SearcharxivSearch

arXiv subjects

Boyang Ma

Publications and source records attributed to Boyang Ma.

15 recordsLinked to original sources

Bad company corrupts good morals: Understanding and Measuring Narrative-Induced Moral Reasoning Degradation in LLMs

Large language models are deployed in long-context, emotionally interactive environments like digital humans, AI companions, educational assistants, and counseling systems. Unlike jailbreak attacks with explicit adversarial prompts, these systems interact with emotionally charged narratives involving bullying, betrayal, loneliness, social hostility, and institutional unfairness. This raises an important question: can prolonged narrative exposure reshape the reasoning and alignment stability of LLMs? We present the first systematic study of narrative-induced alignment degradation in LLMs. We design BreakingBad, a three-stage framework that measures how negative narrative immersion affects moral reasoning, behaviors, and deployment risks. It combines ethical decision evaluation, behavioral probing, and digital-human interaction analysis. Our experiments reveal three findings. First, negative narrative exposure degrades moral accuracy across multiple LLMs, with average drops of 12%-31%, especially in ambiguous scenarios and those involving vulnerable individuals. Second, the degradation is structured: different narratives induce distinct shifts, and first-person narratives produce stronger effects than third-person. Third, these shifts propagate into real deployments. Across counseling, education, medical, and financial/legal scenarios, narrative-conditioned models increasingly normalize hopelessness, cynicism, emotional detachment, and ethically questionable reasoning while remaining superficially policy-compliant. More broadly, our findings suggest alignment robustness is not static but a dynamically conditioned state shaped by long-term semantic environments and interaction history. These results reveal a new class of alignment risk that existing safety defenses largely fail to capture.

cs.CY

"What Happens Locally, Leaks Globally": Detecting Privacy Leakage Risks in MCP Servers

The Model Context Protocol (MCP) has rapidly become the de facto standard for connecting large language models (LLMs) to external resources, but it also introduces a class of privacy risks that existing tools are ill-equipped to detect. Unlike conventional exfiltration bugs, leakage in MCP servers is largely protocol-induced: credentials, API keys, and Personally Identifiable Information (PII) cross the local/LLM boundary simply by being returned, logged, or raised inside a tool handler, with no explicit outbound request in the source code. We present MCPPrivacyDetector, a context-aware cross-language static analysis framework that detects such leakage in multilingual MCP servers. MCPPrivacyDetector lifts heterogeneous code implemented across different programming language (e.g., Python) into a unified program representation, applies context-aware semantic filtering to isolate genuinely sensitive values and protocol-specific implicit sinks (e.g., @mcp.tool handlers), and performs taint analysis to enumerate feasible flows. Applied to 10,655 real-world MCP servers, MCPPrivacyDetector finds leakage rates above 10%. Case studies confirm concrete exposures including leaked Bearer tokens, propagated API keys, and plaintext authentication credentials, arguing for systematic, protocol-aware safeguards in the emerging LLM agent toolchain.

cs.CR

A Measurement Study of Cryptographic Misuse in Embodied AI Mobile Applications

Embodied AI (EAI) mobile applications are evolving from auxiliary user interfaces into active control-path components, directly linking mobile-side cryptographic security to cyber-physical trust. Despite this shift, existing security research predominantly focuses on embodied AI devices and cloud infrastructures, leaving the mobile control layer largely unexplored as a critical attack surface. To bridge this gap, we present the first large-scale measurement study of cryptographic misuse within the EAI mobile ecosystem. We construct EAIAppZoo, a benchmark of 507 real-world applications across six EAI domains, and employ an automated semantic-aware analysis pipeline to measure the prevalence and characteristics of five major cryptographic failure modes. Our measurement yields 12,975 misuse findings (with an evaluated precision of 80.74\%), revealing that these cryptographic failures are driven by EAI-specific engineering constraints rather than random developer errors. We uncover structural security trade-offs: latency-sensitive control paths systematically weaken transport protection, while the heavy reliance on offline device provisioning and legacy IoT SDKs exacerbates the local hardcoding of authentication credentials. Through real-world case studies, we demonstrate how these mobile-side cryptographic flaws bypass nominal network protections, enabling adversaries to intercept command channels and hijack the physical control of EAI entities. Ultimately, our findings highlight that mobile applications have become a fragile, yet overlooked, cryptographic trust boundary in cyber-physical systems.

