Searcharxiv⌕ Search

arXiv subjects

Qinfeng Li

Publications and source records attributed to Qinfeng Li.

At least 37 records · Page 2Linked to original sources
arXiv2025

Do Not Merge My Model! Safeguarding Open-Source LLMs Against Unauthorized Model Merging

Model merging has emerged as an efficient technique for expanding large language models (LLMs) by integrating specialized expert models. However, it also introduces a new threat: model merging stealing, where free-riders exploit models through unauthorized model merging. Unfortunately, existing defense mechanisms fail to provide effective protection. Specifically, we identify three critical protection properties that existing methods fail to simultaneously satisfy: (1) proactively preventing unauthorized merging; (2) ensuring compatibility with general open-source settings; (3) achieving high security with negligible performance loss. To address the above issues, we propose MergeBarrier, a plug-and-play defense that proactively prevents unauthorized merging. The core design of MergeBarrier is to disrupt the Linear Mode Connectivity (LMC) between the protected model and its homologous counterparts, thereby eliminating the low-loss path required for effective model merging. Extensive experiments show that MergeBarrier effectively prevents model merging stealing with negligible accuracy loss.

cs.CR↗
arXiv2025

RAGFort: Dual-Path Defense Against Proprietary Knowledge Base Extraction in Retrieval-Augmented Generation

Retrieval-Augmented Generation (RAG) systems deployed over proprietary knowledge bases face growing threats from reconstruction attacks that aggregate model responses to replicate knowledge bases. Such attacks exploit both intra-class and inter-class paths, progressively extracting fine-grained knowledge within topics and diffusing it across semantically related ones, thereby enabling comprehensive extraction of the original knowledge base. However, existing defenses target only one path, leaving the other unprotected. We conduct a systematic exploration to assess the impact of protecting each path independently and find that joint protection is essential for effective defense. Based on this, we propose RAGFort, a structure-aware dual-module defense combining "contrastive reindexing" for inter-class isolation and "constrained cascade generation" for intra-class protection. Experiments across security, performance, and robustness confirm that RAGFort significantly reduces reconstruction success while preserving answer quality, offering comprehensive defense against knowledge base extraction attacks.

cs.AI↗
arXiv2025

Heat Transfer Shape Optimization: Stability and Non-Optimality of the Ball

This paper investigates shape optimization problems in the context of heat transfer, with a focus on the stability and non-optimality of round domains under Robin boundary conditions. Using the flow approach and Steklov eigenvalue estimates, we derive the necessary and sufficient stability conditions for a ball to maximize the averaged heat when the heat source is radially decreasing. Our results show that, counterintuitively, a ball may not be optimal for maximizing the averaged heat under heat convection, even with radially decreasing heat sources located on the center of the ball. Moreover, we identify stability-breaking phenomena by giving precise values of thresholds, which depend on the Robin coefficient, dimension, and volume constraints. Additionally, we demonstrate that a ball can maximize the averaged temperature under certain conditions and we also explore optimal shapes in thin insulation problems.

math.AP↗
arXiv2025

Flow approach on Riesz type nonlocal energies

Via continuous deformations based on natural flow evolutions, we prove several novel monotonicity results for Riesz-type nonlocal energies on triangles and quadrilaterals. Some of these results imply new and simpler proofs for known theorems without relying on any symmetrization arguments.

math.AP↗
arXiv2024

TransLinkGuard: Safeguarding Transformer Models Against Model Stealing in Edge Deployment

Proprietary large language models (LLMs) have been widely applied in various scenarios. Additionally, deploying LLMs on edge devices is trending for efficiency and privacy reasons. However, edge deployment of proprietary LLMs introduces new security challenges: edge-deployed models are exposed as white-box accessible to users, enabling adversaries to conduct effective model stealing (MS) attacks. Unfortunately, existing defense mechanisms fail to provide effective protection. Specifically, we identify four critical protection properties that existing methods fail to simultaneously satisfy: (1) maintaining protection after a model is physically copied; (2) authorizing model access at request level; (3) safeguarding runtime reverse engineering; (4) achieving high security with negligible runtime overhead. To address the above issues, we propose TransLinkGuard, a plug-and-play model protection approach against model stealing on edge devices. The core part of TransLinkGuard is a lightweight authorization module residing in a secure environment, e.g., TEE. The authorization module can freshly authorize each request based on its input. Extensive experiments show that TransLinkGuard achieves the same security protection as the black-box security guarantees with negligible overhead.

