arXiv subjects

Taoran Li

Publications and source records attributed to Taoran Li.

16 recordsLinked to original sources

arXiv2026

AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents

Indirect prompt injection (IPI) is a major security threat to LLM-powered agents. Thus, a growing body of work have proposed a variety of defensive approaches against IPI. These can be grouped into three broad categories: 1) prompt-based (using prompting as a way to prevent agents from following malicious instructions), 2) detection-based (identifying and filtering malicious instructions), and 3) system-level (using systems insights, such as control and data isolation, for defense). However, commonly used benchmarks for evaluating defense, such as AgentDojo, are \emph{inherently static}, generating a fixed distribution of IPI attacks. Consequently, static benchmarks do not usefully evaluate defense robustness to adaptive threats. We address this issue by developing AutoDojo, an adaptive extension of AgentDojo that optimizes IPI against a given defense. Using AutoDojo against state-of-the-art IPI defenses across three task suites and five target models, we make two key observations. First, many defenses offer only limited protection: a cheap, black-box adaptive attack using a frontier LLM to iteratively optimize the injection raises attack success rate (ASR) well above the level achieved by static injections against nearly all evaluated defenses. Against a filter that reduces static ASR to 0\%, AutoDojo recovers 28\% overall and 64\% on action-open tasks. Second, for prompt-level and filter-based defenses, ASR is substantially higher on \emph{action-open} tasks -- where the user's request delegates the action itself to attacker-controlled content -- than on precisely specified tasks. This is a structural limit: on such tasks the injection can pose as ordinary data rather than an explicit instruction, bypassing defenses that rely on detecting instruction-like text. AutoDojo is publicly available at https://github.com/xhOwenMa/AutoDojo.

cs.CR↗

arXiv2026

Dynamic Modulated Arc Therapy (DMAT): A Time Aware, Modulation Steered Optimization Framework for Next Generation Radiotherapy Delivery

Background: Conventional VMAT optimization treats delivery time and deliverability as emergent properties of control-point-centric models that ignore finite acceleration and other dynamic limits. As linacs gain axis speed and dose rate, the plan quality-time trade-off must become explicit and steerable. Purpose: To introduce Dynamic Modulated Arc Therapy (DMAT), a time-aware, modulation-steered framework that jointly optimizes dosimetric quality, delivery time, and modulation complexity. Methods: DMAT couples direct machine emulation (axis synchronization, finite acceleration), dynamic modulation control, and clinical metrics used directly as cost functions. A user-selected modulation level (-3 to +3) governs leaf-travel allowance, total MU, aperture complexity, and control-point (CP) density. Plans are generated by progressive-resolution optimization alternating dosimetric with sequencing/deliverability updates, with non-uniform CP redistribution and complexity-reducing post-processing. DMAT was evaluated on head-and-neck, lung SBRT, and prostate SBRT cases using a hypothetical accelerated system (2.5 RPM gantry, 6.25 cm/s MLC, 3000 MU/min). Results: Increasing modulation level raised modulation surrogates (MU/Gy, aperture complexity) and delivery time, with additional CPs concentrated in arc sectors where finer angular resolution was most beneficial. The trade-off was site dependent: head-and-neck gained substantial plan quality, whereas prostate and lung SBRT gained little beyond baseline. Negative levels predictably shortened delivery time at a fixed CP budget, with quantifiable quality loss. Conclusions: DMAT co-optimizes plan quality and modulation complexity under machine-aware timing and explicit user control, making quality-time trade-offs transparent and navigable and supporting time-constrained workflows such as motion management and adaptive radiotherapy.

physics.med-ph↗

arXiv2026

Chain of Risk: Safety Failures in Large Reasoning Models and Mitigation via Adaptive Multi-Principle Steering

Large reasoning models (LRMs) increasingly expose chain-of-thought-like reasoning for transparency, verification, and deliberate problem solving. This creates a safety blind spot: harmful or policy-violating content may appear in reasoning traces even when final answers appear safe. We test whether final-answer safety is a sufficient proxy for the full reasoning-answer trajectory by scoring both stages under a unified twenty-principle safety rubric. Using prompts from seven public harmfulness and jailbreak sources, plus four out-of-distribution (OOD) sources, we evaluate 15 open-weight and API-based LRMs across 41K prompts per model. Reasoning traces consistently reveal additional safety risks beyond final answers, especially in high-severity stage-wise failures: leak cases, where unsafe reasoning precedes a safe-looking answer, and escape cases, where benign-looking reasoning precedes an unsafe final response. Principle-level analysis shows that risk concentrates in misinformation, legal compliance, discrimination, physical harm, and psychological harm. We further propose adaptive multi-principle steering, a white-box test-time mitigation that learns one unsafe-to-safe activation direction per safety principle and activates only directions whose current hidden state is closer to the unsafe than safe centroid. On three steerable open reasoning models, adaptive steering reduces unsafe counts in both reasoning traces and final answers on held-out and OOD benchmarks. DeepSeek-R1-Qwen-7B achieves a 40.8% average unsafe-count reduction while retaining 97.7% macro-averaged accuracy on BBH, GSM8K, and MMLU. These results suggest that LRM safety should be evaluated and mitigated over the full exposed reasoning-answer trajectory, not only at the final-answer stage.

