jingqun Tang, Haiyang Yu, Hui Xue, Longtao Huang, Haiwen Hong
Computer Vision
Revisiting Local Context for Long-Horizon Streaming 3D Reconstruction
Jiarong Han, Jincheng Xiong, Yuzhou Liu et al. (+6 more)
Streaming 3D reconstruction from extremely long
videos requires estimating camera motion and scene geometry online under bounded
memory and computation. Early streaming models achieve causal, bounded-cost inference using finite context buffers or compact recurrent states, yet their estimates often deteriorate as sequences grow. Recent methods improve long-horizon stability by coupling short-range context with persistent or multi-level long-range
memory. We pursue a different route: we keep the learned temporal state strictly local and formulate predictions whose targets remain independent of sequence length. We present ABot-Recon, a simple streaming model that caches KV features from only the preceding 11 frames. It predicts a point map in the current camera coordinate system together with an adjacent-frame relative pose. These predictions remain equivariant under changes of reference frame, and global poses and geometry are recovered through sequential composition. To reduce accumulated drift, a lightweight temporal refiner improves relative rotations using recent visual and motion context, while a composition-aware pose loss supervises multi-step pose composition. Extensive evaluations on challenging long-sequence
benchmarks demonstrate the superior long-horizon performance of our local-context approach. On Oxford Spires, ABot-Recon achieves an ATE of 4.35 m and an RPE-R of $0.12^\circ$, reducing both errors by approximately 40% relative to the best prior results.
Read the full abstract ▾
All authors Jiarong Han, Jincheng Xiong, Yuzhou Liu, Linzhe Shi, Changjie Wu, Ning Guo, Mu Xu, Hang Zhang, Ming Qian
Computer Vision
FVeinSyn: Synthetic Finger Vein Image Generator
Yifan Wang, Jie Gui, Adams Wai Kin Kong et al. (+6 more)
A major challenge in finger vein recognition is the lack of large-scale public
datasets. Existing
datasets contain few identities and limited samples per finger, restricting the advancement of deep learning-based methods. To address this, we propose FVeinSyn, a large-scale controllable synthetic data generation framework for finger vein. It explicitly decouples synthesis of vascular
topology and imaging appearance to mitigate the limitations caused by insufficient training samples, such as inadequate identity diversity and restricted realism. Specifically: first, a finger vein identity generator models vascular
topology under physiological and
geometric constraints using
stochastic L-systems, producing anatomically valid and identity-distinctive vascular patterns. Then, a cascaded region-aware GAN renders the topological maps into realistic near-infrared images. Finally, an intra-class diversity generator introduces
geometric and optical perturbations to simulate realistic intra-class variations. Using FVeinSyn, we generated 500,000 images (10,000 vein identities, 50 samples per identity) and conducted extensive evaluations. Results show that FVeinSyn holds significant advantages in realism, identity diversity, vascular pattern consistency, and intra-class diversity. Models trained with FVeinSyn outperform real-data-only baselines a cross eight public
datasets, achieving an average accuracy improvement of 27.43%. The code is available at: https://github.com/EvanWang98/Synthetic-Finger-Vein-Generator.
Read the full abstract ▾
All authors Yifan Wang, Jie Gui, Adams Wai Kin Kong, Baosheng Yu, Changsheng Chen, Qi Li, Zhenan Sun, James Tin-Yau Kwok, Alex Kot
Social and Information Networks
Community corrections have divergent downstream effects across corrected accounts
Yuwei Chuai, Thomas Renault, Nicolas Pröllochs et al. (+2 more)
Community-based fact-checking can reduce the spread of annotated misleading posts, but whether it produces lasting behavioral change among corrected authors remains unclear. Here, we conduct a large-scale quasi-experimental study of the Community Notes system on X (formerly Twitter), tracking four weeks of activity before and after note display for 19,854 accounts and 57,935 corrections (noted posts and matched controls), covering 11,909,591 original posts. Difference-in-Differences estimates show that note display is followed by an average 2.9% increase in corrected accounts' original-post activity. This aggregate conceals two divergent trajectories. Accounts corrected only once reduce their activity by 2.4% and subsequently publish less toxic and less misleading content. Repeatedly corrected accounts, which constitute 28.6% of corrected accounts but produce 73.4% of fact-checked posts, instead increase their activity by 4.4% after their first correction and show no detectable response to later ones. They exhibit no comparable content improvement, and instead publish more highly misleading posts, cite lower-quality domains, and post more political content. Community notes can thus constrain individual misleading posts without durably improving the behavior of the accounts most responsible for them, indicating that correcting content and changing its producers are distinct objectives for platform design.
Read the full abstract ▾
All authors Yuwei Chuai, Thomas Renault, Nicolas Pröllochs, Gabriele Lenzini, Mohsen Mosleh
Artificial Intelligence
SETU: An Agentic Ecosystem for Multilingual, Persona-Aware Communication Coaching
Jonnalagadda Maruthi Tejas, Uponika Barman Roy, Tilottama Goswami et al. (+2 more)
Corporate training teams need scalable and explainable tools to improve workforce communication in
multilingual settings. Existing systems often score text, audio, or
video in isolation, or produce black-box outputs that are difficult to audit for coaching use. This paper presents SETU, an agentic ecosystem for corporate communication coaching aimed at recruiters, frontline sales professionals and training units who prepare for audience specific conversations. SETU is designed for two scoped scenarios: (i) recruiter-candidate eligibility-and-interest calls with persona context and (ii) sales pitches with target-audience adaptation; owing to limited evaluation resources, this paper reports results on scenario (ii) only. The ecosystem decomposes analysis into specialized
video, audio-
speech, text-relevance, scoring, notification and reporting
agents coordinated through trust-aware orchestration. It generates modality-attributed coaching reports for formative training, with human reviewers retaining final judgment. The name SETU (bridge in several Indic
languages) reflects the goal of bridging communication gaps across regional
languages and audience expectations.