cs.CR↗
arXiv2024

HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models

Retrieval-Augmented Generation (RAG) systems enhance large language models (LLMs) by integrating external knowledge, making them adaptable and cost-effective for various applications. However, the growing reliance on these systems also introduces potential security risks. In this work, we reveal a novel vulnerability, the retrieval prompt hijack attack (HijackRAG), which enables attackers to manipulate the retrieval mechanisms of RAG systems by injecting malicious texts into the knowledge database. When the RAG system encounters target questions, it generates the attacker's pre-determined answers instead of the correct ones, undermining the integrity and trustworthiness of the system. We formalize HijackRAG as an optimization problem and propose both black-box and white-box attack strategies tailored to different levels of the attacker's knowledge. Extensive experiments on multiple benchmark datasets show that HijackRAG consistently achieves high attack success rates, outperforming existing baseline attacks. Furthermore, we demonstrate that the attack is transferable across different retriever models, underscoring the widespread risk it poses to RAG systems. Lastly, our exploration of various defense mechanisms reveals that they are insufficient to counter HijackRAG, emphasizing the urgent need for more robust security measures to protect RAG systems in real-world deployments.

cs.CR↗
arXiv2024

On Laplacian eigenvalue equation with constant Neumann boundary data

Let $Ω$ be a bounded Lipshcitz domain in $\mathbb{R}^n$ and we study boundary behaviors of solutions to the Laplacian eigenvalue equation with constant Neumann data. \begin{align} \label{cequation0} \begin{cases} -Δu=cu\quad &\mbox{in $Ω$}\\ \frac{\partial u}{\partial ν}=-1\quad &\mbox{on $\partial Ω$}. \end{cases} \end{align}First, by using properties of Bessel functions and proving new inequalities on elementary symmetric polynomials, we obtain the following inequality for rectangular boxes, balls and equilateral triangles: \begin{align} \label{bbb} \lim_{c\rightarrow μ_2^-}c\int_{\partial Ω}u_c\, dσ\ge \frac{n-1}{n}\frac{P^2(Ω)}{|Ω|}, \end{align}with equality achieved only at cubes and balls. In the above, $u_c$ is the solution to the eigenvalue equation and $μ_2$ is the second Neumann Laplacian eigenvalue. Second, let $κ_1$ be the best constant for the Poincaré inequality with mean zero on $\partial Ω$, and we prove that $κ_1\le μ_2$, with equality holds if and only if $\int_{\partial Ω}u_c\, dσ>0$ for any $c\in (0,μ_2)$. As a consequence, $κ_1=μ_2$ on balls, rectangular boxes and equilateral triangles, and balls maximize $κ_1$ over all Lipschitz domains with fixed volume. As an application, we extend the symmetry breaking results from ball domains obtained in Bucur-Buttazzo-Nitsch[J. Math. Pures Appl., 2017], to wider class of domains, and give quantitative estimates for the precise breaking threshold at balls and rectangular boxes. It is a direct consequence that for domains with $κ_1<μ_2$, the above boundary limit inequality is never true, while whether it is valid for domains on which $κ_1=μ_2$ remains open.

math.AP↗
arXiv2023

Torsion energy with boundary mean zero condition

Motivated by establishing Neumann Talenti type comparison results, we concern the minimization of the following shape functional under volume constraint: \begin{align*} T(Ω):=\inf\left\{\frac12 \int_Ω |\nabla u|^2\,dx -\int_Ωu\,dx: u\in H^1(Ω),\ \int_{\partial Ω}udσ=0 \right\}. \end{align*} We prove that ball is a local minimizer to $T(\cdot)$ under smooth perturbation, but quite surprisingly, ball is not locally minimal to $T(\cdot)$ under Lipschitz perturbation. In fact, let $P_N$ be the regular polygon in $\mathbb{R}^2$ with $N$ sides and area $π$, then we prove that $T(P_N)$ is a strictly increasing function with respect to $N$ and $\lim_{N\rightarrow \infty}T(P_N)=T(B)$ where $B$ is the unit disk. As another side result, we prove that in dimension bigger than or equal to three, rigidity results of Serrin's seminal overdetermined system is not stable under Dirichlet perturbations, in contrast to the stability of rigidity under Neumann perturbation.

