Searcharxiv⌕ Search

arXiv subjects

Di Wang

Publications and source records attributed to Di Wang.

At least 55 records · Page 3Linked to original sources
arXiv2026

Final Checkpoints Are Not Enough: Analyzing Latent Reasoning Faithfulness Along Training Trajectories

Latent reasoning performs multi-step inference in continuous hidden states, promising more compact and efficient reasoning. However, these opaque states raise a question of faithfulness: whether the latent reasoning steps drive the final answer. Prior work studies this question at selected checkpoints and reports several unfaithful behaviors. This endpoint view leaves how evidence of faithfulness evolves during training unexamined. We track behavioral and activation-based evidence across training using verified counterfactual edits and interventions on the latent reasoning states. We find that high task accuracy can coexist with low counterfactual responsiveness: as accuracy improves, responsiveness can decline, and different latent reasoning approaches follow distinct trajectories. On ProsQA, output sensitivity to norm-noise replacement declines alongside counterfactual responsiveness, although the result depends on the replacement. Across separately trained binary-choice and open-ended GSM settings, intervention sensitivity follows opposite trajectories. These results show that evaluating only a final checkpoint can obscure both when counterfactual responsiveness changes and what the latent states contribute.

cs.LG↗
arXiv2026

VCAR: Training-Free 3DGS Segmentation via View Completeness and Axis-Aware Boundary Refinement

Semantic segmentation in 3D Gaussian Splatting (3DGS) is crucial for advancing 3D scene understanding. Existing methods predominantly rely on feature distillation, which incurs substantial per-scene training overhead and often yields blurred segmentation boundaries. We identify that these boundary artifacts are driven in part by insufficient viewpoint coverage and boundary overflow of anisotropic Gaussian primitives. To address these challenges, we propose VCAR, a training-free coarse-to-fine segmentation strategy based on View Completeness and Axis-aware Boundary Refinement. In the coarse stage, a visibility-based weighted multi-view voting scheme rapidly localizes the target. In the fine stage, an object-centric sphere derived from the coarse result generates supplementary viewpoints via Spherical Spiral Sampling (SSS), allowing multi-view voting on the augmented views to precisely refine object boundaries and suppress irrelevant 3D Gaussians. Moreover, we introduce Axis-aware Boundary Refinement (ABR) to mitigate artifacts from anisotropic primitives. By decomposing the projected 2D covariance into per-axis contributions, ABR identifies the dominant axis responsible for boundary leakage and applies targeted anisotropic compression exclusively along that axis. Extensive experiments on NVOS and LERF demonstrate that VCAR achieves state-of-the-art segmentation accuracy and efficiency without training. Our code is available at https://github.com/DDKK0526/VCAR.

cs.CV↗
arXiv2026

Mitigating Reasoning-Induced Misalignment via Safety-Direction Penalty

Reasoning-Induced Misalignment, where fine-tuning on reasoning data containing no harmful content, including mathematics, code, and problem-solving with chain-of-thought traces can induce harmful behaviors of LLM, posing a serious challenge to the safety of LLM reasoning. Cross-architecture, cross-scale, and cross-dataset checks show that RIM does not always emerge. Previous work attributed RIM to neuron-level entanglement, but did not identify the geometry of the representation space underlying this entanglement or propose a training-time fix. We provide both: a representation-space analysis of RIM and the Safety-Direction Penalty (SDP), which penalizes movement along a learned safety direction during reasoning fine-tuning. The analysis extracts two activation-space directions, one encoding reasoning ability and the other safety behavior. These directions are coupled: fine-tuning that improves reasoning shifts safety representations, and prompts with larger shifts show larger safety degradation. CKA distance ratios and probes locate the safety-decision layers where this shift is most relevant. These findings guide the design of SDP: the coupling motivates penalizing displacement along the safety direction, and the layer localization sets the initial scope. When the initial scope leaves compensatory shifts beyond the penalized layers, the same diagnostics guide iterative expansion. On Qwen2.5-3B and 7B, SDP restores safety while preserving benchmark reasoning performance.