Read the full abstract ▾
All authors Jonnalagadda Maruthi Tejas, Uponika Barman Roy, Tilottama Goswami, Samir Goswami, Mousita Dhar
Machine Learning
Dandelion: A Spherical Flower for Neural Simulation of Planetary Dynamics
Till Muser, Giovanni Abati and Ivan Dokmanić
Many dynamical processes unfold on the sphere but the default scientific machine learning architectures are Euclidean. Applying these architectures on a regular lat-lon grid causes problems: Cartesian convolutions become distorted at high latitude; 2D FFTs in
Fourier neural operators incorrectly assume double periodicity; Cartesian positional encodings in ViTs distort spherical geodesic distances. Recent work moves towards natively spherical primitives, including spherical convolutions (e.g., DeepSphere or DISCO), Spherical
Fourier Neural Operators (SFNOs), and geodesic
attention. Here we propose Dandelion, a spherical version of Flower, a warp-based neural PDE solver. Layers of Dandelion predict a tangent-plane displacement and transport features along great circles. We obtain a U-Net-like structure by implementing hierarchical pooling entirely in the spherical-harmonic domain. There are thus no convolutions: spatial mixing is achieved only through spherical coordinate changes, or warps. To compare Dandelion with existing spherical architectures, we release an evolving
benchmark suite of challenging, natively-spherical PDE
datasets including a modified Galewsky jet, anomalous chained
turbulence, Cahn-Hilliard decomposition, spherical Riemann shocks, Held-Suarez dry atmospheric transport and global ocean dynamics. This new
benchmark fills the gap in existing spherical
datasets which are either too small and stylized, or much too large (ERA5) for model iteration. Dandelion is best or second-best on every
dataset, and the gap to non-warp baselines widens with resolution: at $256\times 512$, Dandelion and Flower2D occupy the top two slots in both single-step prediction and rollout.
Read the full abstract ▾
Machine Learning
When Muon Meets Task Interference: A Spectral Perspective on Continual Learning and Model Merging
Shangge Liu, Yuehan Yin, Yinghuan Shi et al. (+2 more)
Continual learning (CL) and model merging (MM) both aim to obtain a single model that performs well across multiple tasks, challenged respectively by catastrophic forgetting and weight-disentanglement error. In the literature, these difficulties are merely treated separately and mitigated through a variety of solutions, while the geometry induced by the base optimizer is treated as an implementation detail. In this work, we show that the two difficulties are in fact two instances of the same phenomenon: a parameter update useful for one task shifts the model's outputs on another. We formalize this shared phenomenon as task interference and reduce it to a common layer-wise Frobenius inner product $\langle \Delta W_\ell, J_\ell(x)\rangle_F$. This quantity, in turn, is utilized to expose the role of the optimizer. We theoretically derive an upper bound that isolates the spectral norm $\|\Delta W_\ell\|_2$ as an optimizer-controllable factor of task interference, and a per-mode analysis shows that this bound tracks the dominant part of the empirical interference. Specifically, we then identify the recent
Muon optimizer as a mechanism that regulates this factor by construction. Our work reveals that its elegant control on spectral norm tightens the interference bound for both CL and MM, positioning
Muon as a principled optimizer-centric approach complementary to existing solutions. Our theoretcal analysis is well validated by experimental results. Replacing the AdamW optimizer with
Muon improves accuracy by up to +5.02 points on the eight-task model-merging
benchmark across three CLIP backbones. For continual learning,
Muon also delivers uniformly positive gains across ten class-incremental protocols, three task-incremental protocols, and the 11-task MTIL
benchmark.
Read the full abstract ▾
All authors Shangge Liu, Yuehan Yin, Yinghuan Shi, Lei Wang, Wenbin Li
Artificial Intelligence · Cross-listed from eess.IV
Destroy Me: Automatic Artifact Generation for Histopathology Images
Zuzanna Krawczyk-Borysiak, Adam Krawczyk, Mateusz Miller et al. (+4 more)
Deep learning's diagnostic utility in pathology is constrained by model vulnerability to real-world data imperfections. While current strategies favor "perfect data" by filtering low-quality regions, which can lead to the loss of valuable diagnostic context, we propose a paradigm shift: engineering models to thrive in imperfect environments using "Destroy Me", a hybrid framework for realistic artifact synthesis and robust data augmentation. Our approach combines Stable
Diffusion, fine-tuned to preserve morphological continuity by realistically integrating artifacts with the underlying tissue architecture, with physics-based procedural modeling to synthesize six common artifact types: tissue folds, precipitates, blur, stitching errors,
dust, and pen markers. Artifact fidelity is assessed using Kernel Inception Distance (KID) and color Wasserstein distance metrics. Validating this strategy on lung adenocarcinoma pattern classification with an nnU-Net, we confirm that models trained on "destroyed" patches consistently outperform baselines on independent real-world
datasets. Specifically, we observed a 10.5% relative improvement in macro F1-score and a 15% relative increase in the Cohen's Kappa ($\kappa$) coefficient. Crucially, our results demonstrate that selective, impact-weighted augmentation is vital for balancing practical robustness with the preservation of subtle diagnostic features.