math.AP↗
arXiv2023

On location of maximum of gradient of torsion function

It has been a widely belief that for a planar convex domain with two coordinate axes of symmetry, the location of maximal norm of gradient of torsion function is either linked to contact points of largest inscribed circle or connected to points on boundary of minimal curvature. However, we show that this is not quite true in general. Actually, we derive the precise formula for the location of maximal norm of gradient of torsion function on nearly ball domains in $\mathbb{R}^n$, which displays nonlocal nature and thus does not inherently establish a connection to the aforementioned two types of points. Consequently, explicit counterexamples can be straightforwardly constructed to illustrate this deviation from conventional understanding. We also prove that for a rectangular domain, the maximum of the norm of gradient of torsion function exactly occurs at the centers of the faces of largest $(n-1)$-volume.

math.AP↗
arXiv2023

A stronger constant rank theorem

Motivated from one-dimensional rigidity results of entire solutions to Liouville equation, we consider the semilinear equation \begin{align} \label{liouvilleequationab} Δu=G(u) \quad \mbox{in $\mathbb{R}^n$}, \end{align}where $G>0, G'<0$ and $GG^{''}\le A(G')^2$, with $A>0$. Let $u$ be a smooth convex solution and $σ_k(D^2 u)$ be the $k$-th elementary symmetric polynomial with respect to $D^2u$. We prove stronger constant rank theorems in the following sense. (1) When $A\le 2$, if $σ_2(D^2u)$ takes a local minimum, then $D^2 u$ has constant rank $1$. (2) When $A\le \frac{n}{n-1}$, if $σ_n(D^2 u)$ takes a local minimum, then $σ_n(D^2 u)$ is always zero in the domain.

math.AP↗
arXiv2023

Concentration breaking on two optimization problems

In the present paper, we study the boundary concentration breaking phenomena on two thermal insulation problems considered on Lipschitz domains, based on Serrin's overdetermined results, perturbation argument and comparison of Laplacian eigenvalues with different boundary conditions. Since neither of the functionals in the two problems is $C^1$, another key ingredient is to obtain the global Hölder regularity of minimizers to both problems on Lipschitz domains. Also, exact dependence on domain of breaking thresholds is also given in the first problem, and the breaking values are obtained in the second problem on ball domains, which are related to $2π$ in dimension $2$.

math.AP↗
arXiv2022

On a variational problem of nematic liquid crystal droplets

Let $μ>0$ be a fixed constant, and we prove that minimizers to the following energy functional \begin{align*} E_f(u,Ω):=\int_Ω|\nabla u|^2+μP(Ω) \end{align*}exist among pairs $(Ω,u)$ such that $Ω$ is an $M$-uniform domain with finite perimeter and fixed volume, and $u \in H^1(Ω,\mathbb{S}^2)$ with $u =ν_Ω$, the measure-theoretical outer unit normal, almost everywhere on the reduced boundary of $Ω$. The uniqueness of optimal configurations in various settings is also obtained. In addition, we consider a general energy functional given by \begin{align*} E_f(u,Ω):=\int_Ω |\nabla u(x)|^2 \,dx + \int_{\partial^* Ω} f\big(u(x)\cdot ν_Ω(x)\big) \,d\mathcal{H}^2(x), \end{align*}where $\partial^* Ω$ is the reduced boundary of $Ω$ and $f$ is a convex positive function on $\mathbb R$. We prove that minimizers of $E_f$ also exist among $M$-uniform outer-minimizing domains $Ω$ with fixed volume and $u \in H^1(Ω,\mathbb{S}^2)$.

math.AP↗
arXiv2022

On smooth interior approximation of Sets of Finite Perimeter

In this paper, we prove that for any bounded set of finite perimeter $Ω\subset \mathbb{R}^n$, we can choose smooth sets $E_k \Subset Ω$ such that $E_k \rightarrow Ω$ in $L^1$ and \begin{align} \label{moregeneralapproximation} \limsup_{i \rightarrow \infty} P(E_i) \le P(Ω)+C_1(n) \mathscr{H}^{n-1}(\partial Ω\cap Ω^1). \end{align}In the above $Ω^1$ is the measure-theoretic interior of $Ω$, $P(\cdot)$ denotes the perimeter functional on sets, and $C_1(n)$ is a dimensional constant. Conversely, we prove that for any sets $E_k \Subset Ω$ satisfying $E_k \rightarrow Ω$ in $L^1$, there exists a dimensional constant $C_2(n)$ such that the following inequality holds: \begin{align} \label{gap} \liminf_{k \rightarrow \infty} P(E_k) \ge P(Ω)+ C_2(n) \mathscr{H}^{n-1}(\partial Ω\cap Ω^1). \end{align} In particular, these results imply that for a bounded set $Ω$ of finite perimeter,\begin{align} \label{char*} \mathscr{H}^{n-1}(\partial Ω\cap Ω^1)=0 \end{align} holds if and only if there exists a sequence of smooth sets $E_k$ such that $E_k \Subset Ω$, $E_k \rightarrow Ω$ in $L^1$ and $P(E_k) \rightarrow P(Ω)$.

