Cryptography and Security
Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation
Jinqian Zhang, Haojun Xia, Shujiang Wu et al. (+4 more)
Coding-
agent approval interfaces bind a human decision to a command or tool call, while developer tools execute the transitive workflow that invocation activates. Package installation can run lifecycle hooks and write files; an MCP call can exercise network authority. We call the resulting record-coverage failure approval laundering: the durable record names the entry invocation but omits effects exercised by its workflow. We present the first systematic security analysis of this record-to-closure relation in
agent systems. We formalize closure-bound approval over six effect classes and derive an information limit: identical policy-visible fields can require different effect-specific decisions, so no record-only policy can guarantee both. The Approval-to-Action Security
Benchmark binds approval objects and decision-time metadata to post-execution evidence. Across 111 fixed approval-object/trace pairs, residual records fall from 40 under explicit fields to 17 with command semantics and 13 with decision-time metadata. Across 11 fixed-SHA executions, the ladder reaches zero metadata residuals; two exact mappings recur across three product frontends. For prospective recovery, effect-bound records commit frozen, source-backed predictions and provenance before authorization. On 17 prespecified holdout workflows, predictions achieve 0.926 macro recall and 0.941 macro precision; binding them cuts residual effects from 10 to 3. A Claude Code PreToolUse integration carries the frozen record through the permission path without automatic approval. These results establish approval laundering as a measurable, recurrent record-coverage failure despite truthful invocation identity. They motivate binding each invocation before authorization to a source-backed prediction of its workflow's transitive effect boundary and preserving that binding with the decision.
Read the full abstract ▾
All authors Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue, Xia Zhang, Zhangpei Cheng, Bibo Tu
Cryptography and Security
Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
Jinqian Zhang, Haojun Xia, Shujiang Wu et al. (+4 more)
Multi-step tool-calling LLM
agents rely on host runtimes to preserve state across turns. When a runtime carries an external tool return into later model inputs, providers meter it again. An admitted malicious or compromised tool can thereby convert untrusted data into recurring victim-billed processing without victim credentials or local runtime privilege. We call retained content persistent billable state and formalize the host's decision over whether and how it enters later billable context as the persistent billable-state boundary. We present the first systematic security study of this post-admission lifecycle. We derive six denial-of-wallet attack vectors and build DOW-BENCH, an end-to-end harness evaluated across six model families. Across 243 executions, usage telemetry shows that the maximum per-session cumulative input reaches 14,293x the session's first-call input. Controlled history-policy reruns isolate raw retention's contribution: retaining raw history increases mean effective session cost by 21.2-35.9%. Compression succeeds on 10/12 and 11/12 history-dependent tasks, versus 2/12 under deletion for each provider. To govern this boundary, we combine deterministic history transformation with four host-side invariants that bound
prompt mass, context growth, recursive opportunity, and cumulative spend before reingestion. The kernel contains every recurring attack in the 123-evaluation replay corpus. Across 24 Mistral Small 4 workflows, a progress-authorized policy achieves 22/24 oracle-verified task successes with no pre-completion interruptions, versus 13/24 under a fixed cap. Only 71 of 3,830 scanned MCP server and transport repositories expose any code-visible safeguard proxy, and none cover all four safeguard families. These results establish persistent billable state as a first-class security object and pre-reingestion as its host-owned control point.
Read the full abstract ▾
All authors Jinqian Zhang, Haojun Xia, Shujiang Wu, Jingkun Yue, Xia Zhang, Zhangpei Cheng, Bibo Tu
Machine Learning
SGA: Uncertainty Quantification for Multi-Step Forecasting in Time Series Foundation Models
Xin-Yu Hu, Shuang Liang, Cheng Feng et al. (+1 more)
The recent emergence of Time Series Foundation Models (TSFMs) has significantly advanced multi-step
forecasting performance, enabling accurate predictions over extended future horizons. However, existing TSFMs often suffer from significantly inherent uncertainty, which typically manifests as derived forecast branches emerging at each time step and spreading to subsequent steps; different forecast branches often exhibit varying
forecasting performance, thereby undermining the credibility of TSFM forecasts. In this paper, we propose the Slicing-Graphing-
Alignment (SGA) method to quantify the uncertainty of multi-step TSFM forecasts. The proposed SGA first characterizes the
topology of all potential forecast branches using a directed acyclic graph, such that the graph complexity bounds the uncertainty of multi-step forecasts, and then precisely measures the graph complexity by integrating both topological information and TSFM-inherent stochasticity. Experimental results conducted on 11 TSFMs and 27
datasets demonstrate that (i) SGA achieves the best performance when ranking predictive errors with uncertainty estimates; (ii) SGA works with a more extensive and more precise sampling coverage than those of existing UQ methods, deriving a quantification mechanism fundamentally different from those of established ones; and (iii) larger model scales of TSFMs correlate with lower uncertainty estimates of multi-step forecasts, suggesting another empirical scaling law for uncertainty quantification of multi-step TSFM forecasts.
