Searcharxiv⌕ Search

arXiv subjects

Taylan Alpay

Publications and source records attributed to Taylan Alpay.

At least 19 recordsLinked to original sources
arXiv2026

AccretionLink: On-Device Auditing of Exposure-Control Attacks on Attribute Inference

Exposure control lets an adversary rank authentic public posts to strengthen private-attribute inference without altering content. AccretionLink defines confidentiality and integrity games for this attack, models bounded selection odds through partial identification, and constructs dependence-aware time-uniform e-processes. On 52 held-out synthetic profiles, odds-four selection reduced aggregate negative log likelihood at every horizon. At eight posts the advantage was 0.01595 nats (95% CI [0.00890, 0.02336]), three of four target effects survived Holm adjustment, and label-blind model-guided selection caused 6/109 high-confidence false reversals. On 142 PAN15 test profiles, exploratory selection produced a 0.01227-nat advantage but no reversal. A separate TF-IDF selector retained a 0.01470-nat advantage against the unchanged G5 target, while matched identity shuffling did not reproduce it. Pixel 10 encoded all 1,622 held-out posts once with a fallback-free Tensor G5 graph. A P-256 checkpoint authenticated the selected-replay, actual-model, native-report, and operation digests; local KeyInfo identified the signing key as StrongBox-backed.

cs.CR↗
arXiv2026

Conductance-Repair Evidence Graphs for Prospective Security Retrieval

Security retrieval is often evaluated as ranking over complete evidence, but operational triage is prospective: CVE descriptions, weakness metadata, fix commits, EPSS scores, KEV membership, validation-vector metadata, and side-channel benchmark routes arrive through separate channels, and many are missing, delayed, poisoned, or visible only after the decision time. We introduce conductance-repair evidence graphs, a timestamped framework in which retrieval is performed over a temporal admissibility mask and missing channels are widened by a deterministic graph-flow recurrence rather than by a learned predictor. The method emits a repair certificate recording source probes, decision time, withheld edges, repaired channels, forbidden post-decision edges, backend availability, numerical deviation, and verifier results. The theoretical layer gives an adaptive \(\lceil\log_2 N\rceil\) lower bound for missing-channel identification, an NP-hardness result for minimum harmful repair, and a fixed-parameter certified search bound for \(q\) questionable channels. The current artifact materializes 30 deduplicated public security records, 57 terms, and 58 withheld admissible document-term edges. Under random edge withholding, conductance repair changes recall@\(k\) from 0.017 to 0.069 and average precision from 0.062 to 0.060, while a synthetic security fixture improves recall@\(k\) from 0.055 to 0.099; the public AP drop exposes a limit of broad admissible repair under random edge corruption. The implementation benchmarks the same flow/SVD/einsum kernel under NumPy, PyTorch, JAX, and TensorFlow when available, recording unavailable backends rather than silently substituting them. BBBC019 and LIVECell metadata are retained only as structural controls for sparse evolving source channels, with no clinical or biological performance claim.

cs.CR↗
arXiv2026

Unprivileged Topology Certificates for Cloud GPU Attestation

Cloud GPU tenants receive a model name and a region, but cannot directly inspect the physical accelerator that runs their job. We present a software-only attestation primitive for this setting. A CUDA probe measures an SM-by-memory-region latency matrix using physical SM labels and dependent global loads. A streaming reducer commits sufficient statistics, configuration, code hashes, network evidence, and a compressed raw data archive into a certificate that a verifier can check without a GPU. The certificate supports three claims. First, the per-SM latency map is a stable physical fingerprint. Over a six-hour full-load RTX 5090 run, its median temporal jitter is 0.09 cycles, while shape-only leave-one-out classification separates distinct Blackwell dies with 100.0% accuracy. Second, cache-bypassing HBM sweeps recover hardware-class topology across generations, including a unified Volta V100 memory domain, a two-way Hopper H200 L2 split, and a Blackwell B200 two-die NV-HBI package whose 74/74 SM partition carries a 30-cycle, 15.5 ns cross-die penalty. Third, public network landmarks bind the same certificate to a coarse location. In the B200 run, 169 RIPE Atlas probes place the server within 44 km of its claimed datacentre and reject all 11 decoy sites. Together, these measurements check cloud-GPU identity, class, and coarse location without privileged access or a vendor key.

