arXiv subjects
Publications and source records attributed to Hanwen Liu.
We study compact Hessian manifolds. We prove vanishing of their Euler characteristics. For compact hyperbolic affine manifolds, we deduce that topologically they are periodic mapping tori, and that they admit no Riemannian metric of negative sectional curvature. We then establish a sharp integral inequality characterizing Cheng--Yau metrics. We also construct counterexamples to an incorrect but widely cited assertion of Shima--Yagi.
Modern hearing aids combine noise reduction (NR) with wide dynamic range compression (WDRC) to suppress background interference while compensating for the reduced auditory dynamic range associated with hearing loss. Conventional systems typically process NR and WDRC as separate stages, although the output of NR directly affects the signal levels and envelopes that determine subsequent compression. Recent end-to-end neural approaches can jointly optimize these processes, but their dense computation remains challenging for always-on hearing aids. In this work, we propose SpikeAid, a causal end-to-end spiking neural network (SNN) framework for joint NR and WDRC. SpikeAid consists of an NR-Net that constructs complementary speech and noise representations and a WDRC-Net that estimates the corresponding branch gains, with both components jointly optimized according to the final hearing aid objective. To capture the multiscale temporal structures required by joint NR and WDRC in a computationally efficient manner, we further introduce the Delayed Resonate-and-fire Neuron (DRN), which incorporates bio-inspired heterogeneous dendritic delays and resonating dynamics. Experimental results on the hearing aid task show that SpikeAid improves key objective metrics over cascaded processing and outperforms existing spiking speech-processing baselines. Evaluation on the public Intel Neuromorphic Deep Noise Suppression (N-DNS) Challenge further demonstrates state-of-the-art neuromorphic speech-denoising performance with DRN. Finally, we designed an FPGA-based neuromorphic hardware system for efficient deployment of SpikeAid, where it achieves over two orders of magnitude higher energy efficiency than conventional CPU/GPU implementations, demonstrating its potential for energy-efficient hearing aid applications.
Best-of-N jailbreaking spends a query budget on surface variation, scrambling and recasing a request until one draw lands. We ask what the same search buys when it wraps a structural encoding instead. Against SAGE, a published self-check defense, best-of-N over a code-completion encoding reaches 67, 22 and 15% of behaviors on three open-weight targets, where that encoding fired once reaches at most 4.7% and the published character search at full budget at most 3.0%: 9 to 68 times the sum of the parts, with bootstrap intervals clearing both ingredients on every target. We report the operative figure beside the headline rather than the headline alone: at the actionable severity threshold those cells read 24, 8 and 1 behaviors (95% interval [13, 28], [3, 13], [0, 3]). A 2x2 on Llama-3.1-8B holding encoding and variation apart shows that SAGE and a classifier gate fail to different factors: SAGE is broken by the depth of the encoding (7 -> 67 behaviors at fixed variation) and the gate by the breadth of the variation (13 -> 57 at fixed encoding). Per-draw reporting also overstates robustness, because an attacker who may try N times experiences the maximum over draws while safety results are reported as means: on one target SAGE stops 99.8% of individual draws yet loses at least as many behaviors to a repeat attacker (12) as a classifier gate that stops 95.6% (10). Removing the target's sampling shrinks SAGE's coverage, relative to its own level, by 59, 76, 82 and 29 percentage points more than an undefended control's, against 25, -5, 8 and 2 for a defense whose verdict comes from a fixed shadow model. The design that loses is the one fusing screening and answering into a single generation, so every attacker draw redraws the safety decision as well. The prescription is architectural, not free: do not fuse screening with generation.
When an encoded attack passes a content guard, the guard either never represented the payload's harmful content or represented it and failed to act. End-to-end attack success rate reports one number for both, yet the two have opposite remedies: one is a representational limit that more verdict-level safety training cannot reach, the other is a decision rule that it can. We separate them by reading a guard's own residual stream, using a content probe fitted on plaintext and transferred without refitting to the encoded condition, alongside the verdict logits from the same pass. Licensing that read honestly is most of the problem and is our main contribution. A conventional permutation test admits the decode measurement on most of a 19-condition encoding ladder for each of two open guards. A length-matched null and a floor calibrated on conditions the guard's base model decodes at rate zero reduce it to four conditions each; holding out the items the probe was fitted on removes one more. A further screen constrains the block axis by running plaintext content inside each condition's own wrapper. It removes the largest surviving cell. What remains is a policy failure that survives an item-level holdout on the zero-width encoding for both guards, at 8 and 7 per 100 prompts, against 17 and 23 when the probe is allowed to have seen the prompt it is scoring. It is also confined to one family of surface encodings: where an encoding leaves content linearly recoverable we can separate the two failures, and on genuine ciphers we report the cells as unmeasured rather than as evidence that nothing was decoded. Across every guard and condition pair except two, both unmeasured on the decode axis, blocked without decoding is near zero, so we find little evidence for a pure encoding-format detector under the conditions we test. That cell is the one read we do not repeat under the holdout.