Read the full abstract ▾
All authors Xin-Yu Hu, Shuang Liang, Cheng Feng, Shao-Qun Zhang
Machine Learning
Auditability Is Not One Property: Rule Overlap, Behavioural Agreement, and Composition in Reinforcement Learning
Liu Hung Ming
Reinforcement-learning (RL) policies are often distributed as opaque neural checkpoints, while training logs show that a run occurred without explaining what the policy learned. We study whether independently trained policies can be represented and composed through auditable discrete behavioral rules. We define auditability as six separately testable predicates: trace integrity, lossless coding, rule coverage, behavioral agreement, composition quality, and value-model reliability. Our protocol uses a shared frozen symbolizer, passive rule extraction, an append-only hash-bound ledger, exact environment replay, and offline confidence-ranked arbitration with an explicit blind-spot fallback. The results place strict limits on this description layer. Rule-set overlap does not imply behavioral agreement: policies may share symbolic rules while choosing near-chance-matching actions on fresh states. The fused policy therefore selects among existing rules rather than generating a new skill. On a conflict-dominated task, an apparent fusion failure is traced to an induction/deployment mismatch: rules induced from sampled actions were evaluated under argmax actions, and deployment-consistent re-induction reverses the arbitration ordering. A fitted-Q generalized-policy-improvement diagnostic also fails in both environments, limiting claims that rule fusion is superior to value-based composition. One exploratory comparison favors rule fusion, but its comparator is post hoc, the task is partly saturated, and the fused policy remains below the strongest held-out actor. We contribute an evidence-bounded audit and composition protocol, not a claim of universal interpretability or autonomous skill generation. Future work must add temporally extended skills, cross-skill interfaces, composition search, and independent novelty audits.
Read the full abstract ▾
Computer Vision
Token Clustering and Semantic Sequence Mamba for Hyperspectral Image Classification
Yimin Zhu, Mahmood Elahi and Lincoln Linlin Xu
Although hyperspectral images (HSIs) provide rich spectral-spatial information, accurate pixel-level classification remains challenging because of spectral-spatial heterogeneity and complex spatial structures. Existing
vision state space models (Mamba) typically construct sequences according to predefined spatial neighborhoods, without explicitly accounting for semantic similarity or spatial non-stationarity. To address this limitation, we propose
Token Clustering and Semantic Sequence Mamba (STMamba), which organizes sparse
tokens into semantically coherent sequences for hyperspectral image classification with the following features. First, at the macro level, a hierarchical encoder decoder progressively selects semantic
tokens with the
Token Clustering Module (TCM) and restores dense features using a parameter-free Cross-scale Neighborhood
Attention (CNA) Upsampler. Second, at the micro level, TCM first identifies representative cluster centers through density-aware clustering and estimates soft memberships based on feature similarity. A quadtree-based dynamic selection strategy then retains sparse and spatially distributed
tokens from each semantic cluster, forming coherent semantic-
token sequences while reducing redundant pixel-wise representations. Third, parallel Spatial and Spectral Semantic-wise Sequencing Mamba (SWSM) modules capture complementary long-range spatial and spectral dependencies within homogeneous semantic
token sequences while suppressing irrelevant interactions across heterogeneous regions. Experimental results on three large-scale
benchmark datasets demonstrate that STMamba outperforms the SOTA methods with respect to quantitative and qualitative results.
Read the full abstract ▾
Machine Learning
Uncovering Residential PV-EV Co-Adoption from Smart-Meter Data: Load Archetypes and Detection for Demand-Side Planning
Jack Zheng and Hao Wang
The increasing adoption of electric vehicles (EVs) and rooftop photovoltaic (PV) systems is reshaping residential electricity demand and creating new challenges for demand-side management (DSM), tariff design, and low-voltage network planning. Much of the existing literature examines EV charging or PV generation in isolation, leaving the behavioral dynamics of household co-adoption less understood. We develop an integrated, two-part workflow to analyze advanced metering infrastructure (AMI) data. A discovery component applies dynamic time warping (DTW) k-means with DTW barycenter averaging to cluster daily import or export profiles into interpretable behavioral archetypes, while a predictive component trains a bidirectional long short-term
memory (BiLSTM) model on 21-day windows and
benchmarks it against tabular baselines for PV/EV activity detection. The EV activity labels are inferred from charging-like load signatures because charger measurements are unavailable. Using half-hourly AusNet residential data from Victoria, Australia, the clustering uncovers distinct patterns across PV-only, EV-only, co-adoption, and neither cohorts; for co-adopters, a midday-centered weekday export archetype accounts for approximately 50% of days. At validation-tuned thresholds, both BiLSTM and XGBoost achieve strong discrimination. BiLSTM obtains 0.991 for the area under the receiver operating characteristic curve (AUROC), 0.906 for macro-F1, and the highest recall on the most difficult class (0.836 for EV-only recall). Tree-based baselines remain competitive. Performance remains stable across plausible labeling rules (macro-F1: 0.894–0.914) and strictly forward temporal splits (macro-F1: 0.894–0.906).
Read the full abstract ▾
Sound
ASR ensembling for phoneme intelligibility evaluation of speech anonymizers
Victor Ménestrel, Sebastian Möller, Slim Ouni et al. (+1 more)
We present the first phoneme-level intelligibility evaluation of
speech anonymizers, assessing the performance of ASR-ensemble-based metrics against measured intelligibility from a crowdsourced listening test. Our results show that simple hard-voting ASR metric reaches correlations above 0.9 with human ratings when aggregated by feature, test-type, or condition, provided that multiple ASR models are combined; evaluating stimuli with and without a carrier sentence further improves the correlation at the stimulus level. However, posterior-probability-based confidence metrics bring no gain, which can be traced back to the insufficient calibration of the state-of-the-art open ASR models that were utilized here. All data, code, and evaluation tools are released as open source.
Read the full abstract ▾
All authors Victor Ménestrel, Sebastian Möller, Slim Ouni, Dorothea Kolossa
Machine Learning
Time-Series Foundation Models That Understand Data Revisions
Taimoor Ahmad
Historical observations are not always fixed: statistical agencies revise previously published values as new evidence arrives.
