arXiv subjects

Jianxin Wei

Publications and source records attributed to Jianxin Wei.

10 recordsLinked to original sources

arXiv2026

Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks

Distributed large language model (LLM) inference frameworks connect isolated consumer-grade devices for large-scale model inference, substantially reducing hardware constraints. However, recent studies show that intermediate embeddings transmitted among participants can leak private prompts. As LLMs evolve into multimodal LLMs (MLLMs), this risk extends beyond text: image prompts contain rich visual and semantic information, making their intermediate embeddings highly privacy-sensitive. Yet, image-prompt leakage in distributed MLLM inference remains largely unexplored. In this paper, we investigate privacy risks to input images caused by intermediate embeddings in distributed MLLM frameworks. We first analyze the information flow from image pixels to intermediate representations. Since image and text embeddings are often intertwined across MLLM layers, we design an image embedding extraction algorithm as a prerequisite for reconstruction attacks, achieving 100% extraction accuracy across almost all MLLM layers in our experiments. Building on this, we develop two passive black-box image reconstruction attacks, MPAA and IEDA, reflecting realistic threats from normal participants with limited knowledge and capability. MPAA performs fine-grained pixel-level reconstruction via patch-wise information extraction and assembly, while IEDA performs coarse-grained semantic reconstruction through embedding-guided diffusion generation. We evaluate our attacks on four representative MLLM families: Gemma 3, Phi 4 Multimodal, Qwen 2.5 VL, and Llama 4 Scout. Results show consistently superior reconstruction performance in various settings. We further analyze the effects of MoE architecture, image preprocessing, model size, and text-image dependency on attack performance. To our knowledge, this is the first study of image reconstruction attacks on MLLMs.

cs.CR↗

arXiv2026

The size of $k$-th order generalized Fibonacci cubes

Let $k\geq2$. Then the $k$-th order Fibonacci cube $Γ^{(k)}_{n}$ is the subgraph of the hypercube $Q_{n}$ induced by vertices without $k$ consecutive $1$s. The case $k=2$ corresponds to the classic Fibonacci cube $Γ_{n}$. There are three kinds of calculation formulas of the size of $Γ_{n}$: the iteration form $|E(Γ_{n})|=|E(Γ_{n-1})|+|E(Γ_{n-2})|+F_{n}$ (Hsu, 1993), %iteration form the convolution form $|E(Γ_{n})|=\mathop{\sum}\limits_{i=1}^{n}F_{i}F_{n-i+1}$ (Klavžar, 2005) %convolution form and the linear form $|E(Γ_{n})|=\frac{nF_{n+1}+2(n+1)F_{n}}{5}$ (Munarini et al., 2001). %linear form Belbachir and Ould-Mohamed (2020) studied the iteration and convolution formulas of the size of $Γ^{(3)}_{n}$. Very recently, Mollard (2025) deduced the iteration formula of the size of $Γ^{(k)}_{n}$ for $k\geq2$. In this paper, we give the the formulas of convolution and linear forms of $|E(Γ^{(k)}_{n})|$ for all $k\geq2$. Specifically, we obtain the formula of $|E(Γ^{(k)}_{n})|$ in terms of convolved $k$-th order Fibonacci numbers and the formula of $|E(Γ^{(k)}_{n})|$ of linear expression of $k$ consecutive $k$-th order Fibonacci numbers.

math.CO↗

arXiv2025

GCON: Differentially Private Graph Convolutional Network via Objective Perturbation

