Computer Vision
Strike a Chord! Modal Kinetic Typography
Maham Tanveer, Jiyeon Han, Nanxuan Zhao et al. (+1 more)
We introduce modal kinetic typography, which animates a vector glyph to express a semantic concept while keeping it legible. Our key idea is to build motion from the glyph's natural vibration modes. Specifically, a finite-element eigenproblem assembled from the vector outline yields the glyph's softest modes, for the whole letter and for each of its parts, allowing it to bend. The problem's zero-energy solutions, i.e., rigid translations and rotations, are applied in closed form to each part, allowing parts to also move as blocks. To animate the glyph, a frozen
video diffusion model supervises only the modes' amplitudes and phases. Our modal approach addresses two weaknesses of prior work. Free-form point optimization under
video score
distillation (SDS) moves each point and frame independently along noisy gradients, tearing the outline and causing jitter. In contrast, our modes are smooth along the outline and driven by a few whole-cycle harmonics, which restricts these gradients to smooth, seamlessly looping motion. On the other hand, structured alternatives rely on skeletons or keypoints from category-specific priors, whereas our modes come from the glyph itself; the only prior is a list naming each letter's moving parts, generated once for the whole alphabet by a
language model. In modal kinetic typography, shape and motion are disentangled by construction: a single base outline is sculpted toward the concept, and the modal drive cannot alter it, so a letter can also be animated without being reshaped. Our method produces more articulated and smoother motion than Dynamic Typography and AniClipart at comparable or better concept
alignment, with less glyph tearing than Dynamic Typography, and is preferred by human raters, including in a frozen-shape setting where motion alone must carry the concept. Our results were also preferred over Astra (GPT-6) by human raters.
Read the full abstract ▾
All authors Maham Tanveer, Jiyeon Han, Nanxuan Zhao, Hao Zhang
Computation and Language · Cross-listed from physics.soc-ph
Multi-agent discussion gains less when dissent is withheld
Chand Sahil Mansuri, Xin Wang, Mengying Li et al. (+4 more)
Multi-
agent systems of LLMs add discussion to majority voting and are therefore expected to be more capable. However, empirical reports conflict on whether discussion improves accuracy or leads to an incorrect consensus. Here, we introduce a parsimonious model that explains when discussion improves accuracy and when it ends in an incorrect consensus, built from four behaviors repeatedly observed in LLM
agents: (1) withholding dissent, (2) internalizing a stated answer, (3) reconsidering after seeing dissent, and (4) correcting toward the correct answer. The model shows that discussion can overturn an incorrect initial majority only when the withholding rate $c$ is below a critical rate $c^* = \gamma/(\gamma + a)$, set by the net correction rate $\gamma$ and the internalization rate $a$. We estimate these rates from conversation logs with a
Bayesian method and place LLM teams relative to $c^*$. As the model predicts, the gain from discussion shrinks as withholding rises, across LLMs and on a hidden profile
benchmark, HiddenBench, and MedEInst. Instructing
agents not to withhold dissent increases this gain. Turning
reasoning off also increases the gain, because
reasoning raises the internalization rate $a$ and keeps
agents from reconsidering a minority answer. These findings reconcile the conflicting reports and identify when discussion outperforms majority voting.
Read the full abstract ▾
All authors Chand Sahil Mansuri, Xin Wang, Mengying Li, Bryan Acton, Rory Eckardt, Dhaval Patel, Sadamori Kojaku
Machine Learning · Cross-listed from astro-ph.IM
Gestalt: a meta-foundation model for astronomy
Michael J. Smith and Shashwat Sourav
The Platonic Representation Hypothesis predicts that sufficiently scaled foundation models converge on a shared representation of the world. As each non-converged model gives a noisy view of a common structure when passed the same input, we ask whether we can combine models into a representation that outperforms its individual components. We test this on
galaxies: we embed images via a basket of 22 frozen foundation models from eight families, whiten each view, and take a randomised SVD of the
embedding concatenation. The resulting 1024-dimensional
embedding outperforms every basket member on 19/21 of our tested metrics for physical property and
galaxy morphology estimation for HSC, JWST, and DESI Legacy Survey imagery. We find that performance rises with basket size and basket architectural diversity, and that the meta-foundation model's performance transfers across astronomical surveys. We conclude that a useful astronomical foundation model can be assembled from existing generalist models with no training required beyond a single unsupervised projection. By leveraging the community's already-spent work, we save a lot of compute: a fresh pre-train of a comparable single-domain model would cost $\mathcal{O}(10^{4}$–$10^{5})$ A100 GPU hours (emitting several tonnes of CO$_2$eq.), whereas assembling Gestalt requires minutes on a single machine.