cs.CR↗
arXiv2026

Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage

Defenders cannot patch every newly disclosed vulnerability at once, so exploitability prediction must be evaluated prospectively rather than retrospectively. We study compute-budgeted vulnerability triage in which each CVE is scored only from public evidence visible by a fixed decision time. Advisories, exploit archives, fix commits, and hacker-community discourse are represented as a temporal evidence graph; a budgeted selector admits only a few evidence documents per CVE, and every score is paired with an auditable certificate listing the supporting signals, timestamps, source layers, and leakage flags. On 12012 prospective CVEs from public sources, budgeted evidence selection raises leakage-safe prospective recall@50 from 0.010 for a severity-only baseline to 0.026, while two evidence documents per CVE capture most of the value. A strong cross-encoder reranker lowers prospective recall to 0.016, showing that semantic relevance to a CVE is not the same as evidence of exploitation. Most importantly, a naive random split with unfiltered evidence inflates apparent prospective recall by 8.5x and EPSS-high recall by 5.0x. The main contribution is a leakage-safe evaluation protocol and reproducible evidence certificates for contestable vulnerability-prioritization claims.

cs.CR↗
arXiv2026

Choric Masking in Ambient Release Systems: A Finite Certificate Calculus for Trace Indistinguishability under Bounded Audiences

This paper develops a finite certificate calculus for ambient release systems, staged probabilistic environments in which a protected coordinate is not observed directly but can remain statistically readable through visible roles, timing, repeated movement, bounded attention, linked rooms, and post-release state. The security notion, choric masking, requires the trace law induced by a protected locus to lie inside or near the convex hull of admissible cover traces under the tests available to a specified audience. For finite horizons, trace laws form polytopes, audiences induce measurement operators, and masking becomes intersection in the projected measurement space. Exposure is certified by separating hyperplanes, kernel obstructions, hypothesis-testing bounds, Fano-type localization lower bounds, and support separation in downstream rooms. The calculus distinguishes trace residue from carrier localization, full-trace exposure from attention-filtered exposure, first-room masking from delayed post-release exposure, and unresolved system pressure from carrier hazard. It proves measurement-polytope equivalence for exact and approximate masks, dual separation certificates, data-processing laws for attention lenses, aperture identities for gaze-thinned observation, lower bounds for mandatory unique gestures, composition rules for linked releases, and a repeated-room debt theorem showing how unresolved pressure can broaden selection and shift cost onto cover populations without localizing the source. The result is a finite, checkable language for auditing privacy, unlinkability, side-channel leakage, and accountability in public-facing release systems.

cs.CR↗
arXiv2026

Layer Order Semantics for Automata-Based Cybersecurity

Layered cybersecurity pipelines transform evidence before they decide on it, and the order of those transformations determines which security facts become visible to which layer. This paper gives layer order a finite-state semantics built from a layer-order automaton, deterministic sequential security transducers, evidence markers, and a final decision automaton. The worked case is HTTP request desynchronization: front-end and back-end processors compute incompatible request boundaries, and the same trace is detected or missed according to whether framing evidence reaches the parser-differential layer before it commits. The results separate completed-trace recognition, online editing, decision synthesis, and faithful enforcement; characterize faithful online enforcement as the regular prefix-closed case under causal visibility; and show that regular policies beyond that boundary remain recognizable without becoming deployable enforcers. The framework is monolithically equivalent to finite-output deterministic edit automata, while preserving layer-local invariants such as marker birth, marker survival, and reorder-sensitive visibility. A concrete parser-pair semantics identifies the forbidden marker factor with CL.TE, TE.CL, TE.TE, and HTTP/2-downgrade boundary disagreement under the stated abstraction, and a contextual reorder congruence classifies which component permutations induce the same decision language. The result is an automata-theoretic account of order-sensitive security failures and a compositional vocabulary for auditing, synthesizing, and comparing layered enforcement pipelines.

