Searcharxiv⌕ Search

arXiv subjects

Bin Xiao

Publications and source records attributed to Bin Xiao.

At least 19 recordsLinked to original sources
arXiv2026

Uncertainty-Aware Prototype Learning for Open-Set Test-Time Adaptation

Open-set test-time adaptation (TTA) aims to adapt source-trained models to unlabeled test streams where covariate-shifted in-distribution (csID) samples and covariate-shifted out-of-distribution (csOOD) samples may coexist. Existing TTA methods are typically designed under a closed-set assumption and therefore lack explicit mechanisms for reliably distinguishing csID from csOOD samples. Consequently, csOOD samples may be mistakenly included in confidence-enhancing adaptation, producing harmful gradients that degrade known-class performance. To address this, we propose Uncertainty-Aware Prototype Learning for Open-Set Test-Time Adaptation (UAPA), a plug-and-play method for reliable open-set adaptation. Specifically, we first introduce Uncertainty-Driven ID/OOD Separation, which combines a classifier-prototype score with a mini-batch-normalized evidence-derived uncertainty score to distinguish csID from csOOD samples. We then propose a Dynamic Prototype Refinement strategy that periodically refines class-specific target prototypes using buffered csID features to progressively follow the estimated class directions. Lastly, we introduce Contrastive Prototype Entropy Adaptation, which applies entropy minimization to csID samples and entropy maximization to csOOD samples, while prototype-level contrastive learning aligns csID features with their corresponding target prototypes and reduces the maximum similarity between csOOD features and known-class prototypes. Empirically, UAPA outperforms the strongest baselines on the CIFAR benchmarks and Tiny-ImageNet-C, improving average OSCR by 2.08 and 1.28 percentage points, respectively.

cs.LG↗
arXiv2026

AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents

Multimodal agents built on large vision-language models are increasingly deployed in open-world settings but remain highly vulnerable to prompt injection. Typographic text-in-image attacks such as FigStep have been evaluated mainly on standalone vision-language models. For agents, user goals, webpage context, and action history make the effect of embedded instructions uncertain, and robustness to behavior-guided, adaptive visual injections remains insufficiently studied. We introduce AgentTypo, a black-box red-teaming framework that launches adaptive typographic prompt injection by embedding optimized text into webpage images. We formulate an attention-guided automatic typographic prompt-injection objective that favors the attacker's expected answer over the clean-page answer, together with task-conditioned visual attention from small question-answering models. A novel black-box optimization method searches text position, contrast, and color. To further strengthen the attack, we develop a multi-LLM system that iteratively refines injection prompts using evaluation feedback and retrieves successful past examples for strategy learning. Experiments on the VWA-Adv and Mind2Web benchmarks show that AgentTypo significantly outperforms state-of-the-art image-based prompt injection attacks. Across seven closed- and open-source model backends, AgentTypo-pro achieves 45%-83% ASR, outperforming the CLIP-based AgentAttack by 29-47% and previous typographic attacks by 25%-37% on VWA-Adv.

cs.CR↗
arXiv2026

UniPCH: A Unified Framework for Cross-Chain Payments via Payment Channel Hubs

Payment channel hubs (PCHs) enable private cross-chain payments, but existing protocols remain difficult to extend across heterogeneous blockchains. Their payment flows often depend on how particular blockchains represent transactions, authorize channel updates, and settle balances. Some protocols do not explain how their channels are implemented on actual blockchains. Supporting a new ledger or execution model requires a corresponding channel realization and may also require protocol adaptation and security analysis. We present UniPCH, a framework with two layers that separates native channel execution from private cross-chain payment logic. The lower UniPC layer defines common state transitions and security requirements. It separates task authorization from confirmation of the complete channel state. We provide realizations for UTXO ledgers and account ledgers that support smart contracts. At the upper layer, we develop selective re-signing blind conditional signatures (S-RBCS) to coordinate conditional authorization across hubs. Using S-RBCS, we construct a payment protocol that coordinates different channels in four phases. Our analysis establishes local UniPC security, griefing resistance, economic atomicity, and session unlinkability. We implement a Go prototype and evaluate the running time and bandwidth of each phase under different network conditions and system parameters. Results show modest computational overhead from the common interfaces. Most evaluated configurations run faster than comparable schemes under network delay. A full refresh ablation shows that reusing valid task evidence reduces computation and communication costs in the account realization.