Read the full abstract ▾
Artificial Intelligence · Cross-listed from hep-ph
Searching for BSM Experimental Signatures with Large Lagrangian Models
Ibrahim Elsharkawy, Victoria Knapp-Perez, Wahid Bhimji et al. (+1 more)
The search for physics Beyond the Standard Model (BSM) is generally limited not by the supply of theory descriptions but by the lack of discriminating experimental observations. A case in point is dark matter, where the overwhelming gravitational evidence only goes so far in distinguishing between models within a vast theory space. Exploring the space of testable model signatures may help identify overlooked experimental observables and indicate the utility of future experiments. A challenge is designing a search through model signatures outside what is found in the literature. Our primary contribution is hAIthem, a framework that combines the self-guided exploration of reinforcement learning (RL) with the broad literature-derived knowledge of LLMs. We build an RL
agent that learns to find which portions of a theory's high-dimensional parameter space are not excluded under some subset of constraints by playing a Battleship-style "game" against a suite of phenomenology tools. The
agent is built as a Large Lagrangian Model (LLaM), an autoregressive
transformer that reads a tokenized Lagrangian, is pretrained at scale (here on ~1 billion
tokens from ~10,000 Lagrangians), and is fine-tuned in a live environment. The framework then constructs a decision tree that separates RL-found regions using observables computed with established tools, and passes the remaining degenerate regions to a set of LLM
agents that compete to produce realistic signatures. In this proof of concept, RL-search outperforms an evolutionary-
algorithm baseline, finding more viable regions with greater physical diversity. In a restricted space of single dark scalar multiplet models, we find that hAIthem proposes interesting combinations of previously studied observables, such as the application of a
halo-independent kinematic ratio to paleo-detectors.
Read the full abstract ▾
All authors Ibrahim Elsharkawy, Victoria Knapp-Perez, Wahid Bhimji, Aishik Ghosh
Computer Vision
It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at $\epsilon \leq 4/255$
Binchi Zhang, Apurva Narayan and Atrisha Sarkar
Vision Language Models (VLMs) are widely deployed in safety-critical scenarios, and understanding to which extent they can be controlled by
adversarial perturbation is a prerequisite for evaluating their trustworthiness. Existing representation-
alignment attacks, which make a VLM perceive a target image, achieve limited success at $\varepsilon \leq 4/255$. Therefore, VLMs seems robust to perturbations in this range. We show that this robustness does not hold, as targeted semantic substitution succeeds within the same range. Specifically, we align each stream of the source image with its counterpart in the target image in the victim VLM's post-merger
token space, operating under a white-box threat model. We evaluate under a strict success criterion, requiring the model to simultaneously name the target, confirm its presence, and deny the source. In images, target semantics appear at $\varepsilon = 2/255$ and complete replacement reaches 38% at $\varepsilon = 4/255$. On
video, complete replacement reaches 35.9% at $\varepsilon = 1/255$. We also observe a phenomenon of semantic fusion, where Large
Language Model (LLM) rationalizes contradictory visual signals into a coherent narrative.
Read the full abstract ▾
Artificial Intelligence
AI Agents are Vulnerable to Radicalization
Ozgur Can Seckin, Shalmoli Ghosh, Alessandro Flammini et al. (+3 more)
Large
language models (LLMs) can influence people's beliefs, yet little is known about whether and how they can manipulate each other. To investigate this, we simulate conversations between two
agents: a target LLM that role-plays a human persona based on demographic and psychological attributes, and an influencer LLM that aims to make the target's beliefs more extreme. We examine radicalization along two pathways: resonance, where the influencer reinforces a target's pre-existing belief, and persuasion, where the influencer promotes a belief the target initially considers unimportant. Across affective and behavioral metrics, we find that both mechanisms radicalize the target. However, resonance produces consistently stronger effects than persuasion. Different influence tactics, such as using sycophancy and unverified claims, produce different levels of radicalization, but not consistently across metrics. We further show that resonance propagates to related beliefs, suggesting interconnected belief structures within AI
agents. These findings indicate that AI
agents are susceptible to radicalization, particularly when messages align with their existing beliefs, raising concerns about the vulnerability of personalized AI
agents and multi-
agent AI ecosystems.
Read the full abstract ▾
All authors Ozgur Can Seckin, Shalmoli Ghosh, Alessandro Flammini, Kristina Lerman, Maria Elizabeth Grabe, Filippo Menczer
Artificial Intelligence
MoFlow: Multi-Objective Agentic Workflow Generation
Yining Lu, Aurelie Lozano, Xi Yang et al. (+3 more)
We study the generation of agentic workflows that jointly optimize multiple objectives, such as accuracy, cost, latency, robustness, and consistency. Existing methods for workflow generation typically optimize accuracy alone or a weighted sum of objectives, so each trained generator commits to one fixed trade-off and must be retrained from scratch when preferences change. To alleviate this, we propose MoFlow, which generates workflows optimized across varied preferences. Specifically, MoFlow formulates workflow generation as a multi-objective Markov decision process and solves it by leveraging Convex-Hull Monte Carlo Tree Search with optimistic set-valued backups, where every node stores a set of reachable trade-offs rather than one weighted score. A single search thus approximately covers the Pareto front, from which MoFlow can return a workflow for any preference by lookup without retraining. We evaluate MoFlow against six strong baselines on six
benchmarks spanning mathematics, code, and question answering. Since the baselines are single-scalar optimizers by design, an apples-to-apples comparison is difficult. We instead adopt an evaluation setup that favors the baselines, in that they are rerun for each testing preference, which MoFlow never sees. Even under this stringent setup, MoFlow achieves the highest average hypervolume.
