arXiv subjects

Jie Zhang

Publications and source records attributed to Jie Zhang.

At least 73 records · Page 4Linked to original sources

arXiv2026

Measuring the Dependency Gap: Diagnosing Inter-Column Fidelity in Tabular Generative Models

Synthetic tabular data are valued for preserving inter-column dependency, yet each routine fidelity score is a single number that says neither where that dependency is lost nor why. We localize the deficit inside a single score. Equipping a classifier two-sample test (C2ST) with a gradient-boosted discriminator, we decompose it by controlled permutation into marginal, dependency, and numerical-categorical cross components, each read against a fully factorized reference that destroys all dependency while leaving every marginal intact, and against a real-data oracle. The linear detection score in common use rates that same reference as nearly real, a known weakness we replicate on four benchmarks. Applied to a flow-matching (TabbyFlow) and a diffusion (TabDiff) generator, the decomposition exposes a dependency deficit of the same order in both, and we then narrow its source by elimination: it is not a structural limit of the mean-field objective, it is not sampling discretization, and a 16x capacity increase does not close it, while the same measurement responds sharply when capacity is instead cut eightfold, so the plateau is measured rather than a blind spot. Destroying dependency outright collapses minority-class F1 by 0.38-0.61, which bounds what is at stake, though the generators' much smaller residual deficits do not predict their remaining shortfalls. What survives points at the objective: nothing in it scores the joint. Cheap remedies are no substitute: an explicit cross-coupling module and a post-hoc copula both leave the deficit in place.

cs.LG↗

arXiv2026

Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States

Agentic LLMs are vulnerable to indirect prompt injection (IPI) attacks, e.g., malicious side-tasks hidden in external tool results. While many efforts have sought to address this threat, little is known about the internals of agentic LLMs when they are exposed to IPI attacks. For simplicity, we refer to this condition as IPI exposure. In this paper, we study IPI exposure from three perspectives. (1) Probing: Across eight models, including the 753B-parameter GLM-5.2 and the 2.8T-parameter Kimi-K3, simple linear probes trained on pre-generation hidden states can predict LLMs' IPI exposure. These probes achieve 0.90+ AUROC on unseen attacks, agent instructions, and task suites; they remain robustly predictive under adaptive attacks and in cross-lingual settings. (2) Defense: We reveal and diagnose a knowledge-action gap: post-trained LLMs encode signals predictive of IPI exposure, yet do not reliably bind these signals to safe agentic actions. We therefore introduce a probe-gated reasoning-based defense to bridge this gap at test time. On difficult AgentDojo settings, it substantially reduces attack success rate, e.g., from 34.6% to 0% on Qwen3.5-27B, and better preserves clean-task utility than the baselines. (3) Explanation: We introduce an analysis framework that identifies natural-language explanations strongly correlated with probe-captured signals. The resulting profiles differ across models: latent signals can align with either direct IPI-exposure sensing or indirect operational cues. Code is available at https://github.com/jianshuod/IPI-exposure-signal.

cs.CR↗

arXiv2026

A novel strategy for achieving a low-field lightweight permanent MRI magnet system with good magnetic field homogeneity and low eddy current

In low-field, lightweight, pole-pieceless permanent-magnet MRI systems built with sintered Nd-Fe-B or Sm-Co magnets, the rapid switching of gradient fields readily induces eddy currents in the sintered magnets, leading to image artifacts. To address this, we report for the first time a Sm-Fe-N permanent-magnet MRI system based on anisotropic Sm-Fe-N bonded magnets, whose high electrical resistivity reduces the eddy currents in the X, Y and Z directions to 0.093%, 0.172% and 2.38%, respectively, while a magnetic field inhomogeneity below 150 ppm is achieved at the boundary of a 220 mm diameter of spherical volume (DSV). Compared with sintered Nd-Fe-B and Sm-Co magnets, using Sm-Fe-N bonded magnets as the source of the static magnetic field not only suppresses eddy currents but also makes a closely tiled, densely packed magnetic-circuit layout feasible, providing a more uniform static magnetic field for the MRI system. Imaging results free of obvious geometric distortion and banding artifacts further indicate that the Sm-Fe-N magnet system delivers low eddy currents and high static magnetic field homogeneity.