cs.CR↗
arXiv2026

Distortion-Aware Spatiotemporal Learning for Real-Time Wide-Angle Video Rectification

While wide-angle lenses provide an expanded field of view (FoV), they exhibit severe nonlinear distortion near image boundaries, unnaturally stretching people in these regions. Existing methods mostly focus on facial regions, require high computational costs, and lack temporal modeling, resulting in incomplete full-body rectification, impractical real-time deployment, and noticeable inter-frame shakes. To tackle these issues, we propose \textbf{FastVC}, an efficient full-body video rectification framework driven by distortion-aware spatiotemporal learning. Grounded in lens physics, FastVC introduces a distortion-aware thin-plate spline (DA-TPS) module that nonlinearly remaps control points into a peripheral-dense layout, enabling more accurate geometric fitting without additional computational cost. We further develop a dual-level spatiotemporal learning scheme for causal and stable video rectification. At the model level, neighborhood spatiotemporal attention (NST) aggregates local context and selectively fuses historical features with low overhead. At the optimization level, sparse spatiotemporal supervision applies spatial alignment only to anchor frames, decoupling frame-wise accuracy from temporal stability. Besides, we contribute the first benchmark dataset for wide-angle full-body video correction. Extensive experiments show that FastVC achieves state-of-the-art rectification fidelity and visual stability at 57.0 FPS.

cs.CV↗
arXiv2026

Sealed-bid Auctions on Blockchain with Timed Commitment Outsourcing

Sealed-bid auctions play a crucial role in blockchain ecosystems. Previous works introduced viable blockchain sealed-bid auction protocols, leveraging timed commitments for bid encryption. However, a crucial challenge remains unresolved in these works: Who should bear the cost of decrypting these timed commitments? This work introduces a timed commitment outsourcing market as a solution to this challenge. We first introduce an aggregation scheme for timed commitments, which combines all bidders' timed commitments into one while ensuring security and correctness and allowing a varying number of bidders. Next, we remodel the utility of auctioneers and timed commitment solvers, developing a new timed commitment competition mechanism and combining it with the sealed-bid auction to form a two-sided market. The protocol includes bid commitment collection, timed commitment solving, and payment. Through game-theoretical analysis, we prove that our protocol satisfies Dominant Strategy Incentive Compatibility (DSIC) for bidders and Bayesian Incentive Compatibility (BIC) for solvers, and achieves optimal revenue for the auctioneer among a large class of mechanisms. Finally, in the forced-opening-only model in which bidders cannot self-open, we prove that no mechanism can achieve positive expected revenue for the auctioneer while satisfying DSIC and Individual Rationality (IR) for both bidders and solvers, together with ex-post IR for the auctioneer.

cs.GT↗
arXiv2026

Leveraging Arbitrary Data Sources for AI-Generated Image Detection Without Sacrificing Generalization

The accelerating advancement of generative models has introduced new challenges for detecting AI-generated images, especially in real-world scenarios where novel generation techniques emerge rapidly. Existing learning paradigms are likely to make classifiers data-dependent, resulting in narrow decision margins and, consequently, limited generalization ability to unseen generative models. We observe that both real and generated images intend to form clustered low-dimensional manifolds within high-level feature spaces extracted by pre-trained visual encoders. Building on this observation, we propose a single-class attribution modeling framework that first amplifies the intrinsic differences between real and generated images by constructing a compact attribution space from any single-class training set, either composed of real images or generated ones, and then establishes a more stable decision boundary upon the enlarged separation. This process enhances class distinction and mitigates the reliance on generator-specific artifacts, thereby improving cross-model generalization. Extensive experiments show that our method generalizes well across various unseen generative models, outperforming existing detectors by as much as 7.21% in accuracy and 7.20% in cross-model generalization.