Forecasting from a contemporary download can therefore expose a model to information unavailable at the date it purportedly made a prediction. We propose VINTAGE-TS, a revision-aware adaptation of a time-series foundation model that distinguishes observation time from information-availability time. Its targets are the next period's first-published value and the value available a fixed number of days after that publication; neither is declared final truth. A joint predictive distribution preserves dependence between these targets and exposes uncertainty about their difference. We specify an ALFRED-based rolling evaluation, a matched Chronos-2 comparison, conventional and revision-aware baselines, and a separate audit of pretraining overlap. The accompanying software implements validity-interval reconstruction, delayed-label filtering, a frozen-backbone adapter interface, and reproducible diagnostics. An executed synthetic demonstration and a 25-configuration sensitivity suite verify the workflow, expose variation across seeds and revision regimes, and illustrate how hindsight contamination changes measured performance. Thirty one automated tests check temporal and integration contracts. Real ALFRED and Chronos-2 experiments have not been executed; no empirical foundation-model advantage is claimed.
Read the full abstract ▾
Artificial Intelligence
TWIST: A Proposed Benchmark for Intervention Quality in Conversational Memory, with a Human-Validated Draft-Alignment
Subrat Panda
Long-conversation
memory benchmarks increasingly test recall and prompted knowledge updates, and recent work studies evolving user beliefs and
memory state. TWIST is a proposed
benchmark suite for a complementary, unmeasured property: intervention quality – whether a deployed
memory system, exercised through its own ingest/recall/vet surface, acts correctly at belief change points. Four tracks cover unprompted tension detection, vetting outgoing drafts against the record, answering with current beliefs while preserving supersession history, and governing sensitive recall. The suite extends LoCoMo's corpora and harness, pairing every detect/block metric with a matched do-not-over-detect control: surface-matched hard negatives price false intervention, so no track can be gamed by flagging everything. The
benchmark itself is validated first: independent, gold-blind double annotation with adjudication, judge decoy calibration, and a separability audit. On the human-validated Track B v1.0 key (161 items, post-adjudication kappa = 0.85), no tested configuration simultaneously achieves high contradiction recall, high hard-negative specificity, and high attribution: flat-RAG baselines detect 0.76-0.97 of true contradictions but falsely flag 16-43% of surface-matched safe drafts depending on backend, while a deployed coherence-oriented system almost never over-flags (0.98-1.00 specificity) yet catches 42% of true contradictions – a trade-off no recall-only score can see. A 13-configuration baseline ladder localizes causes: every gold contradiction is detectable from its evidence alone (recall 1.000), calibrated models nearly solve the track given the full transcript – consistent with substantial
retrieval-coverage gaps – and draft-only floors reveal model-dependent style priors. A system's TWIST profile, beside its recall score, measures whether
memory knows when to intervene and when not to.
Read the full abstract ▾
Cryptography and Security
Where Cyber Agents Struggle: Bottleneck Analysis of Multi-Stage LLM Agents
Saeedeh Lohrasbi, Mohammad Mamun, Ahmed Yehia et al. (+2 more)
Multi-stage LLM-based cyber
agents may complete attack workflows while remaining brittle, costly, or reliant on incorrect interpretations of execution evidence. Success rates alone obscure inefficiency, adaptation through retries, and recognition of success or failure. We present an end-to-end diagnostic study of an Autonomous Adversary system with orchestrator, executor, and validator LLMs in enterprise-like lateral-movement scenarios. Six frontier models are evaluated across two scenarios and three modes: expert-defined, self-scaffolded, and fully autonomous. We assess validator consistency and evidence grounding; introduce a subtask-conditioned, cost-aware score for abnormal
token use, retries, and runtime; and use comparative LLM-as-a-Judge analysis to identify planning deficiencies, including tool misalignment, plan similarity, over-specification, inadequate probing, and weak recovery. Validators are generally relevant and evidence-grounded but often nonspecific and overly optimistic. Bottlenecks cluster in credential and lateral-movement tasks, spread with scenario complexity, and vary more under full autonomy. Reliable evaluation must assess outcomes, evidence interpretation, resource use, and adaptation after failure.
Read the full abstract ▾
All authors Saeedeh Lohrasbi, Mohammad Mamun, Ahmed Yehia, Scott Buffett, Sherif Saad
Artificial Intelligence
DEEPO: Dual-Entropy Enhanced Policy Optimization for Hallucination in MLLMs
Yingxuan Zhuang, Miao Pan, Wangjie Gan et al. (+6 more)
Reinforcement learning (RL) is widely used to sharpen
reasoning in
multimodal large
language models (MLLMs), yet its effect on
hallucination is uneven. We trace this to two weak points in the correction chain from reward to parameter update. At the rollout level, hard queries—those with high semantic
entropy—frequently produce unanimously wrong sample groups, collapsing the group-relative advantage to zero exactly where
hallucination risk is highest. At the optimization level, confident-but-wrong
tokens are gradient-invisible: a categorical policy's expected score-gradient norm vanishes as its distribution sharpens, so the predictions that most need correction receive the weakest updates. We propose Dual-
Entropy Enhanced Policy Optimization (DEEPO), a dual-stage enhancement combining signal variance regularization with gradient preconditioning: semantic-
entropy-triggered expert prefixes inject grounded continuations on high-uncertainty queries, providing direct supervision and restoring advantage variance, while advantage-sign-aware Renyi preconditioning counteracts logit-level saturation so correction reaches confident errors in the operational confidence regime. Both branches improve over GRPO individually; their interaction is statistically significant on VideoMMMU—the most complex long-horizon task in our evaluation suite (+4.0$, 95% CI [1.1, 6.9])—and additive elsewhere. DEEPO reduces
hallucination while preserving accuracy and training stability.
