Peer Revenue Publish or profit

Papers

Fresh from arXiv, typeset properly. Highlighted words trade on the market.

Statistics

stat Watch Statistics (sign in to use)

Wednesday 7 October

Statistical Methodology

Reusing Statistical Guarantees Under Change: Selection Costs and Event Ownership

An adaptive system can retain an earlier estimate while changing what that estimate is used to guarantee. The guarantee depends on the experiment that produced the evidence, including how its target was selected and which assumptions connect it to the current claim. We show that past-measurable selection preserves future martingale dynamics without preserving a unit expected starting value. An exact finite counterexample, using a strictly positive family, refutes a published changing-prior extension as stated with probability one and rules out unrestricted bounds based only on switch count and the error level. We give a paid-start multi-switch correction and establish $m$ as the sharp worst-case expected starting-moment cost for an unstructured family of $m$ hypotheses. We then develop Adaptive Assurance, a framework in which statistical events retain their experiment, funding and outcome bindings while claims and premise dependencies change. Compatible-outcome projection supports reuse, selective invalidation, fresh acquisition and auditable decisions. Two histories can have identical current regions yet require different responses to a later edit, making evidence origin part of the assurance state. Studies in six public-recorded domains exercise heterogeneous outcomes and access contracts. Component interventions expose erroneous inheritance and unnecessary resets. The framework separates conditional guarantee recovery from competence adaptation, with explicit costs for evidence, computation and verification.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

Global Exponential Convergence of Two-Layer Linear Network Training

We prove global exponential (linear) convergence with an explicit rate in the rich scaling for wide two-layer linear networks trained with smooth Polyak-Lojasiewicz predictor losses. Gradient flow in the factors closes exactly in terms of a finite-dimensional Bures flow of the neuron law covariance, in which the predictor dynamics are preconditioned by hidden covariance blocks. Mean-field conservation laws provide uniform spectral lower bounds on the hidden preconditioning blocks when the initial covariance satisfies a spectral support gap condition. This condition encompasses positive definiteness while still allowing for singular initializations. For an initial covariance $\Sigma_0 = \sigma^2 \mathrm{Id}$, the loss converges to the global minimum with linear rate at least $4\sigma^2\kappa$, where $\kappa$ is the PL constant. We establish stability of this rate under finite-width sampling, as well as global convergence of factor gradient descent for an explicit stepsize interval depending on smoothness, the initial loss, and conserved spectral margins. Our argument extends layerwise to deep linear ResNets, subject to a residual-path bound. In the case of heavy-ball momentum, training dynamics close instead over positions and velocities in terms of a lifted phase covariance. Linear convergence holds under an explicit condition on the energy and damping, specifying a window of admissible dampings. For two-scale white initializations, this interval is nonempty for sufficiently large position scales, with a fixed initial loss gap and velocity covariance. Numerical experiments illustrate the covariance geometry and compare the predicted and observed rates.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

Benign Overfitting under Heterogeneous Input Fusion

Benign overfitting is extensively studied when learning from a single high-dimensional input, but its behavior under heterogeneous input fusion remains largely unexplored. We study this question for minimum-norm linear interpolation under a heterogeneous Gaussian design, comparing two statistically dependent input blocks with their fusion while holding the underlying population task fixed. For regression, we identify a full-spectrum covariance certificate whose asymptotic status is independent of the cutoff threshold and prove that it is preserved by every positive-semidefinite joint covariance consistent with the two marginals. This protection is sharp, yet it does not extend to all benign regression problems: outside the certified regime, two benign marginals can have a harmful fusion. For one-sparse Gaussian classification, benignity in the regular regime is characterized by the balance between surviving predictive signal and nuisance contamination. Fusion can move these two quantities in opposite directions, and within this model class every marginal-to-joint benign/non-benign pattern is attainable. We further show that the same fused input can have qualitatively different effects on regression and classification. These results establish that benign overfitting under heterogeneous fusion is determined by the joint signal and spectral geometry created by input interaction, rather than by marginal benignity alone.
Read the full abstract

Statistical Methodology

Sequential resetting procedures and false discovery rate

Data arrive sequentially, each associated with a null hypothesis. We develop testing procedures to locate intervals in which some null hypotheses fail, with false discovery rate (FDR) control. The new procedures are called sequential resetting procedures, and they are based on e-values and test supermartingales. We also develop a refined version of the procedures by dropping less informative data points before the block minimum of the test supermartingale in each rejection block. These procedures have explicit FDR bounds under two settings: a classic setting of independence and the more general setting of possible dependence across null data and non-null data. These FDR bounds are independent of the testing horizon, and the general one has anytime validity, but it has an extra logarithm factor compared with the standard FDR level. We present simulation studies and data experiments with applications of sequential resetting procedures to LLM watermark detection and financial backtesting.
Read the full abstract