cs.AI↗
arXiv2026

MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoning

Vision-Language models (VLMs) achieve outstanding performance largely due to the amount of training data available on the internet. At the same time, data holders (e.g., artists) urgently need to determine whether their data has been used for model training without authorization, which concerns both intellectual property rights and personal privacy. Data auditing, particularly through membership inference (MI), has attracted attention as a direct tool. This work proposes MemCatalyst, a set of data poisoning tools, aiming to amplify the data auditing performance on VLMs. MemCatalyst employs two strategies: Poisoning Text (PT) and Poisoning Image (PI). MemCatalyst forces VLMs to over-learn specific inconsistencies between image features and textual semantics during training, thereby increasing their susceptibility to membership information auditing. Crucially, the transferability of poisoned samples across different VLM architectures is demonstrated to be effective in the black-box setting. Extensive evaluations using five state-of-the-art data audits on two prominent VLMs demonstrate that MemCatalyst markedly enhances MI AUC scores with a minimal budget of poisoned samples, while maintaining a negligible impact on model performance.

cs.CR↗
arXiv2026

CP asymmetries in $D\to K^0_{S,L}P$ and $D\to K^0_{S,L}V$ decays

$D$ meson decays into neutral kaons involve both Cabibbo-favored and doubly Cabibbo-suppressed amplitudes as well as final-state kaon mixing, providing abundant sources of CP violation. In this work, we analyze CP asymmetries in the $D\to K^0_{S,L}P$ and $D\to K^0_{S,L}V$ decays, where $P$ and $V$ denote pseudoscalar and vector mesons respectively. The formulas of the time-dependent and time-integrated CP asymmetries in these modes are derived, in which the $D^0-\overline D^0$ mixing effects and the $K^0_L$ modes are considered for the first time. The hadronic parameters that determine CP asymmetries are extracted by the global fit of branching fractions within the topological diagram approach. A significant result is that the tension between theoretical predictions and experimental data for the $K_S^0-K_L^0$ asymmetries in $D^0\to K_{S,L}^0ω$ and $D^0\to K_{S,L}^0ϕ$ modes is mitigated. The CP-violating effects arising from the interference between Cabibbo-favored and doubly Cabibbo-suppressed amplitudes with neutral kaon mixing could reach to $\mathcal{O}(10^{-3})$ order in the $D^+\to K^0_Sπ^+$, $D^+_s\to K^0_SK^+$, $D^0\to K^0_Sρ^0$, and $D^0\to K^0_Sϕ$ modes. The difference between the CP asymmetries in the $D^+\to K^0_Sπ^+$ and $D^+_s\to K^0_SK^+$ modes will be available on LHCb and Belle II in the near future.

hep-ph↗
arXiv2026

Shortest-Path Decomposition for Foliage-Robust 3D Tree Modeling and Above-Ground Biomass Estimation from Point Clouds

Estimating above-ground biomass (AGB) from terrestrial laser scanning (TLS) via quantitative structural models (QSMs) is highly accurate under leaf-off conditions, yet major QSM paradigms degrade sharply when foliage is present. The standard remedy, leaf-wood separation, introduces its own errors and complexity. We present topology-driven foliage suppression that replaces explicit leaf--wood classification inside the reconstruction pipeline. On the shortest-path tree of a point-cloud graph, the number of root-to-node paths traversing a node equals the size of its rooted subtree, so path traversal frequency is an exact topological descriptor of branching hierarchy. Three decompositions of the path structure, plus an adaptive frequency threshold at the elbow of frequency growth along each branch, recover the branching hierarchy from a single Dijkstra run. We evaluate it on 90 trees under exclusively leaf-on conditions across tropical TLS and temperate UAV laser scanning (ULS) platforms. On dense tropical TLS it achieves a mean absolute percentage deviation (MAPD) of 17.2% with RMSE 2.37~Mg (RMSE% 34.8%) and an R^2 of 0.956, outperforming the best separation-assisted TreeQSM pipeline (21.2%). Structural analysis confirms that foliage introduces 2.6~cm of mean geometric error (3.8~cm RMS) and preserves the hierarchical volume distribution. On low-density ULS data, MAPD reaches 6.4% with field-measured diameter at breast height (DBH) and 32.3% with DBH inferred allometrically from tree height. All AGB experiments use identical parameter settings. Directly recovering branching hierarchy from shortest-path structure removes a barrier to operational QSM-based forest inventory under leaf-on conditions.