Read the full abstract ▾
All authors Yingxuan Zhuang, Miao Pan, Wangjie Gan, Jingxiao Yang, Fan Wang, Weiming Liu, Cheng Tan, Xuhong Zhang, Jintao Chen
Software Engineering
Pretraining and adapting a language model on a dependency-free stack: GPT-2 124M from random weights, reproduced against llm.c, and a clinical adapter for Qwen3-0.6B
Thang Tran and Lan Dang
Almost every
language model in service was trained by one family of software. That concentration makes a question hard to settle: how much of what is known about training a
language model describes
language models, and how much describes that software? Settling it needs a second implementation able to carry a model through a whole lifecycle rather than reproduce one operator. We report such a lifecycle. Using numbat, a machine-learning stack written in Zig with no third-party runtime dependencies, we pretrain a 124.4 M-parameter GPT-2 from random initialisation over 9.91 B
tokens of web text, then adapt a separate small model to clinical question answering. A reference implementation runs on identical hardware at both stages, and a sidecar with authority to halt a run supervises each. Agreement is close. Held-out cross-
entropy finishes at 3.2588 against a published 3.29, and HellaSwag at 0.3053 against 0.299; across 8 paired evaluations it sits below a same-machine reference at every point, by 0.0608 on average. Re-running that reference on different hardware moves it 0.0035, which bounds how much of any gap is method rather than framework. Throughput does not pay for agreement: measured in one session at a production configuration, numbat reaches 43,374
tokens per second against PyTorch's 41,202, scaling 2.769x over three cards. Clinical adaptation ends at 2.1899 held-out loss against 2.1941. Neither model is a medical device, and neither is validated for clinical use.
Read the full abstract ▾
Machine Learning
Leakage-Safe Machine Learning for Hydrogen Embrittlement Detection in 316L Stainless Steel: A Region-Held-Out Evaluation of Texture and Deep Features in SEM Micrographs
Muhammad Awais, Muhammad Yaseen, Abdul Shakoor et al. (+3 more)
Scanning electron microscopy (SEM) is routinely used to characterize the microstructural changes caused by hydrogen embrittlement (HE) in structural steels. Machine learning can automate this characterization, but models are often evaluated using image-level splits. When several images come from the same specimen region, such splits leak information between the training and test sets. Here, we propose a region-held-out protocol for classifying as-received (AR) and hydrogen-charged (H2) SEM micrographs of 316L stainless steel, based on Leave-One-Region-Out (LORO) cross-validation over 14 spatial regions (8 AR, 6 H2; 31 images). We compared six feature-classifier combinations built on local binary patterns (LBP), grey-level co-occurrence
matrices (GLCM), self-supervised convolutional
embeddings pretrained on 143 unlabeled SEM images, and a convolutional neural network (CNN). The simplest texture approach, LBP with a support vector machine (LBP+SVM), performed best, achieving a balanced accuracy of 0.79, H2 recall of 0.69, and H2 precision of 0.82, outperforming every deep-learning and combined-feature model. A group-level permutation test (500 permutations sampled from the 3,003 possible region-to-label assignments) yielded p = 0.008, indicating that the result cannot be explained by a chance
alignment of the region structure. Grad-CAM maps from a CNN trained on the full
dataset tended to concentrate on localized surface and grain-boundary features, where hydrogen-induced morphological changes are known to occur. Under a leakage-safe, statistically validated protocol, texture descriptors recover a hydrogen-charging signature from SEM micrographs even with few samples, and the same protocol can be extended to larger HE detection studies in other
alloy systems.
Read the full abstract ▾
All authors Muhammad Awais, Muhammad Yaseen, Abdul Shakoor, Niaz Ahmed Niaz, Huria Zia, Muhammad Zain Shakoor
Machine Learning
When Explanations Cannot Be Read: Measuring and Correcting SHAP and LIME Rendering for Right-to-Left Languages
Rameesha Zia and Muhammad Shahid Iqbal Malik
Post hoc explanation methods such as SHAP and LIME are widely used to interpret text classifiers, but their visualizations are mainly designed for left-to-right
languages. When applied to right-to-left (RTL)
languages such as Urdu, Arabic, Persian, and Hebrew, the attribution values remain mathematically valid, while their visual presentation fails.
Tokens appear out of sequence, connected letterforms break apart, and plot layouts do not follow the natural reading direction. This study addresses this gap as a visualization problem rather than a limitation of the explanation methods themselves. We present SHAP-RTL, a rendering layer that corrects reading direction and script shaping in SHAP and LIME visualizations, with per-
language font selection, while preserving the original attribution values, feature ordering, and model outputs. The approach is evaluated on Urdu, Arabic, Hebrew, and Persian hate and offensive-
language datasets using TF-IDF and logistic regression classifiers. Rendering correctness is measured by an OCR round trip over 200 feature words per
language. Default rendering yields character error rates of 0.820 to 0.979, meaning the label no longer carries its
token; the common reshape-and-reorder workaround fails for Urdu at 0.998, worse than no correction; and the Matplotlib 3.11.0 text rewrite inverts that workaround, while SHAP-RTL remains correct under both versions. The framework also verbalizes the same attributions as short contextual explanations in the reader's
language, constrained to the identified features. Evaluation in this paper concerns rendering correctness; assessment of the generated explanations is left to future work. The study highlights the importance of
language-aware visualization in making post hoc explainability more accessible across different writing systems.
