arXiv subjects

Lan Zhang

Publications and source records attributed to Lan Zhang.

At least 73 records · Page 4Linked to original sources

arXiv2025

To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt

LLM agents are widely used as agents for customer support, content generation, and code assistance. However, they are vulnerable to prompt injection attacks, where adversarial inputs manipulate the model's behavior. Traditional defenses like input sanitization, guard models, and guardrails are either cumbersome or ineffective. In this paper, we propose a novel, lightweight defense mechanism called Polymorphic Prompt Assembling (PPA), which protects against prompt injection with near-zero overhead. The approach is based on the insight that prompt injection requires guessing and breaking the structure of the system prompt. By dynamically varying the structure of system prompts, PPA prevents attackers from predicting the prompt structure, thereby enhancing security without compromising performance. We conducted experiments to evaluate the effectiveness of PPA against existing attacks and compared it with other defense methods.

cs.CR↗

arXiv2025

The Shape and Mass of the Galactic Dark Matter Halo from the Axisymmetric Jeans Model

We explore the density profile, shape, and virial mass of the Milky Way's dark matter halo using K giants (KG) from LAMOST and SDSS/SEGUE, as well as blue horizontal branch (BHB) stars from SDSS. Incorporating Gaia DR3 proper motions, we first investigate the velocity ellipsoid distribution within the $(R, |z|)$ space. The ellipsoids projected onto the $(v_R, v_z)$ plane exhibit near-spherical alignment. We then probe the underlying dark matter distribution using the axisymmetric Jeans equations with multi-Gaussian expansion (MGE) and the spherically aligned Jeans anisotropic modelling (JAM${\rm sph}$), allowing for different flattened dark matter density models. For each model, we apply two fitting approaches: fitting the KGs and BHBs separately or fit them simultaneously as two dynamical tracers in one gravitational potential. We find consistent results on the dark matter density profiles, $r_{200}$, and $M_{200}$ within a 1-$σ$ confidence region for models constrained by KGs, BHBs, and both. We find the strongest consistency between KGs and BHBs in constraining dark matter profiles for models incorporating radially varying halo flattening ($q(r_{\rm gc})$), which suggests the Milky Way's dark matter halo shape evolves with Galactocentric distance ($r_{\rm gc}$). Specifically, the halo flattening parameter $q_h$ decreases within $r_{\rm gc} < 20$ kpc and increases for $r_{\rm gc} > 20$ kpc. In this model, $M_{\rm tot} (< 60~{\rm kpc}) = 0.533^{+0.061}_{-0.054} \times 10^{12}$ $M_{\odot}$, $r_{200}$ is $188\pm15$ kpc, with $M_{200}$ estimated at $0.820^{+0.210}_{-0.186} \times 10^{12} M_{\odot}$.

astro-ph.GA↗

arXiv2025

Observation of Moiré Plasmonic Skyrmion Clusters

Skyrmions are topological defects belonging to nontrivial homotopy classes in particle theory. Their remarkably stable topology has recently been observed in electromagnetic waves. For the evanescent fields near a surface, this has been realized so far only for elementary optical skyrmions, with a fixed skyrmion number. Here we report, both in theory and experiment, the concept of moiré plasmonic skyrmion clusters, where multi-skyrmions are nested to form a large optical skyrmion cluster. By leveraging twistronics engineering of plasmonic nanostructures, we demonstrate both crystallized and quasi-crystallized optical skyrmion lattices, revealing an unprecedented degree of topological control. In a misaligned composite nanostructure, the rapid inverting of optical skyrmion number is achieved, which is explained by a lattice model. This topological change of moiréplasmonic skyrmion clusters can serve as a precise beacon of the relative alignment deviation between composite nanostructures.

physics.optics↗

arXiv2025

You Don't Need All Attentions: Distributed Dynamic Fine-Tuning for Foundation Models