Statistics Theory · Cross-listed from math.OC

The Geometry of Anisotropic Dilation for Optimal Regularization

A central question in data-driven inverse problems is how to construct a regularizer that adapts to the geometry of the data distribution. Recent work in optimal regularization shows that, within a broad Gibbs class, the regularizer best matched to a distribution $P$ is determined by a single, direction-dependent radial summary statistic $\rho_P$. This suggests a way to control regularizer geometry by transforming the data. In particular, which transformations act on $\rho_P$ in a simple, explicit way? Can they improve the optimization properties of the resulting variational problems or adapt a fixed base regularizer to data? To address these questions, we introduce anisotropic dilation, a direction-preserving map that rescales each point along its Euclidean ray by a positive profile on the sphere. Despite its simplicity, this family acts transitively on the space of radial summary statistics: any target regularizer in the Gibbs class can be reached from any source distribution by a single explicit profile. We characterize the resulting orbit structure on distributions, derive in closed form the profile that optimally adapts a fixed base regularizer to the data, and show that its improvement over isotropic rescaling is governed by a Jensen gap that is provably positive for several natural families. We also establish finite-sample generalization bounds for jointly learning the base regularizer and anisotropic profile, with explicit rates when the logarithm of the profile is parameterized by linear feature models or sparse ReLU networks. Building on this theory, we parameterize the base regularizer and anisotropic profile and learn them jointly from samples, yielding a data-adaptive regularizer for variational inverse problems. Experiments on a controlled two-dimensional family and MNIST denoising show that learning the profile further improves performance.
Read the full abstract

Statistics Theory

Tightness and Error Exponents of SDP with Logarithmically Many Communities

We study a semidefinite programming (SDP) relaxation for community recovery when the number of communities grows logarithmically. In the balanced stochastic block model with $n=km$ vertices, we consider the regime $k/\log m\to\gamma>0$, with edge probabilities $\alpha\log m/m$ within communities and $\beta\log m/m$ across them, for fixed $\alpha>\beta>0$. We derive the sharp asymptotic tightness boundary away from critical cases. When rare vertices cause tightness to fail while the bulk remains spectrally stable, the normalized matrix error of every near-optimal solution still vanishes. We prove matching high-probability exponents for this error and the normalized optimal objective gain, governed by the same local correction that determines tightness. Throughout this spectrally stable region, a single SDP solve followed by explicit rounding and refinement achieves exact community recovery above the information-theoretic threshold. This guarantee holds even when the planted community matrix is not an optimal solution to the SDP.
Read the full abstract

Statistics Theory · Cross-listed from quant-ph

Witnessing Quantum Bayesian Inference beyond Classical Learning

Can an agent's predictions reveal whether its reasoning is based on a classical or a quantum model? Using known results on matrix factorizations, here we show that quantum Bayesian retrodiction can produce one-step-ahead forecasts incompatible with every classical Bayesian explanation based on learning about a fixed but unknown sampling law from conditionally independent observations. The separation has a sharp threshold in the number of outcomes: for any measurement with at most four outcomes, the quantum predictions admit a classical realization, irrespective of the prior state and the finite Hilbert-space dimension, whereas a five-outcome measurement on a single qubit already violates an explicit classical bound. This bound holds for arbitrary classical latent states, prior probabilities, and sampling laws, and involves only the agent's initial and updated predictions. Thus, in this setting, quantum Bayesian retrodiction is strictly more expressive than classical Bayesian learning, and this difference can be witnessed without observing or specifying the agent's internal description.
Read the full abstract

Statistics Applications

A Sensitivity-based Framework for Calibrating Coupled Ordinary Differential Equations under Model Discrepancy

Coupled systems of ordinary differential equations (ODEs) are widely used to model complex physical and biological processes. In these applications, ODE model parameters must be calibrated to field data to enable prediction and parameter inference. In practice, the governing ODEs are an imperfect approximation to the true system, leading to non-negligible model discrepancy that must be incorporated to avoid biased parameter estimates. However, it is well known that highly flexible discrepancy models can confound discrepancy and simulator parameters, leading to poor identifiability. As a result, practitioners often must impose problem-specific prior constraints to adequately regularize the discrepancy, which can be challenging and cumbersome. In this work, we propose a novel calibration framework for coupled, multi-output ODE systems that enforces automatic, model-structural constraints on the discrepancy, improving identifiability without requiring application-specific discrepancy priors. Forward-model gradients are computed via sensitivity equations, solved jointly with the ODE system as a coupled initial value problem. Posterior inference is performed using an adaptive Metropolis-within-Gibbs sampler tailored to the resulting constrained posterior. We demonstrate the approach on three model systems: a mass-spring oscillator, a model of infectious disease spread, and a neuron firing model. We show that our method leads to improved parameter inference and predictive accuracy compared to standard calibration approaches.
Read the full abstract

Statistical Methodology

Distinguishable Category Groupings in Complex Surveys: Which Categories Can the Design Tell Apart?

