arXiv subjects

Jiacheng Liang

Publications and source records attributed to Jiacheng Liang.

At least 19 recordsLinked to original sources

arXiv2026

Generalized Telescope Conjecture

We introduce the atomic smashing frame, extending the Balmer spectrum from tensor-triangular geometry to an arbitrary presentably symmetric monoidal $\infty$-category $\mathcal{V}$. This yields a formulation of the telescope conjecture for $\mathcal{V}$ and recovers the classical Balmer spectrum in the stable compactly-rigidly generated case. Exploiting dualizable and rigid $\infty$-categories, we establish a correspondence between smashing ideals and locally rigid localizations. This leads to a recollement theorem for smashing frames in the (pre)stable setting, together with an atomic refinement in the stable compactly-rigidly generated case. As a major application to chromatic homotopy theory, we show that the natural projections induce an embedding of the smashing frame of $\mathrm{Sp}$ into the product of the smashing frames of the monochromatic layers $\mathrm{Sp}_{T(n)}$, over all primes and heights. In particular, the spatiality of the smashing frame of $\mathrm{Sp}$ reduces entirely to that of $\mathrm{Sp}_{T(n)}$. In the unstable setting, we characterize the telescope conjecture for $\infty$-topoi in terms of smashing fields, and for connective module categories and hypercomplete connective sheaves in terms of Pierce-type conditions. Finally, we introduce the Serre smashing frame. Over a connective $\mathbb{E}_\infty$-ring $R$, this frame sits between the atomic and usual smashing frames, providing an intermediate structural layer in the study of the telescope conjecture for the connective $R$-module category.

math.AT↗

arXiv2026

Higher algebra in $t$-structured tensor triangulated $\infty$-categories

We generalize fundamental notions of higher algebra, traditionally developed within the $\infty$-category of spectra, to presentably symmetric monoidal stable $\infty$-categories equipped with compatible accessible $t$-structures, which we call $ttt$-$\infty$-categories. Under a natural structural condition, which we call ``projective rigidity'', we establish higher categorical analogues of Lazard's theorem and prove the existence and universal property of Cohn localizations. Furthermore, we generalize higher almost ring theory to the $ttt$-$\infty$-categorical setting, showing that $π_0$-epimorphic idempotent algebras are in natural bijection with idempotent ideals. Additionally, by exploiting deformation theory, we establish a general \text{\text{é}}tale rigidity theorem. Finally, we characterize the moduli of such projectively rigid $ttt$-$\infty$-categories and show that the $\infty$-category of $\mathrm{Sp}$-valued presheaves on the $1$-dimensional framed cobordism $\infty$-category is universal among them.

math.CT↗

arXiv2026

Dualizable Additive Categories

We develop a comprehensive theory of dualizable additive categories. We provide several equivalent characterizations, notably identifying them as separated Grothendieck prestable categories satisfying the $\mathrm{AB4}^*$ and $\mathrm{AB6}$ axioms. We establish a connection to almost mathematics by demonstrating that they arise precisely as the categories of connective almost modules over connective $\mathbb{E}_1$-rings. Furthermore, we prove that dualizable additive categories are generated by flat objects, and that the passage to flat objects yields an equivalence between dualizable additive categories and compactly assembled additive categories. As a primary application within analytic geometry, we characterize the category $\mathrm{Nuc}(R)_{\geq 0}$ of connective nuclear modules (in the sense of Clausen--Scholze) over an adic $\mathbb{E}_\infty$-ring $R$ via a universal property, identifying it as the additive rigidification of the category of connective complete $R$-modules. Finally, we construct the universal finitary stable localizing invariant for dualizable additive categories, the presentable stable category $\mathcal{M}\mathrm{ot}_{\mathrm{pst}}$ of prestable motives, and demonstrate that its unit corepresents nonconnective algebraic $K$-theory. We prove that the motives of small additive categories and those of dualizable additive categories generate the same presentable stable subcategory.