Read the full abstract ▾
Cryptography and Security
Don't Read the Log: Execution Traces Contaminate Verifiers in Video-Generation Agents
Jian Xu
Agentic
video-generation systems close a loop between a generator and a verifier: an LLM plans shots, calls a text-to-
video model, and a
multimodal judge decides whether the result satisfies the request. To diagnose where a long workflow fails, recent harnesses deliberately show the judge more than the
video-the
agent's execution trace, its plan, the narration it synthesized. We ask whether this auxiliary text moves the judge's verdict on purely visual requirements, holding the frames fixed. On a
benchmark of 109 generated two-event clips with manual labels, in which the requested event is either visibly completed or visibly missing, a trace that reports a successful tool call makes three open-weight Qwen-VL judges (7B, 8B, 32B) accept $78$–$90\%$ of the failures, up from $7$–$19\%$ without text, and a contradicting trace makes them reject up to $100\%$ of correct clips; an instruction to “use only the frames” does not remove the effect. Frontier closed judges are essentially unmoved on the same clips, showing that the vulnerability is a property of the judge's learned trust in tool logs rather than of the task. Plan-derived text carries no clip-specific information, so it can only shift a judge's operating point, and in a repair loop that shift becomes a cap on the true pass rate that no repair policy can exceed; the cap matches simulation to two decimals. In the loop, contamination is exploited without any
adversarial agent: an honest LLM planner that always regenerates ends with a judge pass rate of $1.00$ and a human-labelled pass rate of $0.28$, and a pipeline in which a cheap checker writes its verdict into the trace launders that checker's errors into a stronger final judge ($0.69$ false accepts).
Read the full abstract ▾
Machine Learning
SpaFactor: Lightweight Spatial Context-Aware Gene Program Modeling for Histology-to-Transcriptomics Inference
Shiting Ruan, Xitong Ling, Qiming He et al. (+6 more)
Spatial transcriptomics (ST) profiles gene expression within tissue architecture, but its cost and experimental complexity limit routine use. Predicting spatial expression from routinely available hematoxylin and eosin (HE) images therefore offers a scalable alternative. However, conventional methods often fit high-dimensional gene outputs as independent targets, overlooking the biological coordination among genes while remaining vulnerable to high-dimensional noise and overfitting. Existing attempts to address this limitation often rely on computationally heavy graph networks or complex auxiliary supervision. We therefore introduce SpaFactor, a lightweight and efficient low-rank morphology-program-gene factorization framework. At the input, SpaFactor efficiently fuses the visual representation of the central spot with multiscale local and regional neighborhood context, yielding a histologic representation that captures cellular morphology and microenvironmental heterogeneity. For modeling, a residual MLP stably learns a nonlinear mapping from the tissue microenvironment to low-dimensional latent gene programs. These activities are decoded through shared gene loadings into coordinated multi-gene expression predictions. Across five public cohorts, SpaFactor achieves the best aggregate performance, with particularly clear improvements for spatially variable genes, and more faithfully recovers biologically organized spatial patterns. These results demonstrate that lightweight joint modeling of tissue context and gene programs can improve both predictive accuracy and biological fidelity.
Read the full abstract ▾
All authors Shiting Ruan, Xitong Ling, Qiming He, Ziyou Yan, Huaitian Yuan, Tian Guan, Ying Xiao, Xu Guan, Yonghong He
Machine Learning · Cross-listed from stat.ML
Matrix Aggregation Operators
Inmaculada Gutiérrez, Asier Urio-Larrea, J.Tinguaro Rodríguez et al. (+3 more)
Aggregation theory has traditionally focused on operators defined over vectors. However, many applications-including Multi-Criteria Decision Making, Group Decision Making, Fuzzy Rule-Based Classification Systems, and overlap/grouping indices-require aggregating information naturally structured as a
matrix of membership degrees (e.g., where a set of objects interacts with a family of fuzzy sets). Despite this, no formal framework has been proposed for this class of operators, partly due to the common practice of flattening
matrices into vectors (which discards structural information) and partly due to a reliance on decomposable operators that aggregate rows and columns sequentially. This paper addresses this gap by formalizing the notion of a
matrix aggregation operator (MAO). We analyze the decomposability and
symmetry properties of MAOs, showing that certain operators cannot be expressed in decomposable form and examining several notions of
symmetry. Finally, we introduce a family of MAOs termed maximum
entropy global coverage indices (MEGCIs), provide a construction method for them based on combining grouping functions and MEOWA operators, and illustrate their usefulness in cluster quality assessment through an extensive computational study.
Read the full abstract ▾
All authors Inmaculada Gutiérrez, Asier Urio-Larrea, J.Tinguaro Rodríguez, Daniel Gómez, Javier Montero, Humberto Bustince
Machine Learning
CARE: Condition-Aware Representation Regularization for Diffusion Models
Fengjia Guo, Zhuoyi Yang and Jie Tang
Recent advances in
diffusion models highlight the importance of representation regularization for improving sample quality and training efficiency. However, commonly used regularization methods often overlook the built-in conditions (such as labels or texts) which directly determine the generation target. In this work, we demonstrate how conditioning signals affect the feature distribution and introduce the CARE (Condition-Aware REpresentation regularization). CARE is a lightweight plug-and-play regularization framework that dynamically modulates feature distribution based on condition similarity. CARE leverages built-in conditioning signals to judiciously guide the representation space, promoting tighter feature clusters for similar conditions without relying on explicit
alignment losses or external supervision. Empirically, CARE consistently improves both visual fidelity and convergence stability across both class-to-image and text-to-image tasks. On ImageNet, CARE achieves a 19.08% reduction in FID in 400k training steps, leading to a 3.5$\times$ speed-up. When applied to text-to-image generation, CARE lowers FID by 16.61% in 200k iterations and improves semantic
alignment between generated samples and text
prompts. Moreover, CARE can be seamlessly integrated with existing regularization methods, yielding additional performance gains.