cs.AI↗

arXiv2026

Layer-Targeted Multilingual Knowledge Erasure in Large Language Models

Recent work has demonstrated that machine unlearning in Large Language Models (LLMs) fails to generalize across languages: knowledge erased in one language frequently remains accessible through others. However, the underlying cause of this failure and a principled solution remain open. In this work, we identify intervention depth as the key factor determining multilingual generalization. Through systematic layer-wise experiments, we characterize two distinct failure modes: shallow-layer interventions achieve erasure but collapse multilingual capabilities in held-out languages, while deep-layer interventions preserve utility but fail to erase target knowledge even in source languages. These findings reveal that the choice of intervention layer is not a free parameter; it fundamentally determines whether multilingual unlearning succeeds. We propose MUTE (Multilingual Unlearning via Targeted Erasure), a framework that uses Centered Kernel Alignment (CKA) and Linguistic Regions Development Score (LRDS) to identify intermediate, language-agnostic layers where cross-lingual representations converge. By restricting unlearning updates to these layers, MUTE achieves robust multilingual knowledge erasure while optimizing on only a small set of source languages. Extensive experiments across three LLM architectures and three unlearning algorithms validate our approach, with mechanistic analysis via Logit Lens probing confirming genuine knowledge removal rather than output-level suppression.

cs.CR↗

arXiv2025

The Erasure Illusion: Stress-Testing the Generalization of LLM Forgetting Evaluation

Machine unlearning aims to remove specific data influences from trained models, a capability essential for adhering to copyright laws and ensuring AI safety. Current unlearning metrics typically measure success by monitoring the model's performance degradation on the specific unlearning dataset ($D_u$). We argue that for Large Language Models (LLMs), this evaluation paradigm is insufficient and potentially misleading. Many real-world uses of unlearning--motivated by copyright or safety--implicitly target not only verbatim content in $D_u$, but also behaviors influenced by the broader generalizations the model derived from it. We demonstrate that LLMs can pass standard unlearning evaluation and appear to have "forgotten" the target knowledge, while simultaneously retaining strong capabilities on content that is semantically adjacent to $D_u$. This phenomenon indicates that erasing exact sentences does not necessarily equate to removing the underlying knowledge. To address this gap, we propose Proximal Surrogate Generation (PSG), an automated stress-testing framework that generates a surrogate dataset, $\tilde{D}_u$. This surrogate set is constructed to be semantically derived from $D_u$ yet sufficiently distinct in embedding space. By comparing unlearning metric scores between $D_u$ and $\tilde{D}_u$, we can stress-test the reliability of the metric itself. Our extensive evaluation across three LLM families (Llama-3-8B, Qwen2.5-7B, and Zephyr-7B-$\beta$), three distinct datasets, and seven standard metrics reveals widespread inconsistencies. We find that current metrics frequently overestimate unlearning success, failing to detect retained knowledge exposed by our stress-test datasets.

cs.CR↗

arXiv2025

SoK: Understanding (New) Security Issues Across AI4Code Use Cases

AI-for-Code (AI4Code) systems are reshaping software engineering, with tools like GitHub Copilot accelerating code generation, translation, and vulnerability detection. Alongside these advances, however, security risks remain pervasive: insecure outputs, biased benchmarks, and susceptibility to adversarial manipulation undermine their reliability. This SoK surveys the landscape of AI4Code security across three core applications, identifying recurring gaps: benchmark dominance by Python and toy problems, lack of standardized security datasets, data leakage in evaluation, and fragile adversarial robustness. A comparative study of six state-of-the-art models illustrates these challenges: insecure patterns persist in code generation, vulnerability detection is brittle to semantic-preserving attacks, fine-tuning often misaligns security objectives, and code translation yields uneven security benefits. From this analysis, we distill three forward paths: embedding secure-by-default practices in code generation, building robust and comprehensive detection benchmarks, and leveraging translation as a route to security-enhanced languages. We call for a shift toward security-first AI4Code, where vulnerability mitigation and robustness are embedded throughout the development life cycle.

cs.CR↗

arXiv2025

Temperature and wind characteristics of Lenghu site for ventilation and structural design of large telescope enclosure