cs.CR

MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents

Multimodal Large Language Model (MLLM)-based web agents provide practical, high-precision solutions for visual browser automation; however, they inherently expand the attack surface, introducing novel vision-based vulnerabilities. Existing adversarial evaluations targeting these agents frequently rely on permissive threat models and visually conspicuous artifacts. In this paper, we investigate a constrained vulnerability detection setting: a trusted web platform where the evaluator acts solely as an unprivileged third party, such as a merchant or advertiser, controlling only a semantically legitimate, spatially constrained region, such as an ad slot, a sponsored card, or a localized widget. Operating under these realistic constraints, we propose MIRAGE, a novel visual indirect prompt injection framework for targeted next-action hijacking. Our approach leverages diffusion models to generate perceptually benign adversarial images strictly confined to the attacker-controlled boundaries permitted by the trusted service provider. To maximize attack efficacy within such a restrictive setting, we introduce a robust optimization technique combining curvature-aware adversarial diffusion guidance with sparse, dark-pixel residual perturbations. Comprehensive evaluations against prominent MLLM web agent frameworks, specifically SeeAct and OpenClaw, empirically demonstrate the potency, realism, and stealth of our proposed MIRAGE.

cs.CV

Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems

The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision may implicitly grant access to multiple, potentially untrusted callers.Our empirical study reveals that most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication, regardless of the caller. In addition, many MCP servers fail to enforce authentication at the per-tool level, enabling unauthorized access to sensitive operations.These findings demonstrate that one-time authorization and server-level trust significantly expand the attack surface of MCP-based systems, highlighting the need for explicit caller authentication and fine-grained authorization mechanisms.

cs.CR

What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?

Embodied AI systems (e.g., autonomous vehicles, service robots, and LLM-driven interactive agents) are rapidly transitioning from controlled environments to safety critical real-world deployments. Unlike disembodied AI, failures in embodied intelligence lead to irreversible physical consequences, raising fundamental questions about security, safety, and reliability. While existing research predominantly analyzes embodied AI through the lenses of Large Language Model (LLM) vulnerabilities or classical Cyber-Physical System (CPS) failures, this survey argues that these perspectives are individually insufficient to explain many observed breakdowns in modern embodied systems. We posit that a significant class of failures arises from embodiment-induced system-level mismatches, rather than from isolated model flaws or traditional CPS attacks. Specifically, we identify four core insights that explain why embodied AI is fundamentally harder to secure: (i) semantic correctness does not imply physical safety, as language-level reasoning abstracts away geometry, dynamics, and contact constraints; (ii) identical actions can lead to drastically different outcomes across physical states due to nonlinear dynamics and state uncertainty; (iii) small errors propagate and amplify across tightly coupled perception-decision-action loops; and (iv) safety is not compositional across time or system layers, enabling locally safe decisions to accumulate into globally unsafe behavior. These insights suggest that securing embodied AI requires moving beyond component-level defenses toward system-level reasoning about physical risk, uncertainty, and failure propagation.

cs.CR

When Skills Lie: Hidden-Comment Injection in LLM Agents

LLM agents often rely on Skills to describe available tools and recommended procedures. We study a hidden-comment prompt injection risk in this documentation layer: when a Markdown Skill is rendered to HTML, HTML comment blocks can become invisible to human reviewers, yet the raw text may still be supplied verbatim to the model. In experiments, we find that DeepSeek-V3.2 and GLM-4.5-Air can be influenced by malicious instructions embedded in a hidden comment appended to an otherwise legitimate Skill, yielding outputs that contain sensitive tool intentions. A short defensive system prompt that treats Skills as untrusted and forbids sensitive actions prevents these malicious tool calls and instead surfaces the suspicious hidden instructions.