physics.med-ph↗

arXiv2026

Action-grounded tissue affordance enables anticipatory auto-framing that lowers surgeon cognitive workload during laparoscopic surgery

In laparoscopy, surgeon gaze tracks where the instruments will act; easing this demand through visual attention modeling requires dense labels of those interaction loci. These encode tacit knowledge: experts converge on consensus loci yet struggle to state the rules. Here we show that such labels can be recovered from completed actions in surgical videos, in which recorded instrument trajectories are converted into dense, continuous supervision. DiffeoAfford grounds tissue affordance by attaching instrument tips to the tissue and transporting them through deformation using diffeomorphism-constrained tracking, matching context-informed annotators' accuracy. Trained on these labels and never on gaze, a real-time model aligns with surgeon gaze more closely in space and time than does camera-assistant gaze. The framework also transfers across procedures: on hysterectomy videos, a separately trained predictor reaches 95.16% directional consistency with subsequent camera motion. In 12 paired cholecystectomies (24 procedures), the auto-framing application AffordView, which proactively centers predicted targets in view, lowered surgeon cognitive workload on converging subjective, physiological, and behavioral measures, including a reduced number of verbal instructions to the camera assistant. Deriving supervision from action rather than manual annotation offers a scalable route to anticipatory assistance.

cs.CV↗

arXiv2026

Current Status and Prospects of Neutron Detection and Neutron/Gamma Discrimination Technologies in Fusion Applications

Fusion research is progressing from physics-oriented experiments toward reactor-oriented engineering applications, placing increasing demands on the accuracy and reliability of neutron measurements. This review summarizes the current status and prospects of neutron detection and neutron/gamma discrimination technologies for fusion applications. The main sources, energy characteristics, and measurement requirements of fusion neutrons are first reviewed, with particular attention to 2.45 MeV D-D and 14.1 MeV D-T neutrons. Four principal neutron detection methods, including nuclear reaction, nuclear recoil, nuclear fission, and neutron activation, are discussed together with the operating characteristics and applicability of scintillation, gas, semiconductor, and other specialized detectors. The roles of neutron/gamma discrimination are then examined in plasma diagnostics, safe operation monitoring, radiation protection monitoring, and fusion reactor design. The review shows that different detection methods and detector types have distinct advantages and application boundaries, and no single detector provides an optimal solution for all fusion measurement tasks. Liquid scintillators and some organic crystals remain important for fast-neutron measurement and neutron/gamma discrimination, whereas gas and semiconductor detectors serve complementary roles in thermal-neutron monitoring, compact detection, radiation tolerance, and fast-neutron spectrometry. Future development is expected to focus on high-performance detectors, material damage assessment, intelligent real-time discrimination, and multi-detector coordination with system-level diagnostic integration.

physics.ins-det↗

arXiv2026

Axion generation and detection in laser-plasma wakefields

The axions are compelling candidates for cold dark matter, but their extremely weak interaction with photons makes laboratory searches challenging. We show that the quasi-static electromagnetic fields of a laser-plasma wakefield, which can exceed $10^{11}$\,V/m, enable axion generation without an external production magnet and enhance the conversion rate by two orders of magnitude over a conventional magnetic production region. Self-consistent particle-in-cell simulations reveal two complementary routes to detection. In the first route, axions are reconverted into photons within the wakefield and laser fields, eliminating the need for a separate regeneration magnet but requiring to suppress the intense laser-plasma background. The regenerated photons have polarization, harmonic-frequency, and Laguerre-Gaussian transverse-mode signatures that are largely absent from the driving fields, allowing successive filters to isolate the signal. In the second route, axions traverse a wall and undergo reconversion in a downstream magnet, providing a much lower background at the cost of requiring both the magnet and a seed pulse for coherent amplification. For axion masses below $0.1$\,meV, meter-scale wakefield guiding under our stated assumptions yields a projected coupling sensitivity down to $3.9\times10^{-12}\,\mathrm{GeV}^{-1}$, surpassing the projected constraint of next-generation laboratory searches. These results establish ultra-strong plasma wakefields as a magnet-free axion source with two experimentally distinct and complementary detection strategies.

