arXiv subjects

Rui Wen

Publications and source records attributed to Rui Wen.

At least 19 recordsLinked to original sources

arXiv2026

SpecGuard: Inference-Time Backdoor Detection For Free

Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.

cs.CR↗

arXiv2026

Fierz-complete four-quark interactions and the QCD phase diagram

The dynamics of Fierz-complete four-quark interactions and its influence on the QCD phase diagram have been investigated within the functional renormalization group approach to QCD at finite temperature and densities. It is found that in the vacuum the pion and sigma channels play the overwhelmingly dominant role, and all the other channels are negligible. However, when it is near the critical end point (CEP), the magnitude of four-quark couplings in other channels increases sizably and they become more and more important. In comparison to the single scalar-pseudoscalar channel of four-quark interactions, the dynamics of Fierz-complete four-quark interactions increases a bit the curvature of the phase boundary, and moves the CEP to location of larger baryon chemical potential and smaller temperature.

hep-ph↗

arXiv2026

The Benchmark Illusion: Pruned LLMs Can Pass Multiple Choice but Fail to Answer

Compressing large language models reduces memory use and inference cost, but it can also create failures that standard benchmarks miss. A pruned model may still perform well on multiple-choice evaluations, yet fail to answer the same question in open generation. We ask what pruning changes: does it erase the correct answer, or does it make the answer harder to produce as the top output? We study this question with multilingual question answering, tracking the same questions before and after pruning. We find a benchmark illusion. Under high-sparsity pruning, especially Wanda, models often fail in greedy open generation while still selecting the correct answer under multiple-choice scoring. In these recognition-only errors, the answer is usually not gone, but demoted: it often reappears with beam search, sampling, or one in-context example. Overall, multiple-choice benchmarks can overstate the usability of compressed LLMs, creating an evaluation blind spot. Compressed models should be tested on what they can produce, not only on what they can recognize.

cs.CL↗

arXiv2026

BadBone: Backdoor Attacks Against Backbone Models in Visual Prompt Learning

Prompt learning is a new machine learning paradigm that has attracted ample attention due to its simplicity and proven efficacy. Despite its growing adoption, the security vulnerabilities associated with this paradigm remain underexplored. In this work, we take the first step to propose BadBone, a stealthy and adaptive backdoor attack against prompt learning using bi-level optimization. Instead of backdooring the prompt learning process, we aim to compromise a backbone model such that only target downstream tasks employing prompt learning inherit the backdoor vulnerability. Extensive experiments on three different models and three datasets from various domains show that our targeted/untargeted backdoored models achieve high attack performance while maintaining utility on both pre-training and downstream tasks. Moreover, we evaluate our approach against six state-of-the-art model-level defenses, including Neural Cleanse, ABS, MNTD, NAD, CLP, and D-BR. The results demonstrate that these defenses are largely ineffective against our backdoored models and thus leave the effective defense as an important direction for future work.

cs.CR↗

arXiv2026

Programmable Non-Hermitian Synchronization of Light on a Silicon Photonic Processor

Synchronization is a pervasive collective phenomenon underlying the firing of neurons, the beating of the heart, and the coherent emission of lasers. Across these systems, dissipation plays an organizing role, suppressing microscopic differences and steering coupled units toward a common macroscopic order. Here we harness engineered non-Hermitian dissipation to synchronize light directly in the optical domain. Implementing non Hermitian transition matrices on a silicon photonic processor, we drive arbitrary multimode optical fields toward a unique collective state with equal modal intensities and a globally locked phase, a process we call dissipation-induced phase synchronization. The synchronization rate and total optical power throughput are independently programmable, enabling control over the dissipative dynamics without compromising reconfigurability. These results recast dissipation as a functional resource and open a route to reconfigurable on-chip synchronization for classical and quantum photonic technologies.