Surveys often estimate the share of cases in each of several categories, such as the causes of an event or the reasons for a visit. Readers then compare the categories, but reliability rules usually check each estimate alone, not the differences between them. We ask instead which groups of categories can be told apart under the sampling design. The categories often fall into blocks, such as driver-related and vehicle-related causes. A grouping is called distinguishable when every pair of its groups in the same block differs by more than the design's minimum detectable difference, computed from the primary sampling units at the design's degrees of freedom. The maximal distinguishable groupings are the most detailed and can differ in size, while merging two groups can destroy distinguishability. So even if splitting any one group in two breaks distinguishability, a more detailed distinguishable grouping may still exist. We propose two methods. One merges categories until the grouping is distinguishable, then tests every single split. The other lists every distinguishable grouping of a block with few categories. When groups in different blocks must also differ, there might be no grouping that qualifies. An application to the National Motor Vehicle Crash Causation Survey, with 24 primary sampling units in 12 strata, gives the grouping maxima for two blocks of its categories. Of more than 27 million groupings of its 13 vehicle-related critical reasons, none with more than four groups is distinguishable, and its environment-related reasons resolve into at most four groups. Merging two groups of a distinguishable vehicle grouping destroys distinguishability in 5,239 of 31,773 cases. If groups from different blocks must also be told apart, no grouping qualifies. Analysts can apply these methods before publishing categorical comparisons from designs with few degrees of freedom.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

The Symbol of the Surrogate: Measuring Numerical Provenance in Neural PDE Solvers

Neural PDE surrogates are trained on numerical solver outputs that contain both physical evolution and solver-specific discretization errors. Because surrogates are also evaluated against held-out trajectories from the same solver, standard benchmarks cannot distinguish fidelity to the exact evolution from imitation of the numerical scheme. We introduce an empirical Fourier-symbol diagnostic that probes a trained surrogate's linearized one-step operator with individual Fourier modes and compares it with both exact-evolution and training-scheme references. To address architectural spectral bias, we train identical networks on schemes with orthogonal dissipative and dispersive signatures and compare their learned operators. In linear advection, the learned surrogates reproduce the training schemes' amplitude and phase errors, with the twin-scheme difference reaching more than 99.8% of the analytically predicted full-imitation ceiling. The same behavior occurs for a non-local Fourier neural operator and at the operator level for nonlinear Burgers dynamics. These results show that agreement with solver-generated test data does not by itself establish fidelity to the exact evolution. Fourier-symbol measurements provide a direct diagnostic of numerical provenance.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

Efficient Best-of-N policy evaluation for inference-time alignment

Best-of-N (BoN) is a common inference-time alignment method that selects the highest-scoring response among N samples from a reference model. Evaluating BoN policies from logged data is challenging under sample-only access because standard off-policy estimators require density ratios that depend on unavailable response likelihoods. In this paper, we propose a sample-only framework for evaluating and selecting BoN policies without access to these likelihoods. We show that the order-statistic structure of BoN allows the required density ratios to be expressed through score-rank probabilities that are estimable from samples alone. We then develop a doubly robust estimator of the BoN policy value (BoN-DR) that efficiently reuses a shared auxiliary sample pool across candidate budgets. We establish valid asymptotic inference even under reward estimator misspecification and prove the efficiency of our BoN-DR estimator. Since larger budgets can amplify errors in the score function and lead to reward overoptimization, we derive two selection rules: (i) maximizing the estimated policy value and (ii) maximizing a lower confidence bound on the improvement over the reference policy, which accounts for estimation uncertainty and provides a no-harm guarantee. Across synthetic experiments and GSM8K with multiple reference and reward models, our framework accurately estimates BoN policy values and selects effective sampling budgets.
Read the full abstract

All authors Jonas Schweisthal, Yuxin Wang, Athiya Deviyani, Stefan Feuerriegel, Dennis Frauen

Statistics Applications

Bayesian Optimization for Dose Finding with Two Agents: Participant Allocation and Final Selection