Read the full abstract ▾
All authors Yining Lu, Aurelie Lozano, Xi Yang, Naoki Abe, Yu Deng, Meng Jiang
Cryptography and Security
HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control
Zhuo Liu, Moxin Li, Zhixin Ma et al. (+3 more)
Large
language model (LLM)
agents are vulnerable to safety risks such as injected malicious instructions or misleading information, motivating runtime defenses that prevent unsafe action in execution across diverse risks while preserving benign-task utility. Existing system-level defenses either focus on risk detection rather than timely prevention or rely on predefined rules with limited flexibility across diverse risks. We propose a risk-aware harness that integrates LLM-based monitoring for flexible risk detection and structures monitor-guided execution around three core modules: trigger, monitor, and feedback, enabling targeted safety interventions while limiting disruption to benign task execution. To adapt the harness to different risks and deployment settings, we introduce HARDE, a two-stage harness optimization framework that first performs isolated probing of each module to derive an optimization guide, then uses this guide to iteratively optimize the harness based on safety and utility feedback. Experiments across three attack
benchmarks show that HARDE improves runtime safety while preserving utility, outperforming manually designed harnesses and naive optimization baselines. Our analysis shows that effective runtime defense benefits from complementary safety mechanisms, attack-aware harness optimization, and harness designs matched to monitor capabilities. Our code is available at https://github.com/Liuz233/HARDE.
Read the full abstract ▾
All authors Zhuo Liu, Moxin Li, Zhixin Ma, Wentao Shi, Wenjie Wang, Fuli Feng
Cryptography and Security
Privacy in Personalized AI Is a System Property, Not Just a Model Property
Guillaume Salha-Galvan and Jiaying Xu
In personalized AI applications, such as conversational assistants and recommender systems, users interact not with models in isolation but with broader systems that access, infer, and reuse user information across components and over time. While such use of user information is integral to personalization, it also raises important
privacy questions. In this paper, we argue that individual model- or component-level analyses may not capture all
privacy risks arising in such systems, motivating a system-level perspective on
privacy. We distinguish and analyze four interconnected
privacy-risk channels in personalized AI, and subsequently propose four requirements for system-level
privacy evaluation, covering interaction trajectories, internal information flows, indirect leakage, and the
privacy-utility trade-off. We argue for their systematic incorporation into
privacy audits of personalized AI.
Read the full abstract ▾
Artificial Intelligence
AREX-2: Advancing Self-Improving Agents through Long-Horizon Reflective Tasks
Hongjin Qian, Chaofan Li, Kun Luo et al. (+11 more)
We present AREX-2, an effort to advance the self-improving capability of LLM
agents, which we define as the ability to iteratively refine a solution at test time. This ability rests on two complementary capabilities: reflection, which produces a solution better than the current one, and long-horizon execution, which keeps the iteration effective over many rounds. We hypothesize that both capabilities are domain-agnostic, and can therefore be learned in scenarios that are well suited for supervision. Accordingly, we synthesize long-horizon improvement trajectories from machine learning and algorithmic programming tasks, two domains that offer verifiable feedback and reward sustained iteration. Trained on this data, our
agent, built on Qwen3.8-27B, achieves strong results on MLE-bench Lite (81.8) and Frontier-CS (70.7), transfers to deep research with 84.0 on BrowseComp, 52.6 on HLE, 92.2 on
GAIA, and 93.8 on DeepSearchQA, and keeps improving as its budget of rounds grows. These results show that long-horizon reflective data is an effective route toward self-improving
agents.
Read the full abstract ▾
All authors Hongjin Qian, Chaofan Li, Kun Luo, Wenqing Wei, Jianlyu Chen, Shuqi Lu, Yuyang Hu, Hongwang Xiao, Hui Wang, Chaozhuo Li, Qiwei Ye, Zhicheng Dou, Defu Lian, Zheng Liu
Game Theory
Social Choice Foundations for Simulation-Augmented Generation
Sonja Kraiczy, Smitha Milli, Ratip Emin Berker et al. (+6 more)
Simulation-augmented generation (SAGE) is a recent technical proposal in which models simulate individuals' viewpoints at inference time in order to provide more representative answers to contentious user queries. A core challenge for SAGE is making inference-time simulation efficient without sacrificing representation quality. We introduce the first formalization of this problem, based upon an axiom from proportional clustering known as metric proportional justified representation+ (mPJR+) which is the strongest proportionality axiom known to always be satisfiable by centroid-based clustering. We prove that to proportionally represent the viewpoints of a population of $n_H$ humans on a given
prompt, we need only create simulations of $n \ll n_H$ individuals, and at inference time, need only dynamically route to $k \ll n$ of those simulations based upon the
prompt. This twofold reduction still yields approximate proportional representation guarantees for the entire population. Empirically, across two domains-political questions and personal advice-our proposed routing
algorithm achieves higher mPJR+ satisfaction rates than $k$-means-based or random selection baselines.
Read the full abstract ▾
All authors Sonja Kraiczy, Smitha Milli, Ratip Emin Berker, Avinandan Bose, Brandon Amos, Jamelle Watson-Daniels, Maximilian Nickel, Edith Elkind, Ariel D. Procaccia
Computer Vision
GaugeVLM: Structuring Spatial Supervision with Measured Geometric Interventions
Hongbo Wang, Zihan Lin, Wenkui Yang et al. (+5 more)
Vision-
language models (VLMs) can contradict themselves across views of the same spatial relation and fail to respond when that relation changes. Addressing these failures requires supervision that captures error magnitude and
geometric dependencies across observations, both of which remain implicit in training on individual answers or ordinal preferences. Therefore, we introduce GaugeVLM, which makes this structure explicit through controlled object and camera interventions in explicit 3D scenes, producing linked observations with measured differences between spatial relations and shared truths across views. To translate this structure into learning signals, its core objective, GaugeDPO, converts measured errors into preference margins, directly supervises correct canonical rankings across views, and links intervention-induced answer-odds contrasts to measured relation changes with view-specific scales. Our analysis bounds canonical prediction error and establishes that the cross-view and intervention constraints can be jointly satisfied. Empirically, GaugeVLM improves all 10 established spatial metrics over supervised fine-tuning across three VLM backbones, with the main 7B model gaining 15.0 and 18.9 percentage points on MSMU distance and QSpatial+, respectively. These gains also extend to autonomous driving and
embodied reasoning, demonstrating the robust generalization across domains.
