arXiv subjects

Rui Wen

Publications and source records attributed to Rui Wen.

At least 37 records · Page 2Linked to original sources

arXiv2026

Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models

Large language models (LLMs) remain vulnerable to multi-turn jailbreaking attacks that exploit conversational context to bypass safety constraints gradually. These attacks target different harm categories through distinct conversational approaches. Existing multi-turn methods often rely on heuristic or ad hoc exploration strategies, providing limited insight into underlying model weaknesses. The relationship between conversation patterns and model vulnerabilities across harm categories remains poorly understood. We propose Pattern Enhanced Chain of Attack (PE-CoA), a framework of five conversation patterns to construct multi-turn jailbreaks through natural dialogue. Evaluating PE-CoA on twelve LLMs spanning ten harm categories, we achieve state-of-the-art performance, uncovering pattern-specific vulnerabilities and LLM behavioral characteristics: models exhibit distinct weakness profiles, defense to one pattern does not generalize to others, and model families share similar failure modes. These findings highlight limitations of safety training and indicate the need for pattern-aware defenses. Code available on: https://github.com/Ragib-Amin-Nihal/PE-CoA

cs.CL↗

arXiv2026

Spectral function for pions in magnetic field

This study examines the spectral functions of neutral ($π_0$) and charged ($π_{\pm}$) pions under a uniform magnetic field using the SU(2) Nambu-Jona-Lasinio (NJL) model with the Ritus method. The analysis highlights the complex interplay of magnetic field effects, thermal influences, and chiral symmetry on meson properties in extreme QCD environments. For $π_0$, whose properties are governed by the behavior of its constituent quarks, magnetic field-induced Landau levels lead to a multi-peak structure in its spectral function, reflecting stable and resonance solutions that evolve with temperature, showing shifts and critical enhancements near chiral restoration. For $π_{\pm}$, cross terms that come from the asymmetry between the constituent quarks introduce Landau cuts alongside Unitary cuts, indicating damping effects, with decay widths narrowing at higher temperatures, suggesting increased stability.

hep-ph↗

arXiv2026

SL-CBM: Enhancing Concept Bottleneck Models with Semantic Locality for Better Interpretability

Explainable AI (XAI) is crucial for building transparent and trustworthy machine learning systems, especially in high-stakes domains. Concept Bottleneck Models (CBMs) have emerged as a promising ante-hoc approach that provides interpretable, concept-level explanations by explicitly modeling human-understandable concepts. However, existing CBMs often suffer from poor locality faithfulness, failing to spatially align concepts with meaningful image regions, which limits their interpretability and reliability. In this work, we propose SL-CBM (CBM with Semantic Locality), a novel extension that enforces locality faithfulness by generating spatially coherent saliency maps at both concept and class levels. SL-CBM integrates a 1x1 convolutional layer with a cross-attention mechanism to enhance alignment between concepts, image regions, and final predictions. Unlike prior methods, SL-CBM produces faithful saliency maps inherently tied to the model's internal reasoning, facilitating more effective debugging and intervention. Extensive experiments on image datasets demonstrate that SL-CBM substantially improves locality faithfulness, explanation quality, and intervention efficacy while maintaining competitive classification accuracy. Our ablation studies highlight the importance of contrastive and entropy-based regularization for balancing accuracy, sparsity, and faithfulness. Overall, SL-CBM bridges the gap between concept-based reasoning and spatial explainability, setting a new standard for interpretable and trustworthy concept-based models.

cs.AI↗

arXiv2025

AttackPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents

Inference attacks have been widely studied and offer a systematic risk assessment of ML services; however, their implementation and the attack parameters for optimal estimation are challenging for non-experts. The emergence of advanced large language models presents a promising yet largely unexplored opportunity to develop autonomous agents as inference attack experts, helping address this challenge. In this paper, we propose AttackPilot, an autonomous agent capable of independently conducting inference attacks without human intervention. We evaluate it on 20 target services. The evaluation shows that our agent, using GPT-4o, achieves a 100.0% task completion rate and near-expert attack performance, with an average token cost of only $0.627 per run. The agent can also be powered by many other representative LLMs and can adaptively optimize its strategy under service constraints. We further perform trace analysis, demonstrating that design choices, such as a multi-agent framework and task-specific action spaces, effectively mitigate errors such as bad plans, inability to follow instructions, task context loss, and hallucinations. We anticipate that such agents could empower non-expert ML service providers, auditors, or regulators to systematically assess the risks of ML services without requiring deep domain expertise.

cs.CR↗

arXiv2025

Functional renormalization group study of anomalous magnetic moment in a low energy effective theory