cs.CV↗
arXiv2026

ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions

Recent research on Large Language Model (LLM) safety has widely adopted guardrails to identify unsafe LLM outputs. Existing guardrails typically formulate safety assessment as a deterministic classification task, mapping a discrete token sequence to a discrete safety label. However, this paradigm has two limitations: First, safety assessment is inherently an uncertain problem, particularly during the early generation state. Second, relying solely on discrete token sequences discards the rich probabilistic information embedded in the LLM output distribution. To address these limitations, we propose the first completely probabilistic architecture-agnostic guardrail \textsc{ProbGuard} to leverage the LLM early output distributional signals for estimating and calibrating the safety probability, thereby enabling early stopping of unsafe ongoing outputs. Specifically, given an LLM's generated prefix distribution, we formulate the safety risk as the unsafe probability of its continued generation dynamics and estimate this risk by Monte-Carlo sampling. Through post-training on the distributional signals and calibrated safety risk, \textsc{ProbGuard} achieves the best calibration performance across all nine model--dataset combination settings, reducing the average Brier score and ECE by 79.6\% and 71.9\%, respectively, over the best baseline. \textsc{ProbGuard} further limits the attack success rate to at most 1\% across six representative jailbreak attacks after observing the LLM early output distributions from only the first ten decoding steps.

cs.LG↗
arXiv2026

Dual-Adversarial Safety Alignment: Cultivating Intrinsic Threat Comprehension in LRMs

Large reasoning models (LRMs) achieve remarkable success on complex tasks but remain vulnerable to harmful prompts that induce unsafe outputs. Recent methods align LRMs using direct refusals or safety rationales, yet often focus on prompt patterns rather than intrinsic attack mechanisms. As a result, these pattern-centric alignments struggle to generalize across diverse jailbreaks, compromising adversarial robustness and reasoning utility. We propose AdvSafe, a dual-adversarial framework that enables LRMs to internalize unsafety knowledge by explicitly deconstructing adversarial mechanisms. This moves beyond pattern-dependent traces, fostering robust cognitive defense without compromising reasoning utility. Our pipeline operates via a two-phase adversarial game. First, in adversarial synthesis, an autonomous agent dynamically crafts deceptive jailbreak prompts, adapting its strategies to breach a strong teacher model. Second, in adversarial extraction, the breached teacher executes a cognitive counter-attack. For every successful jailbreak, the teacher unmasks the camouflage, explaining why the attack succeeds and how such prompts can be identified and mitigated. This dual-adversarial process yields a compact reasoning dataset capturing rich, generalizable unsafety knowledge. Student models trained on this dataset implicitly acquire safety alignment through intrinsic threat comprehension. Experiments show that with only 1K synthesized samples, AdvSafe-aligned LRMs achieve significantly stronger jailbreak robustness than existing baselines, with almost no utility degradation. Furthermore, AdvSafe improves robustness against out-of-distribution prompts, demonstrating that learning unsafety knowledge enables a superior robustness-utility trade-off and generalizes beyond seen attack patterns.