Read the full abstract ▾
All authors Hongbo Wang, Zihan Lin, Wenkui Yang, Shiran Ge, Yuang Ai, Jie Cao, Huaibo Huang, Ran He
Artificial Intelligence
Improving OCR Faithfulness via Gated and Attenuated On-Policy Distillation
Baode Wang, Zuming Huang, Kexuan Ren et al. (+2 more)
Vision-
language models may rewrite anomalous text in images into linguistically plausible expressions, compromising OCR transcription faithfulness. Sequence-level task rewards and local teacher guidance are complementary, but guidance from the same teacher may not remain equally effective as the student improves. Offline analysis shows that supervision from a fixed teacher becomes progressively less favorable as the student improves, both across training checkpoints and across response groups with different task rewards. Motivated by this observation, we introduce GAD-RL, which adaptively regulates teacher supervision during joint post-training according to the student's current task performance and local distributions. A frozen teacher conditions on reference transcriptions and student-generated prefixes. GAD-RL disables
distillation for response groups containing an output with task reward at least 0.95 and continuously attenuates
distillation strength as group-mean reward increases. It also weights forward KL by the student's probability of the teacher's Top-1
token, moderating local auxiliary updates when student support for that candidate is low. On Qwen3.5-2B, GAD-RL achieves 59.92% Micro Recall on CHAOS-Bench, surpassing GRPO and GRPO+OPD (fixed-weight) by 8.45 and 4.43 percentage points, respectively, while achieving an Overall score of 91.18 on OmniDocBench v1.6.
Read the full abstract ▾
All authors Baode Wang, Zuming Huang, Kexuan Ren, Jun Huang, Wei Chu
Cryptography and Security
Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare
Nafisa Anjum and M. Rasel Mahmud
Extended reality (XR) systems are increasingly used in healthcare applications ranging from
surgical planning to remote rehabilitation and mental health support. However, the rich streams of sensor, biometric, behavioral, and environmental data that enable these applications also introduce substantial
privacy and security risks. Adversaries may exploit insecure communication, sensor side channels, application-layer vulnerabilities, or data-processing pipelines to infer sensitive information or disrupt clinical workflows. Despite growing interest in XR security and
privacy, the healthcare-specific literature remains fragmented. In this Systematization of Knowledge (SoK), we review 65 peer-reviewed studies published between 2017 and 2024 across XR, security,
privacy, and healthcare venues. We develop a unified threat taxonomy spanning device, user, network, and cloud layers and introduce XR-PRISM, a quantitative
Privacy and Risk Impact Scoring Metric for systematically characterizing security and
privacy risks. Our analysis identifies several gaps in the literature: more than 70% of proposed countermeasures lack standardized risk evaluation, fewer than 15% of studied attacks require high attack prerequisites, and reproducibility is limited by the scarcity of publicly released artifacts and
datasets. Based on these findings, we outline a research roadmap emphasizing shared
benchmark datasets, stronger artifact-release practices, improved cloud-layer protections, and more comprehensive detection, mitigation, and recovery mechanisms. This SoK provides a structured and data-driven foundation for understanding existing risks and guiding the development of more secure,
privacy-preserving, and usable XR healthcare systems.
Read the full abstract ▾
Systems and Control
Timing Sensitivity in Actuated Traffic Signal Control: A simulation study on one urban network
Nitai Aharoni
A comparison between adaptive and fixed-time traffic signals can change when only their timing settings change. We examine this sensitivity in 240 simulation runs on one OpenStreetMap-derived urban network, using eight configurations, three arrival rates and ten paired demand seeds. The experiment varies the maximum green of presence-based actuation, retimes the fixed baseline, and includes a discharge-based phase-termination rule. The endpoint is finite-window time spent per offered trip, including entry waiting and penalties for removed or abandoned trips. At the highest tested load, actuation with a maximum green of twice the planned split has a mean endpoint 57.4 per cent above the original fixed plan. Reducing that multiplier to 1.25 puts it 70.7 per cent below the same plan. Against the best of three tested fixed plans, discharge-based termination reduces the mean endpoint by 14.8, 15.8 and 18.3 per cent across the three loads. Both timing sweeps favour their shortest tested setting, so neither identifies an optimum. This exploratory study uses synthetic demand, negligible start-up lost time and physical removal of persistently stationary vehicles. The results support testing timing sensitivity before attributing performance to a controller family; they do not establish a setting for real-world deployment.