The quark anomalous magnetic moments (AMMs) are investigated in a 2-flavor low-energy effective theory within the functional renormalization group (FRG) approach under an external magnetic field. The Schwinger formalism is adopted for quark propagators, and Fierz-complete four-quark scatterings are self-consistently included through the renormalization group flows. We find that the quark AMMs are dynamically generated with the chiral symmetry breaking, and the magnitude of the AMM of the down quark is around 4 times larger than that of the up quark. The transverse AMMs and the longitudinal d-quark AMM monotonically decrease with the magnetic field strength, while the longitudinal u-quark AMM slightly increases with the magnetic field strength. At $B=0$, the magnetic moments of proton and neutron are computed using the constituent quark model, which are close to the experimental values.

hep-ph↗

arXiv2025

SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmark

Data reconstruction attacks, which aim to recover the training dataset of a target model with limited access, have gained increasing attention in recent years. However, there is currently no consensus on a formal definition of data reconstruction attacks or appropriate evaluation metrics for measuring their quality. This lack of rigorous definitions and universal metrics has hindered further advancement in this field. In this paper, we address this issue in the vision domain by proposing a unified attack taxonomy and formal definitions of data reconstruction attacks. We first propose a set of quantitative evaluation metrics that consider important criteria such as quantifiability, consistency, precision, and diversity. Additionally, we leverage large language models (LLMs) as a substitute for human judgment, enabling visual evaluation with an emphasis on high-quality reconstructions. Using our proposed taxonomy and metrics, we present a unified framework for systematically evaluating the strengths and limitations of existing attacks and establishing a benchmark for future research. Empirical results, primarily from a memorization perspective, not only validate the effectiveness of our metrics but also offer valuable insights for designing new attacks.

cs.CR↗

arXiv2025

Soft modes in hot QCD matter

The chiral crossover of QCD at finite temperature and vanishing baryon density turns into a second order phase transition if lighter than physical quark masses are considered. If this transition occurs sufficiently close to the physical point, its universal critical behaviour would largely control the physics of the QCD phase transition. We quantify the size of this region in QCD using functional approaches, both Dyson-Schwinger equations and the functional renormalisation group. The latter allows us to study both critical and non-critical effects on equal footing, facilitating a precise determination of the scaling regime. We find that the physical point is far away from the critical region. Importantly, we show that the physics of the chiral crossover is dominated by soft modes even far beyond the critical region. While scaling functions determine all thermodynamic properties of the system in the critical region, the order parameter potential is the relevant quantity away from it. We compute this potential in QCD using the functional renormalisation group and Dyson-Schwinger equations and provide a simple parametrisation for phenomenological applications.

hep-ph↗

arXiv2025

Topological Holography for 2+1-D Gapped and Gapless Phases with Generalized Symmetries

We study topological holography for 2+1-D gapped and gapless phases with generalized symmetries using tools from higher linear algebra and higher condensation theory. We focus on bosonic fusion 2-category symmetries, where the Symmetry Topological Field Theory (SymTFT) are 3+1D Dijkgraaf-Witten theories. (1). Gapped phases are obtained from the sandwich construction with gapped symmetry and physical boundaries. A gapped boundary of the 3+1D SymTFT is called minimal if it has no intrinsic 2+1-D topological order. We derive the general structure of a sandwich construction with minimal gapped symmetry and physical boundaries, including the underlying topological order and the symmetry action. We also study some concrete examples with 2-group or non-invertible symmetries. (2). For gapless phases, we show that the SymTFT provides a complete description of the \textit{topological skeleton} of a gapless phase. The topological skeleton of a gapless phase is the higher categorical structure of its topological defects. We rigorously establish this relation for 2+1-D gapless phases with finite group symmetries. For a gapless phase with a finite group symmetry, its topological skeleton(also known as gapless SPT(gSPT)) can be characterized by the decorated domain wall construction. We give a precise formulation of this using spectral sequence. We show that certain class of condensable algebras in the SymTFT $\mathcal{Z}_1[2\mathbf{Vec}_G]$, which we call minimal condensable algebras, has exactly the same structure. We further give a cohomological classification of minimal condensable algebras, which enables us to compute the classification of 2+1-D $G$-gSPTs via ordinary group cohomology. Finally we use SymTFT to construct 2+1-D gSPT with generalized symmetries, including an intrinsically gSPT(igSPT) with exact non-invertible fusion 2-category symmetry and anomalous 2-group IR symmetry.

hep-th↗

arXiv2025

String condensation and topological holography for 2+1D gapless SPT

The theory of anyon condensation is the foundation of the bulk-boundary relation and topological holography in 2+1D/1+1D. It is believed string condensation should replace anyon condensation in the 3+1D/2+1D topological holography theory. In this work we study string condensations in 3+1D topological orders and their relations to 2+1D phases. We find that a class of non-Lagrangian condensable algebras in 3+1D are exactly dual to a class of 2+1D symmetry enriched gapless phases known as gapless SPTs(gSPT). We show how topological properties of a gSPT can be fully extracted from the dual string condensation. We give an algebraic classification of this class of condensable algebras in 3+1D $G$-gauge theories that we call magnetic and simple. Through the topological holography dictionary, this maps to the classification of 2+1D $G$-symmetric phases with no topological order, including gapped and gapless SPTs. Utilizing the classification, we identify three classes of gSPTs and study their properties and gauging. Along the way, we reveal physical structures of string condensations.