In two-agent dose-finding trials, the next cohort should help identify a combination for final selection. We studied a constrained knowledge-gradient (cKG) rule with one-cohort lookahead that updates independent Gaussian-process models of efficacy and continuous toxicity, reapplies a probability criterion for mean toxicity, and evaluates the resulting selection. We derived a deterministic calculation over a fixed set of dose combinations, holding fitted model parameters fixed during each hypothetical update. We compared cKG with constrained expected improvement (cEI) and two toxicity-only rules, targeted mean squared error (tMSE) and entropy, in four synthetic scenarios. In the primary obstructive sleep apnea (OSA)-derived scenario, averaged equally over strata and five probability cutoffs, cKG assigned fewer participants to combinations above the true mean-toxicity limit than tMSE (17.92% versus 27.08%), but selected such combinations more often at trial completion (18.80% versus 11.85%). Compared with cEI, cKG had higher mean simulated reduction in the 4%-desaturation apnea-hypopnea index (AHI4) at final selection (7.46 versus 6.72 events/hour), more above-limit final selections (18.80% versus 10.50%), and more above-limit assignments (17.92% versus 15.10%). Across scenarios, its efficacy advantage over cEI was smaller under stricter toxicity criteria. Continuous outcomes, uncalibrated toxicity limits, and a rule that still selects a combination when none meets the criterion limit clinical interpretation. Allocation and final-selection toxicity should be reported separately, alongside efficacy.
Read the full abstract

Tuesday 6 October

Machine Learning (Statistics)

The optimal information complexity of VC learning

Steinke and Zakynthinou(2020) introduces the Conditional Mutual Information (CMI) framework of analyzing the information complexity of learning algorithms based on algorithm-dependent information-theoretic quantities. We study one of these quantities, the evaluated Conditional Mutual Information (eCMI). It has been an interesting question whether the optimal PAC guarantee for VC classes can be recovered from the algorithm-dependent analyses via CMI. And we show that it is possible to recover this guarantee by constructing a learning algorithm whose eCMI is of order O(d) in the realizable case, where d is the VC-dimension of the concept class. Specially, our algorithm is a randomized Majority-of-5 base learners with optimal in-expectation generalization guarantee.
Read the full abstract

Statistical Methodology · Cross-listed from cs.CR

Certified Corruption Budgets: Anytime-Valid Leaderboard Claims under Adaptive Rigging

Public leaderboards for AI models are read continuously, and attackers can see every published standing. Vote rigging, selective disclosure of private variants, and benchmark contamination can each move a ranking. Existing guarantees assume genuine records or bound the corruption per step, which an attacker who corrupts in bursts evades. We introduce the certified corruption budget, a tolerance $\widehat{B}_t$ computed after $t$ records and published with each pairwise claim. With probability at least $1-\alpha$, simultaneously at all times, the claim is correct or more than $\widehat{B}_t$ records were corrupted. It holds against attackers who watch every certificate, with no bound on their budget. Forged records and records altered once seen require different certificates: the certificate for forgeries fails, with probability approaching one, against an attacker who flips votes it has seen, while one that charges roughly twice as much per record remains valid, with constant bets even against attackers who see the future, and no smaller charge is valid at every level. The certified budget grows nearly as fast as any valid method allows: with a win fraction $\frac{1}{2}+\delta$, each new record adds close to $2\delta$ to the number of forged records the claim can withstand ($\delta$ flipped). Publishing the best of $V$ private variants costs only an amount growing like $\log V$. In replays on 1.8 million Chatbot Arena votes, a few hundred rigged votes make standard confidence intervals certify false orderings, while ours stays valid. On real votes, our certificate shows that clearly separated models withstand about 2,000 forged votes.
Read the full abstract

Statistical Methodology

Longitudinal causal inference under informative missingness using the self-censoring model

Longitudinal observational data are often subject to informative missingness. For example, in healthcare research using electronic health records, covariates and outcomes are measured only when patients interact with the healthcare system. Whether these data are observed usually depends on the unobserved variable values themselves, introducing a common form of data missing not at random. We develop identification and estimation methods for the effects of longitudinal modified treatment policies under a self-censoring model which explicitly models this dependence. We consider effects of treatments that can be modified only at measurement times (e.g., interactions with the heathcare system). We study two settings: one in which the observed history suffices for treatment confounding control, and another in which confounder control requires covariate values that were not measured at missed visits. In both settings, we combine longitudinal causal identification with shadow-variable conditional moment restrictions to obtain recursive identification formulas for the counterfactual outcome mean. We derive gradients of the pathwise derivatives and second-order remainder expansions, and use these results to construct estimators that accommodate machine learning for nuisance-function estimation. Under suitable product-rate conditions and cross-fitting, the estimators are asymptotically linear and permit root-n inference, including simultaneous inference across outcome times. We also describe conditional-moment learning and ensemble approaches for estimating the nuisance functions required by our approach, together with a pool-and-smooth strategy that borrows information across sparsely measured outcomes.
Read the full abstract

