arXiv subjects

Meng Sun

Publications and source records attributed to Meng Sun.

At least 19 recordsLinked to original sources

arXiv2026

Non-Clifford quantum cellular automata from invertible topological quantum field theories

Quantum cellular automata (QCAs) describe locality-preserving quantum dynamics and connect quantum information, many-body physics, and topological quantum field theory (TQFT). Constructing a QCA from a TQFT, however, is challenging. Although a topological action can produce a commuting Hamiltonian realizing the desired ground state, it does not by itself specify an automorphism of the full local operator algebra. In this work, we develop a unified algebraic construction that extends the commuting generators of the Hamiltonian to a complete separator-flipper algebra on the full tensor-product Hilbert space, providing a microscopic definition of the corresponding QCA. In three spatial dimensions, our formalism unifies all previously known QCA constructions associated with the $\mathbb Z_8\times\mathbb Z_2$ subgroup of the Witt group, including the $U(1)_2$ and $U(1)_4$ QCAs. The same algebraic structure directly yields new infinite families of generalized $U(1)_2$ and $U(1)_4$ non-Clifford QCAs in dimensions $d=4k-1$. We also reformulate the 4-dimensional $w_2w_3$ QCA and use it to develop a general construction of QCAs from TQFTs associated with arbitrary products of Wu classes. This construction includes two infinite families. The first consists of $w_2^nw_3^m$ QCAs in dimension $d=2n+3m-1$, while the second consists of $w_2w_{4k-1}$ QCAs in dimension $d=4k$. As a contrasting result, we explicitly construct finite-depth quantum circuits for the 5-dimensional $w_3^2$ and $w_2^3$ QCAs, thereby proving that they are trivial, in agreement with the cobordism classification. Overall, these results convert invertible TQFTs into microscopic QCAs, provide a scalable route to higher-dimensional constructions beyond the Clifford setting, and open a systematic approach to classifying their stable structures and boundary anomalies.

quant-ph↗

arXiv2026

Unveiling the nature of G6096: a likely hierarchical triple system

G6096 (Gaia DR3 609651611028044544) was recently reported as a wide ($P\sim 450$ days) and eccentric ($e\sim0.18$) binary possibly hosting a massive white dwarf or neutron star. In this work, through analyses of the projected rotational velocity between the blue and red bands, spectral disentangling, joint radial velocity and astrometric fitting, and X-ray emission, we suggest that the system contains additional visible component(s) rather than a compact object. We develop a new approach to reveal the nature of G6096 by jointly modeling the spectral energy distribution, rotational velocity, and astrometric measurements. Finally, we speculate that G6096 is a hierarchical triple main-sequence star system, comprising a primary with a mass of $\sim 0.75\,M_\odot$ orbited by an inner binary consisting of two dwarfs with masses of $\sim 0.62\,M_\odot$ and $\sim 0.40\,M_\odot$, respectively. This method may help reveal a population of triple systems when applied to {\it Gaia} astrometric data, particularly the upcoming DR4.

astro-ph.SR↗

arXiv2026

Privacy-Preserving Robustness Verification for Neural Networks

Neural network verification and data privacy are inherently in tension: verification demands full access to model parameters and input data, yet both are increasingly restricted by privacy regulations and intellectual property constraints. This tension has left robustness verification impractical in privacy-sensitive domains. In this work, we address this gap with SecureCROWN, the first framework for privacy-preserving neural network robustness verification. Built upon secure two-party computation (2PC), our framework enables a model owner and a data owner to jointly compute certified robustness bounds -- revealing only the final result while provably protecting both parties' private data under the semi-honest security model. A key challenge is securely computing the conditional operations in Linear Bound Propagation, where the data-dependent branching is incompatible with standard secure computation protocols. We eliminate branching by formulating conditional logic as continuous arithmetic operations. Additionally, we introduce a Newton--Raphson refinement method to improve numerical stability. Extensive analysis and experiments show that SecureCROWN strictly matches plaintext verification results, while completing in 0.1--200s across varied model sizes and communication settings (LAN/WAN), demonstrating the feasibility of privacy-preserving neural network verification.