In recent years, a significant number of observatories and universities have been planning to construct optical and infrared telescopes at the Lenghu site in Qinghai Province due to the site's excellent seeing and clear night sky fraction. Although astronomical performances of the Lenghu site have been reported in detail by numerous papers, there were few reports showing statistics of temperature and wind characteristics in the traditional way required for the design of steel structures of large astronomical telescopes and enclosures, as well as the ventilation and air conditioning systems of these enclosures. This paper aims to present such new statistical data on temperature and wind conditions at the site, which could be helpful to inform and aid in such design decisions at the Lenghu site

astro-ph.IM↗

arXiv2025

A Survey On Secure Machine Learning

In this survey, we will explore the interaction between secure multiparty computation and the area of machine learning. Recent advances in secure multiparty computation (MPC) have significantly improved its applicability in the realm of machine learning (ML), offering robust solutions for privacy-preserving collaborative learning. This review explores key contributions that leverage MPC to enable multiple parties to engage in ML tasks without compromising the privacy of their data. The integration of MPC with ML frameworks facilitates the training and evaluation of models on combined datasets from various sources, ensuring that sensitive information remains encrypted throughout the process. Innovations such as specialized software frameworks and domain-specific languages streamline the adoption of MPC in ML, optimizing performance and broadening its usage. These frameworks address both semi-honest and malicious threat models, incorporating features such as automated optimizations and cryptographic auditing to ensure compliance and data integrity. The collective insights from these studies highlight MPC's potential in fostering collaborative yet confidential data analysis, marking a significant stride towards the realization of secure and efficient computational solutions in privacy-sensitive industries. This paper investigates a spectrum of SecureML libraries that includes cryptographic protocols, federated learning frameworks, and privacy-preserving algorithms. By surveying the existing literature, this paper aims to examine the efficacy of these libraries in preserving data privacy, ensuring model confidentiality, and fortifying ML systems against adversarial attacks. Additionally, the study explores an innovative application domain for SecureML techniques: the integration of these methodologies in gaming environments utilizing ML.

cs.CR↗

arXiv2025

Zk-SNARK for String Match

We present a secure and efficient string-matching platform leveraging zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) to address the challenge of detecting sensitive information leakage while preserving data privacy. Our solution enables organizations to verify whether private strings appear on public platforms without disclosing the strings themselves. To achieve computational efficiency, we integrate a sliding window technique with the Rabin-Karp algorithm and Rabin Fingerprint, enabling hash-based rolling comparisons to detect string matches. This approach significantly reduces time complexity compared to traditional character-by-character comparisons. We implement the proposed system using gnark, a high-performance zk-SNARK library, which generates succinct and verifiable proofs for privacy-preserving string matching. Experimental results demonstrate that our solution achieves strong privacy guarantees while maintaining computational efficiency and scalability. This work highlights the practical applications of zero-knowledge proofs in secure data verification and contributes a scalable method for privacy-preserving string matching.

cs.CR↗

arXiv2025

MedGUIDE: Benchmarking Clinical Decision-Making in Large Language Models

Clinical guidelines, typically structured as decision trees, are central to evidence-based medical practice and critical for ensuring safe and accurate diagnostic decision-making. However, it remains unclear whether Large Language Models (LLMs) can reliably follow such structured protocols. In this work, we introduce MedGUIDE, a new benchmark for evaluating LLMs on their ability to make guideline-consistent clinical decisions. MedGUIDE is constructed from 55 curated NCCN decision trees across 17 cancer types and uses clinical scenarios generated by LLMs to create a large pool of multiple-choice diagnostic questions. We apply a two-stage quality selection process, combining expert-labeled reward models and LLM-as-a-judge ensembles across ten clinical and linguistic criteria, to select 7,747 high-quality samples. We evaluate 25 LLMs spanning general-purpose, open-source, and medically specialized models, and find that even domain-specific LLMs often underperform on tasks requiring structured guideline adherence. We also test whether performance can be improved via in-context guideline inclusion or continued pretraining. Our findings underscore the importance of MedGUIDE in assessing whether LLMs can operate safely within the procedural frameworks expected in real-world clinical settings.

cs.CL↗

arXiv2021

An empirical comparison of primary baffle and vanes for optical astronomical telescope

In optical astronomical telescopes, the primary baffle is a tube-like structure centering in the hole of the primary mirror and the vanes usually locate inside the baffle, improving the suppression of stray light. They are the most common methods of stray light control. To characterize the performance of primary baffle and vanes, an empirical comparison based on astronomical observations has been made with Xinglong 50cm telescope. Considering the convenience of switching, an independent vanes structure is designed, which can also improve the process of the primary mirror cooling and the air circulation. The comparison of two cases: (1) primary baffle plus vanes and (2) vanes alone involves in-dome and on-sky observations. Both the single star and the various off-axis angles of the stray light source observations are presented. The photometrical images are recorded by CCD to analyze the magnitude and the photometric error. The stray light uniformity of the image background derives from the reduction image which utilizes the MATLAB software to remove the stars. The in-dome experiments results reveal the effectiveness of primary baffle and the independent vanes structure. Meanwhile, the on-sky photometric data indicate there are little differences between them. The stray light uniformity has no difference when the angle between the star and the moon is greater than 20 degrees.