Read the full abstract ▾
Computers and Society
How People Use ChatGPT: Conversation-Level Evidence from India, Nigeria, Brazil, and Pakistan
Shreyasi Roy Chowdhury and Kiran Garimella
Public understanding of how people use LLM-based conversational AI assistants comes primarily from aggregate platform reports by OpenAI and Anthropic, which apply fixed taxonomies and inferred demographics to hundreds of millions of users and release only summary statistics that outside researchers cannot re-analyze. We provide a complementary, conversation-level view: complete ChatGPT exports comprising 202,590 conversations from 1,252 users across India, Nigeria, Brazil, and Pakistan, paired with self-reported age and gender and spanning December 2022 to February 2026. To our knowledge this is the first conversation-level, demographically grounded comparison of ChatGPT use across multiple non-Western countries. We ask what these users use ChatGPT for (purpose), what they talk about (topics), and how they engage with it (mode of interaction), using the platform's own classifiers, unsupervised topic discovery, and a thematic analysis of expressive conversations. Personal use accounts for 55-64% of conversations in every country and coursework is about as common as work, so workplace productivity describes a minority of use. Unsupervised topic discovery surfaces country-specific uses that the OpenAI taxonomy folds into generic categories: health and wellness in India and Brazil, Urdu-English translation in Pakistan, current affairs in Nigeria, religious questions in Nigeria and Pakistan, and self-reflection in Brazil. Over three years, the share of conversations that seek information declined only modestly and the share that delegate a task did not grow, while conversations in which users express themselves rose from a few percent to roughly a fifth or more in every country. The same product is thus attached to different local needs in each country, and understanding what adoption means requires conversation-level, country-sensitive measurement alongside global aggregates.
Read the full abstract ▾
Computer Vision
Masked Swingers: Harnessing Data Augmentation to Advance Autoencoders for Self-Supervised Learning
Anthony Fuller, Scott C. Lowe, Daniel G. Kyrollos et al. (+3 more)
Self-supervised learning (SSL) removes the need for annotations and makes models that are capable across more domains than supervised learning. The autoencoder SSL framework learns by reconstructing its own input after information loss through a bottleneck or noise injection. Masked autoencoders (MAE) are the most successful instantiation of this framework: they encode a random subset of patches, then decode the masked-out patches. In this work, we introduce key modifications to improve MAEs. Our method augments an image in two different ways, then masks and encodes each view separately. It then exchanges the global representations (CLS
tokens) between views before decoding the masked patches. By design, our Masked Swingers encourages learning a view-agnostic summary of the image to facilitate efficient transfer. We perform extensive experiments, and find Masked Swingers outperforms MAE by +3-5% on ImageNet-1K kNN and provides large gains on fine-grained tasks, e.g., relative gains of +45% on instance
retrieval, +22% on animal re-ID, and +76% on Omniglot character recognition. To boot, Swingers reduces error -64% relative to MAE on three new state-probing
datasets, opening the door to world modeling. Welcome to our Swingers party.
Read the full abstract ▾
All authors Anthony Fuller, Scott C. Lowe, Daniel G. Kyrollos, Graham W. Taylor, Evan Shelhamer, James R. Green
Machine Learning
Kinematic signatures of impairment: Detecting alcohol intoxication in e-scooter riders using sensor data and machine learning
Rahul Rajendra Pai, Marco Dozza, Alexander Rasch et al. (+2 more)
Alcohol intoxication is a leading contributor to fatal and severe-injured e-scooterist crashes. Current countermeasures, such as temporal restrictions or pre-ride cognitive screening, cannot continuously assess an e-scooterist's physical motor control or impairment in real time. We conducted a controlled experiment in which 25 participants rode an instrumented e-scooter through a test track while sober and at two targeted blood alcohol concentration levels (0.05% and 0.08%). The e-scooter was instrumented with a six-axis inertial measurement unit (IMU), and throttle and brake lever position sensors, all sampled at 100 Hz. Two complementary signal features were computed: normalised permutation
entropy, which quantifies temporal complexity, and standard deviation, which quantifies signal amplitude. Repeated measures correlation identified seven kinematic features (all IMU and throttle signals) whose
entropy decreased (p < 0.001) while standard deviation increased (p < 0.01) with increasing intoxication, indicating that intoxicated riders shift from continuous, low-amplitude micro-corrections to fewer, high-amplitude reactive corrections. An
entropy based multi-class logistic regression classifier, evaluated through leave-one-participant-out cross-validation, achieved 85% overall accuracy and a weighted one-vs-rest area under the receiver operating characteristic curve (AuROC) of 0.94, with a sober-vs-high AuROC of 1.00. Steering rate and lateral acceleration were the most important predictive features, indicating that alcohol induces a distinct collapse in lateral
equilibrium during riding. Ultimately, these results demonstrate that onboard kinematic sensing combined with
entropy-based signal analysis can reliably distinguish sober from intoxicated e-scooter riding, providing a foundation for automatic intoxication detection systems that preserve mobility for sober riders.