math.AT↗

arXiv2026

LaCache: Robust Semantic Caching for LLM Serving

Semantic caching, which reuses responses to semantically similar requests via their embeddings, has seen growing adoption in LLM serving, offering faster responses and reduced costs. Yet existing schemes are fundamentally vulnerable to cache-collision attacks, wherein an adversary pollutes the cache by injecting crafted queries, corrupting responses to subsequent legitimate requests. We present LaCache, a novel semantic caching scheme that addresses this vulnerability through a conceptually simple yet principled redesign. The key insight is that while the adversary has full control over the adversarial query, it has far less control over its response, which must simultaneously satisfy multiple semantic constraints. Rather than checking only the cache hit of a query, LaCache additionally checks the cache hit of its first k (speculatively) decoded tokens. This design yields two concrete benefits. First, it provides formally guaranteed resilience against cache-collision attacks: we prove that it is impossible to craft adversarial queries that simultaneously elicit malicious responses and collide with benign queries. Second, the enriched index supplies additional semantic context for cache retrieval, improving response relevance. Empirical evaluation across diverse LLMs and benchmarks validates both LaCache's security guarantees and efficiency gains, pointing to a promising direction for robust semantic caching.

cs.AI↗

arXiv2026

Smashing, Balmer, Zariski spectra: an ideal approach

We introduce the Zariski frame of any presentably symmetric monoidal $\infty$-category. This allows us to unify several spectral theories arising in higher algebra. The Zariski frame is coherent whenever the category is compactly generated, and the associated spectral space recovers both the classical Zariski spectrum of a commutative ring and the Hochster dual of the Balmer spectrum of a commutative $2$-ring. Moreover, the smashing frame of any stable presentably symmetric monoidal $\infty$-category can be identified with the Zariski frame of its category of dualizable modules. This construction is based on the principle that ideals in a symmetric monoidal $\infty$-category should be understood as monomorphisms into the unit object. In suitable contexts, this notion recovers the kinds of ideals appearing in the preceding examples, including thick ideals and smashing ideals, and it also accommodates the smashing ideals of non-stable $\infty$-categories. We also study the problem of forming quotients by ideals, which is subtle in the setting of higher algebra. To address this, we introduce two properties of pointed $\infty$-categories, called $Σ$-triviality and $Σ$-exactness. These conditions ensure that quotienting by ideals behaves well. As an application, we construct quotients of $\mathbb{E}_\infty$-semirings.

math.AT↗

arXiv2026

MAGE: Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory

As large language model (LLM)-powered agents are increasingly deployed to perform complex, real-world tasks, they face a growing class of attacks that exploit extended user-agent-environment interactions to pursue malicious objectives improbable in single-turn settings. Such long-horizon threats pose significant risks to the safe deployment of LLM agents in critical domains. In this paper, we present MAGE (Memory As Guardrail Enforcement), a novel defensive framework designed to counter a wide range of long-horizon threats. Inspired by the "shadow stack" abstraction in systems security, MAGE maintains a dedicated, safety-focused agentic memory that distills and retains safety-critical context across the agent's full execution trajectory, leveraging this shadow memory to proactively assess the risk of pending actions prior to their execution. Extensive evaluation demonstrates that MAGE substantially outperforms existing defenses across diverse long-horizon threats in detection accuracy, achieves early-stage detection for the majority of attacks, and introduces only negligible overhead to agent utility. To our best knowledge, MAGE represents the first framework to detect and mitigate long-horizon threats using an agentic memory approach, establishing a new paradigm for this critical challenge and opening promising directions for future research.

cs.CR↗

arXiv2026

ARES: Adaptive Red-Teaming and End-to-End Repair of Policy-Reward System

Reinforcement Learning from Human Feedback (RLHF) is central to aligning Large Language Models (LLMs), yet it introduces a critical vulnerability: an imperfect Reward Model (RM) can become a single point of failure when it fails to penalize unsafe behaviors. While existing red-teaming approaches primarily target policy-level weaknesses, they overlook what we term systemic weaknesses cases where both the core LLM and the RM fail in tandem. We present ARES, a framework that systematically discovers and mitigates such dual vulnerabilities. ARES employs a ``Safety Mentor'' that dynamically composes semantically coherent adversarial prompts by combining structured component types (topics, personas, tactics, goals) and generates corresponding malicious and safe responses. This dual-targeting approach exposes weaknesses in both the core LLM and the RM simultaneously. Using the vulnerabilities gained, ARES implements a two-stage repair process: first fine-tuning the RM to better detect harmful content, then leveraging the improved RM to optimize the core model. Experiments across multiple adversarial safety benchmarks demonstrate that ARES substantially enhances safety robustness while preserving model capabilities, establishing a new paradigm for comprehensive RLHF safety alignment.