cs.LG↗
arXiv2026

Gauss law constraint in A-theory branes

A-theory realizes U-duality symmetry by extending the string worldsheet to a higher dimensional brane worldvolume, in which the worldvolume and the spacetime belong to different representations of the exceptional group. The closure of the brane Virasoro algebra requires the Gauss law constraint. The Gauss law constraint promotes spacetime coordinates to gauge fields and extends the string worldsheet into the brane worldvolume. While the Virasoro constraint is used to reduce the spacetime coordinate, the Gauss law constraint is used to reduce both the worldvolume and the spacetime coordinates. As in conventional gauge theories, the treatment of the Gauss law constraint is a technically important aspect of the quantization of A-theory. We show that the string solution is only consistent solution of the Gauss law dimensional reduction condition for D=3 and 4 cases. This result implies that the physical symmetry of the theory is two-dimensional conformal symmetry, suggesting that the theory admits a string-like quantization. We further construct a string solution that is covariant under the exceptional group symmetry. The relation between this solution and the constant charge parameter appearing in the exceptional σ-model is also discussed.

hep-th↗
arXiv2026

Let Geometry GUIDE: Layer-wise Unrolling of Geometric Priors in Multimodal LLMs

Multimodal Large Language Models (MLLMs) have achieved remarkable progress in 2D visual tasks but still struggle to understand physical space in real-world visual streams. Recently, feed-forward geometric foundation models that implicitly extract geometric priors from visual inputs have offered a promising direction. However, many existing geometry-aware MLLMs extract features from a single deep encoder layer and perform one-shot fusion at the language-model input, potentially overlooking complementary information across geometric encoder layers, limiting access to fine-grained geometric cues, and hindering progressive cross-modal adaptation. To address these limitations, we propose GUIDE (Geometric Unrolling Inside MLLM Early-layers), a progressive framework for integrating geometric priors. GUIDE samples and aligns multi-level features from the geometric encoder and sequentially injects them into the early layers of the MLLM. This design enables the MLLM to continuously access multi-granularity geometric cues and progressively integrate them with visual representations during layer-wise semantic abstraction. GUIDE further introduces a dual context-aware gating mechanism at both the token and layer levels, selectively regulating geometric information to reduce redundant injection and interference with pretrained representations. Extensive experiments on spatial reasoning and 3D scene understanding benchmarks, including VSI-Bench, ScanRefer, and Scan2Cap, validate the effectiveness and cross-task applicability of GUIDE. Our 5B and 9B models achieve average scores of 71.5 and 72.1 on VSI-Bench, respectively.

cs.CV↗
arXiv2026

Dynamic Jailbreaking Attack

Existing gradient-based jailbreak attacks typically optimize a fixed-length adversarial suffix toward a predefined target response with a static optimization strategy. However, this fully static formulation undermines the effectiveness, efficiency and flexibility of gradient-based jailbreaking because (i) A predefined target usually lies in the low-probability region of a safety-aligned LLM's conditional output distribution, forcing the optimization to pursue an unlikely response pattern; (ii) Simple affirmative targets may even mislead LLMs to generate affirmative responses that are not highly relevant to the prompts; (iii) Fixed optimization strategy and suffix length treat all prompts equally, leading to limited attack capability for hard prompts and redundant capacity for easy ones. To address these limitations, we propose Dynamic Jailbreaking Attack (DJA), a parameter-free gradient-based jailbreak framework using dynamic candidate exploration, dynamic relevant targets and dynamic optimization strategy to craft adversarial prompts. In each optimization round, DJA samples multiple candidate target responses directly from the LLM's distribution conditioned on the current adversarial prompt. Among these candidates, DJA employs a multi-objective scorer to select an optimal target that satisfies multi-dimensional criteria such as harmfulness, relevance, and usefulness. Moreover, DJA introduces a parameter-free dynamic optimization strategy that allocates adversarial effort based on real-time feedback, adapting suffix length, candidate sampling capacity, and optimization iterations according to the difficulty of each harmful prompt. In an extensive evaluation of 40 safety-aligned LLMs (12 model families, scaling from 0.5B to 32B), DJA achieves a 100% ASR across all LLMs, requiring only 13.68 optimization rounds on average (10 iterations per round).

