arXiv subjects

Shangzhi Xu

Publications and source records attributed to Shangzhi Xu.

5 recordsLinked to original sources

arXiv2026

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities

ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression (regex) engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and degrading service availability. To protect systems against ReDoS attacks, numerous detection techniques have been proposed that simulate the attack process by generating attack strings to proactively exploit ReDoS vulnerabilities at the early development stage and facilitate remediation. Existing techniques broadly fall into two classes: static analyses that search for pathological regex structures, and dynamic exploration methods that synthesize candidate attack strings. However, the generated attack strings are often impractical for real-world exploitation because they usually assume unrealistic input-length budgets and do not validate the effectiveness and efficiency of the attack at the program level. Therefore, many generated strings fail to trigger vulnerable regexes when applied to real-world programs, further limiting the practical utility. To address these shortcomings, we introduce an effective and efficient attack string generator, PUFFERDOS, designed to synthesize attack inputs that are both feasible within realistic length budgets and validated at the program level, enabling effective exploitation of ReDoS vulnerabilities in real-world programs. Specifically, we first define three vulnerable patterns based on our observation and formal verification. According to the patterns, PUFFERDOS conducts a synthesis technique to generate attack strings, and then refines and validates the strings with ReDoS-specific compositional concolic execution to guarantee real-world exploitability.

cs.CR↗

arXiv2026

A Globally Convergent Variational Framework for Mode Number Detection via Spectral Cutting Curves

Automatically determining the number of intrinsic mode functions (IMFs) and their center frequencies in Variational Mode Decomposition (VMD) remains an open mathematical challenge. Existing methods rely on heuristic settings, trial-and-error, or recursive extraction lacking theoretical convergence guarantees. We propose a variational framework that endogenously determines the number of modes. Any curve below the spectral amplitude divides the area under the spectrum into 2 parts and generate the connected intervals where spectrum locates above it, whose count defines the modal number K[g] -- a topological functional induced by the cutting curve. Since K[g] is discontinuous and intractable for direct optimization, we seek the optimal cutting curve as a continuous variational surrogate: it separates distinct spectral peaks into individual regions above it while merging noise-induced fragments below. This surrogate adversarially maximizes the integral of g while penalizing its curvature, transforming the problem into iteratively solving a fourth-order boundary value problem via Lagrangian duality. We establish a rigorous proof of global convergence for the dual ascent algorithm in function space. Comprehensive numerical experiments on artificial and real-world signals including ECG data show accurate estimates of IMFs and center frequencies, avoiding redundant modes while ensuring recovery of necessary components, providing a robust, theoretically grounded initialization routine for VMD.

math-ph↗

arXiv2026

VideoSTF: Stress-Testing Output Repetition in Video Large Language Models

Video Large Language Models (VideoLLMs) have recently achieved strong performance in video understanding tasks. However, we identify a previously underexplored generation failure: severe output repetition, where models degenerate into self-reinforcing loops of repeated phrases or sentences. This failure mode is not captured by existing VideoLLM benchmarks, which focus primarily on task accuracy and factual correctness. We introduce VideoSTF, the first framework for systematically measuring and stress-testing output repetition in VideoLLMs. VideoSTF formalizes repetition using three complementary n-gram-based metrics and provides a standardized testbed of 10,000 diverse videos together with a library of controlled temporal transformations. Using VideoSTF, we conduct pervasive testing, temporal stress testing, and adversarial exploitation across 10 advanced VideoLLMs. We find that output repetition is widespread and, critically, highly sensitive to temporal perturbations of video inputs. Moreover, we show that simple temporal transformations can efficiently induce repetitive degeneration in a black-box setting, exposing output repetition as an exploitable security vulnerability. Our results reveal output repetition as a fundamental stability issue in modern VideoLLMs and motivate stability-aware evaluation for video-language systems. Our evaluation code and scripts are available at: https://github.com/yuxincao22/VideoSTF_benchmark.

cs.CV↗

arXiv2025

NGCaptcha: A CAPTCHA Bridging the Past and the Future

CAPTCHAs are widely employed for distinguishing humans from automated bots online. However, current vision based CAPTCHAs face escalating security risks: traditional attacks continue to bypass many deployed CAPTCHA schemes, and recent breakthroughs in AI, particularly large scale vision models, enable machine solvers to significantly outperform humans on many CAPTCHA tasks, undermining their original design assumptions. To address these issues, we introduce NGCAPTCHA, a Next Generation CAPTCHA framework that integrates a lightweight client side proof of work (PoW) mechanism with an AI resistant visual recognition challenge. In NGCAPTCHA, a browser must first complete a small hash based PoW before any challenge is displayed, throttling large scale automated attempts by increasing their computational cost. Once the PoW is solved, the user is presented with a human friendly yet model resistant image selection task that exploits perceptual cues current vision systems still struggle with. This hybrid design combines computational friction with AI robust visual discrimination, substantially raising the barrier for automated bots while keeping the verification process fast and effortless for legitimate users.

cs.CY↗

arXiv2024

Enhancing Security in Third-Party Library Reuse -- Comprehensive Detection of 1-day Vulnerability through Code Patch Analysis

Nowadays, software development progresses rapidly to incorporate new features. To facilitate such growth and provide convenience for developers when creating and updating software, reusing open-source software (i.e., thirdparty library reuses) has become one of the most effective and efficient methods. Unfortunately, the practice of reusing third-party libraries (TPLs) can also introduce vulnerabilities (known as 1-day vulnerabilities) because of the low maintenance of TPLs, resulting in many vulnerable versions remaining in use. If the software incorporating these TPLs fails to detect the introduced vulnerabilities and leads to delayed updates, it will exacerbate the security risks. However, the complicated code dependencies and flexibility of TPL reuses make the detection of 1-day vulnerability a challenging task. To support developers in securely reusing TPLs during software development, we design and implement VULTURE, an effective and efficient detection tool, aiming at identifying 1-day vulnerabilities that arise from the reuse of vulnerable TPLs. It first executes a database creation method, TPLFILTER, which leverages the Large Language Model (LLM) to automatically build a unique database for the targeted platform. Instead of relying on code-level similarity comparison, VULTURE employs hashing-based comparison to explore the dependencies among the collected TPLs and identify the similarities between the TPLs and the target projects. Recognizing that developers have the flexibility to reuse TPLs exactly or in a custom manner, VULTURE separately conducts version-based comparison and chunk-based analysis to capture fine-grained semantic features at the function levels. We applied VULTURE to 10 real-world projects to assess its effectiveness and efficiency in detecting 1-day vulnerabilities. VULTURE successfully identified 175 vulnerabilities from 178 reused TPLs.

cs.SE↗