Read the full abstract ▾
All authors Zuzanna Krawczyk-Borysiak, Adam Krawczyk, Mateusz Miller, Gabriela Kaczmarek, Sławomir Pakuło, Małgorzata Sokół, Żaneta Swiderska-Chadaj
Machine Learning
A Deeper Analysis of Block-Sparse Featurizers
Alexandru-Iulius Jerpelea and Amith Ananthram
The recently introduced block-sparse featurizer (BSF; Fel et al., 2026) is similar to a sparse autoencoder (SAE), but its atomic unit is a small subspace (a block of directions) rather than a single direction. It is designed for features that live on low-dimensional
manifolds, which are especially frequent in
vision. This work studies the BSF's strengths and weaknesses, finding how it still somewhat suffers from classic SAE failure modes, like feature splitting and composition. We propose several architectural changes to the BSF, including a Tournament Top-K selection rule that significantly reduces feature splitting, and we also extend the block paradigm to the crosscoder.
Read the full abstract ▾
Computation and Language
Trajectory-Level Speculative Decoding for Diffusion Language Models
Tianxiang Pan, Baitao Gong, Mo Guang et al. (+5 more)
Diffusion-based
language models (dLLMs) enable parallel
token generation through iterative denoising, but existing decoding strategies collapse to single-
token generation under low confidence, severely limiting throughput. Unlike autoregressive models where speculative decoding operates on
token sequences in a fixed left-to-right order, dLLMs require speculating over denoising trajectories-sequences of multi-
token updates with explicit positions and unmasking orders. We develop a trajectory-level speculative framework that constructs draft denoising trajectories via confidence-stratified tree exploration and verifies them through blockwise parallel evaluation with bidirectional
attention masking. Our method further introduces inter-block speculation, exploiting
diffusion models' bidirectional structure to perform cross-block lookahead. We formally characterize when this approach is exact and identify trajectory drift as the fundamental cost of increased parallelism. Building on Fast-dLLM's dual-cache infrastructure, our framework reduces denoising iterations by 30-40% and increases
tokens-per-step from 2.6 to 4.3, achieving 7-14x speedup over vanilla dLLMs and 1.3x over Fast-dLLM with less than 1% accuracy change across
reasoning and code
benchmarks.
Read the full abstract ▾
All authors Tianxiang Pan, Baitao Gong, Mo Guang, Hongwei Yong, Tianpeng Jiang, Yaqian Li, Zheng Cao, Kaiwen Long
Machine Learning
DAMP: Decay-Aware Mixed-Precision Recurrent-State Quantization
Tao Zhang, Jianchao Tan, Pingwei Sun et al. (+6 more)
Complex
reasoning and agentic applications increasingly rely on long-context inference, where growing KV caches increase both
memory usage and decoding overhead. Hybrid models reduce these costs by combining Softmax
Attention with Gated DeltaNet (GDN) or Kimi Delta
Attention (KDA), which maintain fixed-size recurrent states. These states are commonly stored in FP32 and consume substantial GPU
memory, while their updates are limited by
memory bandwidth. Quantization can reduce both storage footprint and
memory traffic, but we find that uniform INT8 and FP8 degrade complex
reasoning accuracy, while INT4 and NVFP4 collapse it to near zero. To our knowledge, this is the first study of post-training recurrent-state quantization for GDN and KDA. Our analysis reveals that outliers in GDN and KDA states are concentrated in particular key channels and value dimensions. Learned decay influences how much quantization error is retained. We find that largely the same GDN heads and KDA key channels exhibit slow decay across tasks. Based on these insights, we propose DAMP, which jointly considers quantization error and decay-based error retention to select high-risk key channels offline. Under a fixed storage budget, it retains these channels in FP16 and stores the remainder in INT8. We evaluate DAMP on Qwen3.6-35B, Kimi-Linear-48B and Kimi-K3 across six
reasoning and code generation
benchmarks. At 9.9 bits per state value, DAMP maintains average accuracy close to FP32. In SGLang, DAMP reduces recurrent-state storage by 69.1%, accelerates the recurrent-state update kernel by up to 2.59x , and lowers full-model time per output
token by up to 19.0%.
Read the full abstract ▾
All authors Tao Zhang, Jianchao Tan, Pingwei Sun, Yanqi Yu, Zunhai Su, Zixu Jiang, Yuchen Xie, Xunliang Cai, Ziqian Zeng
Machine Learning
Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation–Deployment Gap
Jacopo Dardini, Claudio Stanzione, Giordano Colò et al. (+1 more)
Post-training quantization is often treated as a semantically neutral optimization for edge deployment of Large
Language Models. When a full-precision source checkpoint is evaluated and quantization is applied downstream without equivalent re-evaluation, this workflow creates a structural validation–deployment gap: because quantization is a many-to-one mapping over parameter space, source-precision certification does not guarantee behavioral equivalence in the deployed configuration. We formalize this gap through Quantization Behavioral Equivalence Classes (QBECs) and prove that QBEC membership does not imply behavioral equivalence, providing a theoretical basis for quantization-triggered
backdoor attacks. Building on a three-stage
adversarial fine-tuning framework, we embed latent malicious payloads into models that satisfy the source-precision checks used in our evaluation, yet activate targeted
adversarial behavior upon INT8 or 4-bit compression. We evaluate this threat in two operationally motivated scenarios, tactical machine translation and political content analysis, extending prior work from decoder-only causal LMs to
multilingual encoder-decoder sequence-to-sequence models. Results show that backdoored translation models move from zero measured friend–foe corruption at repaired FP16 to up to 85.02% inversion after quantization, and that a paired stance classifier measures an ideological shift of up to $\Delta\mathrm{Bias}=0.33$ upon compression. A cross-quantizer transferability analysis further shows that attack persistence varies across quantization schemes and model architectures, rather than being determined by nominal bit-width alone. These findings demonstrate that source-precision
auditing alone does not rule out quantization-triggered behavior and that the final deployed configuration must be included in behavioral certification for trustworthy edge AI.