cs.AI↗

arXiv2026

AutoRAN: Automated Hijacking of Safety Reasoning in Large Reasoning Models

This paper presents AutoRAN, the first framework to automate the hijacking of internal safety reasoning in large reasoning models (LRMs). At its core, AutoRAN pioneers an execution simulation paradigm that leverages a weaker but less-aligned model to simulate execution reasoning for initial hijacking attempts and iteratively refine attacks by exploiting reasoning patterns leaked through the target LRM's refusals. This approach steers the target model to bypass its own safety guardrails and elaborate on harmful instructions. We evaluate AutoRAN against state-of-the-art LRMs, including GPT-o3/o4-mini and Gemini-2.5-Flash, across multiple benchmarks (AdvBench, HarmBench, and StrongReject). Results show that AutoRAN achieves approaching 100% success rate within one or few turns, effectively neutralizing reasoning-based defenses even when evaluated by robustly aligned external models. This work reveals that the transparency of the reasoning process itself creates a critical and exploitable attack surface, highlighting the urgent need for new defenses that protect models' reasoning traces rather than merely their final outputs.

cs.LG↗

arXiv2026

RASA: Routing-Aware Safety Alignment for Mixture-of-Experts Models

Mixture-of-Experts (MoE) language models introduce unique challenges for safety alignment due to their sparse routing mechanisms, which can enable degenerate optimization behaviors under standard full-parameter fine-tuning. In our preliminary experiments, we observe that naively applying full-parameter safety fine-tuning to MoE models can reduce attack success rates through routing or expert dominance effects, rather than by directly repairing Safety-Critical Experts. To address this challenge, we propose RASA, a routing-aware expert-level alignment framework that explicitly repairs Safety-Critical Experts while preventing routing-based bypasses. RASA identifies experts disproportionately activated by successful jailbreaks, selectively fine-tunes only these experts under fixed routing, and subsequently enforces routing consistency with safety-aligned contexts. Across two representative MoE architectures and a diverse set of jailbreak attacks, RASA achieves near-perfect robustness, strong cross-attack generalization, and substantially reduced over-refusal, while preserving general capabilities on benchmarks such as MMLU, GSM8K, and TruthfulQA. Our results suggest that robust MoE safety alignment benefits from targeted expert repair rather than global parameter updates, offering a practical and architecture-preserving alternative to prior approaches.

cs.LG↗

arXiv2026

Reasoning or Retrieval? A Study of Answer Attribution on Large Reasoning Models

Large reasoning models (LRMs) exhibit unprecedented capabilities in solving complex problems through Chain-of-Thought (CoT) reasoning. However, recent studies reveal that their final answers often contradict their own reasoning traces. We hypothesize that this inconsistency stems from two competing mechanisms for generating answers: CoT reasoning and memory retrieval. To test this hypothesis, we conduct controlled experiments that challenge LRMs with misleading cues during reasoning and/or corrupted answers during retrieval. Our results across models and datasets confirm that both mechanisms operate simultaneously, with their relative dominance influenced by multiple factors: problem domains, model scales, and fine-tuning approaches (e.g., reinforcement learning vs. distillation). The findings reveal a critical limitation in current reasoning fine-tuning paradigms: models can exploit the retrieval mechanism as a shortcut, effectively "hacking" the reward signal and undermining genuine reasoning development. To address this challenge, we introduce FARL, a novel fine-tuning framework that integrates memory unlearning with reinforcement learning. By carefully suppressing retrieval shortcuts during the fine-tuning process, FARL promotes reasoning-dominant behavior and enhances generalizable reasoning capabilities. The code is available: https://github.com/ZJUWYH/FARL.