Statistical Methodology

Calibration-Free Robust Bayesian Inference for Discrete Unnormalized Models

Bayesian inference for discrete models with intractable normalizing constants is computationally challenging, particularly when the sample space is large or countably infinite. Although some likelihood-based Bayesian methods can circumvent the intractable normalizing constant, their uncertainty quantification may be poorly calibrated under model misspecification. Generalized Bayesian approaches can address this calibration issue, but typically require careful tuning of a learning rate. In this paper, we propose DFD-BETEL, a semiparametric Bayesian framework that uses the first-order optimality conditions of discrete Fisher divergence as moment conditions in Bayesian exponentially tilted empirical likelihood. The resulting posterior avoids evaluation of the normalizing constant and requires no learning-rate calibration. We establish consistency and asymptotic normality of the discrete Fisher divergence estimator and prove a Bernstein-von Mises theorem for the DFD-BETEL posterior, showing that its limiting covariance matches the sampling covariance of the estimator and yields asymptotically calibrated uncertainty quantification. Numerical studies show that DFD-BETEL remains competitive with likelihood-based Bayesian inference under correct specification and provides more reliable uncertainty quantification under model misspecification. An application to automobile-insurance claim data further illustrates the practical utility of DFD-BETEL.
Read the full abstract

Statistical Methodology

Sketched Calibration for Conformal Prediction under Covariate Shift

Weighted conformal prediction corrects for covariate shift by reweighting calibration scores with the likelihood ratio between target and source covariates. Its cost grows with the chi-square divergence between the two covariate laws, typically exponentially in the size of the shift, and much of it can be paid for shift in directions that do not affect the response. We propose sketched calibration: weighted conformal prediction with the ratio of compressed covariates $Z=T(X)$, used in the weights and optionally in the score. Compression never increases the shift-dependent calibration cost, and target coverage is at least $1-\alpha-\Delta_T$, where the leakage $\Delta_T$ measures how much of the discarded shift reappears as a change in the law of the response, or of the score, given $Z$. The leakage is a covariance between the discarded shift and the response on the fibres of the sketch; it vanishes when the sketch is sufficient or retains the shift, and a minimax construction shows that no threshold rule for a fixed score can avoid it. In a heteroscedastic simulation where unweighted calibration fails, a one-dimensional sketch cuts the fraction of infinite prediction sets from $37.8\%$ to $8.0\%$ at mean coverage $92.3\%$ for a $90\%$ target; nonlinear and real-data experiments show when learned sketches succeed and when they fail.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

An Accuracy-Information Tradeoff for Loss-Difference Conditional Mutual Information

Loss-difference conditional mutual information (ld-CMI) uses the smallest of the standard observations in the supersample hierarchy of generalization bounds: it measures what a learner's loss differences reveal about which candidate of each pair it was trained on. Accuracy is known to force information into the model; data processing does not carry such lower bounds to losses. We show, by bounding three moments of the loss differences, that accuracy also forces ld-CMI. For linear predictors with a smooth convex loss of nonzero slope at zero, such as the logistic loss, plus a regularizer whose curvature and growth are both of power $r\ge2$, on product distributions over a scaled sign cube in dimension at least linear in $n$, every proper learner with expected excess risk at most $\varepsilon$ on these distributions at the optimal sample size $n\asymp\varepsilon^{-2+2/r}$ has worst-case ld-CMI of order $n$ bits, and $\Theta(n/(1+(\tau/\varepsilon)^2))$ bits under Gaussian noise of standard deviation $\tau$ on the loss differences. The same holds without a regularizer, at $n\asymp\varepsilon^{-2}$. Consequently, range-scaled ld-CMI bounds cannot vanish on these distributions, although every proper learner's generalization gap is $O(n^{-1/2})$. We also show that model-level information does not determine noisy loss-difference information, and that the growth, slope and dimension conditions are needed, the last up to a logarithm.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

Exact Dynamics and Finite-Sample Trajectory Recovery of Linear Recursive Feature Machines

Recursive feature machines (RFMs) learn representations of data by alternating between fitting a predictor to a dataset and updating features of that predictor using the average gradient outer product (AGOP). Connections between AGOPs and feature learning in neural networks motivate linear RFMs as a simple setting for analyzing how representations evolve during training. Here, we study the dynamics and statistics of linear RFM in noisy multi-output regression with isotropic sub-Gaussian input data and targets generated by a low-rank teacher matrix of dimension $d$. We extend the known connection between linear RFM and iteratively reweighted least squares from the interpolating setting to ridge-regularized multi-output regression with noise. We show that the learned feature matrix remains close to its infinite-data ideal counterpart at every iteration. Namely, for $n$ samples, we show the error in the feature matrix decays as $O(\sqrt{d/n})$ with high probability. Experiments on real-world text and single-cell gene-expression data illustrate the features learned by this simple linear model.
Read the full abstract