cs.CR↗
arXiv2026

Word Recovery in Large Language Models Enables Character-Level Tokenization Robustness

Large language models (LLMs) trained with canonical tokenization exhibit surprising robustness to non-canonical inputs such as character-level tokenization, yet the mechanisms underlying this robustness remain unclear. We study this phenomenon through mechanistic interpretability and identify a core process we term word recovery. We first introduce a decoding-based method to detect word recovery, showing that hidden states reconstruct canonical word-level token identities from character-level inputs. We then provide causal evidence by removing the corresponding subspace from hidden states, which consistently degrades downstream task performance. Finally, we conduct a fine-grained attention analysis and show that in-group attention among characters belonging to the same canonical token is critical for word recovery: masking such attention in early layers substantially reduces both recovery scores and task performance. Together, our findings provide a mechanistic explanation for tokenization robustness and identify word recovery as a key mechanism enabling LLMs to process character-level inputs.

cs.CL↗
arXiv2026

RSVideo: Are Your Vision-Language Models Ready for Remote Sensing Videos?

Remote-sensing videos enable real-time observation of changes in target attributes, short-term activities, and scene evolution. They record motion, actions, interactions, and scene changes that cannot be captured by isolated images. Existing models primarily target single images or discrete temporal observations spanning a long time range. However, a unified evaluation setting for assessing vision-language models on continuous remote-sensing video understanding remains lacking. We introduce RSVideo-10K, a remote-sensing video dataset comprising 10,773 instances, 1.47 million frames, and 17.02 hours of footage, containing both unmanned aerial vehicles and satellite platforms. Its fixed evaluation benchmark, RSVideo-Bench, contains 2,731 test instances and evaluates two complementary aspects of remote-sensing video understanding: L1 Perception and L2 Reasoning, spanning seven capability groups and 17 tasks. Evaluations show that current vision-language models still struggle to recover small local evidence, track short-lived states, and use scene-constrained spatial relations. Based on this analysis, we further propose RSVideo, a reinforcement learning framework for small-target spatiotemporal focusing that selects question-relevant regions across frames and suppresses redundant background tokens. RSVideo achieves a maximum absolute improvement of 9.01% with InternVL3.5-14B and attains the highest accuracy of 40.63% with Qwen3.6-27B across 26 open-source vision-language backbones. Codes will be available at https://github.com/HongjieZhou0329/RSVideo.

cs.CV↗
arXiv2026

Secure Long-Range Autonomous Valet Parking: A Reservation Scheme With Three-Factor Authentication and Key Agreement

Long-range autonomous valet parking (LAVP) is increasingly adopted to alleviate traffic congestion and parking difficulties. For large-scale parking demand, reservation can improve parking management. However, existing schemes mainly focus on parking request verification and parking check-in, and do not adequately protect identity legitimacy and communication security during passenger drop-off and pick-up. To address this problem, we propose SecLAVP, a provably secure three-factor authentication and key agreement protocol for LAVP reservation services. SecLAVP combines passwords, biometrics, and smart cards. With assistance from the drop-off/pick-up point (DP), the passenger and the autonomous vehicle (AV) achieve mutual authentication and establish a session key for secure communication. In the Real-Or-Random (ROR) model, we formally prove that SecLAVP provides session-key security. AVISPA simulations show that SecLAVP resists man-in-the-middle attacks, while informal analysis demonstrates that it satisfies 15 defined security goals. Finally, performance evaluation in terms of communication overhead, computational overhead, and scheduling shows that SecLAVP is feasible for practical deployment.

cs.CR↗
arXiv2026

PNEC-Mamba: Prototype-Guided Positive-Negative Evidence Calibration for Hyperspectral Image Classification