cs.CR↗

arXiv2026

Majorana-Pauli stabilizer codes and duality webs of fermionic topological phases

Stabilizer codes provide exact lattice realizations of bosonic topological orders. In contrast, systematic stabilizer descriptions of intrinsically fermionic topological phases remain much less developed. In this work, we introduce Majorana-Pauli stabilizer codes, a class of exactly solvable fermionic lattice models whose stabilizers are built from both generalized Pauli operators and Majorana operators. As a main example, we construct an exactly solvable stabilizer realization of the fermionic toric code: an intrinsically fermionic $\mathbb Z_2$ topological order in $(2{+}1)$ dimensions, using $\mathbb Z_8$ Pauli operators coupled to Majorana modes. Within this stabilizer framework, the anyons, string operators, fusion rules, and braiding statistics all follow naturally from the stabilizer algebra. More broadly, we show that the fermionic toric code belongs to a duality web generated by anyon condensation and by gauging bosonic or fermion-parity symmetries. This web connects bosonic topological orders, symmetry-enriched topological phases, and both bosonic and fermionic symmetry-protected topological phases, all within a common stabilizer description. We further show that the construction extends to all Abelian fermionic topological orders with gapped boundaries and to all supercohomology fermionic SPT phases in $(2{+}1)$ dimensions. Going beyond Majorana operators, we introduce fermionic versions of the clock and shift operators and use them to construct an exact bosonization map for $\mathbb Z_D^F$ symmetries for $D$ even. Using this, we realize a stabilizer model for a nontrivial $\mathbb Z_8^F$ fermionic SPT phase with no free-fermion analog. Altogether, these results extend the stabilizer-code paradigm to a broad class of intrinsically fermionic phases bridging fermionic quantum many-body physics to quantum error correction.

quant-ph↗

arXiv2026

VOW: Verifiable and Oblivious Watermark Detection for Large Language Models

Large Language Model (LLM) watermarking is crucial for establishing the provenance of machine-generated text, but most existing methods rely on a centralized trust model. This model forces users to reveal potentially sensitive text to a provider for detection and offers no way to verify the integrity of the result. While asymmetric schemes have been proposed to address these issues, they are either impractical for short texts or lack formal guarantees linking watermark insertion and detection. We propose VOW, a new protocol that achieves both privacy-preserving and cryptographically verifiable watermark detection with high efficiency. Our approach formulates detection as a secure two-party computation problem, instantiating the watermark's core logic with a Verifiable Oblivious Pseudorandom Function (VOPRF). This allows the user and provider to perform detection without the user's text being revealed, while the provider's result is verifiable. Our comprehensive evaluation shows that VOW is practical for short texts and provides a crucial reassessment of watermark robustness against modern paraphrasing attacks.

cs.CR↗

arXiv2026

From Monolithic to Compositional: A Compositional Operational Semantics for Crystality

Parallel execution has become a key approach to improving blockchain scalability, but the lack of formal semantics for smart contract languages in such settings makes rigorous reasoning difficult. Crystality is a smart contract language designed for parallel EVMs, supporting scoped state and asynchronous relay across execution engines. This paper introduces a compositional operational semantics for Crystality. Unlike the original monolithic semantics, the new semantics decomposes the system into engine components and a global component, making the structure of parallel execution explicit. The compositional formulation enables simple proofs of key structural properties, including locality, global isolation, and strong commutativity of independent local steps. Furthermore, we prove that the compositional semantics is semantically equivalent to the original one via a transaction-level bisimulation theorem based on encoding and decoding functions between configurations, and two code-level bisimulation theorems for local and global execution.

cs.PL↗

arXiv2026

Absorber LLM: Harnessing Causal Synchronization for Test-Time Training

Transformers suffer from a high computational cost that grows with sequence length for self-attention, making inference in long streams prohibited by memory consumption. Constant-memory alternatives such as RNNs and SSMs compress history into states with fixed size and thus lose long-tail dependencies, while methods that memorize contexts into parameters, such as Test-Time Training (TTT), are prone to overfitting token-level projection and fail to preserve the causal effect of context in pretrained LLMs. We propose Absorber LLM, which formulates long-context retention as a self-supervised causal synchronization: after absorbing historical contexts into parameters, a contextless model should match the original model with full context on future generations. We optimize this objective by synchronizing internal behaviors of the updated model with the original one, ensuring context absorption and generalization. Experiments on long-context and streaming benchmarks show that Absorber LLM reduces inference memory and improves accuracy over prior parameter-as-memory baselines.

