arXiv subjects

Fangzhou Wu

Publications and source records attributed to Fangzhou Wu.

18 recordsLinked to original sources

arXiv2026

Low-Complexity Near-Field Channel Estimation and Subcarrier-Cooperative Hybrid Precoding for Wideband XL-MIMO OFDM Systems

This paper addresses both accurate near-field channel acquisition and scalable precoding for wideband extremely large aperture MIMO (XL-MIMO) OFDM systems, with particular focus on reducing complexity. In the considered system, each MIMO multipath component is characterized by five continuous angle-distance-delay parameters, making conventional sparse recovery methods computationally infeasible while suffering from grid mismatch. We propose a decoupled off-grid channel estimation algorithm based on sequential sparse Bayesian learning (SBL). By exploiting the separable structure of the OFDM near-field atom, the five-dimensional joint search is replaced by a sequence of low-dimensional operations and active-set inference, avoiding multiplicative scaling with the per-dimension grid sizes. A continuous-domain Newton refinement is incorporated based on the exact marginal likelihood to mitigate the grid mismatch. Based on the estimated multipath parameters, we then develop a subcarrier-cooperative hybrid precoding framework for multiuser wideband transmission. A large-scale-matrix-inversion-free alternating optimization algorithm is established to maximize the sum user rate, together with a non-iterative low-complexity design that exploits the parameterized channel structure and provides an effective initialization. Simulation results demonstrate the accuracy of the estimation methods compared to several benchmarks and the effectiveness of the precoding algorithm based on estimated channel parameters.

eess.SP↗

arXiv2026

Near-Field Communications with Different Array Geometries: Rayleigh Distance, Channel Estimation, and Transmission Design

This work establishes a framework of near-field communication under different array geometries of extremely large-scale multiple-input multiple-output (XL-MIMO). We first formulate the near-field spatial non-stationary channel model which is characterized by the distance between the user and each antenna on uniform and modular curved arrays. By fixing the total number of antennas while varying the degree of curvature, we investigate a fair case where the horizontal arc length of the curved array is the same as the planar array. We explicitly unveil the non-trivial impact of array curvature on extending the near-field region for cell edges. Then, for arbitrary array geometries and arbitrary-field channels, we estimate the spatial-domain channel by tackling a compressed sensing problem with a learned regularizer. Without relying on specific codebooks, we propose a denoising autoencoder (AE)-aided approximated message passing (AMP) algorithm and provide the corresponding theoretical replica bound. Finally, based on the estimated channel, we propose an optimization algorithm to maximize the sum user rate for sub-connected XL-MIMO systems by jointly designing the array geometry and hybrid precoding in the downlink. Numerical results demonstrate that the proposed AE-AMP algorithm can effectively estimate the spatial non-stationary near-field channels with robustness and generalities compared to several conventional and deep-learning-based benchmarks. The improvement of data rate by using modular curved arrays with the estimated channel is also validated.

eess.SP↗

arXiv2026

DynMuon: A Dynamic Spectral Shaping View of Muon

In recent years, Muon has emerged as the dominant method for training large language models, and transformers more broadly. The essential difference, when compared to standard gradient descent methods, is to replace the usual update matrix $M=UΣV^\top$ with its polar factor $UV^\top$. In this work, we consider a class of Muon-like updates, where we replace the update $M$ with $UΣ^p V^\top$ for some parameter $p$. We call this a "spectral-shaping" operation, and develop a theory of how to pick $p$ which depends on (a) local curvature of the loss function, (b) noise stemming from stochastic gradients and label noise, and (c) training stage. Our theory and experimentation reveal a previously overlooked behavior: positive $p$ helps early by emphasizing high-curvature directions and accelerating signal contraction, while mildly negative $p$ helps later by reallocating update strength toward low-curvature directions that still contain useful training signals. Building on the insight, we propose DynMuon, an efficient dynamic spectral shaping method that schedules $p$ from positive to mildly negative over training. Extensive experiments across model sizes, architectures, and training settings show that DynMuon consistently achieves lower validation loss than Muon, while requiring 10.6-26.5% fewer steps to reach the same target loss. Our code is available at https://github.com/fzwark/DynMuon.