physics.plasm-ph↗

arXiv2026

The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges

LLMs increasingly rely on external contexts, such as pre-defined system prompts or retrieved documents, to improve generation quality. However, processing these contexts alongside user queries creates an attack surface: adversarial inputs can induce models to disclose them. Prior probing studies suggest that leakage-related signals emerge in hidden states, yet the need to extract these states poses additional deployment challenges. In this paper, we explore whether this internal signal leaves a more accessible ``tell'' before decoding. We propose LeakGauge, which probes this response by appending a suffix that gauges leakage behavior and mapping its prefill token probabilities to an attack-risk score. While a direct gauge uses the initial tokens of confidential content, we find that a content-agnostic one that verbalizes leakage behavior yields more robust signals. Across 11 LLMs, including GLM-5.2 (753B) and Kimi-K3 (2.8T), LeakGauge reaches an AUROC range of 0.944--0.996 on unseen attacks. The signal remains stable when the content changes language or the attack shifts from verbatim to semantic disclosure. By activation-steering interventions, we further show that the risk score is sensitive to an internal leakage-related direction, relating the observable signal to the model's internal representation. In addition, LeakGauge enables an input detector with fewer than 0.5K extra parameters and added latency of 10.34 ms. Code: \href{https://github.com/yeasen-z/LeakGauge}.

cs.CR↗

arXiv2026

Task Specialization Fine-Tuning for Contextual Reinforcement Learning

Contextual Reinforcement Learning (CRL) seeks to generalize classical RL by maximizing task coverage across a context space of related tasks. While prior works often train from scratch and rely on either multi-task learning for a single policy or strategically training multiple policies, we advocate for a unified alternative: pretraining a single policy with good initial performance, followed by fine-tuning multiple policies for task specialization. This new paradigm, however, introduces unique challenges, such as heterogeneous marginal returns and sample inefficiency. This raises a critical research question: given a pretrained policy and a constrained budget, how much fine-tuning should each task region receive to enable sample-efficient CRL? To this end, we propose Task Specialization Fine-Tuning (TSFT), an online framework that predicts fine-tuning performance with a simple parametric model and exactly solves the resulting discrete budget allocation problem via integer linear programming. Extensive experiments across diverse decision domains, including combinatorial optimization, continuous control, and LLM fine-tuning, demonstrate that TSFT significantly outperforms baselines in task coverage and approaches oracle performance. Our work charts a new direction for model-based CRL, aligning with the modern pretrain-finetune era.

cs.LG↗

arXiv2026

A Sharp and Conservative VOF Method for Multicomponent Liquid--Gas Mass Transfer: Bubble Dissolution and Droplet Evaporation

We present a sharp and conservative geometrical VOF--finite-volume method for multicomponent liquid--gas mass transfer across deformable interfaces. The method solves problems in which multiple species are coupled through interfacial mass balances, latent-heat exchange, and vapor--liquid equilibrium. The key novelty is a fully sharp two-field treatment of scalar transport: the species and temperature equations are solved separately in the liquid and gas phases, while the one-sided Robin conditions for species and the two-sided flux jump for temperature are imposed directly on the reconstructed interface through an embedded-boundary discretization. This avoids both volumetric regularization of interfacial source terms and explicit coupling based on previous-time-step interfacial data. A consistent geometrical advection scheme is used for volume, momentum, energy, and species transport, and a sequential coupling strategy is developed to determine the partial interfacial mass fluxes, close the temperature equation, and update the thermodynamic-equilibrium state. The method is validated through single- and multicomponent bubble dissolution, single-component droplet evaporation, non-ideal ethanol--isooctane droplet evaporation, and sessile water--glycerol droplet evaporation. The results demonstrate second-order accuracy, accurate interfacial flux prediction, good mass and energy conservation, and the ability to capture complex multicomponent effects such as gas replacement, azeotropic volatility reversal, and composition-driven Marangoni flow.

physics.flu-dyn↗

arXiv2026

PACE-dLLM: Elastic Block Decoding via Confidence Cliff Estimation for Diffusion Language Models