cs.LG↗

arXiv2026

M100: An Orchestrated Dataflow Architecture Powering General AI Computing

As deep learning-based AI technologies gain momentum, the demand for general-purpose AI computing architectures continues to grow. While GPGPU-based architectures offer versatility for diverse AI workloads, they often fall short in efficiency and cost-effectiveness. Various Domain-Specific Architectures (DSAs) excel at particular AI tasks but struggle to extend across broader applications or adapt to the rapidly evolving AI landscape. M100 is Li Auto's response: a performant, cost-effective architecture for AI inference in Autonomous Driving (AD), Large Language Models (LLMs), and intelligent human interactions, domains crucial to today's most competitive automobile platforms. M100 employs a dataflow parallel architecture, where compiler-architecture co-design orchestrates not only computation but, more critically, data movement across time and space. Leveraging dataflow computing efficiency, our hardware-software co-design improves system performance while reducing hardware complexity and cost. M100 largely eliminates caching: tensor computations are driven by compiler- and runtime-managed data streams flowing between computing elements and on/off-chip memories, yielding greater efficiency and scalability than cache-based systems. Another key principle was selecting the right operational granularity for scheduling, issuing, and execution across compiler, firmware, and hardware. Recognizing commonalities in AI workloads, we chose the tensor as the fundamental data element. M100 demonstrates general AI computing capability across diverse inference applications, including UniAD (for AD) and LLaMA (for LLMs). Benchmarks show M100 outperforms GPGPU architectures in AD applications with higher utilization, representing a promising direction for future general AI computing.

cs.LG↗

arXiv2026

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

Large Language Models (LLMs) face prominent security risks from jailbreaking, a practice that manipulates models to bypass built-in security constraints and generate unethical or unsafe content. Among various jailbreak techniques, multi-turn jailbreak attacks are more covert and persistent than single-turn counterparts, exposing critical vulnerabilities of LLMs. However, existing multi-turn jailbreak methods suffer from two fundamental limitations that affect the actual impact in real-world scenarios: (a) As models become more context-aware, any explicit harmful trigger is increasingly likely to be flagged and blocked; (b) Successful final-step triggers often require finely tuned, model-specific contexts, making such attacks highly context-dependent. To fill this gap, we propose \textit{Salami Slicing Risk}, which operates by chaining numerous low-risk inputs that individually evade alignment thresholds but cumulatively accumulate harmful intent to ultimately trigger high-risk behaviors, without heavy reliance on pre-designed contextual structures. Building on this risk, we develop Salami Attack, an automatic framework universally applicable to multiple model types and modalities. Rigorous experiments demonstrate its state-of-the-art performance across diverse models and modalities, achieving over 90\% Attack Success Rate on GPT-4o and Gemini, as well as robustness against real-world alignment defenses. We also proposed a defense strategy to constrain the Salami Attack by at least 44.8\% while achieving a maximum blocking rate of 64.8\% against other multi-turn jailbreak attacks. Our findings provide critical insights into the pervasive risks of multi-turn jailbreaking and offer actionable mitigation strategies to enhance LLM security.

cs.CR↗

arXiv2026

AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems

Autonomous LLM-based agents increasingly operate as long-running processes forming densely interconnected multi-agent ecosystems, whose security properties remain largely unexplored. Systems such as OpenClaw, an open-source platform with over 40{,}000 active instances, persistent configurations, tool-execution privileges, and cross-platform messaging, are deployed at scale, yet the security of such agent ecosystems remains largely unexplored. This work presents AgentWorm, the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message: the worm first hijacks the victim's core configuration to establish persistent presence across session restarts, then executes an arbitrary payload upon each reboot, and finally propagates itself to every newly encountered peer without further attacker intervention. The attack is evaluated on a controlled testbed across five distinct LLM backends, three infection vectors, and three payload types. Results show a 63\% aggregate attack success rate, sustained multi-hop propagation, and stark divergences in model security postures, highlighting that while execution-level filtering effectively mitigates dormant payloads, skill supply chains remain universally vulnerable. Defenses are evaluated at three layers (prompt-level mitigations sourced from real community practice, the framework's built-in security controls, and an ecosystem-wide measurement of public configurations), revealing that the critical controls capable of breaking the infection loop are not enabled in any of the observed deployments. A cross-framework transferability experiment on Hermes Agent confirms that the underlying vulnerabilities are properties of the autonomous agent design pattern, not artifacts of a single implementation.