Fine-tuning plays a crucial role in adapting models to downstream tasks with minimal training efforts. However, the rapidly increasing size of foundation models poses a daunting challenge for accommodating foundation model fine-tuning in most commercial devices, which often have limited memory bandwidth. Techniques like model sharding and tensor parallelism address this issue by distributing computation across multiple devices to meet memory requirements. Nevertheless, these methods do not fully leverage their foundation nature in facilitating the fine-tuning process, resulting in high computational costs and imbalanced workloads. We introduce a novel Distributed Dynamic Fine-Tuning (D2FT) framework that strategically orchestrates operations across attention modules based on our observation that not all attention modules are necessary for forward and backward propagation in fine-tuning foundation models. Through three innovative selection strategies, D2FT significantly reduces the computational workload required for fine-tuning foundation models. Furthermore, D2FT addresses workload imbalances in distributed computing environments by optimizing these selection strategies via multiple knapsack optimization. Our experimental results demonstrate that the proposed D2FT framework reduces the training computational costs by 40% and training communication costs by 50% with only 1% to 2% accuracy drops on the CIFAR-10, CIFAR-100, and Stanford Cars datasets. Moreover, the results show that D2FT can be effectively extended to recent LoRA, a state-of-the-art parameter-efficient fine-tuning technique. By reducing 40% computational cost or 50% communication cost, D2FT LoRA top-1 accuracy only drops 4% to 6% on Stanford Cars dataset.

cs.LG↗

arXiv2025

Topology-aware Generalization of Decentralized SGD

This paper studies the algorithmic stability and generalizability of decentralized stochastic gradient descent (D-SGD). We prove that the consensus model learned by D-SGD is $\mathcal{O}{(N^{-1}+m^{-1} +λ^2)}$-stable in expectation in the non-convex non-smooth setting, where $N$ is the total sample size, $m$ is the worker number, and $1+λ$ is the spectral gap that measures the connectivity of the communication topology. These results then deliver an $\mathcal{O}{(N^{-(1+α)/2}+ m^{-(1+α)/2}+λ^{1+α} + ϕ_{\mathcal{S}})}$ in-average generalization bound, which is non-vacuous even when $λ$ is closed to $1$, in contrast to vacuous as suggested by existing literature on the projected version of D-SGD. Our theory indicates that the generalizability of D-SGD is positively correlated with the spectral gap, and can explain why consensus control in initial training phase can ensure better generalization. Experiments of VGG-11 and ResNet-18 on CIFAR-10, CIFAR-100 and Tiny-ImageNet justify our theory. To our best knowledge, this is the first work on the topology-aware generalization of vanilla D-SGD. Code is available at https://github.com/Raiden-Zhu/Generalization-of-DSGD.

cs.LG↗

arXiv2025

Safety Layers in Aligned Large Language Models: The Key to LLM Security

Aligned LLMs are secure, capable of recognizing and refusing to answer malicious questions. However, the role of internal parameters in maintaining such security is not well understood yet, further these models can be vulnerable to security degradation when subjected to fine-tuning attacks. To address these challenges, our work uncovers the mechanism behind security in aligned LLMs at the parameter level, identifying a small set of contiguous layers in the middle of the model that are crucial for distinguishing malicious queries from normal ones, referred to as ``safety layers". We first confirm the existence of these safety layers by analyzing variations in input vectors within the model's internal layers. Additionally, we leverage the over-rejection phenomenon and parameters scaling analysis to precisely locate the safety layers. Building on these findings, we propose a novel fine-tuning approach, Safely Partial-Parameter Fine-Tuning (SPPFT), that fixes the gradient of the safety layers during fine-tuning to address the security degradation. Our experiments demonstrate that the proposed approach can significantly preserve LLM security while maintaining performance and reducing computational resources compared to full fine-tuning.

cs.CR↗

arXiv2025

A semantic communication-based workload-adjustable transceiver for wireless AI-generated content (AIGC) delivery

With the significant advances in generative AI (GAI) and the proliferation of mobile devices, providing high-quality AI-generated content (AIGC) services via wireless networks is becoming the future direction. However, the primary challenges of AIGC service delivery in wireless networks lie in unstable channels, limited bandwidth resources, and unevenly distributed computational resources. In this paper, we employ semantic communication (SemCom) in diffusion-based GAI models to propose a Resource-aware wOrkload-adjUstable TransceivEr (ROUTE) for AIGC delivery in dynamic wireless networks. Specifically, to relieve the communication resource bottleneck, SemCom is utilized to prioritize semantic information of the generated content. Then, to improve computational resource utilization in both edge and local and reduce AIGC semantic distortion in transmission, modified diffusion-based models are applied to adjust the computing workload and semantic density in cooperative content generation. Simulations verify the superiority of our proposed ROUTE in terms of latency and content quality compared to conventional AIGC approaches.