Diffusion language models (dLLMs), such as LLaDA and Dream, have become competitive with autoregressive (AR) LLMs in generation quality while supporting native parallel decoding. A standard acceleration strategy is block-wise decoding, where each forward pass predicts a block of length B and commits high-confidence tokens. However, B couples two distinct decisions: the look-ahead horizon and the number of tokens to commit. Existing accelerators address this limitation through indirect heuristics, such as volatility tracking, delimiter detection, and learned scoring. In contrast, we show that the required information is already encoded in the model's own per-step confidence: in-window confidence typically follows a context-dependent cliff, whose saturation point directly identifies the appropriate look-ahead horizon. We propose PACE-dLLM, which fits this parametric cliff in closed form at each step, sets the next horizon by its saturation point, and uses an independent confidence threshold for token commitment. Under a saturated-yield abstraction, we show that the cliff-anchored horizon is the smallest horizon attaining maximal useful per-pass yield: fixed horizons that undershoot it incur a worse asymptotic NFE rate, while overshooting adds no useful yield. On four reasoning and code benchmarks, PACE-dLLM achieves the best average accuracy on both open-source dLLM backbones, with average wall-clock speedups of 5.23x on LLaDA and 3.06x on Dream (up to 8.52x on math) over the unaccelerated semi-AR baseline, advancing the quality-throughput Pareto frontier.

cs.CL↗

arXiv2026

Techno-Economic Boundary Analysis of Small Modular Reactor Cogeneration for Hyperscale Data Center IT and Cooling Loads

Hyperscale data centers are adding firm, high-utilization demand faster than grids can serve it, renewing interest in colocating them with small modular reactors. Such a plant could earn revenue in two ways, selling low-carbon power and diverting steam to absorption chillers that serve a cooling load accounting for 20-40% of facility electricity use, but neither revenue stream has been priced across the conditions that must coincide. Here we co-optimize reactor dispatch, steam extraction, absorption cooling and grid exchange hourly for a 200 MW$_\mathrm{e}$ data center in the Electric Reliability Council of Texas (ERCOT) region, across 109 runs spanning capital, market, policy, financing and cooling efficiency. At 2023 mid-range reactor capital, the nuclear configurations cost 49-62% more than grid supply even with the Section 45Y production tax credit. The viable region opens near \$5,000 kW$_\mathrm{e}^{-1}$, and nth-of-a-kind capital makes them 77-89% cheaper in 2023, though between parity and 34% more expensive in the low-price 2024 market. A carbon price of \$53-64 tCO$_2^{-1}$ closes the mid-range gap under hourly export crediting. Absorption cooling is dispatched in response to hourly electricity prices and supplies 38% of annual cooling, at an added cost of \$9.2 million yr$^{-1}$ relative to the reactor-only plant; that gap closes at an installed absorption cost of \$60 kW$_\mathrm{c}^{-1}$ at baseline efficiency and \$570 kW$_\mathrm{c}^{-1}$ on a legacy-efficiency campus, against surveyed commercial prices of \$450-1,200 kW$_\mathrm{c}^{-1}$. Together these results delineate the capital, market and policy conditions under which colocated reactor cogeneration is competitive with grid procurement, and the range over which each condition moves the outcome.

eess.SY↗

arXiv2026

Benchmarking Cyberattack Detection in Electric Vehicle Charging Infrastructure with Benign User Updates

Cyberattack detection in electric vehicle charging infrastructure is complicated by legitimate post-activation revisions to requested energy and departure time. Charging manipulation attacks can exploit the same interface and variables; therefore, detecting a request change alone does not establish malicious intent. This paper develops a leakage-controlled session-level benchmark that preserves the ordered inputs of real Adaptive Charging Network (ACN) sessions and models legitimate revisions as normal behavior. A fixed pool keeps each generated attack in its source session's split and contains six physically motivated attacks and their coordinated variants. We compare 22 profile-only, transition-aware, and context-stratified model families under common source-grouped folds, attack data, and operating constraints. The proposed Dual-Branch Masked-Autoencoder (Masked-AE) Transition Boost model evaluates whether the current request is normal and whether its producing transition resembles an observed benign update. Its state branch combines masked reconstruction with a radial-basis-function one-class support boundary, while its transition branch combines masked reconstruction with shrinkage covariance distance. Source-grouped five-fold cross-validation selects complete configurations under explicit overall-normal and benign-update acceptance constraints; disjoint normal data then calibrate the final threshold before one test evaluation. The developed dual-branch model provides the strongest robust validation performance while detecting malicious request manipulations without learning to reject legitimate user choices.

