Papers

The branching ratio $\rho$ of a self-exciting point process determines the branching margin $1-\rho$ to the critical boundary. We study inference on $\rho$ from a finite record for stationary Hawkes processes with completely monotone kernels whose slow relaxation mass obeys an envelope near zero rate. Slow excitation can then be exchanged for exogenous immigration; a spectral bound on the Kullback–Leibler rate and a coupling argument for the unobserved past give a minimax lower bound of order $T^{-\gamma/(2\gamma+1)}$ for a power-law envelope with tail exponent $\gamma$. A block-dispersion estimator whose block length grows as $T^{1/(2\gamma+1)}$ attains this rate. A quantitative central limit theorem, obtained from the cluster representation and a second-order Poincaré inequality on Poisson space, yields honest confidence intervals of nearly minimax expected length. For unknown $\gamma$, a Lepski-type rule adapts in probability at a logarithmic cost; free adaptation between memory classes is impossible, and honest intervals cannot adapt to lighter memory. Simulations are consistent with the rates.

Agentic large language models (LLMs) now move money through tools, yet the record of what they did is usually a trace their own process emits beside the effect. Janus puts the record on the effect path. A step's proposal, the verdict on it and any answer from a validator or a person are durable in a signed, hash-chained log before the step may run or its effect be released; with keys declared, each answer is signed by whoever gave or relayed it. Gates are pure functions of that log, and an auditor re-derives every verdict offline from the log and one public key. At the MCP edge the effect is held until then; through the SDK, which our model experiment uses, a cooperating client runs it only afterwards. We evaluate Janus under crash injection (144 kills in-process, 81 through the daemon), by verifying a 100-million-event log offline (254.5 s), and with a real model behind a lending workflow, run governed and plain on the same recorded model outputs. With the lending mandate in the model's prompt, the comparison was 0 against 0. With it only in the policy and the amount's unit stated, the model approved six loans declared over the mandate, three with no injection (a run that also dropped the unit approved three); the plain agent paid all six and Janus none, each refused by a deterministic validator and re-derivable offline. An always-approve oracle over the recorded intakes gave 20 and 21 declared over the mandate against 0, though Janus paid four and three whose declared amount understated the request. Designing the experiment exposed, in a system that passed its own audit, an instance of post-approval substitution: an approval keyed to an attempt was counted for a different proposal, moving a person's approval from 100 to 1,000,000. We report it, a first fix and the five routes around it, and what Janus does not guarantee.

Onboard AI is gaining interest for space applications such as vessel, wildfire, and cloud detection, where real-time processing can improve mission reactivity and reduce downlink needs. However, onboard models may operate on raw or minimally processed imagery rather than on restored ground products. This study evaluates how image degradation affects object detection by varying Signal-to-Noise Ratio (SNR), Modulation Transfer Function (MTF) at Nyquist, and Ground Sampling Distance (GSD). Controlled degradations are applied to Very High Resolution Maxar imagery, and three lightweight detectors, YOLOv5s, YOLOX-S, and NanoDet, are evaluated on the resulting operating points. The results show that the impact of image quality depends on the degradation mechanism, and that increasing degradation does not necessarily lead to a proportional decrease in vessel detection performance. GSD produces the most consistent performance shift, while MTF and SNR effects depend more on the model and resolution. Severe combinations of blur and noise produce the largest losses. These results provide task-level information that can support sensor, processing, and AI trade-offs for future onboard systems.

Estimating biological age is an important task in ageing research, as it quantifies individual ageing trajectories beyond chronological age. Retinal age estimation has become a well-established direction in this area because retinal imaging provides a non-invasive window into neural and microvascular ageing. Existing studies, however, have predominantly focused on fundus photographs and usually model retinal ageing as a single generic process. Although biological ageing is heterogeneous and different organs or tissues may age at different rates, little research has explicitly distinguished neurostructural and vascular ageing in retinal age prediction. This work fills this gap by studying neurostructural ageing with Optical Coherence Tomography (OCT) images and vascular ageing with Optical Coherence Tomography Angiography (OCTA) images. We formulate multimodal OCT/OCTA retinal age estimation as a structural-vascular ageing decomposition problem and propose SAP-DPF, a unified dual-path prediction framework that separately estimates structural and vascular ageing, models modality-specific predictive uncertainty, and adaptively fuses the two ageing signals through an uncertainty-gated late-fusion module. Using this unified prediction framework, SAP-DPF achieves a mean absolute error of 4.07 years for the structural pathway and 7.37 years for the vascular pathway, while the proposed late-fusion algorithm further improves the overall mean absolute error to 4.02 years, representing a 12.52% improvement over the strongest single-modality baseline. This work could extend retinal age prediction beyond a single biological-age estimate, providing a framework for investigating structural and vascular contributions to heterogeneous retinal ageing.

