arXiv subjects

Jianliang Wu

Publications and source records attributed to Jianliang Wu.

11 recordsLinked to original sources

arXiv2026

Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents

Large Language Model (LLM) email agents have emerged as pivotal autonomous assistants, serving as a critical root of trust for digital identity by managing sensitive communications and authentication workflows. Despite their importance, the prompt injection (PI) resilience of the real-world LLM email agent ecosystem remains poorly understood. Existing assessments largely rely on simulated environments or fragmented production case studies, while existing PI attacks mainly follow an instruction-takeover strategy that directly competes with the system prompt and the user's task. Our evaluation shows that such attacks are insufficient in email-agent settings: existing template-based prompt injection attack baselines achieve Attack Success Rates (ASRs) of only 4.58%-8.13%. In this paper, we propose Email-Specific Prompt Injection (ESPI), a new attack paradigm that manipulates how email agents interpret mailbox operational context. By combining Email Protocol State Masquerade and Camouflage Logic Chain, ESPI reframes attacker-desired mailbox operations as necessary remediation steps under forged email-operational states. We further develop ESPInspector, an automated black-box attack pipeline for analyzing and evaluating real-world email agents. Across 480 controlled attack trials, ESPI achieves 73.54% ASR, substantially outperforming all baselines. Further, ESPI successfully hijacks all 63 evaluated applications across 870 black-box instances, requiring only 1.84-1.89 attempts on average for the first successful hijack. Our responsible disclosure receives formal risk acknowledgment from 22 vendors and the assignment of 16 CVE IDs. Our research provides the first holistic map of security gaps in the real-world email agent ecosystems and highlights the urgent necessity for robust, state-verified security enhancement solutions.

cs.CR↗

arXiv2026

FuseDiff: Symmetry-Preserving Joint Diffusion for Dual-Target Structure-Based Drug Design

Dual-target structure-based drug design aims to generate a single ligand together with two pocket-specific binding poses, each compatible with a corresponding target pocket, enabling polypharmacological therapies with improved efficacy and reduced resistance. Existing approaches typically rely on staged pipelines, which either decouple the two poses via conditional-independence assumptions or enforce overly rigid correlations, and therefore fail to jointly generate two target-specific binding modes. To address this, we propose FuseDiff, an end-to-end diffusion model that jointly generates a ligand molecular graph and two pocket-specific binding poses conditioned on both pockets. FuseDiff features a message-passing backbone with Dual-target Local Context Fusion (DLCF), which fuses each ligand atom's local context from both pockets to enable expressive joint modeling while preserving the desired symmetries. Together with explicit bond generation, FuseDiff enforces topological consistency across the two poses under a shared graph while allowing target-specific geometric adaptation in each pocket. To support principled training and evaluation, we derive a dual-target training set and use an independent held-out test set for evaluation. Experiments on the benchmark and a real-world dual-target system show that FuseDiff achieves state-of-the-art docking performance and enables the first systematic assessment of dual-target pose quality prior to docking-based pose search.

cs.LG↗

arXiv2026

MISApp: Multi-Hop Intent-Aware Session Graph Learning for Next App Prediction

Predicting the next mobile app a user will launch is essential for proactive mobile services. Yet accurate prediction remains challenging in real-world settings, where user intent can shift rapidly within short sessions and user-specific historical profiles are often sparse or unavailable, especially under cold-start conditions. Existing approaches mainly model app usage as sequential behavior or local session transitions, limiting their ability to capture higher-order structural dependencies and evolving session intent. To address this issue, we propose MISApp, a profile-free framework for next app prediction based on multi-hop session graph learning. MISApp constructs multi-hop session graphs to capture transition dependencies at different structural ranges, learns session representations through lightweight graph propagation, incorporates temporal context and similarity-based spatial categorization to characterize session conditions, and captures intent evolution from recent interactions. Experiments on two real-world app usage datasets show that MISApp consistently outperforms competitive baselines under both standard and cold-start settings, while maintaining a favorable balance between predictive accuracy and practical efficiency. Further analyses show that multi-hop relations capture higher-hop-specific predictive signals beyond direct 1-Hop adjacency, and that the learned hop-level attention weights align well with structural relevance, providing both empirical and interpretable evidence for the effectiveness of the proposed multi-hop modeling strategy.

cs.LG↗

arXiv2026

(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents

Third-party mobile agents powered by Vision-Language Models (VLMs) have emerged as a promising paradigm for automating smartphone interactions. These agents act as high-privilege decision-makers, perceiving device states through screenshots and executing actions via VLM reasoning, transforming how an agent app interacts with the environment (i.e., other apps or the OS). Correspondingly, this transformation introduces new attack surfaces or transforms benign/harmless interfaces into exploitable ones for mobile devices. In this paper, we summarize key differences between third-party mobile agent apps and general apps when interacting with the environment, analyze the security posture of agents, and identify two unique attack surfaces compared to general mobile apps: the Screen Perception Attack Surface, which exploits the gap between human and machine vision, and the Misused Channel Attack Surface, which intercepts or manipulates the agent's execution pipeline. We design and implement seven concrete attacks, from subliminal text injection and invisible pixel zone exploitation to screenshot tampering and host PC command injection. Our evaluation of five popular mobile agent frameworks demonstrates that a malicious app can hijack agent actions and achieve arbitrary command execution even without any privilege permissions, while remaining visually indistinguishable to users. These findings reveal a fundamental trust mismatch in autonomous agent design and highlight the urgent need for perception-aware security models on multi-tenant platforms.