Graph Convolutional Networks (GCNs) are a popular machine learning model with a wide range of applications in graph analytics, including healthcare, transportation, and finance. However, a GCN trained without privacy protection measures may memorize private interpersonal relationships in the training data through its model parameters. This poses a substantial risk of compromising privacy through link attacks, potentially leading to violations of privacy regulations such as GDPR. To defend against such attacks, a promising approach is to train the GCN with differential privacy (DP), a rigorous framework that provides strong privacy protection by injecting random noise into the training process. However, training a GCN under DP is a highly challenging task. Existing solutions either perturb the graph topology or inject randomness into the graph convolution operations, or overestimate the amount of noise required, resulting in severe distortions of the network's message aggregation and, thus, poor model utility. Motivated by this, we propose GCON, a novel and effective solution for training GCNs with edge differential privacy. GCON leverages the classic idea of perturbing the objective function to satisfy DP and maintains an unaltered graph convolution process. Our rigorous theoretical analysis offers tight, closed-form bounds on the sensitivity of the graph convolution results and quantifies the impact of an edge modification on the trained model parameters. Extensive experiments using multiple benchmark datasets across diverse settings demonstrate the consistent superiority of GCON over existing solutions.

cs.CR↗

arXiv2024

DPIS: An Enhanced Mechanism for Differentially Private SGD with Importance Sampling

Nowadays, differential privacy (DP) has become a well-accepted standard for privacy protection, and deep neural networks (DNN) have been immensely successful in machine learning. The combination of these two techniques, i.e., deep learning with differential privacy, promises the privacy-preserving release of high-utility models trained with sensitive data such as medical records. A classic mechanism for this purpose is DP-SGD, which is a differentially private version of the stochastic gradient descent (SGD) optimizer commonly used for DNN training. Subsequent approaches have improved various aspects of the model training process, including noise decay schedule, model architecture, feature engineering, and hyperparameter tuning. However, the core mechanism for enforcing DP in the SGD optimizer remains unchanged ever since the original DP-SGD algorithm, which has increasingly become a fundamental barrier limiting the performance of DP-compliant machine learning solutions. Motivated by this, we propose DPIS, a novel mechanism for differentially private SGD training that can be used as a drop-in replacement of the core optimizer of DP-SGD, with consistent and significant accuracy gains over the latter. The main idea is to employ importance sampling (IS) in each SGD iteration for mini-batch selection, which reduces both sampling variance and the amount of random noise injected to the gradients that is required to satisfy DP. Integrating IS into the complex mathematical machinery of DP-SGD is highly non-trivial. DPIS addresses the challenge through novel mechanism designs, fine-grained privacy analysis, efficiency enhancements, and an adaptive gradient clipping optimization. Extensive experiments on four benchmark datasets, namely MNIST, FMNIST, CIFAR-10 and IMDb, demonstrate the superior effectiveness of DPIS over existing solutions for deep learning with differential privacy.

cs.CR↗

arXiv2024

Associated Mersenne graphs

In this paper, a new sub-family of Hypercubes called the \textit{associated Mersenne graphs} $\mathcal{M}_{n}$ are introduced. The definition of associated Mersenne graphs is motivated from the Fibonacci-run graphs ({Ö}. Eǧecioǧlu, V. Iršič, 2021) by extending run-constrained strings to circularly-run-constrained strings. The name of this new family of graphs is identified with the interesting fact that $|V(\mathcal{M}_{n})|$ is equal to the $n$-th associated Mersenne number. Various interesting structural and enumerative properties of associated Mersenne graphs are investigated, including the analogue of the fundamental recursion, number of vertices and edges, radius, diameter, center, periphery and medianicity. Some future research directions and open problems concerning associated Mersenne graphs are also proposed.

math.CO↗

arXiv2024

On a conjecture of Eǧecioǧlu and Iršič

In 2021, {Ö}. Eǧecioǧlu, V. Iršič introduced the concept of Fibonacci-run graph $\mathcal{R}_{n}$ as an induced subgraph of Hypercube. They conjectured that the diameter of $\mathcal{R}_{n}$ is given by $n-\lfloor(1+\frac{n}{2})^{\frac{1}{2}}-\frac{3}{4}\rfloor$. In this paper, we introduce the novel concept of distance-barriers between vertices in $\mathcal{R}_{n}$ and provide an elegant method to give lower bound for the diameter of $\mathcal{R}_{n}$ via distance-barriers. By constructing different types of distance-barriers, we show that the conjecture does not hold for all $n\geq 230$ and some of $n$ between $91$ and $229$. Furthermore, lower bounds for the diameter of some Fibonacci-run graphs are obtained, which turn out to be better than the result given in the conjecture.