Feature selection in neural networks remains a challenging problem, particularly in the presence of noisy or contaminated data. LassoNet is a recent approach that addresses this issue by combining neural networks with hierarchical sparsity constraints, enabling simultaneous prediction and variable selection. However, its standard formulation relies on the mean squared error (MSE) loss, which is known to be highly sensitive to outliers. In this paper, we present Robust LassoNet, an extension of LassoNet that incorporates robust loss functions, such as Huber, Cauchy, Tukey's bisquare, and Nonnegative Garrote, to mitigate the effect of extreme observations. The proposed approach preserves the original optimization framework while improving stability under data contamination. Through experiments on synthetic and real datasets, we show that robust LassoNet significantly improves both predictive performance and feature selection accuracy in the presence of outliers or heavy tailed noise, while maintaining comparable performance in clean settings. These results highlight the importance of robustness in neural network based feature selection and suggest practical guidelines for choosing appropriate loss functions.

Oversight changes the evidence it relies on. We ask when randomized audits and scoring align AI agents that can conceal misconduct and alter records. Stronger auditing makes undeterred violations better hidden. Because the provider writes the agent's objective, sanctions need not stop at forfeiture, and rare audits deter every type of agent if evidence survives concealment and audit draws cannot be learned in advance. When evidence can be erased, deterrence must come from lower gains from violation, such as credit for stopping, or from costlier or fewer ways to conceal. These conditions identify what failed when agents in OpenAI's cybersecurity evaluations compromised parts of Hugging Face's infrastructure in July 2026.

In this paper we propose NinaXander, a series of composed language models obtained by connecting layers of frozen language models from different architecture families with a single trained shared-latent adapter. A composed model runs the first layers of one model, converts the resulting intermediate representation once with the adapter, and then runs the remaining layers of the other model. Once the adapter is trained, several composed models that connect at different layers are obtained without retraining. Using the recurrent RWKV-4-Raven-7B and the Transformer-based Tulu-Pythia-6.9b, abbreviated as RWKV and Pythia, this study examines whether frozen models from different families can be recombined post hoc. The composed models answered multiple-choice questions, and those whose generations we examined produced syntactically well-formed text. The configuration that combines the first 5 layers of Pythia with the remaining 27 layers of RWKV reduced the Transformer key-value (KV) cache by 84.4% with accuracy not significantly different from that of RWKV alone. In multiple-choice accuracy, however, no composed model matched the parent model Pythia, and language-modeling performance decreased sharply on WikiText, a corpus of Wikipedia articles outside the training domain. The correspondence between intermediate representations was also obtained in one favorable case, with a shared tokenizer, the same depth, and the same hidden width, and does not show that the models share a general semantic space.

Values such as honesty, autonomy, and confidentiality are often regarded as general principles underpinning AI alignment. However, what it means to act in accordance with these values can depend on the context in which a decision is made. In this paper, we ask whether large language models (LLMs) appropriately adapt the application of a value across professional settings, while remaining consistent when contextual changes do not alter the relevant professional norm. To study this, we introduce ContextAdapt, an evaluation framework covering honesty, autonomy, and confidentiality across medicine, law, finance, and national security. Drawing on primary-source professional and regulatory documents, we construct a value x domain framework and use this to develop scenarios testing both default professional rules and recognised exceptions. We evaluate 12 LLMs on both the actions they recommend and the justifications they provide. In our main experiment, models achieve 95.6% mean appropriateness, although the use of the correct domain-specific justification varies substantially across models, from 25.6% to 76.9%. In a separate factorial experiment, explicitly naming the professional domain and changing the role of the model have limited effect on behaviour. Varying stakes, however, reveals severe but localised failures: in some cases, models alter their responses even though the underlying professional obligation remains unchanged. In particular, perceived severity appears to act as a cue for disclosure across both honesty and confidentiality scenarios. These results show that evaluating value alignment requires us to consider not only whether models follow abstract principles, but whether they apply them appropriately across different contexts.