cs.LG↗

arXiv2025

Verification of entangled states under noisy measurements

Entanglement plays an indispensable role in numerous quantum information and quantum computation tasks, underscoring the need for efficiently verifying entangled states. In recent years, quantum state verification has received increasing attention, yet the challenge of addressing noise effects in implementing this approach remains unsolved. In this work, we provide a systematic assessment of the performance of quantum state verification protocols in the presence of measurement noise. Based on the analysis, a necessary and sufficient condition is provided to uniquely identify the target state under noisy measurements. Moreover, we propose a symmetric hypothesis testing verification algorithm with noisy measurements. Subsequently, using a noisy nonadaptive verification strategy of GHZ and stabilizer states, the noise effects on the verification efficiency are illustrated. From both analytical and numerical perspectives, we demonstrate that the noisy verification protocol exhibits a negative quadratic relationship between the sample complexity and the infidelity. Our method can be easily applied to real experimental settings, thereby demonstrating its promising prospects.

quant-ph↗

arXiv2025

Hide Your Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Carrier Articles

Large Language Model (LLM) jailbreak refers to a type of attack aimed to bypass the safeguard of an LLM to generate contents that are inconsistent with the safe usage guidelines. Based on the insights from the self-attention computation process, this paper proposes a novel blackbox jailbreak approach, which involves crafting the payload prompt by strategically injecting the prohibited query into a carrier article. The carrier article maintains the semantic proximity to the prohibited query, which is automatically produced by combining a hypernymy article and a context, both of which are generated from the prohibited query. The intuition behind the usage of carrier article is to activate the neurons in the model related to the semantics of the prohibited query while suppressing the neurons that will trigger the objectionable text. Carrier article itself is benign, and we leveraged prompt injection techniques to produce the payload prompt. We evaluate our approach using JailbreakBench, testing against four target models across 100 distinct jailbreak objectives. The experimental results demonstrate our method's superior effectiveness, achieving an average success rate of 63% across all target models, significantly outperforming existing blackbox jailbreak methods.

cs.CR↗

arXiv2024

RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service

Retrieval-augmented generation (RAG) improves the service quality of large language models by retrieving relevant documents from credible literature and integrating them into the context of the user query. Recently, the rise of the cloud RAG service has made it possible for users to query relevant documents conveniently. However, directly sending queries to the cloud brings potential privacy leakage. In this paper, we are the first to formally define the privacy-preserving cloud RAG service to protect the user query and propose RemoteRAG as a solution regarding privacy, efficiency, and accuracy. For privacy, we introduce $(n,ε)$-DistanceDP to characterize privacy leakage of the user query and the leakage inferred from relevant documents. For efficiency, we limit the search range from the total documents to a small number of selected documents related to a perturbed embedding generated from $(n,ε)$-DistanceDP, so that computation and communication costs required for privacy protection significantly decrease. For accuracy, we ensure that the small range includes target documents related to the user query with detailed theoretical analysis. Experimental results also demonstrate that RemoteRAG can resist existing embedding inversion attack methods while achieving no loss in retrieval under various settings. Moreover, RemoteRAG is efficient, incurring only $0.67$ seconds and $46.66$KB of data transmission ($2.72$ hours and $1.43$ GB with the non-optimized privacy-preserving scheme) when retrieving from a total of $10^6$ documents.

cs.IR↗

arXiv2024

Identifying the Galactic Substructures in 5D Space Using All-sky RR Lyrae Stars in Gaia DR3

Motivated by the vast gap between photometric and spectroscopic data volumes, there is great potential in using 5D kinematic information to identify and study substructures of the Milky Way. We identify substructures in the Galactic halo using 46,575 RR Lyrae stars (RRLs) from Gaia DR3 with the photometric metallicities and distances newly estimated by Li et al. (2023). Assuming a Gaussian prior distribution of radial velocity, we calculate the orbital distribution characterized by the integrals of motion for each RRL based on its 3D positions, proper motions and corresponding errors, and then apply the friends-of-friends algorithm to identify groups moving along similar orbits. We have identified several known substructures, including Sagittarius (Sgr) Stream, Hercules-Aquila Cloud (HAC), Virgo Overdensity (VOD), Gaia-Enceladus-Sausage (GES), Orphan-Chenab stream, Cetus-Palca, Helmi Streams, Sequoia, Wukong and Large Magellanic Cloud (LMC) leading arm, along with 18 unknown groups. Our findings indicate that HAC and VOD have kinematic and chemical properties remarkably similar to GES, with most HAC and VOD members exhibiting eccentricity as high as GES, suggesting that they may share a common origin with GES. The ability to identify the low mass and spatially dispersed substructures further demonstrates the potential of our method, which breaks the limit of spectroscopic survey and is competent to probe the substructures in the whole Galaxy. Finally, we have also identified 18 unknown groups with good spatial clustering and proper motion consistency, suggesting more excavation of Milky Way substructures in the future with only 5D data.