math.CO↗

arXiv2020

On the Fibonacci $(p,r)$-cubes

In this paper, first it is shown that the "FSibonacci $(p,r)$-cube"(denoted as $IΓ_{n}^{(p,r)}$) studied in many papers, such as \cite{OZY}, \cite{K1}, \cite{OZ}, \cite{KR} and \cite{JZ}, is a new topological structure different from the original one (denoted as $OΓ_{n}^{(p,r)}$) presented by Egiazarian and Astola $\cite{EA}$. Then some topological properties of $IΓ_{n}^{(p,r)}$ and $OΓ_{n}^{(p,r)}$ are studied, including the recursive structure of them, the cubes $OΓ_{n}^{(p,r)}$ which are partial cubes and median graphs, some distance invariants of $IΓ_{n}^{(p,r)}$ and $OΓ_{n}^{(p,r)}$, and the maximum and minimum degree of these two types of cubes. Finally, several problems and conjectures on $IΓ_{n}^{(p,r)}$ and $OΓ_{n}^{(p,r)}$ are listed

math.CO↗

arXiv2019

O-Fibonacci $(p,r)$-cube as Cartesian products

Let $p ,r $ and $n $ be positive integers. Then the O-Fibonacci $(p,r)$-cube $OΓ^{(p,r)}_{n}$ is the subgraph of $Q_{n}$ induced on the binary words in which there is at least $p-1$ zeros between any two $1$s and there is at most $r$ consecutive $10^{p-1}$. These cubes include a wide range of cubes as their special cases, such as hypercubes, Fibonacci cubes, and postal networks. In this note it is proved that $OΓ^{(p,r)}_{n}$ is a non-trivial Cartesian product if and only if $p=1$ and $r\geq n\geq2$.

math.CO↗

arXiv2015

The index of a string consisting of 4 blocks

Generalized Fibonacci cube $Q_{d}(f)$, introduced by Ilić, Klavžar and Rho, is the graph obtained from the $d$-hypercube $Q_{d}$ by removing all vertices that contain $f$ as a substring. The smallest integer $d$ such that $Q_{d}(f)$ is not an isometric subgraph of $Q_{d}$ is called the index of $f$. A non-extendable sequence of contiguous equal digits in a string $μ$ is called a block of $μ$. The question that determine the index of a string consisting of at most 3 blocks is solved by Ilić, Klavžar and Rho. This question is further studied and the index of a string consisting of 4 blocks is determined, and the necessity of a string being good is also given for the strings with even blocks.

math.CO↗

arXiv2015

Proofs of two conjectures on generalized Fibonacci cubes

A binary string $f$ is a factor of string $u$ if $f$ appears as a sequence of $|f|$ consecutive bits of $u$, where $|f|$ denotes the length of $f$. Generalized Fibonacci cube $Q_{d}(f)$ is the graph obtained from the $d$-cube $Q_{d}$ by removing all vertices that contain a given binary string $f$ as a factor. A binary string $f$ is called good if $Q_{d}(f)$ is an isometric subgraph of $Q_{d}$ for all $d\geq1$, it is called bad otherwise. The index of a binary string $f$, denoted by $B(f)$, is the smallest integer $d$ such that $Q_{d}(f)$ is not an isometric subgraph of $Q_{d}$. Ilić, Klavžar and Rho conjectured that $B(f)<2|f|$ for any bad string $f$. They also conjectured that if $Q_{d}(f)$ is an isometric subgraph of $Q_{d}$, then $Q_{d}(ff)$ is an isometric subgraph of $Q_{d}$. We confirm the two conjectures by obtaining a basic result: if there exist $p$-critical words for $Q_{B(f)}(f)$, then $p$=2 or $p=3$.

math.CO↗