cs.CR↗
arXiv2026

Quantifying Side-Channel Leakage in Public Metrology Releases

Public scientific and metrology releases can leak the hidden settings that produced them. We formalize and quantify this risk as a profiled statistical side-channel audit: a release map exposes finite-band statistics of a power spectral density (PSD), a profiled observer trains labeled template spectra under an explicit budget, and a challenge release is drawn from one of two utility-equivalent recipes separated by a protected coordinate. Averaged PSD bins follow a gamma channel, replaced by a covariance-weighted log-spectrum channel when the bins are correlated; this yields exact Kullback-Leibler divergences, Chernoff exponents, protected-bit advantage bounds, and finite-training, finite-library, finite-compute, and model-mismatch corrections. Our headline result is a finite-band transport-leakage law: after amplitude and blur are eliminated, the protected acid-transport information obeys $I_{\lambda|\alpha,\beta}(K) = (64/1225)\, w \lambda^{6} K^{9} + O(w \lambda^{8} K^{11})$ for $K\lambda \ll 1$, a ninth-order exponent with a closed-form safe band. A step-by-step protocol turns a measured release into these numbers, and a fixed-seed reproducibility package regenerates every table and figure. We instantiate the audit on screened extreme-ultraviolet (EUV) roughness spectra as a model-conditioned case study, with deployment on measured releases the next step.

cs.CR↗
arXiv2026

AgentSecBench: Measuring Prompt Injection, Privacy Leakage, and Tool-Use Integrity in LLM Agents

LLM agents process trusted instructions, retrieved records, and tool observations through a common generative channel. This conflates data flow with authority: an untrusted string can affect a secret-bearing response or an action proposal even when no application policy authorizes that influence. We introduce AgentSecBench as an empirical instantiation of a formal security framework for this problem. The framework defines three games-instruction-integrity, retrieval-confidentiality, and capability-integrity-under a common notion of intent-to-execution noninterference with permitted leakage. It represents an application policy as a projection onto authorized observations and capabilities, distinguishes prompt annotations from enforcing projections, and measures both adversarial advantage and whether a defense closes the relevant model-visible channel before generation. The exact-marker experiments are intentionally one observable instantiation of the games rather than a complete semantic security claim: they test disclosure and forbidden-action distinguishers with unambiguous ground truth. We evaluate six defense classes with Qwen3-0.6B and Qwen3-1.7B on paired adversarial and benign-control executions. The measurements show when risk reduction follows channel closure and when a model-visible adversarial capability remains exploitable. The result is a security-oriented evaluation method: prompt text can describe a boundary, whereas provenance projection, capability restriction, and output validation can enforce one.

cs.CR↗
arXiv2026

Composable Post-Quantum Security for FADEC-Coupled Dual-Spool Turbofan Cyber-Physical Systems

We develop a unified mathematical formulation for post-quantum authenticated telemetry and actuation in FADEC-coupled dual-spool turbofan cyber-physical systems. The formulation integrates lattice-based key establishment under LWE/SIS-style assumptions, PUF-derived attestation entropy, authenticated encryption, radar-altimeter integrity, avionics-bus timing, and Kalman residual monitoring in a stochastic hybrid model. Within this model, plant evolution, communication latency, leakage, adversarial channel quality, and cryptographic state evolve under a common filtration. We show that channel uncertainty tightens admissible key-renewal periods, that ciphertext expansion enters bus-level schedulability constraints, and that sensing and actuator limits shape integrity thresholds and allowable control delay. We further relate PUF smooth min-entropy to distinguishing advantage and connect innovation statistics to conservative alarm design. Overall, the results characterize how post-quantum security, real-time schedulability, and closed-loop stability interact in safety-critical aerospace control architectures within a defensive analytical treatment that does not provide operational guidance for interference with real platforms.

cs.CR↗
arXiv2025

Calibrated Counterfactual Conformal Fairness ($C^3F$): Post-hoc, Shift-Aware Coverage Parity via Conformal Prediction and Counterfactual Regularization

We present Calibrated Counterfactual Conformal Fairness ($C^3F$), a post-hoc procedure that targets group-conditional coverage parity under covariate shift. $C^3F$ combines importance-weighted conformal calibration with a counterfactual regularizer based on path-specific effects in a structural causal model. The method estimates group-specific nonconformity quantiles using likelihood-ratio weights so that coverage degrades gracefully with the second moment of the weights. We derive finite-sample lower bounds on group-wise coverage and a bound on the equalized conditional coverage gap, and we show first-order control of a counterfactual coverage-parity surrogate via smooth threshold regularization. The approach is model-agnostic, label-efficient, and deployable without retraining. Empirical evaluations on standard classification benchmarks demonstrate improved group-conditional coverage and competitive efficiency relative to shift-aware and fairness-oriented conformal baselines. We discuss practical considerations, including partial availability of sensitive attributes and robustness to structural causal misspecification.