Device recognition is vital for security in wireless communication systems, particularly for applications like access control. Radio Frequency Fingerprint Identification (RFFI) offers a non-cryptographic solution by exploiting hardware-induced signal distortions. This paper proposes HyDRA, a Hybrid Dual-mode RF Architecture that integrates an optimized Variational Mode Decomposition (VMD) with a novel architecture based on the fusion of Convolutional Neural Networks (CNNs), Transformers, and Mamba components, designed to support both closed-set and open-set classification tasks. The optimized VMD enhances preprocessing efficiency and classification accuracy by fixing center frequencies and using closed-form solutions. HyDRA employs the Transformer Dynamic Sequence Encoder (TDSE) for global dependency modeling and the Mamba Linear Flow Encoder (MLFE) for linear-complexity processing, adapting to varying conditions. Evaluation on public datasets demonstrates state-of-the-art (SOTA) accuracy in closed-set scenarios and robust performance in our proposed open-set classification method, effectively identifying unauthorized devices. Deployed on NVIDIA Jetson Xavier NX, HyDRA achieves millisecond-level inference speed with low power consumption, providing a practical solution for real-time wireless authentication in real-world environments. The source code is published on https://github.com/Crazy-Bull/HyDRA.
Deep research tasks require agents to navigate large knowledge spaces, synthesize evidence across many sources, and adapt their plans as findings emerge. Directed acyclic graph (DAG)-based multi-agent systems suit this setting because they support parallel execution and isolate each sub-task within a focused dependency context. Yet existing DAG-based agents instantiate a task-level plan before execution and repair the graph only after failures or missing evidence are observed. This Plan-then-Patch strategy is brittle for deep research: the system commits most strongly when its evidence is weakest, and later revisions waste computation on branches that should not have been planned. We propose DAGent, a DAG-based multi-agent framework with Evaluate-then-Grow incremental planning: an Orchestrator grows the task graph one batch at a time, conditioning each expansion on confidence and uncertainty signals from completed nodes. A hierarchical context layer propagates compact QueryDocs by default while preserving full execution traces for on-demand recall. The recorded DAG topology admits structural RL signals that outcome-only recipes cannot define; DAGRPO, a GRPO adaptation, injects topology-conditioned credit on Executor rollouts and a structural compliance regularization on Orchestrator plans. Across BrowseComp-Plus, GAIA, and xbench-DeepSearch, DAGent surpasses the strongest open-source baseline by 5.3 / 5.8 / 2.0 points at the Qwen3-235B-A22B scale, and the lead replicates across four open-source backbones and extends to GPT-5 at 327K context. At the Qwen3-8B scale, DAGRPO improves over a same-budget outcome-only GRPO baseline by 3.0 average Pass@1 points. A same-architecture comparison shows that evidence-conditioned planning reaches higher accuracy at lower per-task token, tool-call, and step footprints than its Plan-then-Patch counterpart. Code: https://github.com/hanwenliu6825/DAGent
Safety classifiers ("guards") are the dominant black-box defense for vision-language models, yet a guard judges an input's surface form, not its meaning: a harmful request re-encoded as set theory, formal logic, a classical language, code, or text rendered inside an image slips past a guard that would block it in plain language - the decode gap. The standard fix is a preprocessor that recovers image content and decodes the encoding before the guard. We build one and evaluate it against an ensemble of eleven encoding attacks - six published implementations, one standard encoding baseline, one adapted and three author-constructed renders - counting a behavior as broken if any attack succeeds. Restoring a view the guard never had is what buys coverage - block rates on image renders go from exactly zero to 67-90% - and what it costs in benign traffic is set by the guard, not by the mechanism: one guard pays 9 benign blocking points for the same 70-point gain another pays 69 for. It still does not make the system safer: against an attacker free to choose among eleven encodings, closing one channel relocates the success rather than removing it, and no ensemble contrast for that step survives multiple-comparison correction. What does lower ensemble attack success is a reguard step that re-screens the recovered pre-decode surface, and it is the one every guard pays for: it raises benign over-refusal on all ten guard-target pairs, where restoring a single channel raises it on some and not others. Across the full guard x target x condition factorial, no configuration reaches an ensemble attack-success rate at or below 40% while holding benign over-refusal under 70%. That empty region is a property of the configurations we sample, not a bound on what recovery-based defenses can reach, and we breach its safety half ourselves.