All authors Andrew Cheng, Bobak T. Kiani, Yue M. Lu, Adityanarayanan Radhakrishnan

Statistics Theory

Low-Order Inclusion Probabilities Do Not Determine Asymptotic Normality

Central limit theorems in survey sampling are typically established under specific sampling designs rather than from generic characteristics of a design. Motivated by the search for more general conditions, we investigate whether low-order inclusion probabilities can provide such a basis. First- and second-order inclusion probabilities determine the first two moments of sampling estimators such as the Horvitz–Thompson estimator, but we show that even exact agreement of these probabilities with those of simple random sampling without replacement (SRSWOR) does not preserve asymptotic normality. We construct a sequence of fixed-size sampling designs having exactly the same first- and second-order inclusion probabilities as SRSWOR, together with a sequence of finite populations for which the sample total converges to $N(0,1)$ under SRSWOR but to a centered standard exponential distribution under the alternative designs. Thus, the two sample totals have exactly the same mean and variance at every stage of the sequence, yet have different limiting distributions. The alternative designs are obtained from balanced incomplete block designs arising from finite projective planes. Their cyclic structure allows us to prescribe the distribution of the sample total under block sampling, while a probabilistic permutation argument, combined with an exponential inequality for sampling without replacement, yields finite populations satisfying the SRSWOR central limit theorem. The result shows that low-order inclusion probabilities do not control the global dependence structure relevant to asymptotic normality and therefore cannot, by themselves, provide general conditions for central limit theorems under complex sampling designs.
Read the full abstract

Statistics Applications

Detecting Unseen Jailbreak Sources: A Multi-Source Conformal Detection Perspective

Jailbreak defenses for large language models are usually calibrated on a fixed set of known attack methods. However, new attack methods keep appearing after deployment, and existing detectors are observed to degrade under the new attacks (Piet et al., 2025). This paper studies how to detect, from a stream of attack prompts, that the prompts come from an attack source outside the known ones. We formulate it as a sequential test whose null hypothesis is that the stream comes from one of the known sources. Methodology-wise, we compute a conformal p-value against each known source, and reject the null only when the evidence against every known source is large. Using these source-wise p-values, we build Persist-3 and analyze its stationary false-alarm probability and detection power. The technical contribution of Persist-3 lies in a detection guarantee that uses only a finite window of recent observations. Our theoretical analysis reveals that its detection probability approaches one exponentially fast as the window grows, and thus a short window suffices to detect unseen sources that are well separated from all known sources. Empirically, we validate Persist-3 on top of two recent jailbreak defenses, MTK (Zhang et al., 2026) and Prompt Guard 2 (Chennabasappa et al., 2025), and observe a significant defense enhancement.
Read the full abstract

All authors Xunlei Qian, Yingqian Cui, Yuping Lin, Jun Wu, Yue Xing

Machine Learning (Statistics) · Cross-listed from cs.DS

Lower Bounds for Parallel Diffusion Sampling

Standard diffusion samplers generate samples through repeated evaluations of a learned score function. Parallel sampling methods seek to accelerate generation by trading additional evaluations for fewer sequential rounds. This raises the question of how much sequential dependence is unavoidable, even when many score queries can be made simultaneously. We establish the first polynomial parallel-round lower bounds for diffusion sampling with approximate scores. Specifically, we prove (1) a $\widetilde{\Omega}(d^{1/3})$-round lower bound for sampling smooth, near-isotropic Gaussian mixtures in $R^d$, and (2) an $\Omega(d)$-round lower bound for uniform sampling from anisotropic axis-aligned boxes contained in the unit ball. Both bounds hold for arbitrary randomized algorithms making polynomially many queries per round at arbitrary locations and noise levels, with inverse-polynomial score error and constant total variation accuracy. The linear bound is tight for our box family. Our constructions use fixed approximate score oracles that enforce sequential access to hidden information while satisfying the accuracy guarantee at every noise level.
Read the full abstract

Statistical Methodology

Relative Wasserstein Spatial Depth for Cluster Number Selection in Distributional Data

Contemporary data in many scientific domains, such as images, media streams, biomedical omics, are naturally modeled as probability distributions in Wasserstein space instead of points in Euclidean space. Consequently, clustering methods for distributions are in high demand, as they provide exploratory frameworks to group objects with similarity. Clustering distribution-valued data in Wasserstein space often requires choosing the number of clusters in advance. We propose Relative Wasserstein Spatial Depth (RWSD) as a selection criterion for optimal number of clusters. It compares the depth of each distribution in its assigned cluster with its depth in competing clusters. We pair this criterion with Wasserstein K-means or a proposed K-medians algorithm. Under suitable assumptions, we establish consistency of the cluster centers and of the selected optimal number of clusters. We also give an error rate under two-stage sampling and characterize the robustness of RWSD under any fixed partition. In extensive simulations, RWSD selects the intended number of clusters under unequal separations, heterogeneous dispersion, heavy tails, and outliers, where silhouette score or the Davies-Bouldin Index often fails. Applications to MNIST images and flow cytometry data illustrate the practical value of RWSD. In some cases where a cluster is not geodesically convex and lacks a meaningful depth center, the RWSD can fail.
Read the full abstract