Read the full abstract ▾
All authors Jacopo Dardini, Claudio Stanzione, Giordano Colò, Giuseppe Fenza
Cryptography and Security
eBPF-Based Cybersecurity Mechanisms: A Systematic Literature Review
Stamatios Kostopoulos, Panagiotis Tsakonas and Evangelos K. Markakis
Extended Berkeley Packet Filter (eBPF) has emerged as a kernel-level framework enabling dynamic security enforcement in modern operating systems. While eBPF's cybersecurity potential has attracted significant
attention, existing work remains fragmented across domains, evaluation methodologies, and deployment contexts. This systematic literature review applies PRISMA methodology to identify, categorize, and synthesize peer-reviewed research on eBPF-based cybersecurity mechanisms. Following a structured screening of 3,735 records from six databases, 54 primary studies (2018-2026) were analyzed and organized into a seven-domain taxonomy: DDoS mitigation, intrusion detection, IoT security, container security, microservice protection, networking, and security tools. Analysis reveals eBPF enables low-overhead security enforcement (median 2.4% CPU overhead [1.1-8.6%], ranging from nanosecond-scale costs for infrequent hooks to 10-20% for kernel hot paths) with high detection accuracy (94-99%). It particularly excels in kernel-level monitoring, real-time packet processing, and cloud-native workload protection. However, significant challenges persist: verifier-imposed constraints limit
algorithm complexity, 85.1% (46/54) of studies require low-level programming expertise, kernel version fragmentation hinders portability, and 96.2% (52/54) of research fails to address eBPF's own vulnerabilities. This review identifies critical research gaps in multi-tenant isolation,
adversarial machine learning (ML) robustness, production validation, and standardized evaluation frameworks. By consolidating fragmented knowledge and highlighting architectural trade-offs between safety and expressiveness, this work provides a foundation for next-generation eBPF security systems and actionable directions for kernel programmability research.
Read the full abstract ▾
Computation and Language
How Do Linear Probes Emerge? A Circuit-Tracing Framework with Concept-Targeted Attribution
Vedant Palit, Florent Draye, Terry Jingchen Zhang et al. (+2 more)
Transcoder attribution graphs are usually trained to explain why a model assigns high probability to a particular next
token. We introduce Concept-Targeted Attribution (CTA), which instead trains attribution graphs with respect to a linear probe direction. CTA therefore yields probe-specific
circuits that explain why an internal concept representation arises in a
prompt, independently of whether it is expressed in the generated
token. Using Cross-Layer Transcoders, we show that these probe-targeted graphs contain predictive structure: graph-level features predict probe accuracy across four widely studied concept categories ($\rho = 0.91$, $R^2 = 0.84$), while local features identify the sparse components driving per-
prompt classification. This connects probe performance to interpretable
circuit structure, allowing us to ask not only whether a probe works, but which internal computations make it work. Causal ablations further show that probe-targeted and logit-targeted graphs capture functionally distinct mechanisms. Removing probe-relevant features reduces internal concept scores while largely preserving generated
tokens, whereas removing logit-relevant features changes the generated
token in 92% to 100% of cases with near-zero effect on probe scores. CTA provides a framework for moving from behavioral probe accuracy to mechanistic explanations of probe performance, enabling more detailed audits of internal concept representations, including safety-critical ones. Our code is available at https://github.com/vedantpalit/concept-targeted-attribution
Read the full abstract ▾
All authors Vedant Palit, Florent Draye, Terry Jingchen Zhang, Bernhard Schölkopf, Zhijing Jin
Artificial Intelligence
WM-R1: Training GUI Agents to Reason and leverage World Models with Reinforcement Learning
Yu Han and Tianwen Qian
GUI
agents trained with reinforcement learning (RL) have showcased strong environment learning capabilities on mobile platforms. However, RL typically demands extensive real-environment interactions, leading to high resource costs and instability, especially in GUI scenarios. To address these, we propose WM-R1, the first reinforcement learning framework that trains mobile GUI
agents with world models instead of real environments. Specifically, world models serve as the source of state transitions during all rollouts, replacing the real Android environment within the training loop. WM-R1 also embeds world models directly into the thinking process, enabling
agents to reason about the consequences of candidate actions before committing to the final action. Crucially, WM-R1 eliminates the need for real-environment interaction, supports massively parallelized and step-level granularized trajectory generation grounded in world models, and introduces a multi-dimensional rule-based reward that jointly optimizes task success, trajectory efficiency, and world model utilization. For efficient training, we curate a high-quality
dataset of 2000 challenging tasks. Experiments on Android mobile
benchmarks demonstrate that WM-R1-trained
agents significantly outperform GRPO-only baselines and inference-time simulation methods. Code is available at https://github.com/genalyu/WM-R1 .