physics.optics↗

arXiv2026

MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs

Backdoor attacks pose a serious security threat to large language models (LLMs), which are increasingly deployed as general-purpose assistants in safety- and privacy-critical applications. Existing LLM backdoors rely primarily on content-based triggers, requiring explicit modification of the input text. In this work, we show that this assumption is unnecessary and limiting. We introduce MetaBackdoor, a new class of backdoor attacks that exploits positional information as the trigger, without modifying textual content. Our key insight is that Transformer-based LLMs necessarily encode token positions to process ordered sequences. As a result, length-correlated positional structure is reflected in the model's internal computation and can be used as an effective non-content trigger signal. We demonstrate that even a simple length-based positional trigger is sufficient to activate stealthy backdoors. Unlike prior attacks, MetaBackdoor operates on visibly and semantically clean inputs and enables qualitatively new capabilities. We show that a backdoored LLM can be induced to disclose sensitive internal information, including proprietary system prompts, once a length condition is satisfied. We further demonstrate a self-activation scenario, where normal multi-turn interaction can move the conversation context into the trigger region and induce malicious tool-call behavior without attacker-supplied trigger text. In addition, MetaBackdoor is orthogonal to content-based backdoors and can be composed with them to create more precise and harder-to-detect activation conditions. Our results expand the threat model of LLM backdoors by revealing positional encoding as a previously overlooked attack surface. This challenges defenses that focus on detecting suspicious text and highlights the need for new defense strategies that explicitly account for positional triggers in modern LLM architectures.

cs.CR↗

arXiv2026

Non-Invertible Symmetries on Tensor-Product Hilbert Spaces and Quantum Cellular Automata

We investigate realizations of (1+1)-dimensional fusion category symmetries on tensor-product Hilbert spaces, allowing for mixing with quantum cellular automata (QCAs). It was argued recently that any such realizable symmetry must be weakly integral. We develop a systematic analysis of QCA-refined realizations of fusion categories and prove two statements. First, we show that, under certain physical assumptions on defects, any QCA-refined realization has QCA and symmetry-operator indices determined by the categorical data, up to the freedom of redefining the symmetry operators. Second, we construct a lattice model that provides a QCA-refined realization for any weakly integral fusion category symmetry on a tensor product Hilbert space. We also compute indices of the QCAs in our lattice model and show agreement with the first result. As an application of the general construction, we give an explicit QCA-refined realization of general Tambara-Yamagami categorical symmetries.

cond-mat.str-el↗

arXiv2026

Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills

LLM-powered coding agents increasingly make software supply chain decisions. They generate imports, recommend packages, and write installation commands. Prior work showed that these systems can hallucinate non-existent package names, which attackers may register as malicious packages. In this paper, we show that this risk is not only a passive model failure. It can be actively induced through the persistent Skill artifact. We introduce Dependency Steering, an attack paradigm in which a malicious Skill biases a coding agent toward an attacker-controlled package during benign coding tasks. The attack does not require modifying model weights, training data, or user prompts. To construct realistic attacks, we design a Skill-level optimization method that searches for localized semantic edits that preserve the apparent purpose of the original Skill while increasing targeted package generation. Across multiple coding-oriented LLMs and programming benchmarks, Dependency Steering achieves high targeted hallucination rates, transfers across models and task domains, and remains difficult for evaluated Skill scanners and LLM-based auditors to detect. Our results show that persistent agent instructions form an underexplored software supply chain attack surface.

cs.CR↗

arXiv2026

Categorical Time-Reversal Symmetries

The classification of phases using categorical symmetries has greatly expanded the landscape of gapped and gapless phases. So far, however, these developments have largely been restricted to phases with unitary (higher-)categorical symmetries over $\mathbb{C}$. In this work, we incorporate anti-unitary symmetries, such as time-reversal symmetry $\mathbb{Z}_2^T$, and show that the relevant physical structures are naturally described by fusion categories over $\mathbb{R}$. A class of real fusion categories, which we call Galois-real fusion categories, provides the correct categorical model for anti-unitary symmetries. A simple example is the time-reversal symmetry $\mathbb{Z}_2^T$ itself. We discuss the basic structures of real fusion categories and present a range of examples, including the group-theoretical categories $(G^T)^{\omega}$ and $\mathsf{Rep}(G^T)$ associated to anti-linear groups $G^T$, as well as non-invertible time-reversal symmetries described by a real analogue of Tambara--Yamagami fusion categories. We then classify gapped phases enriched with anti-linear symmetries in terms of module categories over Galois-real fusion categories. We furthermore apply the categorical formulation to prove dualities (i.e. gauge or Morita equivalences) of anti-linear symmetries generated by gauging subgroups. Complementing this, we also develop a Symmetry Topological Field Theory (SymTFT) framework, in which Galois-real fusion categories arise as boundary conditions of a $\mathbb{Z}_2^T$-enriched SymTFT. Morita equivalent anti-linear symmetries are shown to arise as different boundaries of the same $\mathbb{Z}_2^T$-enriched SymTFT.