cs.CR↗

arXiv2026

RACC: Representation-Aware Coverage Criteria for LLM Safety Testing

Large Language Models (LLMs) face severe safety risks from jailbreak attacks, yet current safety testing largely relies on static datasets and lacks systematic criteria to evaluate test suite quality and adequacy. While coverage criteria have proven effective for smaller neural networks, they are impractical for LLMs due to computational overhead and the entanglement of safety-critical signals with irrelevant neuron activations. To address these issues, we propose RACC (Representation-Aware Coverage Criteria), a set of coverage criteria specialized for LLM safety testing. RACC first extracts safety representations from the LLM's hidden states using a small calibration set of harmful prompts, then measures test prompts' concept activations against these directions, and finally computes coverage through six criteria assessing both individual and compositional safety concept coverage. Experiments on multiple LLMs and safety benchmarks show that RACC reliably rewards high-quality jailbreak test suites while remaining insensitive to redundant or invalid inputs, which is a key distinction that neuron-level criteria fail to make. We further demonstrate RACC's practical value in two applications, including test suite prioritization and attack prompt sampling, and validate its generalization across diverse settings and configurations. Overall, RACC provides a scalable and principled foundation for coverage-guided LLM safety testing.

cs.SE↗

arXiv2026

The effects of star-gas interactions on binary evolution in open clusters

Star-gas interactions can provide gravitational feedback that influences the dynamical evolution of stellar clusters, through processes such as dynamical friction (DF) and its non-dissipative counterpart, negative dynamical friction (NDF). Using the \texttt{PeTar} code, we perform direct $N$-body simulations of an open cluster initially containing $10^4$ stars, evolving within a gaseous medium spanning a range of ambient densities. Our results demonstrate that NDF associated with stellar outflows interacting with the surrounding gas can enhance the rate of cluster expansion, preferentially transporting stars toward the cluster outskirts. This behavior is accompanied by a more rapid decline in the number of binaries composed of a neutron star and a main-sequence star. A statistical analysis of binary orbital parameters further indicates that, compared to DF-dominated evolution, NDF tends to retain systems with larger semi-major axes and lower eccentricities. Outflow-ambient gas interactions can modify the dynamical processing of binaries in star clusters, leading to changes in the survival fraction and composition of the remaining binary population.

astro-ph.GA↗

arXiv2025

Beyond Correctness: Exposing LLM-generated Logical Flaws in Reasoning via Multi-step Automated Theorem Proving

Large Language Models (LLMs) have demonstrated impressive reasoning capabilities, leading to their adoption in high-stakes domains such as healthcare, law, and scientific research. However, their reasoning often contains subtle logical errors masked by fluent language, posing significant risks for critical applications. While existing approaches like fact-checking, self-consistency methods, and rule-based validation provide partial solutions, they fail to detect complex logical flaws in multi-step reasoning. To overcome these challenges, we present MATP, an evaluation framework for systematically verifying LLM reasoning via Multi-step Automatic Theorem Proving. MATP translates natural language reasoning into First-Order Logic (FOL) and applies automated theorem provers to assess step-by-step logical validity. This approach identifies hidden logical errors and provides fine-grained classifications of reasoning correctness. Evaluations on a benchmark comprising 10,830 reasoning instances generated by 10 LLMs across tasks from PrOntoQA-OOD, ProofWriter, and FOLIO show that MATP surpasses prompting-based baselines by over 42 percentage points in reasoning step verification. It further reveals model-level disparities, with reasoning models generating more logically coherent outputs than general models. These results demonstrate MATP's potential to enhance the trustworthiness of LLM-generated reasoning.

cs.SE↗

arXiv2025

Tides in Massive Binaries: Numerical Solutions and Semi-Analytical Comparisons

We present a systematic comparison between the tidal secular evolution timescales predicted by the direct numerical method and those given by the commonly used semi-analytic prescriptions implemented in 1-D hydrostatic binary evolution codes. Our study focuses on binary systems with intermediate- to high-mass primaries ($M_1 = 5$-$50\,M_\odot$), companion masses between $1.4\,M_\odot$ and $10\,M_\odot$, and orbital periods ranging from 0.5 to 50 days. Before mass transfer, both approaches predict synchronization and orbital decay timescales that agree within $\sim$2 orders of magnitude and typically exceed the stellar main sequence lifetime, implying negligible tidal impact on secular orbital evolution. However, the implied dissipation channels differ, and the differences become more pronounced once mass transfer begins. To test the theoretical predictions against observations, we apply both approaches to the well-characterized PSR J0045--7319 system, which has an orbital decay timescale of 0.5 Myr. The numerical solution reveals strong resonances with internal gravity waves, bringing the predicted orbital period change rate close to the observed value. In contrast, the semi-analytic prescriptions predict orbital decay timescales longer than the Hubble time. These results suggest that for population studies, modestly calibrated parameterized equations may suffice, but for individual systems, reliable interpretation requires direct numerical approaches.