Read the full abstract ▾
All authors Rahul Rajendra Pai, Marco Dozza, Alexander Rasch, Ali Mohammadi, Marco Capuccini
Distributed Computing
When Correct Memory Goes Wrong: Fuzzing Persistent Memory Use in LLM Agents
Yuqiao Meng, Luoxi Tang, Yingxue Zhang et al. (+2 more)
Persistent
memory helps LLM
agents carry information across long interactions, but correct
memory can still be used incorrectly when queries change or
memory states evolve. Existing work mainly studies
memory content errors or evaluates fixed test cases, leaving
memory-use failures hard to discover systematically. We formulate this issue as a fuzzing problem and categorize such failures into query-related and
memory-state failures. We then develop U-Fuzz, which starts from
memory checkpoints as test seeds, mutates queries or
memory states under explicit mutation obligations, validates each mutant, and uses observed
memory behavior to guide iterative testing while keeping failure labels outside the search. We evaluate U-Fuzz across several
memory systems against diverse fuzzing baselines, and further test an output-only setting with API-based LLMs where
memory retrieval is hidden. Across these settings, U-Fuzz consistently uncovers more confirmed
memory-use failures, showing that its search remains effective across different
memory architectures and even when only final responses are observable.
Read the full abstract ▾
All authors Yuqiao Meng, Luoxi Tang, Yingxue Zhang, Yuchen Yang, Zhaohan Xi
Computation and Language
Which Models Work Well Together? Measuring Heterogeneity for LLM Team Selection
Liangyu Teng, Hengsong Liu, Juncen Guo et al. (+4 more)
The performance ceiling of an LLM team is constrained not only by individual model capabilities, but also by inter-member error resonance and predictive differences. Although heterogeneous teaming is often observed to be effective in practice, existing approaches lack complementarity metrics that are computable, interpretable, and optimizable, leaving team composition to rely on heuristics. We propose a heterogeneity-driven team selection framework that performs offline profiling to characterize individual capability along with two complementary signals: one captures decorrelation in error patterns to reduce co-failures, while the other measures divergence in predictive behavior to capture strategy diversity. We formulate team selection as a standardized quality–complementarity combinatorial objective and apply an efficient greedy search to select a small team from a candidate pool. Experiments across multiple
benchmarks demonstrate that our framework consistently outperforms quality-only baselines under controlled candidate pools and team sizes, establishing reusable selection principles for multi-LLM systems.
Read the full abstract ▾
All authors Liangyu Teng, Hengsong Liu, Juncen Guo, Jingyu Zhang, Yang Liu, Jing Liu, Liang Song
Systems and Control
Computing Scaled Relative Graphs of Discrete-Time LTI Systems: A Frequency-Domain Approach
Guoming Shi and Fredy Ruiz
The scaled relative graph (SRG) represents the joint gain and phase properties of an input–output operator in the complex plane. This paper characterizes the SRG closure of causal, stable, square discrete-time linear time-invariant (LTI) systems on one-sided square-summable sequences. The Beltrami–Klein image of this closure equals the convex hull of the numerical ranges of the transformed frequency-response
matrices. For real-coefficient single-input single-output systems, this yields the
hyperbolic convex hull of the discrete-time Nyquist locus. The proof addresses the Hardy-space restriction imposed by one-sided inputs, which excludes persistent sinusoids, by replacing them with explicitly constructed finite-duration sinusoids. This construction shows how points in frequency-wise SRGs arise as limits of operator SRG points generated by admissible inputs. The characterization enables model-based computation of the closure from a state-space realization using frequency-response evaluations, numerical ranges, and planar convex hulls, without solving linear
matrix inequalities.
Read the full abstract ▾
Computer Vision
Evaluating Multi-Task Morphological Concept Learning for Pulmonary Nodule Malignancy Assessment in 3D CT
Namitha Narayanan
Morphological characteristics such as spiculation and lobulation play an important role in assessing pulmonary nodules on computed
tomography (CT), particularly in relation to malignancy risk. This study examines whether learning radiologist-annotated morphological features together with malignancy risk from lesion-centred 3D CT volumes improves classification performance. The Lung Image Database Consortium and Image Database Resource Initiative (LIDC-IDRI)
dataset was used, comprising 3,918 reader-level nodule annotations from 742 patients after excluding indeterminate malignancy ratings. Patient-level splitting was used for training, validation, and testing, with 112 patients and 628 reader annotations in the held-out test set. A single-task 3D convolutional neural network was compared with a multi-task model predicting malignancy risk, spiculation, and lobulation. The single-task model achieved a balanced accuracy of 0.548 and receiver operating characteristic area under the curve (ROC-AUC) of 0.552, while the multi-task model achieved 0.539 and 0.558, respectively. Patient-level bootstrap analysis showed an ROC-AUC difference of 0.005 (95% confidence interval (CI): -0.087 to 0.090) and a balanced-accuracy difference of -0.009 (95% CI: -0.067 to 0.043). The auxiliary tasks were strongly imbalanced and showed limited predictive performance. Overall, including morphological features did not clearly improve malignancy-risk classification, showing the importance of class balance, label formulation, and reader-level annotation structure in multi-task pulmonary CT analysis.