Read the full abstract ▾
Artificial Intelligence · Cross-listed from stat.ML
Speculative Evaluation of Stochastic LLMs
Qianli Shen, Xiang Li, Ruomeng Ding et al. (+3 more)
Evaluating a
stochastic large
language model is costly:
benchmark scores estimate expected performance from randomized rollouts, yet uniform repetition ignores sharp differences in task-level rollout variance. We ask how to minimize the variance of a fixed-
benchmark mean under an exact rollout budget. We develop Speculative Evaluation with a Hierarchical
Bayesian Neyman (HBN) policy with pilot size and stage weight jointly chosen ex ante. It runs a short uniform pilot, pools per-task success counts with a hierarchical
Bayesian model, and uses posterior expectations of task-level sampling variances for exact positive-integer Neyman allocation. To mitigate the pilot synchronization barrier, HBN-async speculatively executes continuations from partial pilot feedback and retains those selected by the final allocation. Across six checkpoints and 18
benchmark groups, we evaluate 107 nondegenerate
benchmark-checkpoint profiles. For rollout budgets of 8-64 per task, Speculative Evaluation reduces variance relative to Uniform by 12.8%-33.6% on average across profiles, outperforming hindsight-tuned empirical and independent
Bayesian baselines. Real-generation experiments that account for the pilot synchronization barrier show that HBN-async mitigates its overhead, helping translate statistical efficiency into practical evaluation benefits.
Read the full abstract ▾
All authors Qianli Shen, Xiang Li, Ruomeng Ding, Yanxi Chen, Daoyuan Chen, Yaliang Li
Cryptography and Security
Who Is Behind the Harness? Fingerprinting LLMs through Agentic Behavior
Chuyi Wang, Xiaohui Xie, Tongze Wang et al. (+2 more)
LLMs increasingly operate through coding-
agent harnesses that inspect repositories, invoke tools, and modify files. Substituting the model behind such an
agent can therefore change security-relevant decisions, including whether it verifies changes or recovers safely from failures. Existing LLM fingerprints largely infer identity from direct text or
token distributions. In coding
agents, these signals are mediated by system instructions, controller logic, tools, and execution feedback, limiting their transfer. We present
LIDAR (LLM Identification from Decisions and Actions at Runtime), an active black-box fingerprinting method for coding-
agent execution. Three coding probe pairs expose post-edit verification, transient-failure recovery, and specification–test conflict resolution under controlled changes.
LIDAR represents the resulting trajectories with complementary instance-level and distribution-level features and compares them with clean references using a lightweight probabilistic identifier. It requires no access to model weights, logits, or provider internals. Across 36 models from seven families and two
agent harnesses,
LIDAR achieves high Top-1 accuracy and MRR and outperforms four existing fingerprinting and API-
auditing baselines. Ablations confirm that the two feature levels, all probe pairs, and their controlled variants contribute. These results show that
agent execution behavior provides model-identity evidence beyond final outputs.
Read the full abstract ▾
All authors Chuyi Wang, Xiaohui Xie, Tongze Wang, Fangchen Luo, Yong Cui
Machine Learning
CFD Correction of Open Tip Clearance Flow in a Compressor Cascade Using VAE Latent Space Adaptation
Xiang Zuo, Hefang Deng, Caiyan Chen et al. (+4 more)
CFD predictions of open tip clearance flow in compressor cascades are subject to discrepancies relative to experiments, while experimental observations are sparse and high-resolution experimental ground truth is unavailable. This study proposes a non-intrusive correction method based on a variational autoencoder (VAE) and latent-space adaptation. A VAE is first trained using a
dataset of 166 parametrically sampled CFD total pressure loss fields to learn a low-dimensional statistical representation of these fields. The VAE is then frozen, and a low-rank latent-space adapter is trained using only 12 paired CFD–experiment operating conditions. An observation operator maps the corrected high-resolution fields to the experimental observation space, allowing supervision to be applied only at the available measurement locations and within the measured pitchwise windows. In the current 12-fold cross-validation, the mean absolute error decreases from 0.1335 to 0.0473, the root mean square error from 0.1717 to 0.0621, and the relative $L_2$ error from 0.5108 to 0.1871. These results indicate that the method improves agreement between CFD predictions and sparse experimental observations of open tip clearance flow without modifying the RANS solver or constructing artificial high-resolution experimental labels.
Read the full abstract ▾
All authors Xiang Zuo, Hefang Deng, Caiyan Chen, Honglin He, Mingmin Zhu, Songan Zhang, Jinfang Teng
Artificial Intelligence
BaseCamp — An Agentic AI Framework for Automating DNA Sequencing Data Pipelines
Eranga Bandara, Xueping Liang, Asanga Gunaratna et al. (+19 more)
DNA sequencing pipelines, spanning quality control,
alignment, variant calling, and annotation, are now reliably executed by workflow management systems that orchestrate established bioinformatics tools at scale. What remains manual is the decision layer surrounding that execution: selecting quality thresholds appropriate to a sample and platform, adjudicating borderline variant calls, diagnosing anomalies, and determining which findings warrant expert review. These decisions are repetitive, judgment-intensive, inconsistent across operators, and frequently undocumented. This paper introduces BaseCamp, a novel agentic AI framework for automating the decision layer of DNA sequencing pipelines. The framework decomposes the pipeline into six specialized AI
agents, covering sample intake and quality control,
alignment, variant calling, annotation, cross-stage monitoring, and reporting. Critically, BaseCamp
agents do not perform sequence analysis: established tools execute
alignment, calling, and annotation, while the
agents select among them, configure them, interpret their output, and decide what follows. This confines
language model
reasoning to the judgment layer where it is reliable and preserves the reproducibility existing tooling guarantees.
Agent reasoning is powered by a consortium of fine-tuned, domain-specialized large
language models coordinated by a central
reasoning LLM, executing locally so no sequencing data leaves the operating environment, under human-in-the-loop orchestration. Evaluation shows
agent-generated configurations are concordant with expert practice, that an explicit filtering ledger renders inspectable what filtering otherwise removes without trace, and that cross-stage anomaly detection surfaces conditions execution monitoring misses. BaseCamp offers a generalizable blueprint for agentic automation of scientific data pipelines.