Machine Learning (Statistics)

The Impact of Likelihood Tempering on the Limiting Predictive Moments of Variational Bayesian Linear Neural Networks

In wide Bayesian neural networks, Gaussian mean-field variational inference is prone to "prior dominance": the Kullback-Leibler (KL) regularization term of the ELBO outweighs the expected log-likelihood, and the variational predictive distribution collapses to the prior predictive as the width $M$ grows. Tempering the likelihood, by raising it to the power $1/T$ for a temperature $T < 1$, is equivalent to scaling the KL term by $T$. We ask in this paper how fast $T$ must decrease with $M$ to counteract this degeneracy and strike a good balance between the two terms. For single-hidden-layer linear networks with isotropic Gaussian priors, we derive the limiting predictive distribution under schedules of the form $T = \tau/M^{c}$, with constants $\tau, c > 0$, as $M \to \infty$ and compare it with the untempered neural network Gaussian process (NNGP) posterior, the infinite-width limit of the exact posterior. Our main result is that the predictive expectation and variance undergo phase transitions at different scales: the limiting expectation leaves its prior value at $c = 1/2$, once $\tau$ falls below an explicit threshold, and equals the least-squares prediction for $c > 1/2$, whereas the limiting variance keeps its prior value for $c < 1$, matches the NNGP's for $c=1$, and vanishes for $c > 1$. With suitable choices of $\tau,c$, one can recover either the NNGP posterior expectation or its variance.
Read the full abstract

Statistics Theory

Sharp and Adaptive Cluster Recovery in Slowly Mixing Gaussian Hidden Markov Models

We study cluster recovery in a two-state Gaussian hidden Markov model in the slowly mixing regime, where the transition probability $\delta$ may vanish with the sample size. Temporal persistence creates long homogeneous segments and fundamentally changes the recovery problem relative to the i.i.d. Gaussian mixture benchmark. Rather than being purely adverse, label dependence provides exploitable structure: the statistical difficulty becomes concentrated near the rare transition points, giving rise to recovery regimes governed explicitly by their frequency $\delta$. We first characterize, up to universal constants, the oracle Bayes risk for offline and online clustering. Both problems exhibit a nonstandard polynomial risk regime, but the sequential constraint induces an additional logarithmic localization cost, yielding a genuine online/offline gap. We also study fixed lag prediction with delayed label feedback and identify the effective memory horizon beyond which past labels no longer improve the optimal rate. When the signal direction is unknown and possibly high dimensional, the problem is governed by the effective signal strength \[ r_n^2 = \frac{\|\theta\|^4/\sigma^4} {\|\theta\|^2/\sigma^2+d/n}. \] We derive minimax lower bounds and construct fully adaptive polynomial time procedures attaining the sharp recovery rates. In particular, almost full recovery is possible precisely when $r_n^2\gg\delta$. If $n\delta\gtrsim\log n$, adaptation to both the signal $\theta$ and the transition probability $\delta$ incurs no first order loss, and the sharp exact recovery threshold (under the Hamming loss) is \[ r_n^2 = 2\log(n\delta)\,(1+o(1)). \] Thus the effective complexity of the problem is governed by the number of latent transitions, rather than by the sample size itself.
Read the full abstract

Statistics Theory

Local asymptotic normality for spectral-tail likelihoods under fixed-domain sampling

We establish local asymptotic normality (LAN) for joint inference on scale and roughness in stationary Gaussian random fields observed on increasingly dense regular grids in a fixed domain. Scale and roughness are represented by the coefficient and decay exponent of the leading spectral tail. Under spectral regularity conditions, we identify the joint normalization governing the LAN expansion and prove consistency and asymptotic normality of the maximum likelihood estimators. For \(N\) observations, the estimation errors are of order \(N^{-1/2}\) for roughness and \((\log N)/\sqrt N\) for scale. After componentwise normalization, the errors converge to a perfectly correlated Gaussian pair. Knowing either parameter improves the convergence rate for estimating the other by a logarithmic factor. The analysis uses generalized locally Toeplitz (GLT) theory, for which we develop a truncation principle accommodating nonintegrable limiting symbols and quantitative bounds on the contribution from low frequencies. We verify the assumptions for Matérn and generalized Wendland covariance families, establishing uniform spectral bounds for the latter. We also show that consistency and the limiting distributions persist under covariance misspecification when the true and fitted spectra share the same leading tail and their difference decays sufficiently rapidly. This includes misspecification between Matérn and generalized Wendland models under explicit parameter restrictions.
Read the full abstract