We show that aligned vision-language models also condition refusal on a property of a request's form: whether an image is attached, holding everything the request asks fixed. Attaching a blank canvas, an image that cannot be read, cannot relate to the request, and is byte-identical across every prompt in its condition, shifts benign refusal by tens of points. The shift is not blanket caution but a threshold shift: genuinely neutral instructions are almost unaffected (<=2 percentage points on three of four hosted models) while borderline-benign prompts move +23 to +51 points, so the cost falls on sensitivity-adjacent traffic, meaning benign questions about privacy, self-harm, violence and illegal activity. There is a benign reading of such a threshold, namely that attachment correlates with risk in real traffic, and we take it seriously; a black-box study cannot measure that correlation and we do not claim to. What it can test is whether the response to attachment is robust to variation carrying no information about the request, and on four independent measurements it is not. It varies with canvas colour and pixel count. Its sign inverts across checkpoints. It survives an explicit instruction to disregard the image. And on one model it fires on a bare assertion that an attachment exists, with nothing attached and the modality word contributing none of it. Finally we price it. On a matched harmful set the same canvas does lower attack success, so the cue buys something. But the charge is decoupled from the purchase: the checkpoint with the least harmful headroom we measure, completing only 2% of plain harmful requests, still pays the benign cost in full, and across our models the harmful-side denominator falls as alignment improves while the benign cost does not track it down. Image presence is not a conservative default that a deployer chose and priced. It is an uncontrolled variable.
Encoded-prompt attacks are evaluated almost entirely on their harmful arm: a benchmark sends obfuscated harmful requests and reports how often the model complied. A high refusal rate there is reported as safety, and it is equally consistent with a model that has stopped telling the request apart from anything else in the same format. We run the benign arm through the same transformation, and the two cases are far apart. Across four 7-8B models spanning three base families and four post-training recipes, refusal of harmful homoglyph-encoded prompts spans 0.08 while the same four span 0.57 on the identical requests in plaintext. What the encoding destroys is not refusal but the harm gap: on one model the gap between harmful and benign refusal falls from +0.82 in plaintext to exactly 0.00 under the encoding, and a benchmark reading only the harmful arm scores that model and one retaining a +0.61 gap identically. Running the cell such benchmarks leave out (plaintext content wearing the attack template, with nothing obfuscated) shows that on two of the four models the loss is caused by the protocol rather than by the character transformation, and on a third by the characters. Across a full SFT -> DPO -> RLVR pipeline the harm gap rises by +0.26 with a paired interval excluding zero while the standard harmful-arm metric registers no resolved change at all. We report twelve instrument defects, each with the control that caught it, including a binary jailbreak judge that fires on 0.61-0.70 of responses to plaintext benign prompts; six of the twelve inflate apparent safety, which is the direction a broken safety evaluation fails in by default.
We establish quantitative comparisons between the Laplace--Beltrami spectra of Kähler metrics of equal area on a compact Riemann surface. An estimate in terms of the oscillation of a potential gives bounds for fractional powers of reciprocal eigenvalues and explicit intervals for eigenvalue ratios. Bounds involving the gradient and Laplacian of the potential give further comparisons. On the Riemann sphere, we obtain estimates for individual eigenvalues, reciprocal sums and counting functions. For a Kähler metric on the unit 2-sphere which is centered in the sense that the unit normal vector field integrates to zero, the Dirichlet energy of the potential yields quantitative improvements of Hersch's bounds for the first positive eigenvalue and the sum of the first three reciprocal eigenvalues.