cs.AI↗

arXiv2026

Dynamic Token Reweighting for Robust Vision-Language Models

Large vision-language models (VLMs) are highly vulnerable to multimodal jailbreak attacks that exploit visual-textual interactions to bypass safety guardrails. In this paper, we present DTR, a novel inference-time defense that mitigates multimodal jailbreak attacks through optimizing the model's key-value (KV) caches. Rather than relying on curated safety-specific data or costly image-to-text conversion, we introduce a new formulation of the safety-relevant distributional shift induced by the visual modality. This formulation enables DTR to dynamically adjust visual token weights, minimizing the impact of adversarial visual inputs while preserving the model's general capabilities and inference efficiency. Extensive evaluation across diverse VLMs and attack benchmarks demonstrates that DTR outperforms existing defenses in both attack robustness and benign-task performance, marking the first successful application of KV cache optimization for safety enhancement in multimodal foundation models. The code for replicating DTR is available at: https://github.com/TanqiuJiang/DTR.

cs.CV↗

arXiv2026

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

LLM agents are increasingly deployed in long-horizon, complex environments to solve challenging problems, but this expansion exposes them to long-horizon attacks that exploit multi-turn user-agent-environment interactions to achieve objectives infeasible in single-turn settings. To measure agent vulnerabilities to such risks, we present AgentLAB, the first benchmark dedicated to evaluating LLM agent susceptibility to adaptive, long-horizon attacks. Currently, AgentLAB supports five novel attack types including intent hijacking, tool chaining, task injection, objective drifting, and memory poisoning, spanning 28 realistic agentic environments, and 644 security test cases. Leveraging AgentLAB, we evaluate representative LLM agents and find that they remain highly susceptible to long-horizon attacks; moreover, defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats. We anticipate that AgentLAB will serve as a valuable benchmark for tracking progress on securing LLM agents in practical settings. The benchmark is publicly available at https://tanqiujiang.github.io/AgentLAB_main.

cs.AI↗

arXiv2025

GraphRAG under Fire

GraphRAG advances retrieval-augmented generation (RAG) by structuring external knowledge as multi-scale knowledge graphs, enabling language models to integrate both broad context and granular details in their generation. While GraphRAG has demonstrated success across domains, its security implications remain largely unexplored. To bridge this gap, this work examines GraphRAG's vulnerability to poisoning attacks, uncovering an intriguing security paradox: existing RAG poisoning attacks are less effective under GraphRAG than conventional RAG, due to GraphRAG's graph-based indexing and retrieval; yet, the same features also create new attack surfaces. We present GragPoison, a novel attack that exploits shared relations in the underlying knowledge graph to craft poisoning text capable of compromising multiple queries simultaneously. GragPoison employs three key strategies: (i) relation injection to introduce false knowledge, (ii) relation enhancement to amplify poisoning influence, and (iii) narrative generation to embed malicious content within coherent text. Empirical evaluation across diverse datasets and models shows that GragPoison substantially outperforms existing attacks in terms of effectiveness (up to 98% success rate) and scalability (using less than 68% poisoning text) on multiple variations of GraphRAG. We also explore potential defensive measures and their limitations, identifying promising directions for future research.

cs.LG↗

arXiv2025

Model Extraction Attacks Revisited

Model extraction (ME) attacks represent one major threat to Machine-Learning-as-a-Service (MLaaS) platforms by ``stealing'' the functionality of confidential machine-learning models through querying black-box APIs. Over seven years have passed since ME attacks were first conceptualized in the seminal work. During this period, substantial advances have been made in both ME attacks and MLaaS platforms, raising the intriguing question: How has the vulnerability of MLaaS platforms to ME attacks been evolving? In this work, we conduct an in-depth study to answer this critical question. Specifically, we characterize the vulnerability of current, mainstream MLaaS platforms to ME attacks from multiple perspectives including attack strategies, learning techniques, surrogate-model design, and benchmark tasks. Many of our findings challenge previously reported results, suggesting emerging patterns of ME vulnerability. Further, by analyzing the vulnerability of the same MLaaS platforms using historical datasets from the past four years, we retrospectively characterize the evolution of ME vulnerability over time, leading to a set of interesting findings. Finally, we make suggestions about improving the current practice of MLaaS in terms of attack robustness. Our study sheds light on the current state of ME vulnerability in the wild and points to several promising directions for future research.

