arXiv subjects

Arnav Garg

Publications and source records attributed to Arnav Garg.

7 recordsLinked to original sources

arXiv2026

The Devil is in the Context: Nine Dimensions of Prompt Injection Attacks

Prompt injection is usually discussed and evaluated as a single, homogeneous type of attack. However, vulnerabilities reported in real-world systems show that prompt injections vary widely. Moreover, the same instruction can be a prompt injection in one context and a legitimate request in another, depending on the user's intent and the system's policies. Ignoring this variation leaves gaps in how defenses are evaluated, and can give a false sense of security against real-world attacks. We identify nine dimensions along which prompt injection attacks differ. Together, they form a taxonomy that describes the injected instruction itself, its relation to the user's task, and how it manifests in the target system. Each dimension affects which defenses can detect or prevent an attack. We first use the taxonomy to characterize six real-world prompt injection vulnerabilities, showing how much these attacks differ. We then apply it to nine prompt injection benchmarks and find that most cover only a small region of this space. Combining benchmarks helps, but 13% of pairwise category combinations remain untested, mostly among the less commonly represented categories. Finally, we show that the taxonomy supports automated annotation of benchmarks and targeted generation of new test cases to fill these gaps. The taxonomy is also useful beyond benchmarks. Defense authors can use it to state which types of prompt injection they evaluated against, and system operators can use it to identify which attacks apply to their system and choose defenses to match.

cs.CR↗

arXiv2026

MetaVul: Agentic Harness Discovery for Vulnerability Detection

LLM agents are increasingly used to automate vulnerability detection, but reliable detection is challenging because agents must distinguish subtle, security-relevant fixes from benign code variation. While underlying LLM capability has improved significantly, the accuracy of the agent still depends heavily on the harness: the code that defines the scaffolding around the LLM. Harnesses are typically fixed, and largely hand-written, limiting adaptation to evaluator feedback. Additionally, when harnesses are static, improvements on one dataset or model may not transfer to others. To address these challenges, we introduce MetaVul, a self-improving framework for harness discovery in vulnerability detection. Starting from a seed structured reasoning scaffold, MetaVul uses a workflow-based optimization loop to iteratively refine the harness using feedback from paired vulnerable and patched functions, while preserving the structured reasoning and verdict format. At each iteration, it searches over the history of prior harnesses, with access to their trajectories, logs, and metrics, and it returns a set of Pareto-optimal harnesses. We apply MetaVul to discover agent harnesses for various architectures. A validation set (202 pairs) is used for optimization, while an unseen dataset (430 pairs) is kept as the held-out set. We test whether harnesses learned from one model transfer to others not seen during optimization. Results on both frontier and small LLMs show that the optimized harnesses improve pairwise vulnerability detection up to 23.3 percentage points on the validation set and up to 25.8 points on the held-out set with a Pareto-frontier harness. Harnesses learned with one model also transfer to others. We show that harnesses optimized with one model transfer to another, improving held-out pairwise accuracy by 14.7 points without further optimization.

cs.CR↗

arXiv2026

Impartial Combinatorial Games and the Nuclear Escalation Ladder

We model Herman Kahn's escalation ladder as an impartial combinatorial game. Reindexing each rung by its distance to the nuclear threshold turns the ladder into a subtraction game, the most tractable class in combinatorial game theory, and the doctrinal fact that no side wishes to fire first selects the misere convention. We prove that single-ladder stability is governed by a congruence (Theorem 4.1) and derive a ladder-design corollary that makes the burden of first escalation a function of ladder length and escalation granularity (Corollary 4.2). For simultaneous theaters we show, under normal play, that joint stability is the Nim-sum of the theater-wise escalation distances (Theorem 5.2), a condition that is neither additive nor dominated by the most dangerous theater. We then show the Nim-sum reduction fails under misere play, introduce the misere quotient as its replacement, and prove by exhaustive backward induction that for two-step escalation the quotient is the order-six monoid with generators a, b satisfying a^2=1 and b^3=b, with loss set {a,b^2} (Theorem 6.3). To our knowledge, impartial combinatorial game theory has not previously been applied to nuclear escalation ladders; the existing game-theoretic literature on escalation is classical and payoff-based.