We construct systematic $q$-ary codes correcting two deletions with three redundant symbols over polynomial-size alphabets. For every information length $n\ge2$, our first construction has length $n+3$ over an alphabet of size $q=2^s<2^{32}n^7$ for some integer $s$, with polynomial-time encoding and decoding. A cardinality bound of Liu and Xing implies that three redundant symbols are necessary, so the construction is optimal in this measure. We also establish the existence of systematic codes with the same redundancy over alphabets of size $O(n^4)$, leaving efficient encoding and decoding at that alphabet scale open. For a single burst of at most two adjacent deletions, we give a polynomial-time systematic construction with three redundant symbols over a power-of-two alphabet of size $q<(n+2)^4$. A converse bound for adjacent deletions shows that three redundant symbols are again optimal for $n\ge2$.

Market clearing in community-based local energy markets relies on power demand and PV forecasts, making it vulnerable to coordinated false data injection (FDI) attacks. This paper proposes a bilevel optimization framework to identify worst-case bus-level FDI against interconnected multi-community electricity markets within a distribution network. The upper level attacker maximizes physical impact, measured by cumulative voltage deviation, while accounting for detectability. The lower level re-clears the interconnected multi-community markets subject to operational and network constraints. The bilevel model is reformulated as a single-level mixed-integer program through Karush-Kuhn-Tucker conditions and solved using the epsilon constraint method to characterize the trade-off between physical impact and detectability. Case studies on the IEEE 33-bus system with three communities show that even bounded, system-level zero-sum attacks can reshape local trading, reduce voltage security margins, and produce asymmetric community-level market outcomes. The results further show that vulnerability depends strongly on the spatiotemporal placement of falsified data rather than on uniform spreading across buses and time periods.

Code editing requires a model to decide where to make changes, generate the new content, and preserve everything else. We study how masked diffusion language models divide these responsibilities across four editing interfaces: whole-file rewriting, search-and-replace, locate-then-infill, and token-level editing. Experiments on CanItEdit reveal a composition gap: diffusion models can generate coordinated changes when the correct edit locations are supplied, but much of this capability is lost when those locations must be predicted. Access to the intact original code helps the model fill multiple edit regions, yet does not resolve the difficulty of selecting those regions. By varying the editable regions while holding the generation model and decoding procedure fixed, we identify two distinct requirements for successful editing: covering every required change and placing precise boundaries around it. Missing a required region prevents the corresponding change, while widening regions to ensure coverage can sharply reduce success by requiring unchanged code to be regenerated. A sentence-level Wiki editing probe shows the same qualitative gap between supplied and predicted locations beyond code. These findings show why strong infilling capability alone does not ensure reliable editing: the interface must expose all required changes while limiting regeneration of unchanged code.

Large language models (LLMs) are increasingly used to answer questions about politically contentious issues, yet evaluations typically treat a model's stance as a relatively stable property. Real users, however, communicate political signals through their terminology, assumptions, and personal context. We investigate whether such signals produce ideological mimicry: systematic shifts in the political stance expressed by an LLM toward the position conveyed by the interaction. If LLMs adapt their responses to these signals, they risk creating personalised political information environments in which users with opposing views receive systematically different accounts of the same issue, potentially reinforcing existing divisions. We build the Poli-SHIFT dataset and evaluation framework and assess seven open-weight LLMs across ten contentious political topics in the United States, United Kingdom, and Australia, systematically manipulating contested terminology, politically valenced premises, and user information, and eliciting responses in both multiple-choice and open-text formats. Across models, we find robust evidence that prompt framing shapes the political stance of LLM outputs. Changing terminology alone reverses which side of an issue a model supports in 16.9% of matched comparisons. Stated political ideology also systematically shifts responses toward the user's position. These findings show that political stance is not a fixed property of LLMs; the views expressed are conditional on the interaction with the user. As LLMs become increasingly personalised sources of information, such interaction-dependent adaptation could contribute to political information environments that reinforce users' existing perspectives.