For a closed oriented Riemannian $4$-manifold $(M,g)$, we consider $\operatorname{SO}(3)$ connections on the bundle $Λ^+$ of self-dual $2$-forms. On the open locus where the self-dual curvature is an orientation-preserving frame, pointwise polar decomposition removes the gauge freedom and replaces the connection by a positive self-adjoint endomorphism field $h$ of $Λ^+$. Using the classical reconstruction of the compatible connection $A(h)$, we obtain a global formulation of the Yang--Mills equation as the determined second order system $$ Φ_g(h):=F_{A(h)}^+h^{-1}-\operatorname{Id}=0. $$ Here, the tensor $F_{A(h)}^+$ is the self-dual curvature of $A(h)$, regarded as an endomorphism of $Λ^+$, and $\operatorname{Id}$ is the identity of $Λ^+$. We establish a variational formulation, automatic irreducibility, elliptic regularity, and a Fredholm index theorem for the linearized operator $D_hΦ_g$. For fields of the form $h=e^{2ω}\operatorname{Id}$, where $ω$ is a smooth real-valued function on $M$, the equation $Φ_g(h)=0$ is equivalent to anti-self-duality and constant scalar curvature $6\sqrt{2}$ of the conformal metric $\hat g=e^{2ω}g$. Consequently, every anti-self-dual conformal class of positive Yamabe constant gives a global solution of $Φ_g(h)=0$.
The Dinew--Popovici functional is an energy functional for Hermitian symplectic metrics in a fixed Aeppli cohomology class. Its vanishing characterizes the Kähler metrics in that class, providing a variational approach to Kähler geometry. Dinew and Popovici proved that every critical point is Kähler in complex dimension three. We give a negative answer to Erfan Soheil's question about higher dimensions by constructing non-Kähler critical metrics on products of two Kähler surfaces $(S_1,η_1)$ and $(S_2,η_2)$. These metrics are critical under every variation on the product 4-fold. We characterize the critical product metrics and prove that non-Kähler critical products exist in the Aeppli class $[η_1+η_2]_A$ precisely when the canonical bundles of the two surface factors are smoothly trivial. As a by-product, we develop a geometric flow driven by the torsion tensor and converging to the fixed Kähler background when this background metric has nonnegative holomorphic bisectional curvature.
Large-language-model (LLM)-based text-to-speech (TTS) systems can generate natural speech, but most are not designed for low-latency dual-streaming synthesis. High-quality dual-streaming TTS depends on accurate text--speech alignment and well-designed training sequences that balance synthesis quality and latency. Prior work often relies on GMM-HMM based forced-alignment toolkits (e.g., MFA), which are pipeline-heavy and less flexible than neural aligners; fixed-ratio interleaving of text and speech tokens struggles to capture text--speech alignment regularities. We propose CTC-TTS, which replaces MFA with a CTC based aligner and introduces a bi-word based interleaving strategy. Two variants are designed: CTC-TTS-L (token concatenation along the sequence length) for higher quality and CTC-TTS-F (embedding stacking along the feature dimension) for lower latency. Experiments show that CTC-TTS outperforms fixed-ratio interleaving and MFA-based baselines on streaming synthesis and zero-shot tasks.
As a close relative of the Jacobian conjecture, the Hessian conjecture in dimension $n$ states that the local Legendre transform of a polynomial solution to the Monge--Ampère equation $\det(\operatorname{Hess}(ϕ))=\pm1$ is also a polynomial solution. The general Hessian conjecture is false for $n\geq5$, while in Riemannian signature it follows from the Jörgens--Calabi--Pogorelov theorem. We study the four-dimensional Hessian conjecture in Lorentzian signature. For a polynomial potential $ϕ$ in four real variables whose Hessian matrix has index $1$ and determinant $-1$, we define a constant pivot for $ϕ$ to be a nonzero constant vector $ξ$ such that the second directional derivative $D_ξ^2ϕ$ is constant. We then prove that the gradient mapping of every potential admitting a pivot is a polynomial automorphism, and that a pivot always exists when $ϕ$ decomposes into homogeneous pieces as $ϕ=ϕ_d+ϕ_{d-1}+ϕ_2+ϕ_1+ϕ_0$ with $d\geq4$. More generally, we prove the same conclusion when $$ϕ=ϕ_d+\cdots+ϕ_{d-k}+ϕ_2+ϕ_1+ϕ_0,$$ where $k\geq0$ and $d\geq4k+3$. Then, we associate with each potential a linear system of quadrics, called the Hesse system, and a canonical homomorphism $μ_ϕ$. We prove that the existence of a pivot is equivalent to $\operatorname{rank}(μ_ϕ)\leq55$. As an application, we prove that the gradient mapping is a polynomial automorphism whenever the Hesse system has complex dimension at most 4. We also show that if ${\det(\operatorname{Hess}(ϕ-ϕ_2))\equiv0}$, then the potential $ϕ$ admits a pivot. After that, we then give an analytic degeneracy criterion for $\operatorname{Hess}(ϕ-ϕ_2)$. Finally, we prove the Hessian conjecture in this setting for every polynomial potential of degree at most five.