In real-world hyperspectral scenes, pixel representations are often ambiguous due to factors such as spectral similarity, mixed pixels, and local context interference, which may simultaneously encode discriminative evidence and interfering information. Existing methods mainly focus on learning more powerful representations or modeling broader contexts, but rarely investigate whether the learned representations provide reliable evidence or introduce interference into classification decisions. To address this issue, we view hyperspectral image classification from the perspective of pixel-level evidence reliability modeling and propose PNEC-Mamba, a prototype-guided positive-negative evidence calibration framework. The framework progressively establishes semantic references, separates class-related evidence from interference, estimates pixel-level reliability, and performs selective calibration. First, a full-image state-space encoder extracts pixel representations, while dynamic class prototypes provide semantic references that evolve jointly with the feature space. Subsequently, positive and negative evidence is derived from pixel-prototype competition, explicitly separating discriminative cues that support classification from confusing signals associated with competing classes. Based on these evidence relationships, a multi-source uncertainty estimation strategy is introduced to assess pixel-level reliability, enabling stronger evidence calibration for uncertain regions. Finally, a full-resolution consistency refinement step is applied to recover local spatial details and improve boundary coherence in the final predictions. Extensive experiments on three benchmark datasets demonstrate that PNEC-Mamba achieves superior classification performance compared with state-of-the-art methods.

cs.CV↗
arXiv2026

Universal Pansharpening Model

Pansharpening generates the high-resolution multi-spectral (MS) image by integrating spatial details from a texture-rich panchromatic (PAN) image and spectral attributes from a low-resolution MS image. Existing methods are predominantly satellite-specific and scene-dependent, which severely limits their generalization across heterogeneous sensors and varied scenes, thereby reducing their real-world practicality. To address these challenges, we present UniPS, a universal pansharpening model for satellite-agnostic and scene-robust fusion. Specifically, we introduce a modality-interleaved transformer that learns band-wise modal specializations to form reversible spectral affine bases, mapping arbitrary-band MS into a unified latent space via tensor multiplication. Building upon this, we construct a latent diffusion bridge model to progressively evolve latent representations, and incorporate bridge posterior sampling to couple latent diffusion with pixel-space observations, enabling stable and controllable fusion. Furthermore, we devise infinite-dimensional pixel-to-latent interaction mechanisms to comprehensively capture the cross-domain dependencies between PAN observations and MS representations, thereby facilitating complementary information fusion. In addition, to support large-scale training and evaluation, we construct a comprehensive pansharpening benchmark, termed PSBench, consisting of worldwide MS and PAN image pairs from multiple satellites across diverse scenes. Extensive experiments verify that UniPS consistently outperforms state-of-the-art methods, exhibiting superior generalization and robustness across a wide range of tasks.

cs.CV↗
arXiv2026

The Best of Times, the Worst of Times: Moment-Based Analysis of Probabilistic Cost Structures

This paper studies how to compute the moments -- mean, variance, and beyond -- of the cost (e.g., running time) of certain probabilistic programs, in which local costs combine not only additively but also via the extremal operations $\max$ and $\min$. Such costs arise naturally -- for instance, the number of rounds of a contention-resolution protocol, the waiting time of a quantum repeater, and the completion time of a fork-join computation -- but fall outside the scope of moment-based analyses developed for additive costs. The difficulty is that $\max$ and $\min$ are nonlinear: the moments of $\max(X, Y)$ are not determined by those of $X$ and $Y$, so propagating moments alone fails. In contrast, propagating full distributions would suffice, but is computationally intractable. We present a compositional cost analysis for a family of probabilistic programs whose cost structure can be represented as a hierarchical cost expression. The analysis proceeds bottom-up through the hierarchical structure, solving local recurrence equations at each node and summarizing each subproblem with a surrogate distribution. Each surrogate consists of an exact short-time prefix and a compact parametric tail. Our approach computes the mean of the cost distribution with a sound error bound, and systematically lifts to second and higher moments. In addition, precision can be increased by refining the surrogate representation, trading additional computation for tighter bounds. We implemented our method in a tool, called DICKENS, and evaluated its capabilities on three problems: quantum repeater waiting times, RFID collision resolution, and completion times of fork-join computations.

cs.PL↗