We continue research on the burning game on graphs. Given a graph $G$, two players, Burner and Staller, take turns in selecting vertices of $G$ to burn. All burned vertices spread fire to unburned neighboring vertices, as in the burning process. The goal of Burner is to burn the graph as quickly as possible, while Staller wants the process to last as long as possible. If both players play optimally, then the number of time steps needed to burn the whole graph $G$ is the game burning number $b_{\rm g}(G)$ if Burner makes the first move, and the Staller-start game burning number $b_{\rm g}'(G)$ if Staller starts. In this paper, we study this game further, establishing Nordhaus-Gaddum bounds on the game burning number, as well as bounds for four different types of graph products: strong, Cartesian, lexicographic and corona products.

The Thurston spine of the genus 2 Teichmüller space of closed compact surfaces is obtained. In particular, we identify all mapping class group-orbits of filling sets of systoles in genus 2. Thereby, surprisingly rich cases already appear in this simplest case which is genus 2. This is contrasted with a cell decomposition of a bordification of Teichmüller space obtained computationally using Rivin's angle coordinates, on which the cells are labelled by Delaunay graphs closely related to our systolic graphs.

Text-to-image (T2I) models have substantially improved in language understanding, in-image text rendering, and visual composition, while their safety mechanisms do not always keep pace with these capabilities. This creates a cross-modal attack surface in which harmful semantics can remain inconspicuous in a serialized prompt yet emerge through image-level composition. We propose CollageAttack, an automated single-prompt black-box jailbreak that shifts semantic assembly into the image plane by combining context-relevant scenes, scene-grounded textual carriers, and spatially distributed text fragments. Experiments across multiple open-weight and commercial T2I models show that CollageAttack achieves attack success rates of up to 86.0%, outperforming the strongest baseline on the same model by 18.5 percentage points, while consistently producing more harmful outputs and preserving the source intent. We further find that distributed textual fragments can reconstruct the intended semantics after generation, with visual composition producing stronger communicative impact than text alone. These results reveal a cross-modal safety gap in which harmful meaning emerges from the composition of individually less explicit elements.

With the proliferation of free online editing tools, altering or forging pdf documents has become trivially easy, often leaving no visual traces on screen. This paper introduces a two- stage forensic pipeline. An initial security-gating layer validates format compliance and flags embedded malicious payloads and a forensic engine that inspects internal objects across meta- data, visual overlays, and dual-source OCR consistency, etc... A weighted scoring engine aggregates these forensic indicators into an interpretable risk score is proposed. The approach was validated on real medical work-stoppage certificates.

The rapid evolution of image manipulation techniques has raised growing public security concerns. Existing Image Forgery Localization (IFL) methods can accurately localize manipulated regions but are often unable to adapt to newly emerging forgeries. In real-world forensic scenarios, data typically arrive sequentially, yet continual model adaptation remains largely unexplored in IFL. To bridge this gap, we introduce the first continual learning framework for IFL and establish a comprehensive benchmark under two realistic data-evolution protocols: cross-dataset and cross-content continual learning. Evaluations of representative state-of-the-art IFL and continual learning methods reveal substantial performance degradation, highlighting two key challenges: (1) adaptively capturing intrinsic forensic traces from incoming data across unseen domains, and (2) preserving previously acquired forensic knowledge during sequential adaptation. To address these challenges, we propose a forensic-aware continual adaptation framework. First, a forensic trace mining module employs Spatial Mixture-of-Forensic-Experts (SMoFE) to dynamically route complementary forensic cues across spatial locations, together with Forensic Evidence-Guided Dense Prompting (FEGDP) to transform low-level forensic traces into structured localization evidence for SAM. Second, Fisher-weighted LoRA Gradient (FLAG) surgery identifies old-task-sensitive adaptation directions and suppresses conflicting updates, mitigating catastrophic forgetting while preserving plasticity for emerging forgery domains. Extensive experiments demonstrate state-of-the-art performance in both pixel-level forgery localization and image-level forgery detection across diverse continual learning scenarios.