cond-mat.str-el↗

arXiv2024

Cheshire qudits from fractional quantum spin Hall states in twisted MoTe$_2$

Twisted MoTe$_2$ homobilayers exhibit transport signatures consistent with a fractional quantum spin Hall (FQSH) state. We describe a route to construct topological quantum memory elements, dubbed Cheshire qudits, formed from punching holes in such a FQSH state and using proximity-induced superconductivity to gap out the resulting helical edge states. Cheshire qudits encode quantum information in states that differ by a fractional topological "Cheshire" charge that is hidden from local detection within a condensate anyons. Control of inter-edge tunneling by gates enables both supercurrent-based readout of a Cheshire qudit, and capacitive measurement of the thermal entropy associated with its topological ground-space degeneracy. Additionally, we systematically classify different types of gapped boundaries, Cheshire qudits, and parafermionic twist defects for various Abelian and non-Abelian candidate FQSH orders that are consistent with the transport data, and describe experimental signatures to distinguish these orders.

cond-mat.str-el↗

arXiv2024

The QCD moat regime and its real-time properties

Dense QCD matter may exhibit crystalline phases. Their existence is reflected in a moat regime, where mesonic correlations feature spatial modulations. We study the realtime properties of pions at finite temperature and density in QCD in order to elucidate the nature of this regime. We show that the moat regime arises from particle-hole-like fluctuations near the Fermi surface. This gives rise to a characteristic peak in the spectral function of the pion at nonzero \emph{spacelike} momentum. This peak can be interpreted as a new quasi particle, the moaton. In addition, our framework also allows us to directly test the stability of the homogeneous chiral phase against the formation of an inhomogeneous condensate in QCD. We find that the formation of such a phase is highly unlikely for baryon chemical potentials $μ_B \leq 630$\,MeV.

hep-ph↗

arXiv2024

Magnetic catalysis and diamagnetism from pion fluctuations

In the framework of Nambu--Jona-Lasinio model beyond mean field approximation, the effects of pion fluctuations on (inverse) magnetic catalysis and magnetic susceptibility are studied. The negative magnetic susceptibility at low temperature is observed when contributions from both neutral and charged pions are taken into account. In weak field approximation, it is observed that at finite temperature, the magnetic inhibition effect in the chiral limit, resulting from the difference between the transverse and longitudinal velocities of neutral pions, converts to weak magnetic catalysis when considering a non-zero current quark mass. Moreover, the magnetic catalysis is amplified by the charged pions.

hep-ph↗

arXiv2024

Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?

Machine learning has revolutionized numerous domains, playing a crucial role in driving advancements and enabling data-centric processes. The significance of data in training models and shaping their performance cannot be overstated. Recent research has highlighted the heterogeneous impact of individual data samples, particularly the presence of valuable data that significantly contributes to the utility and effectiveness of machine learning models. However, a critical question remains unanswered: are these valuable data samples more vulnerable to machine learning attacks? In this work, we investigate the relationship between data importance and machine learning attacks by analyzing five distinct attack types. Our findings reveal notable insights. For example, we observe that high importance data samples exhibit increased vulnerability in certain attacks, such as membership inference and model stealing. By analyzing the linkage between membership inference vulnerability and data importance, we demonstrate that sample characteristics can be integrated into membership metrics by introducing sample-specific criteria, therefore enhancing the membership inference performance. These findings emphasize the urgent need for innovative defense mechanisms that strike a balance between maximizing utility and safeguarding valuable data against potential exploitation.

cs.CR↗

arXiv2024

Membership Inference Attacks Against In-Context Learning

Adapting Large Language Models (LLMs) to specific tasks introduces concerns about computational efficiency, prompting an exploration of efficient methods such as In-Context Learning (ICL). However, the vulnerability of ICL to privacy attacks under realistic assumptions remains largely unexplored. In this work, we present the first membership inference attack tailored for ICL, relying solely on generated texts without their associated probabilities. We propose four attack strategies tailored to various constrained scenarios and conduct extensive experiments on four popular large language models. Empirical results show that our attacks can accurately determine membership status in most cases, e.g., 95\% accuracy advantage against LLaMA, indicating that the associated risks are much higher than those shown by existing probability-based attacks. Additionally, we propose a hybrid attack that synthesizes the strengths of the aforementioned strategies, achieving an accuracy advantage of over 95\% in most cases. Furthermore, we investigate three potential defenses targeting data, instruction, and output. Results demonstrate combining defenses from orthogonal dimensions significantly reduces privacy leakage and offers enhanced privacy assurances.