cs.LG↗

arXiv2026

Capturing LLM Capabilities via Evidence-Calibrated Query Clustering

Query clustering organizes queries into groups that reflect shared latent capability demands, enabling capability-aware LLM evaluation. Existing clustering methods, which primarily rely on semantic taxonomies or embeddings, often fail to capture such latent capability requirements due to a misalignment between surface-level semantics and actual model performance. We propose ECC, an algorithm that calibrates prior semantic embeddings using limited posterior model comparisons to bridge the gap between surface-level semantics and latent capability requirements. ECC characterizes each cluster through a capability profile parameterized by a Bradley-Terry model and uses trainable mixture weights to accommodate queries with mixed capability demands, jointly learning a flexible, capability-aware clustering structure that supports query-specific inference of LLM capabilities. Extensive quantitative and qualitative evaluations demonstrate that ECC significantly improves LLM capability ranking quality, outperforming human-labeled and embedding-based baselines by an average of 17.64 and 18.02 percentage points, respectively, and proves effective in downstream tasks such as query routing.

cs.AI↗

arXiv2026

DynaGraph: Lightweight Multi-Model Interaction Framework via Dynamic Topological Reconfiguration

Tackling complex reasoning tasks typically relies on massive monolithic LLMs, which suffer from severe computational redundancy. While task decomposition through structured pipelines or multi-agent collaborations offers an alternative, these approaches inevitably fall into a critical dilemma: predefined static topologies are highly vulnerable to cascading errors, whereas unconstrained dynamic agents suffer from trajectory divergence and unpredictable memory bloat. To address this, we present DynaGraph, a lightweight multi-model framework driven by dynamic topological reconfiguration. At the execution level, DynaGraph multiplexes time-division PEFT adapters over a shared base model, enabling both full system training and inference deployment on a single consumer-grade GPU. At the routing level, the Evaluator continuously monitors execution confidence to trigger hierarchical self-healing: Fine-grained Patching for localized data gaps and Subgraph Reconstruction for severe logical ruptures. Experiments on StrategyQA, MATH, and FinQA demonstrate our 8B model closely approximates the reasoning capabilities of a 72B monolithic model (e.g., 87.6% on StrategyQA, 82.7% on MATH). Furthermore, it reduces latency by up to 68.1% and token consumption by 68.6% compared to unconstrained dynamic architectures.

cs.MA↗

arXiv2026

Randomization Boosts KV Caching, Learning Balances Query Load: A Joint Perspective

KV caching is a fundamental technique for accelerating Large Language Model (LLM) inference by reusing key-value (KV) pairs from previous queries, but its effectiveness under limited memory is highly sensitive to the eviction policy. The default Least Recently Used (LRU) eviction algorithm struggles with dynamic online query arrivals, especially in multi-LLM serving scenarios, where balancing query load across workers and maximizing cache hit rate of each worker are inherently conflicting objectives. We give the first unified mathematical model that captures the core trade-offs between KV cache eviction and query routing. Our analysis reveals the theoretical limitations of existing methods and leads to principled algorithms that integrate provably competitive randomized KV cache eviction with learning-based methods to adaptively route queries with evolving patterns, thus balancing query load and cache hit rate. Our theoretical results are validated by extensive experiments across 4 benchmarks and 3 prefix-sharing settings, demonstrating improvements of up to 6.92$\times$ in cache hit rate, 11.96$\times$ reduction in latency, 14.06$\times$ reduction in time-to-first-token (TTFT), and 77.4% increase in throughput over the state-of-the-art methods. Our code is available at https://github.com/fzwark/KVRouting.

cs.LG↗

arXiv2025

Efficient Training-Free Online Routing for High-Volume Multi-LLM Serving

Increasing demand for Large Language Models (LLMs) services imposes substantial deployment and computation costs on providers. LLM routing offers a cost-efficient solution by directing queries to the optimal LLM based on model and query features. However, existing works primarily focus on offline scenarios and struggle to adapt to online settings with high query volume and constrained token budgets. In this work, we introduce the first training-free algorithm for online routing scenarios. Our algorithm leverages approximate nearest neighbor search to efficiently estimate query features and performs a one-time optimization over a small set of initial queries to learn a routing strategy that guides future routing. We provide theoretical guarantees demonstrating that our algorithm achieves a competitive ratio of $1 - o(1)$ under natural assumptions, which is further validated by extensive experiments across 3 benchmark datasets and 8 baselines, showing an average improvement of 3.55$\times$ in overall performance, 1.85$\times$ in cost efficiency, and nearly 4.25$\times$ in throughput. Our code is available at https://github.com/fzwark/PORT.