cs.CR↗

arXiv2026

Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis

Mini-programs have become a dominant paradigm for lightweight application deployment within super apps such as WeChat. To support seamless integration, super apps provide OAuth mechanisms for user login. However, improper integration of OAuth-based Authentication (OBA) flows by third-party developers can lead to critical security flaws. In this paper, we discover three new types of runtime OBA misuses that differ from prior static-code-based studies, enabling attackers to impersonate victims. To assess their real-world impact, we design and implement MINIAUTH, the first analysis framework for systematically analyzing OBA misuse at scale. MINIAUTH automatically pinpoints the OBA login page of a mini-program, executes the workflow dynamically, and analyzes its runtime behaviors. This enables it to handle obfuscated mini-programs and uncover vulnerabilities that existing approaches cannot detect. Applying MINIAUTH to 44,273 WeChat and 2,721 Baidu mini-programs, we uncover 1,834 misuse cases, including critical logic flaws that enable client-side identity forgery via exposed credentials and authentication bypass through static or plaintext identifiers. Our cross-platform evaluation further shows that such misuses are not confined to a single ecosystem but consistently appear across different mini-program platforms. We also identify a cryptographic design flaw in Baidu's OBA APIs that allows brute-forcing of session keys. We responsibly disclosed our findings to the developers and platforms, receiving acknowledgments and assigned CNVD/CNNVD IDs. These results underscore the need for more robust developer guidance and enhanced platform-level safeguards.

cs.CR↗

arXiv2026

The maximum number of two 4-vertex graphs in planar graphs

Let $f(n,H)$ be the maximum number of copies of a graph $H$ in a planar graph of order $n$. When $H$ is a connected graph on four vertices, $f(n,H)$ has been completely determined except for two cases: $K_{1,3}^+$ (the claw graph $K_{1,3}$ with one additional edge) and $K_4^-$ (the complete graph $K_4$ with one edge removed). Here, we address these two cases and establish that for all $n\ge4$, $$f(n,K_{1,3}^+) = 4n^2-12n-4 \textrm{ and } f(n,K_4^-) =\frac{1}{2}(n^2+9n-40).$$

math.CO↗

arXiv2022

A note on the edge choosability of $K_{5}$-minor free graphs

For a planar graph $G$, Borodin stated that $G$ is $(Δ+1)$-edge-choosable if $Δ\geq9$ and later Bonamy showed that $G$ is $9$-edge-choosable if $Δ=8$. At the same time, Borodin et al. proved that $G$ is $Δ$-edge-choosable if $Δ\geq12$. In the paper, we extend these results to $K_5$-minor free graphs.

math.CO↗

arXiv2021

The total coloring of $K_5$-minor-free graphs

A total $k$-coloring of a graph $G$ is a coloring of $V(G)\cup E(G)$ using $k$ colors such that no two adjacent or incident elements receive the same color. The total chromatic number $χ"(G)$ of $G$ is the smallest integer $k$ such that $G$ has a total $k$-coloring. In the paper, it is proved that for any $K_5$-minor-free graph $G$, $χ''(G)\leq Δ(G)+2$ if $Δ(G)\geq 7$. Moreover, $χ"(G)=Δ(G)+1$ if $Δ(G)\geq 10$.

math.CO↗

arXiv2020

The edge colorings of $K_{5}$-minor free graphs

In 1965, Vizing proved that every planar graph $G$ with maximum degree $Δ\geq 8$ is edge $Δ$-colorable. It is also proved that every planar graph $G$ with maximum degree $Δ=7$ is edge $Δ$-colorable by Sanders and Zhao, independently by Zhang. In this paper, we extend the above results by showing that every $K_5$-minor free graph with maximum degree $Δ$ at least seven is edge $Δ$-colorable.

math.CO↗

arXiv2019

Equitable Coloring and Equitable Choosability of Planar Graphs without chordal 4- and 6-Cycles

A graph $G$ is equitably $k$-choosable if, for any given $k$-uniform list assignment $L$, $G$ is $L$-colorable and each color appears on at most $\lceil\frac{|V(G)|}{k}\rceil$ vertices. A graph is equitably $k$-colorable if the vertex set $V(G)$ can be partitioned into $k$ independent subsets $V_1$, $V_2$, $\cdots$, $V_k$ such that $||V_i|-|V_j||\leq 1$ for $1\leq i, j\leq k$. In this paper, we prove that if $G$ is a planar graph without chordal $4$- and $6$-cycles, then $G$ is equitably $k$-colorable and equitably $k$-choosable where $k\geq\max\{Δ(G), 7\}$.

math.CO↗

arXiv2018

On splitting digraphs

In 1995, Stiebitz asked the following question: For any positive integers $s,t$, is there a finite integer $f(s,t)$ such that every digraph $D$ with minimum out-degree at least $f(s,t)$ admits a bipartition $(A, B)$ such that $A$ induces a subdigraph with minimum out-degree at least $s$ and $B$ induces a subdigraph with minimum out-degree at least $t$? We give an affirmative answer for tournaments, multipartite tournaments, and digraphs with bounded maximum in-degrees. In particular, we show that for every $ε$ with $0<ε<1/2$, there exists an integer $δ_0$ such that every tournament with minimum out-degree at least $δ_0$ admits a bisection $(A, B)$, so that each vertex has at least $(1/2-ε)$ of its out-neighbors in $A$, and in $B$ as well.

math.CO↗