Statistics Theory · Cross-listed from cs.CC

On the Computational Complexity of Hidden Markov Model Identification

Identification is the task of recovering the parameters of an unknown ground-truth model from sampled data. When parameters other than the ground truth induce the same output distribution, data alone does not provide enough information to recover the ground truth, and the model is thus called unidentifiable. We study the identifiability problem for hidden Markov models (HMMs): given an HMM, is it identifiable? Existing work on HMM identification establishes conditions under which the ground-truth HMM can be identified. However, most of these conditions are sufficient but not necessary, meaning that, when a model does not satisfy them, its identifiability remains inconclusive. We instead take a computational perspective: is there a sound and complete algorithm that decides whether a given HMM is identifiable, and if so, what is the complexity of this decision problem? We consider the decision problems arising from the various notions of identifiability in the literature, including deterministic, generic, global, local, state-permutation- invariant, and finite-alphabet identifiability. We show that all of these problems are decidable in PSPACE, via reductions to the theory of the reals at various levels of its quantifier-alternation hierarchy. We further show that the deterministic variants are already coETR-hard (and hence coNP-hard) for simply parameterized families.
Read the full abstract

Statistical Methodology

Score-Based Methods for Selecting Direct Causes in Reweighted Distributions

Scoring methods based on the Bayesian information criterion (BIC) are commonly used for model selection tasks such as choosing features in a regression model or learning directed acyclic graphs from data. In certain model classes, model selection based on the BIC is consistent. However, since the BIC is based on the observed likelihood function, it does not apply directly to reweighted distributions arising in causal inference, missing data, and domain shift applications. Here, we propose a generalized version of the BIC that allows for model selection in reweighted distributions. We prove its corresponding consistency property and demonstrate how it can be used for selecting direct causes of an outcome variable in a marginal structural model. Our proposed method accounts for scenarios with unmeasured confounders and where the weights must be estimated from data. Through simulation studies, we demonstrate the asymptotic properties of the reweighted BIC and compare it with alternative methods for model selection.
Read the full abstract

Statistical Methodology

A Formal Graphical Inference Framework for Combining Effect Size with Statistical Significance: Application to Multivariate and Functional Linear Models

To address the critical need for statistical methods that evaluate practical magnitude alongside statistical significance, we introduce a formal graphical inference framework that intrinsically combines effect size with uncertainty. Built upon resampling and global envelopes, this approach provides universality and direct visual interpretability. While existing envelope tests provide only weak family-wise error rate (FWER) or false discovery rate control, we advance the methodology by introducing novel step-down global envelopes. We theoretically prove that several of these envelopes achieve exact strong FWER control under exchangeability, guaranteeing rigorous inference for each individual local hypothesis. Beyond yielding adjusted $p$-values, the framework provides adjusted subset $p$-values for blocks of hypotheses, such as the functional effect of a covariate within a specific category. By explicitly visualizing the size and direction of the effect relative to its variability under the null hypothesis, our approach overcomes the dichotomous nature of traditional testing and provides profound informational value. The proposed framework is applied to multivariate and functional linear models.
Read the full abstract

Machine Learning (Statistics) · Cross-listed from cs.LG

FedRSPO+: A Heterogeneity-aware Algorithm for Decision-focused Federated Learning

Decision-focused learning (DFL) trains predictive models for downstream optimization, but existing methods largely assume centralized data. In cross-silo settings, federated learning offers a natural alternative, yet standard federated methods optimize prediction over decision quality and do not address heterogeneity in downstream objectives or feasible sets. This heterogeneity is especially challenging for DFL because small perturbations in polyhedral problems can cause discontinuous changes in optimal decisions, destabilizing client updates and aggregation. We propose FedRSPO+, a heterogeneity-aware framework for decision-focused federated learning, built on RSPO+, a regularized predict-then-optimize surrogate that smooths the decision map through projection. We show that RSPO+ upper bounds decision error and regret for the regularized decision and, under exact regularization and consistent LP solution selection, for the original LP decision. We further derive cross-client heterogeneity bounds that depend on both objective and feasible-set heterogeneity, vanish at homogeneity, and require no strong convexity. FedRSPO+ uses an annealed, modular training procedure compatible with standard federated personalization and aggregation methods. Experiments on synthetic knapsack, shortest-path, and real-world energy pricing tasks compare against prediction-only federated learning and DFL baselines under varying heterogeneity and communication budgets. Results suggest that smoothing is a useful ingredient for stable collaborative decision learning and provide a heterogeneity-aware foundation for federated DFL.
Read the full abstract