cond-mat.str-el↗

arXiv2026

Strangeness neutrality and the QCD phase diagram

We map out the phase structure of $N_f=2+1$ flavour QCD at strangeness neutrality with functional QCD. We find a critical end point at $(T_{\rm CEP},\mu_{B,{\rm CEP}})|_{n_S=0} = (92, 696)$\,MeV. The computation is done with the functional renormalisation group, and we systematically improve on previous works, hence reducing the systematic error significantly. Our results pass relevant QCD benchmarks: they agree well with and corroborate the QCD phase structure from functional QCD results at vanishing strangeness chemical potential. Moreover, they agree well with lattice QCD results at vanishing chemical potential. Specifically, the ratio of the second order curvature coefficient $\kappa_2$ agrees with that obtained from lattice computations, $\kappa_2(n_S=0)/\kappa_2(\mu_S=0)=0.897(20)$.

hep-ph↗

arXiv2026

Spectral function for pions in magnetic field

This study examines the spectral functions of neutral ($\pi_0$) and charged ($\pi_{\pm}$) pions under a uniform magnetic field using the SU(2) Nambu-Jona-Lasinio (NJL) model with the Ritus method. The analysis highlights the complex interplay of magnetic field effects, thermal influences, and chiral symmetry on meson properties in extreme QCD environments. For $\pi_0$, whose properties are governed by the behavior of its constituent quarks, magnetic field-induced Landau levels lead to a multi-peak structure in its spectral function, reflecting stable and resonance solutions that evolve with temperature, showing shifts and critical enhancements near chiral restoration. For $\pi_{\pm}$, cross terms that come from the asymmetry between the constituent quarks introduce Landau cuts alongside Unitary cuts, indicating damping effects, with decay widths narrowing at higher temperatures, suggesting increased stability.

hep-ph↗

arXiv2026

Progressive Masked Refinement Self-supervised Learning for Low-Dose CT Denoising

Self-supervised learning has been increasingly investigated for low-dose computed tomography (LDCT) image denoising, as it alleviates the dependence on paired normal-dose CT (NDCT) data, which are often difficult to obtain. However, many existing self-supervised blind-spot denoising methods may under-utilize pixel-wise supervisory information loss due to evaluating the training loss only at masked locations. To mitigate this issue, we propose a novel Progressive Masked Refinement Learning framework that progressively refines denoising results while preserving and exploiting available LDCT information. Specifically, we explicitly inject a combination of controlled Gaussian and Poisson noise during training to regularize the denoising process and mitigate trivial identity mapping. Furthermore, we introduce a step-wise mask denoising mechanism that gradually reduces the discrepancy between synthetic corruption and the noise characteristics of LDCT images, enabling more fine-grained learning for denoising. Extensive experiments on the Mayo LDCT dataset demonstrate that the proposed method outperforms existing self-supervised approaches and achieves performance comparable to, or better than, several representative supervised denoising methods.

cs.CV↗

arXiv2026

SL-CBM: Enhancing Concept Bottleneck Models with Semantic Locality for Better Interpretability

Explainable AI (XAI) is crucial for building transparent and trustworthy machine learning systems, especially in high-stakes domains. Concept Bottleneck Models (CBMs) have emerged as a promising ante-hoc approach that provides interpretable, concept-level explanations by explicitly modeling human-understandable concepts. However, existing CBMs often suffer from poor locality faithfulness, failing to spatially align concepts with meaningful image regions, which limits their interpretability and reliability. In this work, we propose SL-CBM (CBM with Semantic Locality), a novel extension that enforces locality faithfulness by generating spatially coherent saliency maps at both concept and class levels. SL-CBM integrates a 1x1 convolutional layer with a cross-attention mechanism to enhance alignment between concepts, image regions, and final predictions. Unlike prior methods, SL-CBM produces faithful saliency maps inherently tied to the model's internal reasoning, facilitating more effective debugging and intervention. Extensive experiments on image datasets demonstrate that SL-CBM substantially improves locality faithfulness, explanation quality, and intervention efficacy while maintaining competitive classification accuracy. Our ablation studies highlight the importance of contrastive and entropy-based regularization for balancing accuracy, sparsity, and faithfulness. Overall, SL-CBM bridges the gap between concept-based reasoning and spatial explainability, setting a new standard for interpretable and trustworthy concept-based models.