Read the full abstract ▾
Cryptography and Security
VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents
Yurong Hao, Wen Zhou, Guowei Guan et al. (+3 more)
Advancing beyond traditional static scoring models, LLM-powered agentic recommender systems (LLM-ARS) instantiate users and items as autonomous
agents, whose semantic states are dynamically refined through a recurrent process known as collaborative reflection. While this mechanism improves recommendation quality, it simultaneously introduces a systemic vulnerability:
adversarial evidence injected into a single
agent can be rationalised into a legitimate preference narrative, written back into
memory, and propagated to other
agents through interaction contexts. We term the local rationalisation process reflection laundering, and its system-wide escalation through collaborative reflection collaborative-reflection hijacking. Existing attacks on recommender systems, whether based on interaction-level data poisoning or text-level
adversarial perturbations, assume static pipelines and thus cannot exploit this recurrent, multi-
agent amplification pathway. To bridge this gap, we first conduct a controlled vulnerability analysis that establishes two exploitable properties underlying collaborative-reflection hijacking: reflective persistence and cross-
agent propagation. Then building on these findings, we propose VirusCascade, the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces: the former ensures the target item is naturally rationalised as satisfying broad user preferences, the latter positions it for system-wide propagation. Extensive experiments on four real-world
datasets across diverse LLM-ARS architectures demonstrate that VirusCascade consistently achieves state-of-the-art targeted exposure under evaluated stealth constraints, reaching a mean E@20 of 0.384 and surpassing the strongest baseline by an absolute margin of +0.185.
Read the full abstract ▾
All authors Yurong Hao, Wen Zhou, Guowei Guan, Tiantong Wu, Fuyao Zhang, Wei Yang Bryan Lim
Software Engineering
Zero2Repo: Can Coding Agents Build Repositories from Scratch?
Pei Yang, Tianyu Shi, Yuhang Yao et al. (+23 more)
Coding
agents are increasingly asked to build software rather than patch it, yet
benchmarks for from-scratch repository construction are mostly limited to a single
language and depend on manually curated tasks. We introduce Zero2Repo, a
benchmark in which an
agent receives a product requirements document, an interface contract, and an empty workspace, and must deliver a complete repository in the project's native ecosystem. Tasks are produced by a
language-agnostic authoring pipeline that converts real, version-pinned open-source projects into behavioral specifications, reproducible environments, and hidden acceptance tests. Each task is validated by execution: a reference implementation derived from the upstream project must pass, and
adversarial validation must show that the tests reject incorrect implementations. Evaluation runs production coding
agents in isolated containers, withholds the acceptance tests until an explicit submission, and assigns a binary reward only when every test passes, with no LLM judge. The pipeline and harness make no
language-specific assumptions and apply to mainstream programming ecosystems; the current release contains Python, TypeScript, Go, and C++ tasks. Even on 11 tasks drawn from repositories that frontier models have very likely seen during training, the strongest
agent solves only 10, and every failing submission passes 90-99% of the hidden tests; for the two strongest
agents, 67-100% of failed tests trace to a single omission or a low-frequency rule stated in the specification rather than to a missing subsystem, so each failure is a concrete target for improvement.
Read the full abstract ▾
All authors Pei Yang, Tianyu Shi, Yuhang Yao, Wanyi Chen, Tongyun Yang, Dun Pei, Haonan Wang, Pengbin Feng, Guanxu Yu, Jingchun Huang, Zeyu Zhang, Shuhan Sun, Hao Li, Alex Gu, Xiang Li, Jie Xiao, Xinyu Wang, Hanxin Chen, Daqi Li, Qi Jia, Hongshan Lin, Zhizhou Gu, Zijun Tian, Weizhi Du, Lynn Ai, Eric Yang
Cryptography and Security
Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs
Mustafa Arslan
Agentic large
language models (LLMs) now move money through tools, yet the record of what they did is usually a trace their own process emits beside the effect. Janus puts the record on the effect path. A step's proposal, the verdict on it and any answer from a validator or a person are durable in a signed, hash-chained log before the step may run or its effect be released; with keys declared, each answer is signed by whoever gave or relayed it. Gates are pure functions of that log, and an auditor re-derives every verdict offline from the log and one public key. At the MCP edge the effect is held until then; through the SDK, which our model experiment uses, a cooperating client runs it only afterwards. We evaluate Janus under crash injection (144 kills in-process, 81 through the daemon), by verifying a 100-million-event log offline (254.5 s), and with a real model behind a lending workflow, run governed and plain on the same recorded model outputs. With the lending mandate in the model's
prompt, the comparison was 0 against 0. With it only in the policy and the amount's unit stated, the model approved six loans declared over the mandate, three with no injection (a run that also dropped the unit approved three); the plain
agent paid all six and Janus none, each refused by a deterministic validator and re-derivable offline. An always-approve oracle over the recorded intakes gave 20 and 21 declared over the mandate against 0, though Janus paid four and three whose declared amount understated the request. Designing the experiment exposed, in a system that passed its own audit, an instance of post-approval substitution: an approval keyed to an attempt was counted for a different proposal, moving a person's approval from 100 to 1,000,000. We report it, a first fix and the five routes around it, and what Janus does not guarantee.
Read the full abstract ▾
Artificial Intelligence · Cross-listed from eess.IV
Raw Imagery Impacting Your AI: Should You Care?
Adrien Dorise, Marjorie Bellizzi and Stéphane May
Onboard AI is gaining interest for space applications such as vessel, wildfire, and cloud detection, where real-time processing can improve mission reactivity and reduce downlink needs. However, onboard models may operate on raw or minimally processed imagery rather than on restored ground products. This study evaluates how image degradation affects object detection by varying Signal-to-Noise Ratio (SNR), Modulation Transfer Function (MTF) at Nyquist, and Ground Sampling Distance (GSD). Controlled degradations are applied to Very High Resolution Maxar imagery, and three lightweight detectors, YOLOv5s, YOLOX-S, and NanoDet, are evaluated on the resulting operating points. The results show that the impact of image quality depends on the degradation mechanism, and that increasing degradation does not necessarily lead to a proportional decrease in vessel detection performance. GSD produces the most consistent performance shift, while MTF and SNR effects depend more on the model and resolution. Severe combinations of blur and noise produce the largest losses. These results provide task-level information that can support sensor, processing, and AI trade-offs for future onboard systems.