cs.CV↗
arXiv2026

Seeing as Humans Do: Learning from Motion to Segment Anything Without Supervision

The Segment Anything Model (SAM) relies heavily on massive manual annotations, creating a fundamental bottleneck for model scaling. While unsupervised methods attempt to learn object concepts from motion, they typically overfit to moving entities, lacking both multi-granularity understanding and the ability to generalize to static objects. To overcome this, we introduce Motion-Grounded Segment Anything (MoSA), a highly scalable unsupervised framework that learns a transferable objectness prior from unlabeled videos. MoSA operates in three progressive stages: (1) automatically generating multi-granularity motion pseudo-labels from large-scale video data; (2) training a Perceptual Grouping Model (PGM) via contrastive learning to internalize a generalized, appearance-driven concept of objects; and (3) transferring this learned prior into a prompt-guided architecture for segment-anything-style inference on images. Extensive zero-shot evaluations across seven challenging benchmarks (e.g., COCO and ADE20K) demonstrate that MoSA significantly outperforms existing unsupervised methods. Notably, despite using zero manual annotations, MoSA achieves segmentation performance comparable to the fully supervised SAM. Our findings reveal that harnessing large-scale unlabeled motion is a feasible and highly scalable alternative to annotation-driven segment-anything pipelines.

cs.CV↗
arXiv2026

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.

cs.CR↗
arXiv2026

Omni-Flow: A Unified Workflow Orchestration and Distributed KV Cache Sharing Framework for Multimodal Inference

Multimodal models increasingly integrate heterogeneous components, from encoders and LLMs to diffusion models and media decoders. Serving these models efficiently requires flexible workflow orchestration, independent component scheduling, and cross-component state sharing. However, existing multimodal frameworks primarily organize execution as stage-level pipelines, while state ownership remains largely stage-local. We present Omni-Flow, a distributed serving framework built around three cooperating abstractions. Control Flow defines workflows through a Python DSL, organizing heterogeneous components and their dependencies into a unified dataflow graph. The runtime uses these dependencies to determine when each component can execute. Data Flow manages the placement, transfer, and lifetime of shared tensors and paged KV caches across roles, together with same-device weight sharing. Compute Flow matches multimodal conversation histories to reuse KV across turns and integrates framework-managed KV and model-specific sampling with SGLang's execution interfaces. Omni-Flow also enables cross-role prefix-KV reuse between compatible LLM and diffusion components. Together, these abstractions separate model-specific computation from workflow coordination and state management, allowing independently executing roles to share compatible resources through a common programming model. Experiments with Qwen3-Omni show that, across four benchmarks and multiple concurrency levels, Omni-Flow's aggregate job completion time (JCT) is 1.2\% and 4.9\% higher than vLLM-Omni's and SGLang-Omni's, respectively. In a 50-turn multimodal session, Omni-Flow avoids resubmitting accumulated inputs through server-side session state, reducing mean JCT by 7.5\% and 19.3\% relative to vLLM-Omni and SGLang-Omni, respectively.