Read the full abstract ▾
Machine Learning
Marginal Coverage Credit Reduces Redundant Exploration in Parallel State-Entropy Optimization
Junhao Cao, Hongyi Xia, Jianian Wu et al. (+3 more)
Policy Gradient for Parallel State
Entropy maximization (PGPSE) expands state-space coverage by training independently parameterized policies in replicated copies of the same environment. However, its pooled team-
entropy score measures only collective exploration and cannot identify policies that contribute non-redundant coverage. We introduce Marginal Coverage Credit for PGPSE (MCC-PGPSE), which combines leave-one-policy-out coverage with state-owner specialization to estimate policy-specific credit. MCC-PGPSE preserves PGPSE's pooled objective and redistributes non-negative auxiliary intrinsic rewards according to these credits without changing their total mass. This redistribution is designed to discourage redundant visitation and promote complementary coverage. We evaluated MCC-PGPSE in controlled environments, seven public discrete-state
benchmarks, and representative Room and Maze settings from the original PGPSE protocol. Across all tested settings, MCC-PGPSE produced positive final window gains in normalized team state
entropy and state support over the
Entropy baseline. Controlled-task comparisons and the fixed-suite public aggregate were significant, whereas five-seed original-protocol comparisons were directionally consistent. Ablations and credit
alignment controls indicate that most gains arise from leave-one-policy-out coverage rather than non-uniform weighting, mismatched credit, or neural novelty alone. These results support contribution-conditioned auxiliary reward allocation as an interpretable approach to improving complementary coverage among parallel policies in discrete state spaces.
Read the full abstract ▾
All authors Junhao Cao, Hongyi Xia, Jianian Wu, Xiaopeng Yi, Lixia Huang, Ping Guo
Artificial Intelligence
Thinking Costs Tokens: When More Structure is Worth the Price
Thomas Nolasque, John Grey, Calista Pham et al. (+1 more)
Adding inference structure to a
language model lets it search, verify, and revise, but these actions consume the very budget they are supposed to use well. In this paper, we investigate whether there exists a
token-budget threshold, below which the overhead of planning and verification hurts performance and above which it helps. We evaluate two systems on FinQA and TAT-QA financial
reasoning tasks, using GPT-5.4 mini across 14 budget tiers ranging from 250 to 42,000 output-equivalent
tokens. The first system is a monolith, which is a single LLM call. The second is a verified search architecture that adds planning, label-blind checking, and repair capabilities. We run 1,000 cases for a total of 28,000 completed
cells. Both systems score 0% at the two lowest tiers, where neither can fit a complete
prompt. At 1,000
tokens, the monolith reaches 18% accuracy while verified search scores near 0%, since the planning overhead leaves no room for an answer. From 1,500
tokens onward, verified search surpasses the monolith and maintains a consistent advantage, reaching approximately 44% at the highest tiers while the monolith reaches approximately 40%. The crossover occurs between 1,000 and 1,500 output-equivalent
tokens, confirmed by a strict intersection-union test ($p \le 0.001$ at both endpoints).
Read the full abstract ▾
All authors Thomas Nolasque, John Grey, Calista Pham, Ankit Vani
Computation and Language
A Survey on Rubric-Guided Reinforcement Learning for Language Models
Zifei Shan and Fangning Shao
Reinforcement learning from human feedback (RLHF) has become the dominant paradigm for aligning large
language models (LLMs) with human preferences. However, traditional RLHF relies on scalar reward signals that lack interpretability and fail to capture the multifaceted nature of response quality. Rubric-guided reinforcement learning addresses these limitations by introducing structured, interpretable evaluation criteria, or rubrics, as the backbone of reward design, feedback generation, and policy optimization. In this survey, we introduce a
Bayesian framework that defines constitutions as prior distributions $P(R)$ over evaluation criteria and rubrics as conditional instantiations $R_x \sim P(R|x)$. Under this unified view, we present a taxonomy of rubric-guided RL along the prior-posterior axis, covering constitutional AI, instance-specific rubrics, process-level supervision, self-evolving rubrics, and their agentic and
multimodal extensions. Furthermore, as rubrics are natural-
language artifacts, we present a linguistic analysis of how granularity trade-offs, semantic drift, and linguistic reward hacking impact
alignment reliability, identifying key open problems for future research.
Read the full abstract ▾
Cryptography and Security
Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study
Paria Mehrbod, Boris Knyazev, Guy Wolf et al. (+2 more)
Despite extensive safety
alignment, large
language models (LLMs) remain vulnerable to jailbreak attacks that bypass safeguards to elicit harmful content. While prior work attributes this vulnerability to safety training limitations, the internal mechanisms by which LLMs process
adversarial prompts remain poorly understood. We present a mechanistic analysis of the jailbreaking behavior in a large-scale, safety-aligned LLM, focusing on LLaMA-2-7B-chat-hf. Leveraging edge attribution patching and subnetwork probing, we systematically identify computational
circuits responsible for generating affirmative responses to jailbreak
prompts. Ablating these
circuits during the first
token prediction can reduce attack success rates by up to 80%, demonstrating its critical role in safety bypass. Our analysis uncovers key
attention heads and MLP pathways that mediate
adversarial prompt exploitation, revealing how important
tokens propagate through these components to override safety constraints. These findings advance the understanding of
adversarial vulnerabilities in aligned LLMs and pave the way for targeted, interpretable defense mechanisms based on mechanistic interpretability.