A skew-morphism of a finite group $G$ is a permutation $\sigma$ of $G$ fixing the identity element such that there exists a function $\pi\colon G\to\mathbb{Z}$ satisfying $\sigma(xy)=\sigma(x)\sigma^{\pi(x)}(y)$ for all $x,y\in G$. For a given skew-morphism $\sigma$ of $G$, the product of the left regular representation of $G$ and the cyclic group $\langle\sigma\rangle$ forms a permutation group on $G$, called a skew-product group of $G$. Skew-product groups of finite elementary abelian $p$-groups were investigated in \cite{DLYZ}. In the present paper, we extend this study to all finite abelian $p$-groups.

Warning: This paper contains harmful and offensive text. Recently, large language models such as GPT-4, and Claude have revolutionized tasks in various domains. As the use of these large language models increases, people are increasingly concerned about AI safety and demand that large language models behave responsibly and safely. As a result, there has been growing global interest in developing methods to ensure AI safety. However, the detailed criteria for AI safety may vary depending on the country, culture, and policies of the company you serve. In this study, we propose SURE (A Safe and Unified AI Framework foR Everyone), which is designed as a framework for customizing the attributes of AI safety and ensuring the defined AI safety. Within SURE, we establish taxonomies for adversarial prompts that could threaten AI safety and construct prompts based on the taxonomies. We then define templates for desirable AI responses to these prompts and design an absolute safety scoring scheme. Finally, we conduct AI alignment using the datasets to gradually ensure AI safety. The effectiveness of SURE is demonstrated through experiments with various base models.

Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundary without trusting the agent or its policy suggestions. A model may propose a tri-state asset contract - allow, deny, or no_egress - but a human makes the final choice. An execution gate binds the contract to a concrete task before untrusted code runs. An extended Berkeley Packet Filter (eBPF) Linux Security Modules (LSM) data plane then enforces file and network decisions and monotonically propagates no_egress through processes, regular files, pipes, FIFOs, and supported Unix-domain sockets. All 570 runs across 19 security tests satisfy predefined return-value and side-effect criteria. On three co-located file-I/O workloads, median overhead is 11.96-12.89% in a Linux 6.15 virtual machine and 35.79-61.54% on a Linux 6.15 physical platform, lower than the evaluated frozen ActPlane baseline. The results demonstrate deterministic kernel enforcement for declared assets, supported paths, and controlled object lifecycles.

Standard many-body perturbation theory for optical excitations combines the $GW$ approximation for quasiparticle energies with the Bethe-Salpeter equation (BSE) for the electron-hole response. Formally, the BSE kernel must equal the functional derivative of the self-energy, $K=\delta\Sigma/\delta G$. In routine practice, however, the kernel is built from a statically screened direct interaction and a bare exchange interaction, which breaks this consistency. Using exact diagonalization of the extended Hubbard dimer, we construct a controlled benchmark that isolates the price of this inconsistency. We show that the internally inconsistent practical $GW$+BSE construction frequently yields accurate optical gaps through accidental cancellation between an underestimated $GW$ gap and an oversized bare-exchange kernel, and we map the regions of parameter space where this accidental accuracy occurs. Upon switching on the nearest-neighbor interaction and binding the exciton, the practical construction remains the accurate one throughout the weak-binding regime, with cancellation optima at parts in $10^{3}$, while the frozen-$W$ construction fails at every binding strength. Beyond a binding threshold both static constructions deteriorate, showing that deeply bound excitons require physics beyond any static kernel. Accidental accuracy is therefore a property of the weak-binding regime, and the systematic failure of the frozen-$W$ derivative kernel within the explored parameter space traces to its overscreening of the exchange channel. The accuracy of the practical kernel is an accidental cancellation of two independent errors, an underestimated quasiparticle gap and an oversized exchange term, not a hidden consistency. These results provide a controlled taxonomy of approximation failure in $GW$+BSE and a precise diagnostic for when standard workflows can be trusted.