astro-ph.SR↗

arXiv2025

Numerical Non-Adiabatic Tidal Calculations with GYRE-tides: The WASP-12 Test Case

We revisit the tidal evolution of the WASP-12 system using direct numerical calculations with the GYRE-tides code. WASP-12b is a hot Jupiter on a 1.1-day orbit around a slightly evolved F-type star. Its observed orbital decay rate, $|\dot{P}_{\rm orb}/P_{\rm orb}| \approx 3.2\,\mathrm{Myr}^{-1}$, provides a strong constraint on stellar tidal dissipation. We confirm that linear tides with radiative damping and convective damping, as currently implemented, are not sufficient to reproduce the observed inspiral timescale. Nevertheless, our calculations, based on fully non-adiabatic forced oscillations in MESA stellar models with convective envelopes, yield dissipation rates that are consistent with previous semi-analytic and adiabatic estimates, confirming the robustness of our numerical framework. As the only open-source, actively maintained tool capable of computing orbital evolution in exoplanet systems, GYRE-tides provides a benchmark calculation for WASP-12 and future applications. Our results validate GYRE-tides as a tool for analyzing combined radiative and convective damping, and indicate that the observed decay rate requires tidal dissipation operating in or near the fully damped regime, which may be achieved through nonlinear damping. These contributions could also be evaluated by computing the wave luminosity at the radiative-convective boundary using our tool. GYRE-tides offers an open-source framework for computing tidal dissipation in short-period exoplanet systems, including the many systems expected to show orbital decay in upcoming Roman surveys.

astro-ph.SR↗

arXiv2025

Stabilizing Multi-Attack Adversarial Training via Bandit Optimization

Deep Neural Networks (DNNs) remain vulnerable to diverse adversarial perturbations, motivating multi-attack adversarial training (AT) for improved robustness. However, existing methods either incur prohibitive overhead by computing all attacks at each iteration, or rely on stochastic sampling over adversarial examples, which may cause excessive parameter drift. To address these issues, we propose Calibrated Adversarial Sampling (CAS), an efficient and stable framework that reformulates multi-attack AT as a multi-armed bandit optimization problem. By sampling a single attack per iteration that dynamically balances exploration and exploitation, CAS significantly reduces training cost while mitigating optimization conflicts across attacks and controlling excessive parameter drifts. Extensive experiments demonstrate that CAS achieves superior overall robustness at low computational cost, offering a scalable and principled approach to robust generalization against multi-attack settings. Our code is available at https://github.com/1240148048/CAS.

cs.LG↗

arXiv2025

Automata-Based Steering of Large Language Models for Diverse Structured Generation

Large language models (LLMs) are increasingly tasked with generating structured outputs. While structured generation methods ensure validity, they often lack output diversity, a critical limitation that we confirm in our preliminary study. We propose a novel method to enhance diversity in automaton-based structured generation. Our approach utilizes automata traversal history to steer LLMs towards novel structural patterns. Evaluations show our method significantly improves structural and content diversity while maintaining comparable generation efficiency. Furthermore, we conduct a case study showcasing the effectiveness of our method in generating diverse test cases for testing open-source libraries.

cs.CL↗

arXiv2025

Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation

Multi-Agent Systems (MAS) have become a prevalent paradigm for Large Language Model (LLM) applications. However, the complex multi-agent design in MAS introduces unique trustworthiness concerns: adversarial agents can inject misleading information that propagates contagiously through the system, corrupting benign agents and leading to false outputs. Existing graph-based defenses model agents as nodes and communications as edges, yet are limited to static-graph defenses. In this paper, we propose a dynamic defense paradigm that models MAS communication as a signed directed acyclic graph and computes each agent's contribution to the final decision via backward propagation, enabling accurate identification and isolation of malicious agents to secure multi-agent task collaboration. Experimental results in complex and dynamic MAS environments demonstrate that our method notably outperforms existing MAS defense mechanisms, providing an effective guardrail for trustworthy MAS deployment. Our code is available at https://github.com/ChengcanWu/BPD.

cs.CR↗