Read the full abstract ▾
All authors Paria Mehrbod, Boris Knyazev, Guy Wolf, Eugene Belilovsky, Geraldin Nanfack
Information Theory · Cross-listed from quant-ph
Quantized Low-Rank Quantum State Tomography: Hyperbolic Quantization and Riemannian Least-Squares Recovery
HanQin Cai, Longxiu Huang and Juntao You
We study low-rank
quantum state
tomography from finite-bit Pauli batch responses. To avoid bias introduced by generic quantization, we propose HyperQuant, a mean-preserving
hyperbolic quantizer adapted to the second-moment scale of Pauli responses. We establish minimax distortion guarantees and show that exact mean preservation enables direct rank-constrained least-squares recovery without altering the population target. We derive nonasymptotic recovery guarantees and an explicit bit–shot tradeoff under which finite-bit responses retain the error order of unquantized batch averages using fewer response bits. For efficient computation, we develop QuantRGD, a Riemannian gradient method with provable linear convergence to the corresponding statistical neighborhood under explicit resource conditions. Numerical experiments validate the predicted quantization, recovery, and convergence behavior.
Read the full abstract ▾
Software Engineering
Image Augmentation as Test Generation for Deep Learning-Based Image Retrieval Systems
Yehan De Silva, Anirudh Sridhar, Armin Lotfy et al. (+6 more)
Ensuring the reliability of deep learning-based image
retrieval systems is a software engineering challenge. This paper presents a dual contribution: (1) a literature review of augmentation and generation techniques which resulted in the identification of 50 techniques which we organized into a ten-category taxonomy, and (2) a large-scale empirical study that evaluates these techniques as test generators for
embedding-based image
retrieval systems. Augmented images are embedded using Amazon Titan and OpenCLIP, and evaluated across four analytical dimensions: (1)
embedding-space similarity, (2)
embedding uncertainty measured via four
estimators, (3) semantic realism scored by LLaVA, and (4)
retrieval failure rate. Experiments are performed on three
datasets: CIFAR-10, ImageNet-1K, and a
dataset from an industrial partner (March Networks). Across all evaluated
datasets and
embedding models, and under the single severity level tested for each technique, weather simulation and SaSPA are the image augmentation/generation techniques that produce the highest
embedding uncertainty and failure rates while maintaining a favorable balance between performance stability, visual realism, and augmentation effectiveness. The results we discuss are configuration-specific and may shift under milder or stronger perturbation settings. In contrast, GAN-based augmentation techniques are among the lowest in realism, indicating the presence of synthetic artifacts and perceptual inconsistencies that reduce their suitability to produce realistic test inputs. Overall, our findings provide practical guidelines for selecting augmentation techniques that maximize test diversity while preserving realistic image characteristics, thereby enabling the construction of comprehensive and effective test suites for image
retrieval systems while reducing the cost of manual data labeling through the use of metamorphic testing.
Read the full abstract ▾
All authors Yehan De Silva, Anirudh Sridhar, Armin Lotfy, Nafiseh Kahani, Yvan Labiche, Ziyu Wang, Frank Ouyang, Clare Carty, Azalia Shamsaei
Computation and Language
INSPIRE: An Internalize-Then-Improve Approach for Example-Driven Mathematical Reasoning
Shuai Wang, Jiayi Kuang, Yinghui Li et al. (+4 more)
Mathematical
reasoning has seen rapid progress in large
language models (LLMs), yet existing methods optimize predominantly for final-answer correctness, raising the question whether models truly internalize mathematical concepts or merely memorize solution patterns. In human mathematics education, example-based
reasoning such as constructing counterexamples to test
theorem boundaries reflects deep conceptual understanding, but remains underdeveloped in current LLMs. Enhancing this capability through preference optimization presents two key challenges: (1) the model's limited example-based
reasoning ability makes constructing effective preference pairs inherently difficult; and (2) capability acquisition is progressive, as the model must first learn to adopt this strategy before learning to apply it correctly. Therefore we propose INSPIRE, an Internalize-Then-Improve approach combining Reference-Guided Student Internalization (RGSI), which produces high-quality preference candidates under the policy model's own distribution, with a stage-wise rubric preference training strategy that decomposes learning into method-oriented and correctness-oriented stages. Experiments across multiple model scales and families demonstrate consistent improvements, even surpassing larger open-source models, while evaluations on out-of-distribution
benchmarks confirm no degradation in general mathematical
reasoning ability.
Read the full abstract ▾
All authors Shuai Wang, Jiayi Kuang, Yinghui Li, Haojing Huang, Xinnian Liang, Ying Shen, Liang Lin
Machine Learning · Cross-listed from stat.ML
Optimal Transport for Network Comparison: A Unified Review with New Spectral Bounds and Machine Learning Applications
James Hyun and François G. Meyer
Network comparison using optimal transport is a growing area of research in network science. Unlike standard graph metrics, optimal transport computes both network dissimilarity and a transport plan that explains how one graph morphs into another. In this paper, we review how optimal transport compares undirected, unweighted simple graphs using three primary distances: the Wasserstein, Gromov-Wasserstein, and Bures-Wasserstein distances. We examine the closed form of the Wasserstein distance in one dimension via node feature probability distributions, and show how the transport plans of the Wasserstein and Gromov-Wasserstein distances visualize how mass is shifted to transform one network into another. Beyond reviewing existing transport-based approaches, we establish new spectral lower and upper bounds for the Bures-Wasserstein distance and characterize the tightness of the lower bound under eigenbasis perturbations. Finally, we evaluate these distances using a synthetic network
dataset for clustering and a real-world temporal network.