Deepfakes no longer need to fake a whole video. Generators that read the transcript now alter only the few seconds in which a video's meaning turns, so a forgery hides in a small, unknown fraction of the video. Yet detectors still read every one-second window of both the audio and image streams, spending nearly all of their compute where nothing was altered. We observe that deciding where to look is far cheaper than looking. We present ModalFidelity, a lightweight router that previews each window and decides, before any forensic detector runs, which stream is worth reading, under a hard compute budget it can never exceed. On AV-Deepfake1M, reading at most a fifth of the windows, it is more accurate than gating after the detectors at 15.9x less compute, and retains over 96% of the accuracy of an oracle that knows where every forgery lies.

LLM agents execute dynamically generated process and file operations that are often invisible to application-layer tracing. We present Agent-Warden, an extended Berkeley Packet Filter (eBPF)-based provenance monitor for tracking task and regular-file states across process creation, file access, and process termination. Agent-Warden provides two interchangeable state backends: a PID-keyed hash-map backend for compatible kernels lacking BPF local-storage support and a task/inode-local-storage backend that couples state reclamation to kernel-object lifetimes. The system emits incremental causal edges to user space for asynchronous graph reconstruction and applies conservative exit-triggered causal aggregation to preserve causal context for short-lived proxy tasks. In a controlled file-mediated propagation scenario, Agent-Warden reconstructed a cross-process causal chain that was absent from the application-layer trace. On x86-64 and ARM64 bare-metal hosts, the evaluated workloads showed 0.2-3.5% end-to-end overhead and 0.6-3.7% additional system CPU time. These results indicate that the prototype provides kernel-level visibility with the measured overheads in the evaluated settings.

Murphy and Petridis proved that, for subsets $A$ of an arbitrary finite field $\F_q$, the condition $\abs A>q^{2/3-\delta}$ implies $\abs{(A-A)(A-A)}>q/2$ whenever $\delta<1/13542$ and $q$ is sufficiently large. We improve the explicit saving to $1/1689$. The proof replaces the main physical-space extraction in their large-energy branch by a common Fourier spectrum, followed by a popular-ratio Balog–Szemerédi–Gowers step. The resulting additive energy is treated level by level, retaining difference multiplicities and combining the Reiher–Schoen relation lemma with Mohammadi's difference–ratio estimate. This gives the structural exponent $188$ and hence \[ \abs A\ge Cq^{375/563}=Cq^{2/3-1/1689} \quad\Longrightarrow\quad \abs{(A-A)(A-A)}>\frac q2 \] for an absolute constant $C>0$.

The problem of the uniform law being a sum of two independent distributions has been well studied. Here, we study the approximation of the uniform law to a sum of two distributions with fixed support, under the following discrepancies: the Manhattan distance, the Euclidean distance, the forward Kullback–Leibler divergence and the Wasserstein-one distance based on the line metric. The problem of membership of the uniform law in this model has been well studied. Explicit results are obtained in two models, one where one of the distributions is a Bernoulli and the other when both distributions have the same support, including one conjecture. Finally, we show an application of our reconstruction method to a recent conjecture about the coding capacity of an additive noise channel.

Programs that compute with physical quantities often need to convert between units of measurement, and as the Mars Climate Orbiter showed, these conversions can be a rich source of errors. Meanwhile, typed unit calculi, our most rigorous formalisms for checking physical units in a program, have excluded unit conversions. Through this exclusion, they have established a powerful property: well-typed programs are invariant under rescaling (no program can depend on how big a meter is). But losing the ability to convert between units is a significant cost. In contrast, practical languages provide conversion but no invariance theorem. We present $\Lambda_S$, a typed lambda calculus with conversion, quantification over units and dimensions, and vectors and linear maps with per-component units, and we determine exactly how much invariance survives conversion. For terms without unit constants we prove two abstraction theorems: (i) a convert-free term is invariant under every rescaling; (ii) a term with conversions is invariant under every rescaling that scales all units of one dimension by the same factor. The condition in (ii) cannot be weakened: under any other rescaling, some conversion of a nonzero value is not invariant. For first-order programs, a verified decision procedure returns one of three verdicts: it certifies that no error in the declared conversion factors can change the program's answer, names the accumulated ratio through which such an error would scale it, or declines. A verified checker decides whether unit declarations are consistent and determine every conversion factor, and extracts each factor exactly. We also prove adequacy, erasure, and the $n$-variable Pi theorem of dimensional analysis with conversion. Every theorem is mechanized in Lean 4, and the evaluator compiles to a native binary.