math.AP↗
arXiv2022

Some geometric inequalities related to Liouville equation

In this paper, we prove that if $u$ is a solution to the Liouville equation \begin{align} \label{scalliouville} Δu+e^{2u} =0 \quad \mbox{in $\mathbb{R}^2$,} \end{align}then the diameter of $\mathbb{R}^2$ under the conformal metric $g=e^{2u}δ$ is bounded below by $π$. Here $δ$ is the Euclidean metric in $\mathbb{R}^2$. Moreover, we explicitly construct a family of solutions such that the corresponding diameters of $\mathbb{R}^2$ range over $[π,2π)$. We also discuss supersolutions. We show that if $u$ is a supersolution and $\int_{\mathbb{R}^2} e^{2u} dx<\infty$, then the diameter of $\mathbb{R}^2$ under the metric $e^{2u}δ$ is less than or equal to $2π$. For radial supersolutions, we use both analytical and geometric approaches to prove some inequalities involving conformal lengths and areas of disks in $\mathbb{R}^2$. We also discuss the connection of the above results with the sphere covering inequality in the case of Gaussian curvature bounded below by $1$. Higher dimensional generalizations are also discussed.

math.AP↗
arXiv2022

Rigidity results on Liouville equation

We give a complete classification of solutions bounded from above of the Liouville equation $$-Δu=e^{2u}\quad\mbox{in}\quad {\mathbf{R}}^2.$$ More generally, solutions in the class $$N:=\{ u:\limsup_{z\to\infty} u(z)/\log|z|:=k(u)<\infty\}$$ are described. As a consequence, we obtain five rigidity results. First, $k(u)$ can take only a discrete set of values: either $k=-2$, or $2k$ is a non-negative integer. Second, $u\to-\infty$ as $z\to\infty$, if and only if $u$ is radial about some point. Third, if $u$ is symmetric with respect to $x$ and $y$ axes and $u_x<0,\; u_y<0$ in the first quadrant then $u$ is radially symmetric. Fourth, if $u$ is concave and bounded from above, then $u$ is one-dimensional. Fifth, if $u$ is bounded from above, and the diameter of ${\mathbf{R}}^2$ with the metric $e^{2u}δ$ is $π$, where $δ$ is the Euclidean metric, then $u$ is either radial about a point or one-dimensional. In addition, we extend the concavity rigidity result on Liouville equation in higher dimensions.

math.AP↗
arXiv2022

Stability analysis on the thermal insulation problems

Based on the domain variational point of view, we carry on stability analysis on two shape optimization problems from thermal insulation background. The novelty is that, we do not require that the second variation is normal to the boundary. For example, translation variation is not normal, but as one can see in our work, it not only plays a role in obtaining the necessary and sufficient condition for stability of ball shape in the first problem when heat source is radial, but also is essential in deriving the precise value of symmetry breaking threshold of insulation material in the second problem, which turns out to be related to isoperimetric constant and in turn implies that ball shapes are stable in two dimensions.

math.AP↗
arXiv2020

Traces and Extensions of Bounded Divergence-Measure Fields on Rough Open Sets

We prove that an open set $Ω\subset \mathbb{R}^n$ can be approximated by smooth sets of uniformly bounded perimeter from the interior if and only if the open set $Ω$ satisfies \begin{align*} &\qquad \qquad\qquad\qquad\qquad\qquad\qquad \mathscr{H}^{n-1}(\partial Ω\setminus Ω^0)<\infty, \qquad &&\quad\qquad\qquad \qquad\qquad (*) \end{align*} where $Ω^0$ is the measure-theoretic exterior of $Ω$. Furthermore, we show that condition (*) implies that the open set $Ω$ is an extension domain for bounded divergence-measure fields, which improves the previous results that require a strong condition that $\mathscr{H}^{n-1}(\partial Ω)<\infty$. As an application, we establish a Gauss-Green formula up to the boundary on any open set $Ω$ satisfying condition (*) for bounded divergence-measure fields, for which the corresponding normal trace is shown to be a bounded function concentrated on $\partial Ω\setminus Ω^0$. This new formula does not require the set of integration to be compactly contained in the domain where the vector field is defined. In addition, we also analyze the solvability of the divergence equation on a rough domain with prescribed trace on the boundary, as well as the extension domains for bounded $BV$ functions.

math.FA↗