Read the full abstract ▾
Robotics
Beyond Relative Geometry: Metric-Aware Geometry Perception for Robotics
Fengjun Zhong, Congjia Chen, Zhaoxu Liu et al. (+7 more)
Recent
embodied models increasingly leverage
geometric representations to improve spatial
reasoning and robotic manipulation. However, existing reconstruction methods only reconstruct relative geometry with arbitrary scales, causing predicted object dimensions and spatial distances to vary across scenes, viewpoints, and input configurations. This inconsistency prevents
geometric perception from being directly aligned with robotic actions defined on the real-world scale. To address this limitation, we propose Metric-Aware Geometry Perception (MAGP), an end-to-end, plug-and-play framework for metric geometry reconstruction that can be seamlessly integrated into robotic policies. At its core, Metric Scale Equivariant Augmentation encourages the model to reconstruct metric geometry from camera parameters and depth observations, ensuring that the reconstructed geometry follows the metric scale specified by observations. Flexible Metric Conditioning further enables MAGP to support arbitrary view counts and combinations of camera and depth inputs, improving robustness to heterogeneous robotic sensing configurations. Together, these designs produce geometrically consistent reconstructions with stable object dimensions and spatial distances across scenes and sensing conditions. Experiments on ETH3D, MegaDepth, and ScanNet++ demonstrate that MAGP maintains strong relative geometry accuracy while reducing the absolute error by over an order of magnitude, from 2.01m to 0.07m. When integrated into multiple robotic policies, MAGP consistently improves performance on LIBERO, RoboTwin, and zero-shot LIBERO-Plus, with gains of up to 6.26% on RoboTwin. These results demonstrate the effectiveness and generalizability of metric geometry for robotic manipulation.
Read the full abstract ▾
All authors Fengjun Zhong, Congjia Chen, Zhaoxu Liu, Jinyang Du, Yuchen Gong, Enqi Mao, Ruihao Gong, ShuJie Wang, Xianglong Liu, Zhongliang Qiao
Cryptography and Security
ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection
Xinhang Ma, Chaowei Xiao, William Yeoh et al. (+2 more)
Indirect
prompt injection (IPI) plants instructions in the content a tool-using LLM
agent reads, steering the
agent into harmful tool calls. The strongest defenses are system-level, leveraging techniques such as task-conditional tool screening to prevent execution of malicious tools, and information-flow control to avoid tool execution with untrusted parameters. However, as
agents grow more capable, users delegate more to automation. Consequently, tool execution sequences and parameter values are increasingly determined at runtime and cannot be reliably screened from solely user's query without significant utility loss. We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust: a value may reach a state-changing tool only if it traces unforgeably to the user, a source the user explicitly named, or the user's own authoritative records. Enforcement is then a deterministic origin check over an audited set of sensitive tool parameters, and the only reliance on a
language model involves solely the trusted user request, out of the attacker's reach. Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision. We evaluate across four
agent models on open-ended
agent suites, ROPE holds attack success rate to 1.6–2.6% while retaining 82–100% of undefended clean utility, significantly exceeding state-of-the-art system-level defenses in utility while attaining comparable or better security. Further, we show that optimizing the injection against ROPE is largely ineffective, while long-horizon attacks that defeat prior system-level defenses achieve zero success rate. Our code and logs are available at https://github.com/xhOwenMa/ROPE .
Read the full abstract ▾
All authors Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik
Computer Vision
UrbanGround: From Local Perception to Spatial Agency in a Real-Scale City
Tianjie Ju, Zheng Wu, Yueqing Sun et al. (+15 more)
Multimodal large
language models (MLLMs) can interpret a street view, but reliable urban action depends on whether such local evidence remains useful after the
agent starts to move. In this paper, we investigate how far current MLLM
agents can turn local urban perception into reliable action in a real-scale city. We propose UrbanGround, an urban sandbox built from Hong Kong's territory-wide 3D geospatial data. It combines the city's geographic structure with continuous, collision-constrained control through a shared evaluation interface.
Agents use first-person observations and an interactive map to select actions across tasks ranging from local question answering to long-horizon
navigation. Our analysis follows the growth of the spatial problem through three research questions. We first test whether an
agent can gather and interpret local visual evidence to answer spatial questions. Then we ask whether these abilities support
navigation as destinations become farther away and less explicit. Finally, we examine whether the resulting behavior survives changes in route availability and pedestrian motion. MLLM
agents usually show useful atomic abilities in visual recognition and short-range spatial
reasoning, while orientation and pedestrian-aware movement remain unreliable. Their central failure emerges over extended exploration, where local abilities do not compose into sustained goal-directed behavior and errors accumulate without effective correction. We hope UrbanGround will support broader study of how far MLLM
agents can explore reliably in open-ended urban environments.