We prove that every commutative Gaussian ring has finitistic weak dimension at most two. The proof works with a fixed module of finite flat dimension and does not assume that the weak global dimension of the ring is finite. For a local Gaussian ring $A$, with nilradical $N$, the kernel $I$ of $A\to A_N$ satisfies $NI=I^2=0$. A hypothetical module $M$ of flat dimension three gives a nonzero torsion module $H=\Tor_2^A(A/N,M)$ over the valuation domain $A/N$, with $H\cong\Tor_1^A(I,M)$ and $I\otimes_{A/N}H=0$. Two carefully controlled localizations, a propagation argument in the chain ring $A/D$, where $D=\{x:x^2=0\}$, and an annihilator factorization in a filtered system of cyclic modules yield a contradiction.

A set of integers has zero harmonic density if its elements, viewed as frequencies of continuous characters of the unit circle as a compact group, are measure-theoretically sparse enough that the values of Fourier transforms of Radon measures supported on small open arcs can interpolate those of any global Radon measure. In contrast, zero density quantifies the proportional size of a set of integers relative to expanding intervals on the real line. Although these notions arise from abstract harmonic analysis and elementary number theory, respectively, zero harmonic density is proven as a sufficient condition for zero density, resolving what has been stated in the literature as an open problem concerning the relation between these two notions. The proof makes use of classical gap theorems from complex analysis.

A Technical Report: Operating a large language model (LLM) as a service requires more than inference infrastructure: the provider must also defend against adversarial interactions that seek to exploit the service, including jailbreaking for harmful use, sophisticated denial of service, and distillation attacks. We study this problem at the inference layer, using a hypothetical frontier lab, Five Elements Inc., as a running example. Because no public labelled dataset of adversarial LLM usage exists, we introduce a structural causal model (SCM) that generates a realistically grounded, labelled dataset of user-sessions, with coordinated multi-account campaigns, platform feedback, and three tiers of label observability. On this dataset we train a practical gradient-boosted detector that classifies each user-session as benign or malicious and, if malicious, by attack type. Against oracle labels the detector very nearly solves the binary task (AUPRC $0.993$), yet against the operational labels a real Trust & Safety team would hold, the same model scores an AUPRC of only $0.313$: the detector is more accurate than the labels used to evaluate it. For attack-type attribution, a naive argmax is dominated by the $98\%$ benign prior (macro-F1 $0.295$), whereas a simple thresholded decision engine raises macro-F1 to $0.489$ without sacrificing accuracy. The dataset is publicly released.

Existing 3D part decomposition methods do not necessarily partition the original shape into non-overlapping parts that collectively cover the entire shape, allowing overlaps or gaps that hinder downstream part-level applications. We instead formulate part decomposition as a joint partitioning of the entire shape, where the predicted parts are non-overlapping and jointly recover the entire shape. Our key insight is that part decomposition should consider all desired parts jointly, rather than modeling each part independently. To this end, we develop a promptable model for 3D part decomposition from images or meshes. Users can specify desired parts through 3D point prompts for controllable decomposition. Given one point prompt per desired part, our model produces the corresponding parts as a complete partition of the entire shape. We build on a pretrained 3D generation model and first obtain a shape latent from either an input image or mesh. We then introduce a prompt encoder that maps each 3D point prompt to a part token while attending to the shape latent. To decode the desired parts, we propose a novel part decoder jointly scoring the entire shape against all part tokens in a coarse-to-fine manner, assigning every position within the shape volume to exactly one part. We perform part decomposition in this shared shape latent space, enabling a unified model for image-to-part generation, mesh-to-part generation, and part segmentation. Our method outperforms existing works on all part-quality metrics across all three tasks, and improves compatibility among parts by an order of magnitude over previous SOTA methods. Code and models will be released.