cs.DB↗

arXiv2024

FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks

Large language models (LLMs) have been widely deployed as the backbone with additional tools and text information for real-world applications. However, integrating external information into LLM-integrated applications raises significant security concerns. Among these, prompt injection attacks are particularly threatening, where malicious instructions injected in the external text information can exploit LLMs to generate answers as the attackers desire. While both training-time and test-time defense methods have been developed to mitigate such attacks, the unaffordable training costs associated with training-time methods and the limited effectiveness of existing test-time methods make them impractical. This paper introduces a novel test-time defense strategy, named Formatting AuThentication with Hash-based tags (FATH). Unlike existing approaches that prevent LLMs from answering additional instructions in external text, our method implements an authentication system, requiring LLMs to answer all received instructions with a security policy and selectively filter out responses to user instructions as the final output. To achieve this, we utilize hash-based authentication tags to label each response, facilitating accurate identification of responses according to the user's instructions and improving the robustness against adaptive attacks. Comprehensive experiments demonstrate that our defense method can effectively defend against indirect prompt injection attacks, achieving state-of-the-art performance under Llama3 and GPT3.5 models across various attack methods. Our code is released at: https://github.com/Jayfeather1024/FATH

cs.CR↗

arXiv2024

System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective

Large Language Model-based systems (LLM systems) are information and query processing systems that use LLMs to plan operations from natural-language prompts and feed the output of each successive step into the LLM to plan the next. This structure results in powerful tools that can process complex information from diverse sources but raises critical security concerns. Malicious information from any source may be processed by the LLM and can compromise the query processing, resulting in nearly arbitrary misbehavior. To tackle this problem, we present a system-level defense based on the principles of information flow control that we call an f-secure LLM system. An f-secure LLM system disaggregates the components of an LLM system into a context-aware pipeline with dynamically generated structured executable plans, and a security monitor filters out untrusted input into the planning process. This structure prevents compromise while maximizing flexibility. We provide formal models for both existing LLM systems and our f-secure LLM system, allowing analysis of critical security guarantees. We further evaluate case studies and benchmarks showing that f-secure LLM systems provide robust security while preserving functionality and efficiency. Our code is released at https://github.com/fzwark/Secure_LLM_System.

cs.CR↗

arXiv2024

A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems

Large Language Model (LLM) systems are inherently compositional, with individual LLM serving as the core foundation with additional layers of objects such as plugins, sandbox, and so on. Along with the great potential, there are also increasing concerns over the security of such probabilistic intelligent systems. However, existing studies on LLM security often focus on individual LLM, but without examining the ecosystem through the lens of LLM systems with other objects (e.g., Frontend, Webtool, Sandbox, and so on). In this paper, we systematically analyze the security of LLM systems, instead of focusing on the individual LLMs. To do so, we build on top of the information flow and formulate the security of LLM systems as constraints on the alignment of the information flow within LLM and between LLM and other objects. Based on this construction and the unique probabilistic nature of LLM, the attack surface of the LLM system can be decomposed into three key components: (1) multi-layer security analysis, (2) analysis of the existence of constraints, and (3) analysis of the robustness of these constraints. To ground this new attack surface, we propose a multi-layer and multi-step approach and apply it to the state-of-art LLM system, OpenAI GPT4. Our investigation exposes several security issues, not just within the LLM model itself but also in its integration with other components. We found that although the OpenAI GPT4 has designed numerous safety constraints to improve its safety features, these safety constraints are still vulnerable to attackers. To further demonstrate the real-world threats of our discovered vulnerabilities, we construct an end-to-end attack where an adversary can illicitly acquire the user's chat history, all without the need to manipulate the user's input or gain direct access to OpenAI GPT4. Our demo is in the link: https://fzwark.github.io/LLM-System-Attack-Demo/