cs.CR↗

arXiv2026

RVANNS: Mixed-Precision Indexing and Locality-Aware Graph Traversal on RISC-V

Approximate nearest neighbor search (ANNS) on CPUs is increasingly constrained by candidate-vector movement and decoding rather than peak arithmetic throughput. Although the RISC-V Vector Extension (RVV) provides vector-length-agnostic execution and LMUL-based register grouping, generic low-precision decoding still incurs conversion overhead, while irregular graph traversal generates scattered accesses that degrade cache locality and memory-level parallelism. We present RVANNS, an RVV-oriented ANNS engine that jointly optimizes vector representation and graph locality. Its Mixed-Precision Multi-Layer Index (MPMI) represents each vector with a dense 8-bit affine base and sparse FP16/FP32 residuals, fusing reconstruction with distance accumulation and aligning widening with LMUL-sized register groups. ROrder co-locates likely co-visited graph nodes and sorts remapped adjacency lists, transforming scattered payload probes into denser, predominantly forward-moving address streams. Integrated into Milvus, RVANNS achieves 3.39x and 4.94x speedups over scalar execution on real 128-bit and 256-bit RVV processors, respectively. Under controlled HNSW configurations, it improves throughput by 2.27--2.76x over RVV SIMD+FP32 and by 1.18--1.59x over the corresponding AVX-512 and SVE baselines. On Cohere10M, it further delivers 1.82--2.27x higher QPS/W than the evaluated GPU baselines.

cs.IR↗

arXiv2026

ARC: Augmented-Rank Conformalization for Changepoint Localization --- Finite-Sample Validity and Distribution-Robust Efficiency

Conformal changepoint localization turns any score into a confidence set for the changepoint with finite-sample coverage. Coverage is universal; efficiency is not. The oracle score is a likelihood ratio, so practical scores estimate density ratios, and set length deteriorates under heavy tails, skewness, and distribution shift, where no length guarantee applies. We propose ARC (Augmented-Rank Conformalization), a family of scores depending on the data only through within-segment ranks: rank-CUSUM location and scale channels, their fixed combinations, and a lightweight neural score frozen after synthetic training. Every ARC score inherits finite-sample coverage for every frozen weight configuration, including random initialization and mistraining. The main result is an efficiency transfer theorem: the entire ARC confidence set is almost surely invariant under strictly increasing marginal transforms, so the set length distribution depends on the data pair only through its rank structure, and lengths certified once hold verbatim across its monotone orbit, whereas a plug-in score's length changes with every re-expression. Across different rank structures lengths do change, and are reported as such. Classical rank-test theory positions ARC as targeting the optimal invariant score at bounded cost. Simulations confirm nominal coverage for all scores, including sabotaged networks, identical sets under monotone transforms where plug-in scores inflate, and smooth degradation where plug-in sets become vacuous; on the well-log benchmark ARC localizes annotated shifts to three to five candidates and flags misfit by an empty set. Two boundaries are stated rather than hidden: serial dependence destroys exactness, and trend-type alternatives lie outside the piecewise-exchangeable model.

stat.ML↗

arXiv2026

READER: Dynamic LLM Provenance from Query-Varying Interactions

Existing black-box LLM provenance methods achieve comparability by querying every candidate model with the same diagnostic prompts. In deployment, auditors inherit a different evidence stream: heterogeneous prompt-response traces that arrive incrementally. We formalize dynamic black-box LLM provenance: after enrolling a fixed candidate ecosystem, attribute query-varying interactions at any available evidence budget. READER recovers comparability through a frozen proxy LLM. It projects proxy states aligned with response tokens onto length-normalized DC and first-AC modes, capturing response-wide activation location and coarse trajectory evolution. An enrollment-trained linear probe converts each fingerprint into source evidence, and Bayesian accumulation reuses this evidence unit from one observation to many. We introduce Agent500, containing 50,000 responses from 100 local and API sources to 500 heterogeneous agent prompts. On 100-way attribution, READER reaches $50.4\%$ accuracy from one response and $96.2\%$ from 100, compared with $33.0\%$ and $79.0\%$ for the strongest dynamic baselines. Four distinct proxy families all exceed $94.8\%$ at the latter budget. Controlled response-length and Math100 domain shifts expose the limits of zero-retraining transfer. Component analysis reveals a task-dependent spectral division of labor: DC dominates dynamic source identity, while first AC dominates static relationship evidence. Their joint fingerprint provides a shared measurement space for both tasks. READER audits observed text without target internals or audit-only queries. Code and data are available at https://github.com/LeoJeshua/READER.