cs.AI↗

arXiv2025

One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs

Finetuning pretrained large language models (LLMs) has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigate this question in a realistic pretrain-to-finetune threat model, where an attacker has full access to a released pretrained LLM but no access to its proprietary finetuned derivatives. Empirical analysis shows that adversarial prompts optimized on the pretrained model transfer most effectively to its finetuned variants, revealing inherited vulnerabilities from pretrained to finetuned LLMs. To further examine this inheritance, we conduct representation-level probing, which shows that transferable prompts are linearly separable within the pretrained hidden states, suggesting that transferability-relevant structure is already encoded in pretrained representations. Building on this insight, we propose the Probe-Guided Projection (PGP) attack, which steers optimization toward transferability-relevant directions. Experiments across multiple LLM families and diverse finetuned tasks confirm PGP's strong transfer success, underscoring the security risks inherent in the pretrain-to-finetune paradigm. Finally, we demonstrate that the same representation-level insights also enable a lightweight defense that mitigates pretrain-to-finetune jailbreak transfer while preserving downstream utility.

cs.CR↗

arXiv2025

AttackPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents

Inference attacks have been widely studied and offer a systematic risk assessment of ML services; however, their implementation and the attack parameters for optimal estimation are challenging for non-experts. The emergence of advanced large language models presents a promising yet largely unexplored opportunity to develop autonomous agents as inference attack experts, helping address this challenge. In this paper, we propose AttackPilot, an autonomous agent capable of independently conducting inference attacks without human intervention. We evaluate it on 20 target services. The evaluation shows that our agent, using GPT-4o, achieves a 100.0% task completion rate and near-expert attack performance, with an average token cost of only $0.627 per run. The agent can also be powered by many other representative LLMs and can adaptively optimize its strategy under service constraints. We further perform trace analysis, demonstrating that design choices, such as a multi-agent framework and task-specific action spaces, effectively mitigate errors such as bad plans, inability to follow instructions, task context loss, and hallucinations. We anticipate that such agents could empower non-expert ML service providers, auditors, or regulators to systematically assess the risks of ML services without requiring deep domain expertise.

cs.CR↗

arXiv2025

Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models

Large language models (LLMs) remain vulnerable to multi-turn jailbreaking attacks that exploit conversational context to bypass safety constraints gradually. These attacks target different harm categories through distinct conversational approaches. Existing multi-turn methods often rely on heuristic or ad hoc exploration strategies, providing limited insight into underlying model weaknesses. The relationship between conversation patterns and model vulnerabilities across harm categories remains poorly understood. We propose Pattern Enhanced Chain of Attack (PE-CoA), a framework of five conversation patterns to construct multi-turn jailbreaks through natural dialogue. Evaluating PE-CoA on twelve LLMs spanning ten harm categories, we achieve state-of-the-art performance, uncovering pattern-specific vulnerabilities and LLM behavioral characteristics: models exhibit distinct weakness profiles, defense to one pattern does not generalize to others, and model families share similar failure modes. These findings highlight limitations of safety training and indicate the need for pattern-aware defenses. Code available on: https://github.com/Ragib-Amin-Nihal/PE-CoA

cs.CL↗

arXiv2025

Functional renormalization group study of anomalous magnetic moment in a low energy effective theory

The quark anomalous magnetic moments (AMMs) are investigated in a 2-flavor low-energy effective theory within the functional renormalization group (FRG) approach under an external magnetic field. The Schwinger formalism is adopted for quark propagators, and Fierz-complete four-quark scatterings are self-consistently included through the renormalization group flows. We find that the quark AMMs are dynamically generated with the chiral symmetry breaking, and the magnitude of the AMM of the down quark is around 4 times larger than that of the up quark. The transverse AMMs and the longitudinal d-quark AMM monotonically decrease with the magnetic field strength, while the longitudinal u-quark AMM slightly increases with the magnetic field strength. At $B=0$, the magnetic moments of proton and neutron are computed using the constituent quark model, which are close to the experimental values.

hep-ph↗

arXiv2025

SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmark

Data reconstruction attacks, which aim to recover the training dataset of a target model with limited access, have gained increasing attention in recent years. However, there is currently no consensus on a formal definition of data reconstruction attacks or appropriate evaluation metrics for measuring their quality. This lack of rigorous definitions and universal metrics has hindered further advancement in this field. In this paper, we address this issue in the vision domain by proposing a unified attack taxonomy and formal definitions of data reconstruction attacks. We first propose a set of quantitative evaluation metrics that consider important criteria such as quantifiability, consistency, precision, and diversity. Additionally, we leverage large language models (LLMs) as a substitute for human judgment, enabling visual evaluation with an emphasis on high-quality reconstructions. Using our proposed taxonomy and metrics, we present a unified framework for systematically evaluating the strengths and limitations of existing attacks and establishing a benchmark for future research. Empirical results, primarily from a memorization perspective, not only validate the effectiveness of our metrics but also offer valuable insights for designing new attacks.

cs.CR↗