cs.CR↗

arXiv2024

Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition

Large language model systems face important security risks from maliciously crafted messages that aim to overwrite the system's original instructions or leak private data. To study this problem, we organized a capture-the-flag competition at IEEE SaTML 2024, where the flag is a secret string in the LLM system prompt. The competition was organized in two phases. In the first phase, teams developed defenses to prevent the model from leaking the secret. During the second phase, teams were challenged to extract the secrets hidden for defenses proposed by the other teams. This report summarizes the main insights from the competition. Notably, we found that all defenses were bypassed at least once, highlighting the difficulty of designing a successful defense and the necessity for additional research to protect LLM systems. To foster future research in this direction, we compiled a dataset with over 137k multi-turn attack chats and open-sourced the platform.

cs.CR↗

arXiv2024

Instruction Backdoor Attacks Against Customized LLMs

The increasing demand for customized Large Language Models (LLMs) has led to the development of solutions like GPTs. These solutions facilitate tailored LLM creation via natural language prompts without coding. However, the trustworthiness of third-party custom versions of LLMs remains an essential concern. In this paper, we propose the first instruction backdoor attacks against applications integrated with untrusted customized LLMs (e.g., GPTs). Specifically, these attacks embed the backdoor into the custom version of LLMs by designing prompts with backdoor instructions, outputting the attacker's desired result when inputs contain the pre-defined triggers. Our attack includes 3 levels of attacks: word-level, syntax-level, and semantic-level, which adopt different types of triggers with progressive stealthiness. We stress that our attacks do not require fine-tuning or any modification to the backend LLMs, adhering strictly to GPTs development guidelines. We conduct extensive experiments on 6 prominent LLMs and 5 benchmark text classification datasets. The results show that our instruction backdoor attacks achieve the desired attack performance without compromising utility. Additionally, we propose two defense strategies and demonstrate their effectiveness in reducing such attacks. Our findings highlight the vulnerability and the potential risks of LLM customization such as GPTs.

cs.CR↗

arXiv2024

Universal structure of measurement-induced information in many-body ground states

Unlike unitary dynamics, measurements of a subsystem can induce long-range entanglement via quantum teleportation. The amount of measurement-induced entanglement or mutual information depends jointly on the measurement basis and the entanglement structure of the state (before measurement), and has operational significance for whether the state is a resource for measurement-based quantum computing, as well as for the computational complexity of simulating the state using quantum or classical computers. In this work, we examine entropic measures of measurement-induced entanglement (MIE) and information (MII) for the ground-states of quantum many-body systems in one- and two- spatial dimensions. From numerical and analytic analysis of a variety of models encompassing critical points, quantum Hall states, string-net topological orders, and Fermi liquids, we identify universal features of the long-distance structure of MIE and MII that depend only on the underlying phase or critical universality class of the state. We argue that, whereas in $1d$ the leading contributions to long-range MIE and MII are universal, in $2d$, the existence of a teleportation transition for finite-depth circuits implies that trivial $2d$ states can exhibit long-range MIE, and the universal features lie in sub-leading corrections. We introduce modified MIE measures that directly extract these universal contributions. As a corollary, we show that the leading contributions to strange-correlators, used to numerically identify topological phases, are in fact non-universal in two or more dimensions, and explain how our modified constructions enable one to isolate universal components. We discuss the implications of these results for classical- and quantum- computational simulation of quantum materials.

quant-ph↗

arXiv2024

Topological holography for fermions

Topological holography is a conjectured correspondence between the symmetry charges and defects of a $D$-dimensional system with the anyons in a $(D+1)$-dimensional topological order: the symmetry topological field theory (SymTFT). Topological holography is conjectured to capture the topological aspects of symmetry in gapped and gapless systems, with different phases corresponding to different gapped boundaries (anyon condensations) of the SymTFT. This correspondence was previously considered primarily for bosonic systems, excluding many phases of condensed matter systems involving fermionic electrons. In this work, we extend the SymTFT framework to establish a topological holography correspondence for fermionic systems. We demonstrate that this fermionic SymTFT framework captures the known properties of $1+1D$ fermion gapped phases and critical points, including the classification, edge-modes, and stacking rules of fermionic symmetry-protected topological phases (SPTs), and computation of partition functions of fermionic conformal field theories (CFTs). Beyond merely reproducing known properties, we show that the SymTFT approach can additionally serve as a practical tool for discovering new physics, and use this framework to construct a new example of a fermionic intrinsically gapless SPT phase characterized by an emergent fermionic anomaly.

cond-mat.str-el↗