Read the full abstract ▾
All authors Tianjie Ju, Zheng Wu, Yueqing Sun, Yuhan Cui, Bobo Li, Shengqiong Wu, Pengzhou Cheng, Haodong Zhao, Zongru Wu, Xinbei Ma, Doris Zhang, Kunling Li, Mong-Li Lee, Wynne Hsu, Hao Fei, Qi Gu, Gongshen Liu, Zhuosheng Zhang
Computation and Language
CritICL: Inference-Time Weak-to-Strong Generalization from Small Language Model Failure Modes
Yufan Wu, Yinghui He, Zhengyi Hu et al. (+4 more)
Recent advances in inference-time scaling have significantly improved the
reasoning performance of large
language models (LLMs). However, these methods typically rely on repeated generation or external verification. To address this limitation, we introduce CritICL, a novel inference-time framework that improves
reasoning while maintaining high efficiency. Our key insight is that LLM failure modes exhibit structured patterns across model scales within the same family. Instead of treating failures as undesirable outputs, CritICL leverages them as a source of guidance. Specifically, we utilize failure modes derived from weaker models and incorporate them into inference through critique-based in-context examples. We propose two variants: CritICL-dynamic, which adaptively predicts input-specific failure modes and retrieves critiques, and CritICL-static, which uses a global failure mode profile to provide stable guidance. Experimental results show that CritICL consistently outperforms standard in-context learning and achieves performance competitive with or superior to test-time scaling methods, while requiring significantly fewer generations and lower
token cost. Code available at: https://github.com/umwyf/CRITICL
Read the full abstract ▾
All authors Yufan Wu, Yinghui He, Zhengyi Hu, Lang Wei, Ruichen Li, Qifan Yang, Ting Zhu
Artificial Intelligence
WikiSkill: Compiling Agent Experience into Persistent Knowledge for Skill Evolution
Liyan Tang, Cyrus Rashtchian, Chun-Sung Ferng et al. (+3 more)
Agent skills package specialized knowledge and workflows into reusable resources that extend AI
agent capabilities. Recent work automatically discovers such skills from
agent experience, which enables
agents to progressively adapt through interaction. However, the insights that guide skill development typically remain scattered across optimization histories, limiting their systematic reuse across iterations. We introduce WikiSkill, a framework that co-evolves
agent skills with a persistent knowledge base (wiki). At a high level, WikiSkill separates raw execution experience, accumulated knowledge, and executable skills, while continuously consolidating experience into the wiki, which subsequent skill updates can build on. Across diverse
benchmarks and models, WikiSkill consistently outperforms state-of-the-art skill-
evolution methods and improves over no-skill baselines in most model-
benchmark settings. We find that skill
evolution complements model scaling: larger models generally benefit more from evolved skills, while smaller models with skills can outperform substantially larger models without them. We also find that evolved skills transfer effectively across models and model families, and skills evolved by other models can outperform self-evolved skills. Finally, our ablation studies confirm that persistent knowledge accumulation in the wiki is critical for effective skill
evolution. These results demonstrate the benefits of systematically accumulating and refining
agent experience for developing reusable and transferable skills.
Read the full abstract ▾
All authors Liyan Tang, Cyrus Rashtchian, Chun-Sung Ferng, Andrew Tomkins, Da-Cheng Juan, Tu Vu
Programming Languages
Tacet: A Language and Type System for Automatic Statistical Validity Accounting
Chiké Abuah
Empirical comparisons between systems are a standard form of evidence in computer science research, but few are checked for statistical validity: most are never framed as statistical tests at all. Existing multiple-comparison procedures could control the resulting error, but need inputs (what an analysis examined, and how its observations are arranged) that are not recoverable from a list of p-values. We introduce Tacet, a
language in which an analysis declares what it generated, states what it expects to find, and is refused any claim it cannot afford or cannot properly test. Its core calculus T pairs a free estimation sublanguage, carrying a reported footprint and a purity bit that records whether any outcome was consulted in building a value, with a priced claim sublanguage, carrying a wealth
transformer, connected only by a mechanism that prices a comparison. A sample selected by reading outcomes sets the purity bit and is recorded as having examined everything it read, permanently, so it can never be granted a one-sided or confirmatory price, without the system ever asking whether the analyst intended to cherry-pick. Whether a comparison is paired or clustered is computed statically from the artifact schema, from declared functional dependencies between key fields alone and before any data is read, and a mechanism that assumes that structure away is refused rather than priced. Because the wealth
transformer is antitone in the realized p-value, affordability can be checked before the analysis runs too, turning pre-registration into a typing rule. We prove the metatheory machine-checked in Lean 4 with no admitted gaps, and demonstrate the approach on a reference implementation and two case studies on published artifacts, the SWE-bench Verified leaderboard and BIG-Bench Hard.
Read the full abstract ▾
Software Engineering
SWE-Prime: Fewer Trajectories, Better Performance
Dewu Zheng, Ruizhe Ye, Yanlin Wang et al. (+7 more)
To improve large
language models' ability to resolve real-world software issues, prior work has focused on constructing large-scale
agent trajectory
datasets and performing supervised fine-tuning (SFT) on successful trajectories. However, task success does not guarantee high-quality supervision: successful trajectories may still contain ineffective, redundant, or risky steps. Directly using such trajectories for SFT can introduce noisy supervision and encourage models to imitate undesirable problem-solving behaviors. Therefore, we propose SWE-
Prime, a multi-granularity, two-stage SFT data selection method that progressively filters training data at the trajectory and segment levels. Specifically, the first stage performs trajectory-level screening based on process quality, result quality, and data representativeness, selecting a high-quality and representative subset of successful trajectories. The second stage performs segment-level selection by grouping consecutive steps into semantic segments and assessing each segment based on its contribution to the final solution, learnability, and potential risks. During SFT, all segments remain in the sequence to preserve context, while only selected segments contribute to the loss computation. Experiments on SWE-Bench Pro and SWE-Bench Verified show that training on the 10% trajectory subset selected by SWE-
Prime outperforms training on the full resolved
dataset, yielding relative performance gains of up to 12.2% and 24.2%, respectively.
Read the full abstract ▾
All authors Dewu Zheng, Ruizhe Ye, Yanlin Wang, Yang Ye, Hongyu Zhang, Ensheng Shi, Xilin Liu, Yuchi Ma, Jianxing Yu, Zibin Zheng