cs.AI↗

arXiv2026

An Early Warning of Emerging Biosecurity Risks in Frontier LLMs

Frontier large language models (LLMs) are increasingly integrated into scientific workflows, yet their growing biological capabilities may outpace current safeguards. To assess the biological risks of frontier models, we develop Intern-BioBreaker, a specialized bio-red-teaming model, together with an integrated computational-to-physical framework that couples model-level stress testing with wet-lab validation. Within this framework, Intern-BioBreaker generates targeted jailbreak prompts to test whether aligned models can be induced to provide operational guidance for safety-sensitive biological tasks or produce sequence-level outputs with potentially harmful properties. Selected sequence outputs are then carried forward for DNA synthesis, host expression, and orthogonal protein verification to assess whether model-generated designs can yield the intended biological products. Our evaluation reveals a concerning gap between text-level safeguards and the risks posed by capable scientific models: (i) Intern-BioBreaker outperforms baseline attack models and reveals widespread bio-risk jailbreak vulnerabilities across both open-weight and proprietary frontier LLMs, with several targets reaching near-saturated or 100% task-level attack success rate (ASR); (ii) in sequence-level case studies, GPT-5.5 can be induced to generate modified viral candidate sequences with pathogenic potential; the corresponding translated proteins may exhibit even stronger receptor-binding affinity and thus enhanced infection potential; and (iii) end-to-end verification shows that selected model-generated biological designs are not merely textual artifacts, but can be physically realized under controlled experimental settings. These findings underscore the need for stronger biological red-teaming, nucleic acid synthesis screening, and safety mechanisms that keep pace with model capabilities.

cs.CL↗

arXiv2026

WorldCycle: Self-Verifiable Reinforcement Learning for Long-Horizon Video World Models

Interactive video world models are essential for long-horizon planning and exploration, yet they suffer from compounding errors. Post-training methods such as reinforcement learning (RL) can improve these models, but they hit a verification bottleneck: for arbitrary action sequences, no ground-truth future state exists to measure long-term drift. Our key insight is that reversible action cycles make this verification possible: a sequence composed with its inverse must analytically return to the initial state, yielding annotation-free supervision on long-horizon correctness. Building on this, we introduce WorldCycle, a self-verifiable RL framework that constructs closed action cycles and their repeated executions from ordinary action sequences, and optimizes two complementary rewards: a spatial closure reward enforcing symmetry between mirrored forward and reverse segments, and a temporal consistency reward aligning states across repeated cycle executions. These rewards force the model to learn actions as consistent state operators rather than memorized temporal patterns, and extend naturally to out-of-distribution composite action cycles that the base model handles poorly. We further release CycleBench, a diagnostic benchmark for state-returning ability under complex action structures. WorldCycle reduces state returning drift by up to 44% and lifts composite-action accuracy nearly 4x over the base model, providing a vital foundation for physically grounded world models.

cs.AI↗

arXiv2026

Token Buncher: Shielding LLMs from Harmful Reinforcement Learning Fine-Tuning

As large language models (LLMs) continue to grow in capability, so do the risks of harmful misuse through fine-tuning. While most prior studies assume that attackers rely on supervised fine-tuning (SFT) for such misuse, we systematically demonstrate that reinforcement learning (RL) enables adversaries to more effectively break safety alignment and facilitate more advanced harmful task assistance, under matched computational budgets. To counter this emerging threat, we propose TokenBuncher, the first effective defense specifically targeting RL-based harmful fine-tuning. TokenBuncher suppresses the foundation on which RL relies: model response entropy. By constraining entropy, RL-based fine-tuning can no longer exploit distinct reward signals to drive the model toward harmful behaviors. We realize this defense through entropy-as-reward RL and a Token Noiser mechanism designed to prevent the escalation of harmful capabilities. Extensive experiments across multiple models and RL algorithms show that TokenBuncher robustly mitigates harmful RL fine-tuning while preserving benign task performance and finetunability. Our results highlight that RL-based harmful fine-tuning poses a greater systemic risk than SFT, and that TokenBuncher provides an effective and general defense.

cs.LG↗