cs.DC↗
arXiv2026

Trade-Adaptive Aggregation of Probabilistic Financial Forecasts

Financial NLP systems produce probabilistic forecasts from news, reports, and filings. Prediction markets can aggregate these forecasts sequentially, but their fees must reward information without overcharging low-risk updates. Existing quadratic-fee mechanisms use a state-blind bound, while a local-curvature envelope remains conservative because it prices every trade at the largest permitted span. We introduce SpanPM, a prediction-market mechanism that sets the local-curvature multiplier from each trade's realized payoff spread. Its fee dominates exact Bregman exposure trade by trade, preserves no arbitrage, information incorporation, expressiveness, and bounded worst-case loss, and yields a tighter overcharge factor approaching one as trade span vanishes. Repeated global best responses converge to a common belief and become full Newton steps locally, giving quadratic rather than damped-linear convergence. We implement a deterministic bounded one-dimensional multi-basin search, audited against a dense grid. Across paired synthetic experiments, SpanPM improves 20-round consensus error by several orders of magnitude over a fixed-envelope local baseline under the same hard cap. With evolving beliefs, it preserves 96--97\% of the trader surplus achieved with exact Bregman fees while cutting excess fees by 94\% relative to the global quadratic mechanism. These results establish a trade-adaptive prediction-market mechanism for sequential aggregation of probabilistic financial forecasts.

cs.CE↗
arXiv2026

DSPrompt: Dynamic Soft Prompt Defense Against M-RAG Corruption

Multimodal Retrieval Augmented Generation (M-RAG) is increasingly vulnerable to adversarial attacks where malicious data are crafted to produce embeddings that align with benign entries in the vector space, deceiving retrieval and inducing harmful outputs. Existing defenses primarily operate at query time, relying on auxiliary detectors, similarity re-ranking, or feature-consistency checks. However, these approaches suffer from non-trivial inference overhead, generalize poorly to unseen attack strategies, and often assume specific attack distributions. To address this, we propose DSPrompt, a Dynamic Soft Prompt defense framework that directly reshapes the retriever's embedding semantics, without modifying the retrieval pipeline. It inserts few learnable soft prompts into each layer of the visual and textual encoders of a frozen retriever, utilizing a shallow-to-deep length schedule that is adaptive to the capacity in the model layers. These prompts are trained under a dynamic min-max scheme: an online multimodal attacker continually crafts hard adversarial documents against the current retriever, while the defender is updated to push such documents out of the top-k while preserving the ranking and diversity of benign evidence. Because the defended encoder can be pre-computed and indexed exactly as in standard dense retrieval, DSPrompt incurs no additional per-query optimization and introduces fewer than 1% additional parameters. Extensive experiments across four benchmarks and three representative poisoning attacks show that DSPrompt substantially reduces the attack success rate and poison retrieval rate while maintaining near-lossless retrieval utility and generation fidelity, consistently outperforming existing defense baselines at a fraction of their computational cost.

cs.CR↗
arXiv2026

Perspective-Invariant Attack with Enhanced Transferability of Adversarial Examples

Adversarial examples generated on a surrogate deep neural network (DNN) can often successfully fool other black-box DNN models. This cross-model transferability poses serious security threats to DNNs in practical applications. Input transformation techniques are widely used to enhance adversarial transferability by increasing the diversity of input images. However, existing methods primarily rely on local operations with limited degrees of freedom (DOF), such as block-wise shuffling and resizing, overlooking global perspective transformations that naturally arise from viewpoint changes. In this work, we propose a Perspective-Invariant Attack (PIA), which introduces a multi-DOF vertex sampling strategy that systematically covers the perspective transformation hierarchy from 2-DOF translation to 8-DOF projective mapping. By generating geometrically diverse input variations, PIA effectively reduces overfitting of adversarial perturbations to the surrogate model, thereby improving adversarial transferability. We further propose PIA-Mix, a generic extension that maintains a complementary transformation pool and efficiently combines our perspective transformation with auxiliary methods for improved transferability. Extensive experiments involving various DNN architectures, advanced defense mechanisms, and multimodal large language models (LLMs) demonstrate that PIA and PIA-Mix outperform state-of-the-art transfer-based attacks.