math.CO↗

arXiv2026

Proof of Conjecture 19 of Ballantine, Beck, Merca, and Sagan on Elementary Symmetric Partitions

Ballantine, Beck, Merca, and Sagan conjectured four identities, collectively Conjecture 19, relating the image of the map pre_k on integer partitions to four OEIS sequences. We prove parts (i) and (iii) unconditionally, prove part (iv) unconditionally using the injectivity of pre_2 on partitions of n (Conjecture 1 of the same paper, proved by Li in arXiv:2508.00971), and show that this injectivity is in fact equivalent to part (iv). For part (ii) we prove the partition-theoretic half unconditionally and reduce the remaining content to a 2006 conjecture of Dean Hickerson on the OEIS concerning Huffman coding. We also correct a sign error in the published statement of part (iii): the correct identity is chi(ImP_3(n)) = A213213(n) - 1, not 1 + A213213(n) as stated.

math.CO↗

arXiv2026

A note on partitions in the image of pre$_2$

Devnani and Eyyunni recently studied the maps pre$_k$ on integer partitions, which arise from applying elementary symmetric polynomials to the parts of a partition. They asked whether there exists $n \ge 1$ such that exactly one partition of $n$ lies in the image of pre$_2$. We show that this occurs only for $n$ in {1, 2, 4}, and that for all $n \ge 5$, at least two partitions of n are in the image of pre$_2$.

math.CO↗

arXiv2026

Structural Results for 4 x n Chomp: Unique Extension, Bimodal Asymptotic Structure, and Period-112 Geometry

We present a complete computational tabulation of all 961,619,972 P-positions in 4xn Chomp for n <= 3000, obtained via a new O(n^4) shadow-array sieve that replaces the O(n^5) hash-set approach of prior work. Three structural results are reported. First, we prove the Unique Extension property: for any triple (a,b,c), there is at most one value of d such that (a,b,c,d) is a P-position. The proof is a short contradiction using the move structure of Chomp and generalizes immediately to all k-row Chomp. Second, the P-positions exhibit a persistent bimodal decomposition into two subfamilies, HIGH and LOW, separated by a clean gap in the per-a median of d/a that grows monotonically from 0.040 at n=500 to 0.062 at n=3000, with the HIGH subfamily maintaining a stable density of 56.2% throughout. The previously conjectured global limit d/a -> 2/9 is shown to be a mixture artifact. Third, within each family the two larger row-length ratios satisfy an exact quadratic relation at machine precision, and numerical evidence suggests d/a -> 1/4 in the HIGH family, though a power-law convergence fit gives an asymptote of approximately 0.248 with exponent alpha ~ 0.05, leaving the exact limit open. The LOW family limit L3 ~ 0.183 is not well approximated by 3/16; the best rational with denominator at most 2000 is 20/109. Code and the n <= 500 dataset are available at https://github.com/gargarnav/chomp-4xn-v2.

math.GM↗

arXiv2024

LoRA Land: 310 Fine-tuned LLMs that Rival GPT-4, A Technical Report

Low Rank Adaptation (LoRA) has emerged as one of the most widely adopted methods for Parameter Efficient Fine-Tuning (PEFT) of Large Language Models (LLMs). LoRA reduces the number of trainable parameters and memory usage while achieving comparable performance to full fine-tuning. We aim to assess the viability of training and serving LLMs fine-tuned with LoRA in real-world applications. First, we measure the quality of LLMs fine-tuned with quantized low rank adapters across 10 base models and 31 tasks for a total of 310 models. We find that 4-bit LoRA fine-tuned models outperform base models by 34 points and GPT-4 by 10 points on average. Second, we investigate the most effective base models for fine-tuning and assess the correlative and predictive capacities of task complexity heuristics in forecasting the outcomes of fine-tuning. Finally, we evaluate the latency and concurrency capabilities of LoRAX, an open-source Multi-LoRA inference server that facilitates the deployment of multiple LoRA fine-tuned models on a single GPU using shared base model weights and dynamic adapter loading. LoRAX powers LoRA Land, a web application that hosts 25 LoRA fine-tuned Mistral-7B LLMs on a single NVIDIA A100 GPU with 80GB memory. LoRA Land highlights the quality and cost-effectiveness of employing multiple specialized LLMs over a single, general-purpose LLM.

cs.CL↗