cs.CR

Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions

The Model Context Protocol (MCP) enables large language models to invoke external tools through natural-language descriptions, forming the foundation of many AI agent applications. However, MCP does not enforce consistency between documented tool behavior and actual code execution, even though MCP Servers often run with broad system privileges. This gap introduces a largely unexplored security risk. We study how mismatches between externally presented tool descriptions and underlying implementations systematically shape the mental models and decision-making behavior of intelligent agents. Specifically, we present the first large-scale study of description-code inconsistency in the MCP ecosystem. We design an automated static analysis framework and apply it to 10,240 real-world MCP Servers across 36 categories. Our results show that while most servers are highly consistent, approximately 13% exhibit substantial mismatches that can enable undocumented privileged operations, hidden state mutations, or unauthorized financial actions. We further observe systematic differences across application categories, popularity levels, and MCP marketplaces. Our findings demonstrate that description-code inconsistency is a concrete and prevalent attack surface in MCP-based AI agents, and motivate the need for systematic auditing and stronger transparency guarantees in future agent ecosystems.

cs.CR

Beyond Model Jailbreak: Systematic Dissection of the "Ten DeadlySins" in Embodied Intelligence

Embodied AI systems integrate language models with real world sensing, mobility, and cloud connected mobile apps. Yet while model jailbreaks have drawn significant attention, the broader system stack of embodied intelligence remains largely unexplored. In this work, we conduct the first holistic security analysis of the Unitree Go2 platform and uncover ten cross layer vulnerabilities the "Ten Sins of Embodied AI Security." Using BLE sniffing, traffic interception, APK reverse engineering, cloud API testing, and hardware probing, we identify systemic weaknesses across three architectural layers: wireless provisioning, core modules, and external interfaces. These include hard coded keys, predictable handshake tokens, WiFi credential leakage, missing TLS validation, static SSH password, multilingual safety bypass behavior, insecure local relay channels, weak binding logic, and unrestricted firmware access. Together, they allow adversaries to hijack devices, inject arbitrary commands, extract sensitive information, or gain full physical control.Our findings show that securing embodied AI requires far more than aligning the model itself. We conclude with system level lessons learned and recommendations for building embodied platforms that remain robust across their entire software hardware ecosystem.

cs.CR

Ultrafast optically induced tunneling in narrow metallic gaps from the time dependent density functional perspective

In this work, using the time-dependent density functional theory, we address the electron tunneling triggered by short (single-cycle and several-cycle) optical pulses in narrow metallic gaps under conditions relevant for actual experiments. We identify photon-assisted tunneling with one-photon, two-photon, and higher-order photon absorption, and we discuss the effect of the tunneling barrier, applied bias, and strength of the optical field on transition from photon-assisted tunneling (weak optical fields) to the optical field emission at strong optical fields. The numerical single-electron calculations and an analytical strong-field theory model are used to gain deeper insights into the results of the time-dependent density functional theory calculations. Additionally, our parameter-free calculations allow us to retrieve and explain recent experimental results on optically induced transport in narrow metallic gaps under an applied dc bias.

physics.optics

Clocking and controlling attosecond currents in a scanning tunnelling microscope

Quantum tunnelling of electrons can be confined to the sub-cycle time scale of strong light fields, contributing decisively to the extreme time resolution of attosecond science. Because tunnelling also enables atomic-scale spatial resolution in scanning tunnelling microscopy (STM), integrating STM with light pulses has long been a key objective in ultrafast microscopy, spanning the picosecond and femtosecond domains, with first signatures of attosecond dynamics. However, while sub-cycle dynamics on the attosecond time scale are routinely controlled and determined with high precision, controlling the direction of attosecond currents and determining their duration have remained elusive in STM. Here, we induce STM tunnelling currents using two-colour laser pulses and dynamically control their direction, relying solely on the sub-cycle waveform of the pulses. Projecting our measurement data onto one-electron and many-body theory descriptions reveals a three-step transport process in the non-adiabatic tunnelling regime as the physical mechanism, with a theory-derived current burst duration of 860 as. Despite working under ambient conditions but free of thermal artifacts, we achieve sub-angstr\"om topographic sensitivity and a lateral spatial resolution of 2 nm. This unprecedented capability to directionally control attosecond bursts will enable triggering and imaging ultrafast charge dynamics at the spatio-temporal microscopy frontier of lightwave electronics.