cs.CV↗
arXiv2026

ZeroPur: Succinct Training-Free Adversarial Purification

Adversarial purification is a kind of defense technique that can defend against various unseen adversarial attacks without modifying the victim classifier. Existing methods often depend on external generative models or cooperation between auxiliary functions and victim classifiers. However, retraining generative models, auxiliary functions, or victim classifiers relies on the domain of the fine-tuned dataset and is computation-consuming. In this work, we suppose that adversarial images are outliers of the natural image manifold, and the purification process can be considered as returning them to this manifold. Following this assumption, we present a simple adversarial purification method without further training to purify adversarial images, called ZeroPur. ZeroPur contains two steps: given an adversarial example, Guided Shift obtains the shifted embedding of the adversarial example by the guidance of its blurred counterparts; after that, Adaptive Projection constructs a directional vector by this shifted embedding to provide momentum, projecting adversarial images onto the manifold adaptively. ZeroPur is independent of external models and requires no retraining of victim classifiers or auxiliary functions, relying solely on victim classifiers themselves to achieve purification. Extensive experiments on three datasets (CIFAR-10, CIFAR-100, and ImageNet-1K) using various classifier architectures (ResNet, WideResNet) demonstrate that our method achieves state-of-the-art robust performance. The source code is publicly available at: https://github.com/erhul/ZeroPur.

cs.CV↗
arXiv2026

AuditVotes: Elevating Provable Defense for GNNs with Efficient Augmentation and Conditional Smoothing

Despite advancements in Graph Neural Networks (GNNs), adaptive attacks continue to challenge their robustness. Certified robustness via randomized smoothing offers provable guarantees but suffers from a severe accuracy-robustness trade-off, limiting its practical use. To bridge this gap, we introduce AuditVotes, the first framework that simultaneously achieves high clean accuracy and strong certified robustness. AuditVotes seamlessly integrates two novel components into the randomized smoothing pipeline: (1) graph rewiring augmentation, which denoises randomized graphs to recover data quality, and (2) conditional smoothing, which filters low-confidence votes to ensure prediction consistency. We establish a novel theoretical result, proving that certified robustness is preserved under arbitrary filtering functions. Designed for inductive learning, our framework generalizes to unseen nodes and applies broadly to other smoothing schemes, including de-randomized smoothing for graphs and Gaussian smoothing for images. Extensive experiments show AuditVotes delivers substantial gains: on Cora-ML under 20-edge attacks, it improves clean accuracy by 437.1% and certified accuracy by 409.3%, while maintaining comparable runtime to vanilla smoothing. As a widely applicable and efficient plug-in, AuditVotes offers higher accuracy and stronger guarantees, enabling the practical and certifiably robust GNNs in security-sensitive domains.

cs.LG↗
arXiv2026

Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application

With the rapid evolution of the Industrial Internet of Things (IIoT), the boundaries and scale of the Internet are continuously expanding. Consequently, the limitations of traditional certificate-based Public Key Infrastructure (PKI) have become increasingly evident, particularly in scenarios requiring large-scale certificate storage, verification, and frequent transmission. These challenges are expected to be further amplified by the widespread adoption of post-quantum cryptography. In this paper, we propose a novel identity-based public key management framework for PKI based on post-quantum cryptography, termed \textit{IPK-pq}. This approach implements an identity key generation protocol leveraging NIST ML-DSA and random matrix theory. Building on the concept of the Composite Public Key (CPK), \textit{IPK-pq} addresses the linear collusion problem inherent in CPK through an enhanced identity mapping mechanism. Furthermore, it simplifies the verification of the declared public key's authenticity, effectively reducing the complexity associated with certificate-based key management. We also provide a formal security proof for \textit{IPK-pq}, covering both individual private key components and the composite private key. To validate our approach, formally, we directly implement and evaluate \textit{IPK-pq} within a typical PKI application scenario: Resource PKI (RPKI). Comparative experimental results demonstrate that an RPKI system based on \textit{IPK-pq} yields significant improvements in efficiency and scalability. These results validate the feasibility and rationality of \textit{IPK-pq}, positioning it as a strong candidate for next-generation RPKI systems capable of securely managing large-scale routing information.

cs.CR↗
arXiv2026

Efficient and Privacy-Preserving Distribution Statistics Analytics on Mobile Spatial Data