cs.CR↗

arXiv2024

WIPI: A New Web Threat for LLM-Driven Web Agents

With the fast development of large language models (LLMs), LLM-driven Web Agents (Web Agents for short) have obtained tons of attention due to their superior capability where LLMs serve as the core part of making decisions like the human brain equipped with multiple web tools to actively interact with external deployed websites. As uncountable Web Agents have been released and such LLM systems are experiencing rapid development and drawing closer to widespread deployment in our daily lives, an essential and pressing question arises: "Are these Web Agents secure?". In this paper, we introduce a novel threat, WIPI, that indirectly controls Web Agent to execute malicious instructions embedded in publicly accessible webpages. To launch a successful WIPI works in a black-box environment. This methodology focuses on the form and content of indirect instructions within external webpages, enhancing the efficiency and stealthiness of the attack. To evaluate the effectiveness of the proposed methodology, we conducted extensive experiments using 7 plugin-based ChatGPT Web Agents, 8 Web GPTs, and 3 different open-source Web Agents. The results reveal that our methodology achieves an average attack success rate (ASR) exceeding 90% even in pure black-box scenarios. Moreover, through an ablation study examining various user prefix instructions, we demonstrated that the WIPI exhibits strong robustness, maintaining high performance across diverse prefix instructions.

cs.CR↗

arXiv2023

DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructions

With the advancement of Large Language Models (LLMs), significant progress has been made in code generation, enabling LLMs to transform natural language into programming code. These Code LLMs have been widely accepted by massive users and organizations. However, a dangerous nature is hidden in the code, which is the existence of fatal vulnerabilities. While some LLM providers have attempted to address these issues by aligning with human guidance, these efforts fall short of making Code LLMs practical and robust. Without a deep understanding of the performance of the LLMs under the practical worst cases, it would be concerning to apply them to various real-world applications. In this paper, we answer the critical issue: Are existing Code LLMs immune to generating vulnerable code? If not, what is the possible maximum severity of this issue in practical deployment scenarios? In this paper, we introduce DeceptPrompt, a novel algorithm that can generate adversarial natural language instructions that drive the Code LLMs to generate functionality correct code with vulnerabilities. DeceptPrompt is achieved through a systematic evolution-based algorithm with a fine grain loss design. The unique advantage of DeceptPrompt enables us to find natural prefix/suffix with totally benign and non-directional semantic meaning, meanwhile, having great power in inducing the Code LLMs to generate vulnerable code. This feature can enable us to conduct the almost-worstcase red-teaming on these LLMs in a real scenario, where users are using natural language. Our extensive experiments and analyses on DeceptPrompt not only validate the effectiveness of our approach but also shed light on the huge weakness of LLMs in the code generation task. When applying the optimized prefix/suffix, the attack success rate (ASR) will improve by average 50% compared with no prefix/suffix applying.

cs.CR↗

arXiv2023

Exploring the Limits of ChatGPT in Software Security Applications

Large language models (LLMs) have undergone rapid evolution and achieved remarkable results in recent times. OpenAI's ChatGPT, backed by GPT-3.5 or GPT-4, has gained instant popularity due to its strong capability across a wide range of tasks, including natural language tasks, coding, mathematics, and engaging conversations. However, the impacts and limits of such LLMs in system security domain are less explored. In this paper, we delve into the limits of LLMs (i.e., ChatGPT) in seven software security applications including vulnerability detection/repair, debugging, debloating, decompilation, patching, root cause analysis, symbolic execution, and fuzzing. Our exploration reveals that ChatGPT not only excels at generating code, which is the conventional application of language models, but also demonstrates strong capability in understanding user-provided commands in natural languages, reasoning about control and data flows within programs, generating complex data structures, and even decompiling assembly code. Notably, GPT-4 showcases significant improvements over GPT-3.5 in most security tasks. Also, certain limitations of ChatGPT in security-related tasks are identified, such as its constrained ability to process long code contexts.

cs.CR↗

arXiv2022

Reliability and Latency Analysis of Sliding Network Coding With Re-Transmission

Future networks are expected to support various ultra-reliable low-latency communications via wireless links. To avoid the loss of packets and keep the low latency, sliding network coding (SNC) is an emerging technology by generating redundant packets that are the linear combination of the original data packets from the current block and some previous blocks. However, how to take the advantage of re-transmission for SNC is still an open problem since higher reliability could be achieved at the expense of large latency caused by round-trip time (RTT). To deal with this issue, in this paper, we consider the idea of adjusting the transmission phase and the number of the redundant packets for SNC with re-transmission. Specifically, If RTT is large, most of the redundant packets are sent at the first transmission, otherwise, re-transmission will be used. We first derive a concise and tight lower bound of the block error probability of SNC without re-transmission. Then, based on the bound, the theoretical expressions of the proposed re-transmission schemes are derived regarding the block error probability, the average code length, and the average packet latency. Results show that the proposed SNC with re-transmission improves block error probability and keeps the low latency.

