arXiv subjects

Hongcheng Li

Publications and source records attributed to Hongcheng Li.

10 recordsLinked to original sources

arXiv2026

Contracting for Experimentation with Private Findings

A principal hires an agent to work on a project of unknown quality. Success is contractible, but before it occurs, the agent may privately obtain a favorable finding. For example, a scientist developing a drug may observe a promising microscope reading. An informed agent may conceal the finding; an uninformed agent may fake one. The agent's private information could guide both the project's duration and his pay. Yet I show that an optimal contract pays only success bonuses tied to time, not reported findings, consistent with time-based payment schedules often used in research funding. Dynamically arriving private information drives this simplicity: the agent can conceal good news to retain higher bonuses, so deterring concealment limits pay differences across report histories. Bonuses are high and rising in a research stage that induces learning, then fall to a low, constant level in a development stage where only an informed agent continues working. Rising bonuses reflect a novel force: rents from private learning motivate effort but shrink as fewer research periods remain.

econ.TH↗

arXiv2026

Contracting against a Non-contractible Outsider

I study a general framework of contracting with externalities involving a non-contractible outsider. Strategic symmetry between the insider agent and the outsider is the source of multiple equilibria, even when their actions are strategic substitutes. To tackle strategic uncertainty, the principal guarantees a unique equilibrium outcome. A novel duality approach reformulates her problem as the choice of a series of agent expectations about outsider behavior, one for each agent action. The key constraint comes from eliminating undesired equilibria: she cannot convince the agent to expect higher incentives than those generated by the outsider's best responses to the actions she has already conquered. To reduce strategic rents, the principal optimally induces attenuated agent incentives. In supermodular or submodular environments, her coordination power and commitment power are substitutes in determining the contracting outcome, and perfect substitutes under further conditions. On contractual privacy, the principal can strictly prefer private contracting over public contracting, in sharp contrast to the benchmark that ignores robustness. Applications include regulating international competition, platform design, and labor union contracting.

econ.TH↗

arXiv2026

Multiple-Player War of Attrition with Asymmetric Private Values

This paper studies a war of attrition over public good provision among multiple ex-ante asymmetric privately informed players. In equilibrium, asymmetry leads to a stratified behavior pattern in which at most one player provides the public good at time zero with a positive probability, while the other players can become active one after another, each at a player-specific activation time, before which even his highest type does not provide the good. The equilibrium is essentially unique: the types who never provide make the players' costs of providing a saddle point of the equilibrium dynamics. Comparing two players in the same war, I show that the one with lower cost, more impatience, or a value distribution tilted toward high values in the sense of a higher revelation rate provides earlier at every value, other things equal. In large societies, the cost of delay is determined by the highest value across players.

econ.TH↗

arXiv2026

Hidden Commitment Power Is Powerless

A principal who offers a contract may renege when her default option is sufficiently attractive. The size of this temptation, which inversely measures her commitment power, is often the principal's private information. This paper asks how contracting outcomes change under this information asymmetry. Disciplining off-path beliefs with the Intuitive Criterion, I find that every type of principal behaves and earns payoffs as if she were commonly known to have the least commitment power. Hidden commitment power is therefore powerless, although commitment power can be valuable under symmetric information. The result delivers an unambiguous policy lesson on how to mitigate this information asymmetry prior to contracting: only measures that improve the worst case have value. In an application to credit rating, when the cost of a rating system grows with its number of grades, a rating system that sorts issuers into ordered bands is optimal, and each issuer contracts on the terms warranted by the floor of her band.

econ.TH↗

arXiv2026

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prompt injection (IPI) attacks. Existing defenses mainly rely on prompt hardening, content filtering, pre-generated plans, or permission constraints. These approaches often struggle with complex tasks or over-sanitize external content, making it difficult to balance security and utility. The key challenge is therefore to preserve execution flexibility while precisely identifying and removing the malicious content that actually induces unsafe actions. To address this challenge, we propose ActGuard, a pre-execution action auditing framework. Rather than judging whether external content is inherently suspicious, ActGuard assesses whether it causes the current action to deviate from a locally reasonable expectation. At each step, ActGuard predicts the tools likely to be used by the upcoming action and constructs a local tool prior without constraining the execution trajectory. Before execution, it compares the candidate action against this prior and performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations in tool selection and action parameters. A verifier then examines the localized evidence, masks only spans confirmed as malicious, and regenerates the action from the sanitized context. This design preserves legitimate planning flexibility while minimizing information loss from indiscriminate filtering. We evaluate ActGuard on challenging benchmarks for tool-using agents. Results show that ActGuard reduces attack success rates to a level comparable to state-of-the-art defenses while maintaining task utility close to the no-attack setting, achieving a favorable security-utility trade-off. Our code is publicly available at: https://github.com/binzhwang/ActGuard.

cs.CR↗

arXiv2026

Backdoor Sentinel: Detecting and Detoxifying Backdoors in Diffusion Models via Temporal Noise Consistency