With the rapid development of mobile computing technology, massive amounts of spatial data are continuously generated from various mobile terminals and sensing devices, such as smartphones, connected vehicles, and drones. Performing efficient distributed statistical analysis on this data is crucial for real-time mobile computing applications. However, the constrained and dynamic nature of mobile environments exacerbates the privacy challenge: centralizing sensitive data for analysis risks severe privacy leaks, while existing privacy-preserving techniques often introduce excessive overhead or inaccuracies. In this paper, we design, implement, and evaluate the first system that supports efficient and privacy-preserving distribution statistics analysis for mobile spatial data. First, we propose eSpat-B, which leverages two non-colluding servers and a newly designed improved distributed point functions (DPF) with octree partitioning. Furthermore, considering the frequent updates of spatial data, we propose another more efficient scheme, eSpat+. The core idea of this scheme is to utilize a K-Dimensional tree for spatial partitioning, combine it with incremental DPF for performing statistics analysis, and design an efficient update algorithm. Security analysis demonstrates that our schemes effectively protect data privacy throughout the statistical process. Extensive experiments on real-world trajectory datasets demonstrate that the proposed schemes significantly outperform existing approaches, reducing computation overhead by up to 1.2x and communication overhead by up to 20x while maintaining 100% statistical accuracy.

cs.CR↗
arXiv2026

A Diffeomorphism Groupoid and Algebroid Framework for Discontinuous Image Registration

In this paper, we propose a novel mathematical framework for piecewise diffeomorphic image registration that involves discontinuous sliding motion using a diffeomorphism groupoid and algebroid approach. The traditional Large Deformation Diffeomorphic Metric Mapping (LDDMM) registration method builds on Lie groups, which assume continuity and smoothness in velocity fields, limiting its applicability in handling discontinuous sliding motion. To overcome this limitation, we extend the diffeomorphism Lie groups to a framework of discontinuous diffeomorphism Lie groupoids, allowing for discontinuities along sliding boundaries while maintaining diffeomorphism within homogeneous regions. We provide a rigorous analysis of the associated mathematical structures, including Lie algebroids and their duals, and derive specific Euler-Arnold equations to govern optimal flows for discontinuous deformations. Numerical tests are performed to validate the efficiency of the proposed approach.

math.GR↗
arXiv2026

Layer-dependent quantum transport in KV2Se2O-based altermagnetic tunnel junctions

Magnetic tunnel junction (MTJ) is the key component to enable information access and increasing number of MTJs is integrated to develop high-density spintronic devices. However, continuous miniaturization of the conventional MTJs is hindered by stray magnetic fields. Altermagnets, combining the advantages of both ferromagnets and antiferromagnets, provide a promising alternative to fabricate versatile MTJs with exotic properties, such as giant spin splitting, high intrinsic frequency, and absence of stray fields. Inspired by the altermagnetic metal candidate KV2Se2O reported recently, we design an altermagnetic tunnel junction (AMTJ) based on KV2Se2O/SrTiO3/KV2Se2O. Using density functional theory combined with non-equilibrium Green's function, we investigate the layer-dependent quantum transport properties and the tunneling magnetoresistance (TMR) of such AMTJ device. Our calculated results reveal that the transmission of the AMTJ device exhibits a pronounced oscillation behavior dependent on the number of layers of the SrTiO3 semiconductor, which is attributed to the interface configuration determined by parity of the layer number. In odd-layer devices, the electron-rich O-Se interface exhibits a smooth effective potential and enables transverse momentum (k||) transport channels, leading to enhanced transmission. In contrast, in even-layer devices, the Ti-Se interface presents a steeper effective potential, impeding quantum transport through transverse momentum (k||) channels. A giant TMR of 4.6*10^7% is predicted to be realized by using a 4-layer SrTiO3. Our findings not only provide physical understanding relevant to the quantum transport in AMTJs, but also unveil that the barrier interface engineering is a strategy to tune the magnetoelectric performance.

cond-mat.mes-hall↗