astro-ph.IM↗

arXiv2021

Wind environment analysis of ground-based optical observatory

The telescopes and the infrastructures may alter the local wind environment around the observatory and further affect the observing environment. After the completion of site testing, it is necessary to analyze the wind environment of the entire site and plan the telescope layout to make use of the excellent conditions scientifically and rationally. Taking a typical observatory as an example, the effect of topographical features on wind environment and the mutual interference between telescope enclosures are analyzed by using Computational Fluid Dynamics (CFD) method. The CFD simulations are compared with the seeing data from Differential Image Motion Monitor (DIMM), the results are in good agreement, which verifies the effectiveness of the CFD method. The results of wind environment analysis can provide reasonable suggestions for site layout and construction, improving the observing environment and the image quality.

astro-ph.IM↗

arXiv2021

Analyzing Wikipedia Membership Dataset and PredictingUnconnected Nodes in the Signed Networks

In the age of digital interaction, person-to-person relationships existing on social media may be different from the very same interactions that exist offline. Examining potential or spurious relationships between members in a social network is a fertile area of research for computer scientists -- here we examine how relationships can be predicted between two unconnected people in a social network by using area under Precison-Recall curve and ROC. Modeling the social network as a signed graph, we compare Triadic model,Latent Information model and Sentiment model and use them to predict peer to peer interactions, first using a plain signed network, and second using a signed network with comments as context. We see that our models are much better than random model and could complement each other in different cases.

cs.AI↗

arXiv2019

A method of real-time analysis for stray light uniformity of optical telescope

The stray light uniformity is one of the important factors affecting the signal-to-noise ratio of the optical astronomical telescope. It will cause regional differences in the background intensity of the detector image, resulting in a decrease of the differential photometry accuracy. The source that affects stray light uniformity is the inconsistency of the brightness of the sky background, which comes from moonlight, bright star, and city lighting pollution. During CCD reduction, the effect of background uniformity cannot be eliminated by dividing the flat field. Star deletion method is used in real-time stray light analysis. It's very convenient to achieve a 'clear' background image without stars in MATLAB. A contour map of stray light distribution for each object image will be given to demonstrate the background uniformity directly. The stray light uniformity analysis method is implemented by the following steps: 1) CCD reduction, including preprocessing of an object image with bias and flat field; 2) Histogram generation, performing star subtraction automatically based on ADU value and frequency; 3) Background stray light contour map generation, stray light uniformity and other parameters calculations. This method will calculate the uniformity of image surface in real time, provide background intensity distribution, statistical data of the CCD image and suggestion on compare star selection during CCD data processing and improve the photometry accuracy.

astro-ph.IM↗

arXiv2019

Stray light analysis of the Xinglong 2.16m telescope

An effort towards understanding of the stray light problems for the Xinglong 2.16-m telescope was presented to estimate the stray light performance of the telescope itself and provide a method for improving the stray light suppression. The stray light analysis for 2.16-m telescope model, which consists the onion shaped dome, telescope structure, equatorial mount and telescope optics, has been performed with two cases (1) point to 60° and (2) point to zenith, in both azimuth and elevation direction. The Point Source Normalized Irradiance Transmittance (PSNIT), which is generally used for assessing stray light and uncorrelated to entrance aperture, was calculated with a series of off-axis angles. It shows that the PSNIT values are less than 10-7 when off-axis angles are larger than 20°. The dominant contributors of stray light (primary and secondary mirror, telescope structure and dome) were identified to give advice for performance improvement. The analyses indicate that significant benefit can be realized with adding only 5 vanes inside the bottom portion of the secondary baffle. In the case of point to zenith, the PSNIT values will decrease about 40% at average.

astro-ph.IM↗

arXiv2018

Upgraded Photometric System of The 85-cm Telescope at Xinglong Station

The 85-cm telescope at the Xinglong station is a well-operated prime focus system with high science outputs. The telescope has been upgraded since 2014 with new corrector, filters and camera, which are provided by Beijing Normal University (BNU). The filter set is Johnson-Cousins UBVRI system. We report the test results of the new system including the bias, dark current, linearity, gain and readout noise of the CCD camera . Then we derive accurate instrumental calibration coefficients in UBVRI bands with Landolt standard stars in the photometric nights. Finally, we give the limiting magnitudes with various exposure time and signal-to-noise ratio for observers as references.

astro-ph.IM↗