cs.IT↗

arXiv2022

Towards Efficient Data-Centric Robust Machine Learning with Noise-based Augmentation

The data-centric machine learning aims to find effective ways to build appropriate datasets which can improve the performance of AI models. In this paper, we mainly focus on designing an efficient data-centric scheme to improve robustness for models towards unforeseen malicious inputs in the black-box test settings. Specifically, we introduce a noised-based data augmentation method which is composed of Gaussian Noise, Salt-and-Pepper noise, and the PGD adversarial perturbations. The proposed method is built on lightweight algorithms and proved highly effective based on comprehensive evaluations, showing good efficiency on computation cost and robustness enhancement. In addition, we share our insights about the data-centric robust machine learning gained from our experiments.

cs.LG↗

arXiv2019

Computing and Communicating Functions in Disorganized Wireless Networks

For future wireless networks, enormous numbers of interconnections are required, creating a disorganized topology and leading to a great challenge in data aggregation. Instead of collecting data individually, a more efficient technique, computation over multi-access channels (CoMAC), has emerged to compute functions by exploiting the signal-superposition property of wireless channels. However, the implementation of CoMAC in disorganized networks with multiple relays (hops) is still an open problem. In this paper, we combine CoMAC and orthogonal communication in the disorganized network to attain the computation of functions at the fusion center. First, to make the disorganized network more tractable, we reorganize the disorganized network into a hierarchical network with multiple layers that consists of subgroups and groups. In the hierarchical network, we propose multi-layer function computation where CoMAC is applied to each subgroup and orthogonal communication is adopted within each group. By computing and communicating subgroup and group functions over layers, the desired functions are reconstructed at the fusion center. The general computation rate is derived and the performance is further improved through time allocation and power control. The closed-form solutions to optimization are obtained, which suggest that existing CoMAC and orthogonal communication schemes can be generalized.

cs.IT↗

arXiv2018

Computation Over NOMA: Improved Achievable Rate Through Sub-Function Superposition

Massive numbers of nodes will be connected in future wireless networks. This brings great difficulty to collect a large amount of data. Instead of collecting the data individually, computation over multi-access channel (CoMAC) provides an intelligent solution by computing a desired function over the air based on the signal-superposition property of wireless channel. To improve the spectrum efficiency in conventional CoMAC, we propose the use of non-orthogonal multiple access (NOMA) for functions in CoMAC. The desired functions are decomposed into several sub-functions, and multiple sub-functions are selected to be superposed over each resource block (RB). The corresponding achievable rate is derived based on sub-function superposition, which prevents a vanishing computation rate for large numbers of nodes. In order to gain more insights, we further study the limiting case when the number of nodes goes to infinity. An exact expression of the rate is derived which provides a lower bound on the computation rate. Compared with existing CoMAC, the NOMA-based CoMAC (NOMA-CoMAC) not only achieves a higher computation rate, but also provides an improved non-vanishing rate. Furthermore, the diversity order of the computation rate of NOMA-CoMAC is derived, and it shows that the system performance is dominated by the node with the worst channel gain among these sub-functions in each RB.

cs.IT↗

arXiv2018

Computation over Wide-Band MAC: Improved Achievable Rate through Sub-Function Allocation

Future networks are expected to connect an enormous number of nodes wirelessly using wide-band transmission. This brings great challenges. To avoid collecting a large amount of data from the massive number of nodes, computation over multi-access channel (CoMAC) is proposed to compute a desired function over the air utilizing the signal-superposition property of MAC. Due to frequency selective fading, wide-band CoMAC is more challenging and has never been studied before. In this work, we propose the use of orthogonal frequency division multiplexing (OFDM) in wide-band CoMAC to transmit functions in a similar way to bit sequences through division, allocation and reconstruction of function. An achievable rate without any adaptive resource allocation is derived. To prevent a vanishing computation rate from the increase of the number of nodes, a novel sub-function allocation of sub-carriers is derived. Furthermore, we formulate an optimization problem considering power allocation. A sponge-squeezing algorithm adapted from the classical water-filling algorithm is proposed to solve the optimal power allocation problem. The improved computation rate of the proposed framework and the corresponding allocation has been verified through both theoretical analysis and simulation.

cs.IT↗