Read the full abstract ▾
All authors Eranga Bandara, Xueping Liang, Asanga Gunaratna, Tharaka Hewa, Abdul Rahman, Peter Foytik, Safdar H. Bouk, Sachini Rajapakse, Isurunima Kularathna, Pramoda Karunarathna, Chalani Rajapakse, Ng Wee Keong, Kasun De Zoysa, Amin Hass, Wathsala Herath, Ross Gore, Ravi Mukkamala, Nihal Siriwardanagea, Gihan Siriwardanagea, Aruna Withanage, Nilaan Loganathan, Sachin Shetty
Artificial Intelligence
Pistis Technical Report
Heyun Chen, Xiaohan Lan, Jiaxi Li et al. (+17 more)
We introduce the Pistis model family, comprising 27B- and 9B-parameter
multimodal large
language models built on Qwen3.6 and Qwen3.5, respectively, and developed through a general and scalable post-training framework. The framework first establishes a strong foundation through large-scale
multimodal supervised fine-tuning (SFT). Building on this SFT foundation, we propose Interleaved
Distillation and Reinforcement Learning (IDRL), a novel post-training paradigm that tightly integrates on-policy
distillation and reinforcement learning within a single training loop. By alternating between the two objectives, rather than optimizing either in isolation or combining them in a static joint loss, IDRL enables more effective knowledge transfer, greater optimization stability, and more precise credit assignment for long-horizon agentic trajectories, leading to stronger performance while mitigating common capability trade-offs. At both model scales, the framework produces two specialized variants: Pistis-Thinking, designed to strengthen deep
multimodal reasoning, and Pistis-Agentic, which additionally incorporates agentic trajectory data to support long-horizon planning, iterative
reasoning, and tool use. Pistis-Agentic is particularly strong in
multimodal search. Both scales outperform their corresponding base models. Beyond model-parameter optimization, we further introduce Pistis-Auto-Harnessing (PAH), a system-level method that automatically improves the
agent's inference harness through iterative optimization. Experiments demonstrate that PAH enhances the model performance without updating the model parameters or increasing the interaction budget.
Read the full abstract ▾
All authors Heyun Chen, Xiaohan Lan, Jiaxi Li, Zhilin Lu, Qi She, Weiwen Xu, Fei Yu, Yujie Zhong, Jinghuan Chen, Zijian Feng, Siyu Jiao, Yiheng Lin, Xinhao Wang, Sihan Yang, Jieyu You, Changbin Zhang, Hengyu Zhang, Xudong Zhang, Yunqing Zhao, Shuai Zheng
Machine Learning
SMILESGNN: Interpretable Clinical Toxicity Prediction via SMILES-Graph Cross-Attention Fusion
Quang Minh Nguyen, Thuy Quynh Nguyen, Duc Minh Le et al. (+3 more)
Drug toxicity prediction is critical for reducing late-stage attrition in drug discovery, yet remains challenging due to severe class imbalance, scaffold-based generalization, and the clinical need for interpretable predictions. Single-modality approaches-SMILES
Transformers or graph neural networks capture complementary aspects of molecular structure, while sequence-only models cannot directly provide graph-attributed explanations. We present SMILESGNN, a
multimodal architecture that fuses a SMILES
Transformer encoder and a GATv2 graph encoder via cross-
attention, and SMILESGNN-PT, a variant using a ChemBERTa-2 pretrained backbone. The design retains an explicit graph branch within the predictive pipeline, supporting GNNExplainer-based analysis of substructures associated with toxic predictions. On ClinTox, SMILESGNN achieves AUC-ROC 0.987 and F1 0.906 with only 0.4M parameters, performing competitively with a strong SMILESTransformer and a larger ChemBERTa-2/GATv2 concat-fusion baseline. On Tox21 (12 tasks), SMILESGNN-PT obtains mean AUC-ROC 0.750, comparable to ChemBERTa-2 alone and the same-backbone concat-fusion baseline. Overall, the results suggest that cross-
attention is a practical fusion alternative that preserves competitive predictive performance while enabling graph-based interpretability support.
Read the full abstract ▾
All authors Quang Minh Nguyen, Thuy Quynh Nguyen, Duc Minh Le, Ho Nhat Minh Nguyen, Thanh Long Dai Doan, Trong Nghia Nguyen
Machine Learning · Cross-listed from stat.ML
An Order-Theoretic Characterization of Consistent Inductive Inference
Zhou Lu
When can a learner make only finitely many prediction errors along every infinite sequence labeled by a fixed, unknown hypothesis? We characterize this form of consistency for arbitrary binary hypothesis classes in ZFC, without requiring a uniform mistake bound. The characterization uses a single linear order on finite realizable traces. Each trace selects its least subtrace, and the order must satisfy two conditions: conflicting traces select different subtraces, and the order is well-founded on the traces of each fixed target. These conditions induce a learner whose selected evidence decreases on every mistake. Conversely, a consistent learner yields such an order through canonical mistake transcripts and the Kleene–Brouwer ordering. The result provides a representation of consistent prediction by finite evidence, answering a question of Lu (2024).
Read the full abstract ▾
Artificial Intelligence
PAWS: Policy-driven Agentic World Simulation
Tiviatis Sim, Jia Hui Woon, Xinming Gao et al. (+5 more)
Policy interventions propagate through public communication, institutional decisions, and stakeholder responses, yet
datasets for financial multi-
agent simulation rarely connect these processes to temporally aligned historical evidence. We introduce PAWS, a Policy-driven Agentic World Simulation
dataset covering 36 verified U.S. financial and economic policy episodes, 12,727 policy-linked news records, and 65,291 source-grounded stakeholder actions. Each action is linked to its supporting news and represented by a multi-layer event frame capturing its interaction mode, financial-action family and subtype, semantic attributes, and conditional mappings to external taxonomies. Entities are resolved to normalized organizations, and actions are aligned with daily
market-return context to support policy-
agent simulation replay. On 2,522 stratified action samples, independent AI and human reviewers achieved 89.4% initial agreement on interaction mode, with disagreements subsequently adjudicated. Case studies of the 2008 short-selling ban and 2001 decimalization recover documented policy timelines and associated
market patterns across both dense and sparse news settings. A replay study further shows that high accuracy can mask failure to detect rare stakeholder actions, identifying action timing and calibration as central challenges. PAWS provides an auditable substrate for evaluating
agent influence, policy-response cascades, and action-outcome
alignment in historically grounded financial simulations.