Read the full abstract ▾
Machine Learning · Cross-listed from stat.ML
Robust LassoNet: Enhancing Feature Selection in Neural Networks via Robust Loss Functions
Daniela De Canditiis, Italia De Feis and Paola Stolfi
Feature selection in neural networks remains a challenging problem, particularly in the presence of noisy or contaminated data. LassoNet is a recent approach that addresses this issue by combining neural networks with hierarchical sparsity constraints, enabling simultaneous prediction and variable selection. However, its standard formulation relies on the mean squared error (MSE) loss, which is known to be highly sensitive to outliers. In this paper, we present Robust LassoNet, an extension of LassoNet that incorporates robust loss functions, such as Huber, Cauchy, Tukey's bisquare, and Nonnegative Garrote, to mitigate the effect of extreme observations. The proposed approach preserves the original optimization framework while improving stability under data contamination. Through experiments on synthetic and real
datasets, we show that robust LassoNet significantly improves both predictive performance and feature selection accuracy in the presence of outliers or heavy tailed noise, while maintaining comparable performance in clean settings. These results highlight the importance of robustness in neural network based feature selection and suggest practical guidelines for choosing appropriate loss functions.
Read the full abstract ▾
Artificial Intelligence · Cross-listed from econ.TH
When Does Randomized Oversight Align AI Agents That Can Conceal?
Joshua S. Gans and Richard Holden
Oversight changes the evidence it relies on. We ask when randomized audits and scoring align AI
agents that can conceal misconduct and alter records. Stronger
auditing makes undeterred violations better hidden. Because the provider writes the
agent's objective, sanctions need not stop at forfeiture, and rare audits deter every type of
agent if evidence survives concealment and audit draws cannot be learned in advance. When evidence can be erased, deterrence must come from lower gains from violation, such as credit for stopping, or from costlier or fewer ways to conceal. These conditions identify what failed when
agents in OpenAI's cybersecurity evaluations compromised parts of Hugging Face's infrastructure in July 2026.
Read the full abstract ▾
Computation and Language
NinaXander: Feasibility and Limits of Composing Frozen Language Models Across Architecture Families via a Shared Latent Space
Takanori Kotama, Shun-ichiro Hayashi, Daichi Mukunoki et al. (+2 more)
In this paper we propose NinaXander, a series of composed
language models obtained by connecting layers of frozen
language models from different architecture families with a single trained shared-latent adapter. A composed model runs the first layers of one model, converts the resulting intermediate representation once with the adapter, and then runs the remaining layers of the other model. Once the adapter is trained, several composed models that connect at different layers are obtained without retraining. Using the recurrent RWKV-4-Raven-7B and the
Transformer-based Tulu-Pythia-6.9b, abbreviated as RWKV and Pythia, this study examines whether frozen models from different families can be recombined post hoc. The composed models answered multiple-choice questions, and those whose generations we examined produced syntactically well-formed text. The configuration that combines the first 5 layers of Pythia with the remaining 27 layers of RWKV reduced the
Transformer key-value (KV) cache by 84.4% with accuracy not significantly different from that of RWKV alone. In multiple-choice accuracy, however, no composed model matched the parent model Pythia, and
language-modeling performance decreased sharply on WikiText, a corpus of Wikipedia articles outside the training domain. The correspondence between intermediate representations was also obtained in one favorable case, with a shared tokenizer, the same depth, and the same hidden width, and does not show that the models share a general semantic space.
Read the full abstract ▾
All authors Takanori Kotama, Shun-ichiro Hayashi, Daichi Mukunoki, Tetsuya Hoshino, Takahiro Katagiri
Computation and Language
ContextAdapt: Evaluating Contextual Adaptation and Value Alignment in LLMs
Olivia Macmillan-Scott and Mirco Musolesi
Values such as honesty, autonomy, and confidentiality are often regarded as general principles underpinning AI
alignment. However, what it means to act in accordance with these values can depend on the context in which a decision is made. In this paper, we ask whether large
language models (LLMs) appropriately adapt the application of a value across professional settings, while remaining consistent when contextual changes do not alter the relevant professional norm. To study this, we introduce ContextAdapt, an evaluation framework covering honesty, autonomy, and confidentiality across medicine, law, finance, and national security. Drawing on primary-source professional and regulatory documents, we construct a value x domain framework and use this to develop scenarios testing both default professional rules and recognised exceptions. We evaluate 12 LLMs on both the actions they recommend and the justifications they provide. In our main experiment, models achieve 95.6% mean appropriateness, although the use of the correct domain-specific justification varies substantially across models, from 25.6% to 76.9%. In a separate factorial experiment, explicitly naming the professional domain and changing the role of the model have limited effect on behaviour. Varying stakes, however, reveals severe but localised failures: in some cases, models alter their responses even though the underlying professional obligation remains unchanged. In particular, perceived severity appears to act as a cue for disclosure across both honesty and confidentiality scenarios. These results show that evaluating value
alignment requires us to consider not only whether models follow abstract principles, but whether they apply them appropriately across different contexts.
Read the full abstract ▾