quant-ph

We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems

The Model Context Protocol (MCP) has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad system privileges with minimal isolation or oversight. In this work, we conduct the first large-scale empirical analysis of MCP security risks. We develop an automated static analysis framework and systematically examine 2,562 real-world MCP applications spanning 23 functional categories. Our measurements reveal that network and system resource APIs dominate usage patterns, affecting 1,438 and 1,237 servers respectively, while file and memory resources are less frequent but still significant. We find that Developer Tools and API Development plugins are the most API-intensive, and that less popular plugins often contain disproportionately high-risk operations. Through concrete case studies, we demonstrate how insufficient privilege separation enables privilege escalation, misinformation propagation, and data tampering. Based on these findings, we propose a detailed taxonomy of MCP resource access, quantify security-relevant API usage, and identify open challenges for building safer MCP ecosystems, including dynamic permission models and automated trust assessment.

cs.CR

Improving efficiency and stability for perovskite solar cell with diethylene glycol dimethacrylate modification

The humidity resistance is the key challenges that hinder the commercial application of perovskite solar cells (PSCs). Herein, we propose an ultra-thin acrylate polymer (diethylene glycol dimethacrylate, DGDMA) into perovskite films to investigate the influence of polymerized networks on stability. The monomer molecules containing acrylate and carbonyl groups were selected, and the effects of the polymerized were quantified with different concentration. The experimental results show that, when the concentration of DGDMA is 1 mg/ml, the PCE increases from 18.06% to 21.82%, which is optimum. The monomer molecules with carbonyl groups polymerize, they can chelate with uncoordinated Pb2+ in perovskite films to improve the film quality, reduce the surface defect density to decrease non-radiative recombination, and also significantly enhance the humidity stability of PSCs.

cond-mat.mtrl-sci

Robust strong-field theory model for ultrafast electron transport through metal-insulator-metal tunneling nanojunctions

Ultrafast science studies the dynamics of electrons in matter with extreme temporal precision, typically in the attosecond and femtosecond time domain. Recent experimental and theoretical progress has put metal-insulator-metal (MIM) tunneling nanojunctions in the spotlight of ultrafast science. Waveform-controlled laser fields can induce ultrafast currents in these junctions, opening the door to petahertz electronic operation and attosecond-scale scanning tunneling microscopy (STM). Inspired by our strong-field model for attosecond tunneling microscopy [Boyang Ma and Michael Kr\"uger, Phys. Rev. Lett. 133, 236901 (2024)], here we generalize our model to MIM nanojunctions. We introduce several refinements and corrections, accounting for the image potential inside the gap and boundary effects. Moreover, we also find that the Keldysh parameter alone is insufficient for describing the physics in thin MIM nanojunctions. We introduce a new parameter $\zeta$ that accounts for the effects of the limited size of the junction and provide several interpretations of the parameter that shed new light on the complex physics in the light-driven junction. Most strikingly, we find that for $\zeta > 1$ photon-assisted tunneling is dominating the ultrafast electron transport across the junction, regardless of the value of the Keldysh parameter. Here one or more photons are absorbed and the electron undergoes static tunneling through the barrier. $\zeta < 1$ is required for a regime in which the laser field and the Keldysh parameter dominate the transport. We also discuss the three-step model of electron transport across the nanojunction in the adiabatic regime, the energy cutoff of the transported electrons and the carrier-envelope phase control of the net current. Our theory model provides a rich toolbox for understanding and predicting the physics of ultrafast MIM nanojunctions.

cond-mat.mes-hall

Strong-field theory of attosecond tunneling microscopy

Attosecond observations of coherent electron dynamics in molecules and nanostructures can be achieved by combining conventional scanning tunneling microscopy (STM) with ultrashort femtosecond laser pulses. While experimental studies in the sub-cycle regime are underway, a robust strong-field theory description has remained elusive. Here we devise a model based on the strong-field approximation. Valid in all regimes, it provides a surprising analogy to the standard model of STM. We also show that the intuitive three-step model of attosecond science directly emerges from our model and describe the optimal conditions for attosecond STM experiments.

quant-ph