Read the full abstract ▾
All authors Tiviatis Sim, Jia Hui Woon, Xinming Gao, Chen Gao, Fengbin Zhu, Zheng Huanhuan, Chua Tat Seng, Kenji Kawaguchi
Information Theory
The spectral relation between irreducible cyclic codes and generalized Paley graphs
Ricardo A. Podestá and Denis E. Videla
Let $p$ be a
prime and $\mathbb{F}_q/\mathbb{F}_r$ a finite field extension with $q=p^m$ and $r=p^s$. For any $k\mid q-1$, we consider $r$-ary irreducible cyclic codes (ICC) of the form $C(k,q/r) = \{(Tr_{q/r}(\gamma \omega^{ik})_{i=0}^{n-1})\}_{\gamma \in \mathbb{F}_r}$, with $\omega$ a primitive element of $\mathbb{F}_q$ and $ n= \tfrac{q-1}{k}$, and generalized Paley (GP) graphs $\Gamma(k,q) = Cay(\mathbb{F}_q, \{ x^k : x \in \mathbb{F}_q^* \})$. We show that there is a simple closed formula relating the weight distribution of $C(k,q/r)$ with the spectrum of $\Gamma(k_r,q)$, where $k_r=\gcd(k, \frac{q-1}{r-1})$. Then, we give $Spec(\Gamma(k,q))$ explicitly for those graphs associated with irreducible 2-weight cyclic codes in the semiprimitive and exceptional cases. Finally, we give the weight enumerators of irreducible cyclic codes associated with Hamming GP-graphs.
Read the full abstract ▾
Computer Vision
On the Diffusibility of High-Dimensional Latents
Chao Feng, Zhiyang Xu, Bowei Chen et al. (+7 more)
Representation Autoencoders (RAEs) enable
diffusion models to operate in the feature spaces of pretrained visual encoders. However, many off-the-shelf encoders are not optimized for faithful reconstruction, discarding fine-grained visual details. As expected, finetuning these encoders for image reconstruction recovers such details. However, perhaps counterintuitively, this procedure reduces the effective dimensionality of the resulting representation, and the altered geometry has downstream effects on generation. Specifically, we show that using the standard velocity prediction in flow matching in this high-dimensional space requires the model to fit orthogonal noise directions outside the low-dimensional signal
manifold, making optimization inefficient. This motivates using the clean data parameterization ($\boldsymbol{x}_{0}$-prediction) instead, which focuses learning on the underlying signal
manifold. Across experiments with multiple strong-reconstruction encoders, we show that $\boldsymbol{x}_{0}$-prediction consistently improves text-to-image generation performance.
Read the full abstract ▾
All authors Chao Feng, Zhiyang Xu, Bowei Chen, Yuanjun Xiong, Xiyao Wang, Jui-Hsien Wang, Richard Zhang, Zhe Lin, Andrew Owens, Yijun Li
Numerical Analysis
Hutch#: Optimal non-adaptive Frobenius norm estimation
Tyler Chen, Diana Halikias, Christopher Musco et al. (+1 more)
The Girard–Hutchinson
estimator provides an extremely simple randomized estimate of the Frobenius norm of a
matrix $A$ that can only be accessed implicitly via
matrix-vector products. In particular, if $\Omega$ is a random Gaussian
matrix with $r = O(1/\varepsilon^2)$ columns, than $\frac{1}{r}\|A\Omega\|_F^2$ provides a $(1\pm \varepsilon)$ multiplicative approximation to $\|A\|_F^2$ with high probability. In this work, we introduce a closely related
estimator, given by \begin{align*} {\frac{1}{r}\|A\Omega\|_F^2 + \frac{1}{r}\|\Psi^T A\|_F^2 - \frac{1}{r^2}\|\Psi^T A\Omega\|_F^2}, \end{align*} where $\Psi$ is a second, independent random Gaussian
matrix with $r$ columns. We prove that this
estimator yields a $(1\pm\varepsilon)$ multiplicative approximation to $\|A\|_F^2$ when $r = O(1/\varepsilon)$, a quadratic improvement over Girard–Hutchinson. This dependence on $\varepsilon$ is optimal. Our method, which we call Hutch# (pronounced “Hutch sharp”), matches the complexity of the Hutch++
algorithm [Meyer, Musco, Musco, Woodruff, 2021]. However, unlike Hutch++, Hutch# uses only non-adaptive
matrix-vector products with $A$ and $A^T$ and requires no orthogonalization or other advanced linear
algebra steps. Thus, Hutch# combines the simplicity of the Girard–Hutchinson
estimator and the optimal query complexity of Hutch++.
Read the full abstract ▾
All authors Tyler Chen, Diana Halikias, Christopher Musco, David Persson
Computation and Language
Contrastive Learning for Authorship Verification
Peter Kirby
Our results show that contrastive learning outperforms a classification-based approach to authorship verification under the tested settings. We identify loss function, batch size, training duration, pre-trained model, input context length, and random text span data augmentation as important factors of model performance. Based on these considerations, we develop a ModernBERT Bi-Encoder model that achieves 98.4% accuracy on the PAN21 authorship verification task.
Read the full abstract ▾