cs.LG↗

arXiv2025

Watermark under Fire: A Robustness Evaluation of LLM Watermarking

Various watermarking methods (``watermarkers'') have been proposed to identify LLM-generated texts; yet, due to the lack of unified evaluation platforms, many critical questions remain under-explored: i) What are the strengths/limitations of various watermarkers, especially their attack robustness? ii) How do various design choices impact their robustness? iii) How to optimally operate watermarkers in adversarial environments? To fill this gap, we systematize existing LLM watermarkers and watermark removal attacks, mapping out their design spaces. We then develop WaterPark, a unified platform that integrates 10 state-of-the-art watermarkers and 12 representative attacks. More importantly, by leveraging WaterPark, we conduct a comprehensive assessment of existing watermarkers, unveiling the impact of various design choices on their attack robustness. We further explore the best practices to operate watermarkers in adversarial environments. We believe our study sheds light on current LLM watermarking techniques while WaterPark serves as a valuable testbed to facilitate future research.

cs.CR↗

arXiv2025

Self-Improving Model Steering

Model steering represents a powerful technique that dynamically aligns large language models (LLMs) with human preferences during inference. However, conventional model-steering methods rely heavily on externally annotated data, not only limiting their adaptability to varying contexts but also tethering their effectiveness to annotation quality. In this paper, we present SIMS, the first self-improving model-steering framework that operates without relying on external supervision. At its core, SIMS autonomously generates and refines contrastive samples through iterative self-improvement cycles, enabling adaptive, context-specific steering. Additionally, SIMS employs novel strategies, including prompt ranking and contrast sampling, to further enhance steering efficacy. Extensive evaluation across diverse LLMs and benchmarks demonstrates that SIMS substantially outperforms existing methods in steering effectiveness and adaptability, highlighting self-improving model steering as a promising direction for future research on inference-time LLM alignment.

cs.CL↗

arXiv2025

CyLens: Towards Reinventing Cyber Threat Intelligence in the Paradigm of Agentic Large Language Models

The exponential growth of cyber threat knowledge, exemplified by the expansion of databases such as MITRE-CVE and NVD, poses significant challenges for cyber threat analysis. Security professionals are increasingly burdened by the sheer volume and complexity of information, creating an urgent need for effective tools to navigate, synthesize, and act on large-scale data to counter evolving threats proactively. However, conventional threat intelligence tools often fail to scale with the dynamic nature of this data and lack the adaptability to support diverse threat intelligence tasks. In this work, we introduce CYLENS, a cyber threat intelligence copilot powered by large language models (LLMs). CYLENS is designed to assist security professionals throughout the entire threat management lifecycle, supporting threat attribution, contextualization, detection, correlation, prioritization, and remediation. To ensure domain expertise, CYLENS integrates knowledge from 271,570 threat reports into its model parameters and incorporates six specialized NLP modules to enhance reasoning capabilities. Furthermore, CYLENS can be customized to meet the unique needs of different or ganizations, underscoring its adaptability. Through extensive evaluations, we demonstrate that CYLENS consistently outperforms industry-leading LLMs and state-of-the-art cybersecurity agents. By detailing its design, development, and evaluation, this work provides a blueprint for leveraging LLMs to address complex, data-intensive cybersecurity challenges.

cs.CR↗

arXiv2025

Data to Defense: The Role of Curation in Customizing LLMs Against Jailbreaking Attacks

Large language models (LLMs) are widely adapted for downstream applications through fine-tuning, a process named customization. However, recent studies have identified a vulnerability during this process, where malicious samples can compromise the robustness of LLMs and amplify harmful behaviors-an attack commonly referred to as jailbreaking. To address this challenge, we propose an adaptive data curation approach allowing any text to be curated to enhance its effectiveness in counteracting harmful samples during customization. To avoid the need for additional defensive modules, we further introduce a comprehensive mitigation framework spanning the lifecycle of the customization process: before customization to immunize LLMs against future jailbreak attempts, during customization to neutralize risks, and after customization to restore compromised models. Experimental results demonstrate a significant reduction in jailbreaking effects, achieving up to a 100% success rate in generating safe responses. By combining adaptive data curation with lifecycle-based mitigation strategies, this work represents a solid step forward in mitigating jailbreaking risks and ensuring the secure adaptation of LLMs.

cs.CR↗