astro-ph.GA↗

arXiv2024

A Wireless AI-Generated Content (AIGC) Provisioning Framework Empowered by Semantic Communication

With the significant advances in AI-generated content (AIGC) and the proliferation of mobile devices, providing high-quality AIGC services via wireless networks is becoming the future direction. However, the primary challenges of AIGC services provisioning in wireless networks lie in unstable channels, limited bandwidth resources, and unevenly distributed computational resources. To this end, this paper proposes a semantic communication (SemCom)-empowered AIGC (SemAIGC) generation and transmission framework, where only semantic information of the content rather than all the binary bits should be generated and transmitted by using SemCom. Specifically, SemAIGC integrates diffusion models within the semantic encoder and decoder to design a workload-adjustable transceiver thereby allowing adjustment of computational resource utilization in edge and local. In addition, a Resource-aware wOrklOad Trade-off (ROOT) scheme is devised to intelligently make workload adaptation decisions for the transceiver, thus efficiently generating, transmitting, and fine-tuning content as per dynamic wireless channel conditions and service requirements. Simulations verify the superiority of our proposed SemAIGC framework in terms of latency and content quality compared to conventional approaches.

cs.NI↗

arXiv2024

DeepCore: Simple Fingerprint Construction for Differentiating Homologous and Piracy Models

As intellectual property rights, the copyright protection of deep models is becoming increasingly important. Existing work has made many attempts at model watermarking and fingerprinting, but they have ignored homologous models trained with similar structures or training datasets. We highlight challenges in efficiently querying black-box piracy models to protect model copyrights without misidentifying homologous models. To address these challenges, we propose a novel method called DeepCore, which discovers that the classification confidence of the model is positively correlated with the distance of the predicted sample from the model decision boundary and piracy models behave more similarly at high-confidence classified sample points. Then DeepCore constructs core points far away from the decision boundary by optimizing the predicted confidence of a few sample points and leverages behavioral discrepancies between piracy and homologous models to identify piracy models. Finally, we design different model identification methods, including two similarity-based methods and a clustering-based method to identify piracy models using models' predictions of core points. Extensive experiments show the effectiveness of DeepCore in identifying various piracy models, achieving lower missed and false identification rates, and outperforming state-of-the-art methods.

cs.CR↗

arXiv2024

Wireless Resource Optimization in Hybrid Semantic/Bit Communication Networks

Recently, semantic communication (SemCom) has shown great potential in significant resource savings and efficient information exchanges, thus naturally introducing a novel and practical cellular network paradigm where two modes of SemCom and conventional bit communication (BitCom) coexist. Nevertheless, the involved wireless resource management becomes rather complicated and challenging, given the unique background knowledge matching and time-consuming semantic coding requirements in SemCom. To this end, this paper jointly investigates user association (UA), mode selection (MS), and bandwidth allocation (BA) problems in a hybrid semantic/bit communication network (HSB-Net). Concretely, we first identify a unified performance metric of message throughput for both SemCom and BitCom links. Next, we specially develop a knowledge matching-aware two-stage tandem packet queuing model and theoretically derive the average packet loss ratio and queuing latency. Combined with practical constraints, we then formulate a joint optimization problem for UA, MS, and BA to maximize the overall message throughput of HSB-Net. Afterward, we propose an optimal resource management strategy by utilizing a Lagrange primal-dual transformation method and a preference list-based heuristic algorithm with polynomial-time complexity. Numerical results not only demonstrate the accuracy of our analytical queuing model, but also validate the performance superiority of our proposed strategy compared with different benchmarks.