Every solution of the hyperbolic Toda equation determines a classical Abelian monopole on a (2+1)-dimensional Einstein--Weyl space. We determine when its connection is also a source-free electromagnetic potential on a curved Lorentzian 3+1 spacetime with a spacelike Killing field. On the generic branch, Maxwell's equation classifies the admissible Killing-fibre scale and horizontal twist through one characteristic of the Toda field. A separated Liouville branch gives purely magnetic fields with considerably freer fibre geometry. The round spherical solution yields a monopole of unit charge with conserved flux on a contracting screen. The background metric here is neither assumed to be Einstein nor self-dual.
Spiking Neural Networks (SNNs) hold great potential to realize brain-inspired, energy-efficient computational systems. However, current SNNs still fall short in terms of multiscale temporal processing compared to their biological counterparts. This limitation has resulted in poor performance in many pattern recognition tasks with information that varies across different timescales. To address this issue, we put forward a novel spiking neuron model called Parallel Multi-compartment Spiking Neuron (PMSN). The PMSN emulates biological neurons by incorporating multiple interacting substructures and allows for flexible adjustment of the substructure counts to effectively represent temporal information across diverse timescales. Additionally, to address the computational burden associated with the increased complexity of the proposed model, we introduce two parallelization techniques that decouple the temporal dependencies of neuronal updates, enabling parallelized training across different time steps. Our experiments across a wide range of pattern recognition tasks demonstrate that PMSN outperforms state-of-the-art spiking neuron models in temporal processing capacity and training speed. Specifically, compared with the commonly used Leaky Integrate-and-Fire neuron, PMSN offers more than 10 times acceleration and a 30% accuracy improvement on Sequential CIFAR-10 dataset, while maintaining comparable computational cost. Our implementation on neuromorphic hardware further demonstrates the deployability of PMSN and highlights its favorable trade-off between effectiveness and efficiency. Therefore, the proposed PMSN presents a promising solution to harness the computational advantages of detailed biological neurons, enabling high-performance and efficient temporal processing on neuromorphic computing systems. Code is available at https://github.com/xychen-comp/PMSN.
While CXL presents a promising hardware substrate for Distributed Shared Memory (DSM), seamlessly scaling multithreaded applications across multiple nodes remains a formidable challenge. Existing CXL-based DSMs fall short: they require manual code modifications to share non-heap data, employ rigid data placement policies that fail under diverse and dynamic workloads, and suffer from severe page-fault processing overheads in sub-microsecond ($μ\mathrm{s}$) environments. We present xDSM, a full-space, elastic DSM system built over CXL that transparently scales unmodified multithreaded applications. To eliminate the burden of manual code rewrites, xDSM employs an OS-runtime co-design that establishes a globally coordinated address space, seamlessly sharing all memory segments. To mask CXL access penalties, xDSM abandons static placement rules in favor of a dynamic, latency-driven policy that actively balances data between local DRAM and CXL memory. Finally, to resolve the fundamental tension between high base-page fault overheads and severe huge-page false sharing, xDSM introduces spatial locality-aware elasticity, dynamically coalescing and splitting pages on the fly to amortize processing costs. Evaluated across diverse workloads using 15 system configurations, xDSM outperforms CXL-only baselines by 1.5$\times$ to 2.2$\times$ and state-of-the-art hybrid DSMs by 1.1$\times$ to 2.2$\times$, while achieving near-linear scalability.
We provide a resolution to the non-Abelian Rainich problem. By canonically identifying traceless symmetric $(0,2)$-tensors with Hermitian forms on the vector bundle of chiral 2-forms, we define the internal square roots of a stress-energy tensor. We then prove that the existence of a local $\operatorname{SU}(2)$ Yang-Mills field with prescribed stress-energy tensor $T$ is equivalent to a single differential condition on internal square roots of $T$.