Diffusion models have been widely deployed in AIGC services, but their reliance on opaque training data exposes them to backdoor attacks. In practical auditing scenarios, auditors are typically unable to access model parameters due to intellectual property protection, making white-box or query-intensive detection impractical. After detection, existing detoxification approaches are trapped in a dilemma between detoxification effectiveness and generation quality for service providers. We reveal Temporal Noise Consistency (TNC), a previously unreported phenomenon in which backdoor activation disrupts the consistency of noise predictions between adjacent diffusion timesteps within specific temporal segments, while clean inputs remain stable. Based on this finding, we propose TNC-Defense, a closed-loop framework for gray-box backdoor detection and model repair. Specifically, TNC-Detect (for auditors) uses inference-stage adjacent-noise statistics to detect backdoors and precisely localize anomalous timesteps without model-weight access. TNC-Detox (for service providers) utilizes these locations to perform trigger-agnostic, timestep-aware correction of the generation path, suppressing backdoor behavior while reducing detoxification cost. Across five representative backdoor attacks and state-of-the-art defenses, TNC-Defense improves the average detection accuracy by $11\%$ with negligible additional overhead, and invalidates an average of $98.5\%$ of triggered samples with only a mild degradation in generation quality. Our code is publicly available at: https://github.com/binzhwang/TNC-Defense.

cs.CR↗

arXiv2026

Robust Contracting with Career Concerns

We study optimal contracting when workers face career concerns. Labor markets infer ability from performance, but effort affects how informative performance is. This feedback can generate strategic uncertainty: bonuses inducing effort under optimistic beliefs about effort may fail under pessimistic beliefs. We characterize this force through a criterion tied to skill-effort complementarity and solve for the least-cost policy implementing effort in every equilibrium. Under strategic uncertainty, the employer uses dispersed bonuses. High bonuses rule out pessimistic beliefs, raising the reputational stakes and letting lower bonuses motivate effort. Pay dispersion among observationally identical workers grows with career concerns and skill-wage assortativeness.

econ.TH↗

arXiv2025

Robust Pricing for Quality Disclosure

A platform charges a producer for disclosing quality evidence to consumers before trade. It aims to maximize its revenue guarantee across potentially multiple equilibria which arise from the interdependence of producer purchase decisions and consumer beliefs. The platform's optimal pricing strategy entrenches itself as a market gatekeeper: it induces a unique equilibrium in which non-disclosed products' perceived values are lower than the production cost. To achieve this goal, this pricing strategy iteratively destabilizes under-disclosure equilibria by luring producers to disclose slightly more. Higher-quality producers receive higher rents as their disclosure is prioritized. Despite losing rents, the platform optimally induces socially efficient information transmission for any given evidence structure, and it never benefits from garbling evidence. Compared to the non-robust benchmark, our framework generates more intuitive comparative statics: the platform's ability to extract surplus increases with its value as an information intermediary.

econ.TH↗

arXiv2019

Detecting Adversarial Image Examples in Deep Networks with Adaptive Noise Reduction

Recently, many studies have demonstrated deep neural network (DNN) classifiers can be fooled by the adversarial example, which is crafted via introducing some perturbations into an original sample. Accordingly, some powerful defense techniques were proposed. However, existing defense techniques often require modifying the target model or depend on the prior knowledge of attacks. In this paper, we propose a straightforward method for detecting adversarial image examples, which can be directly deployed into unmodified off-the-shelf DNN models. We consider the perturbation to images as a kind of noise and introduce two classic image processing techniques, scalar quantization and smoothing spatial filter, to reduce its effect. The image entropy is employed as a metric to implement an adaptive noise reduction for different kinds of images. Consequently, the adversarial example can be effectively detected by comparing the classification results of a given sample and its denoised version, without referring to any prior knowledge of attacks. More than 20,000 adversarial examples against some state-of-the-art DNN models are used to evaluate the proposed method, which are crafted with different attack techniques. The experiments show that our detection method can achieve a high overall F1 score of 96.39% and certainly raises the bar for defense-aware attacks.

cs.CR↗

arXiv2019

Deep Text Classification Can be Fooled

In this paper, we present an effective method to craft text adversarial samples, revealing one important yet underestimated fact that DNN-based text classifiers are also prone to adversarial sample attack. Specifically, confronted with different adversarial scenarios, the text items that are important for classification are identified by computing the cost gradients of the input (white-box attack) or generating a series of occluded test samples (black-box attack). Based on these items, we design three perturbation strategies, namely insertion, modification, and removal, to generate adversarial samples. The experiment results show that the adversarial samples generated by our method can successfully fool both state-of-the-art character-level and word-level DNN-based text classifiers. The adversarial samples can be perturbed to any desirable classes without compromising their utilities. At the same time, the introduced perturbation is difficult to be perceived.

cs.CR↗