cs.NI↗

arXiv2024

Deciphering the Kinematic Substructure of Local Dark Matter with LAMOST K Giants

Numerical simulations indicate that correlations exist between the velocity distributions of stars and dark matter (DM). We study the local DM velocity distribution based on these correlations. We select K giants from LAMOST DR8 cross-matched with {\gaia} DR3, which have robust measurements of velocity and metallicity, and separate them into the disk, halo substructure and isotropic halo components in the chemodynamical space utilizing the Gaussian Mixture Model. The substructure component is highly radially anisotropic, and possibly related to the \gaia-Enceladus-Sausage (GES) merger event, while the isotropic halo component is accreted from the earliest mergers following the Maxwell-Boltzmann distribution (Standard Halo Model, SHM). We find that the GES-like substructure contributes $\sim85\%$ of the local nondisk stars in the Solar neighbourhood, which is nearly invariant when applying different volume cuts or additional angular momentum constraints. Utilizing the metallicity-stellar mass relation and the stellar mass-halo mass relation, we find that $\sim25_{-15}^{+24}\%$ of local DM is in the kinematic substructure. Combined with the stellar distributions of nondisk components, we modify the heliocentric velocity distribution of local DM. It shifts to a lower speed with a sharper peak compared to the SHM, and updates the detection limits of DM direct detection experiments. We discuss extensively the degeneracies present in the GMM fitting and propose that more kinematic and chemical information such as $α$ abundance could help to break the degeneracy in the future. Our work confirms that the local DM velocity distribution deviates significantly from the SHM, and needs to be properly accounted for in the DM detection experiments.

astro-ph.GA↗

arXiv2024

Consistent Autoformalization for Constructing Mathematical Libraries

Autoformalization is the task of automatically translating mathematical content written in natural language to a formal language expression. The growing language interpretation capabilities of Large Language Models (LLMs), including in formal languages, are lowering the barriers for autoformalization. However, LLMs alone are not capable of consistently and reliably delivering autoformalization, in particular as the complexity and specialization of the target domain grows. As the field evolves into the direction of systematically applying autoformalization towards large mathematical libraries, the need to improve syntactic, terminological and semantic control increases. This paper proposes the coordinated use of three mechanisms, most-similar retrieval augmented generation (MS-RAG), denoising steps, and auto-correction with syntax error feedback (Auto-SEF) to improve autoformalization quality. The empirical analysis, across different models, demonstrates that these mechanisms can deliver autoformalizaton results which are syntactically, terminologically and semantically more consistent. These mechanisms can be applied across different LLMs and have shown to deliver improve results across different model types.

cs.CL↗

arXiv2024

S-RAN: Semantic-Aware Radio Access Networks

Semantic communication (SemCom) has been a transformative paradigm, emphasizing the precise exchange of meaningful information over traditional bit-level transmissions. However, existing SemCom research, primarily centered on simplified scenarios like single-pair transmissions with direct wireless links, faces significant challenges when applied to real-world radio access networks (RANs). This article introduces a Semantic-aware Radio Access Network (S-RAN), offering a holistic systematic view of SemCom beyond single-pair transmissions. We begin by outlining the S-RAN architecture, introducing new physical components and logical functions along with key design challenges. We then present transceiver design for end-to-end transmission to overcome conventional SemCom transceiver limitations, including static channel conditions, oversimplified background knowledge models, and hardware constraints. Later, we delve into the discussion on radio resource management for multiple users, covering semantic channel modeling, performance metrics, resource management algorithms, and a case study, to elaborate distinctions from resource management for legacy RANs. Finally, we highlight open research challenges and potential solutions. The objective of this article is to serve as a basis for advancing SemCom research into practical wireless systems.

eess.SP↗

arXiv2024

Hybrid Semantic/Bit Communication Based Networking Problem Optimization

This paper jointly investigates user association (UA), mode selection (MS), and bandwidth allocation (BA) problems in a novel and practical next-generation cellular network where two modes of semantic communication (SemCom) and conventional bit communication (BitCom) coexist, namely hybrid semantic/bit communication network (HSB-Net). Concretely, we first identify a unified performance metric of message throughput for both SemCom and BitCom links. Next, we comprehensively develop a knowledge matching-aware two-stage tandem packet queuing model and theoretically derive the average packet loss ratio and queuing latency. Combined with several practical constraints, we then formulate a joint optimization problem for UA, MS, and BA to maximize the overall message throughput of HSB-Net. Afterward, we propose an optimal resource management strategy by employing a Lagrange primal-dual method and devising a preference list-based heuristic algorithm. Finally, numerical results validate the performance superiority of our proposed strategy compared with different benchmarks.

cs.NI↗