stat.ME↗
arXiv2025

XML Prompting as Grammar-Constrained Interaction: Fixed-Point Semantics, Convergence Guarantees, and Human-AI Protocols

Structured prompting with XML tags has emerged as an effective way to steer large language models (LLMs) toward parseable, schema-adherent outputs in real-world systems. We develop a logic-first treatment of XML prompting that unifies (i) grammar-constrained decoding, (ii) fixed-point semantics over lattices of hierarchical prompts, and (iii) convergent human-AI interaction loops. We formalize a complete lattice of XML trees under a refinement order and prove that monotone prompt-to-prompt operators admit least fixed points (Knaster-Tarski) that characterize steady-state protocols; under a task-aware contraction metric on trees, we further prove Banach-style convergence of iterative guidance. We instantiate these results with context-free grammars (CFGs) for XML schemas and show how constrained decoding guarantees well-formedness while preserving task performance. A set of multi-layer human-AI interaction recipes demonstrates practical deployment patterns, including multi-pass "plan $\to$ verify $\to$ revise" routines and agentic tool use. We provide mathematically complete proofs and tie our framework to recent advances in grammar-aligned decoding, chain-of-verification, and programmatic prompting.

cs.PL↗
arXiv2025

Manipulating Transformer-Based Models: Controllability, Steerability, and Robust Interventions

Transformer-based language models excel in NLP tasks, but fine-grained control remains challenging. This paper explores methods for manipulating transformer models through principled interventions at three levels: prompts, activations, and weights. We formalize controllable text generation as an optimization problem addressable via prompt engineering, parameter-efficient fine-tuning, model editing, and reinforcement learning. We introduce a unified framework encompassing prompt-level steering, activation interventions, and weight-space edits. We analyze robustness and safety implications, including adversarial attacks and alignment mitigations. Theoretically, we show minimal weight updates can achieve targeted behavior changes with limited side-effects. Empirically, we demonstrate >90% success in sentiment control and factual edits while preserving base performance, though generalization-specificity trade-offs exist. We discuss ethical dual-use risks and the need for rigorous evaluation. This work lays groundwork for designing controllable and robust language models.

cs.CL↗
arXiv2025

Nonlinear Continuum of States and Intuitionistic Flows in a Cognitive Space

We construct a rigorous mathematical framework for an abstract continuous evolution of an internal state, inspired by the intuitive notion of a flowing thought sequence. Using tools from topology, functional analysis, measure theory, and logic, we formalize an indefinitely proceeding sequence of states as a non-linear continuum with rich structure. In our development, a trajectory of states is modeled as a continuous mapping on a topological state space (a potentially infinite-dimensional Banach space) and is further conceptualized intuitionistically as a choice sequence not fixed in advance. We establish fundamental properties of these state flows, including existence and uniqueness of evolutions under certain continuity conditions (via a Banach fixed-point argument), non-measurability results (demonstrating the impossibility of assigning a classical measure to all subsets of the continuum of states), and logical semantic frameworks (defining a Tarskian truth definition for propositions about states). Throughout, we draw on ideas of Brouwer, Banach, Tarski, Poincar\'e, Hadamard, and others--blending intuitionistic perspective with classical analysis--to rigorously capture a continuous, ever-evolving process of an abstract cognitive state without resorting to category-theoretic notions.

math.LO↗
arXiv2025

Deterministic Coreset Construction via Adaptive Sensitivity Trimming

We develop a rigorous framework for deterministic coreset construction in empirical risk minimization (ERM). Our central contribution is the Adaptive Deterministic Uniform-Weight Trimming (ADUWT) algorithm, which constructs a coreset by excising points with the lowest sensitivity bounds and applying a data-dependent uniform weight to the remainder. The method yields a uniform $(1\pm\varepsilon)$ relative-error approximation for the ERM objective over the entire hypothesis space. We provide complete analysis, including (i) a minimax characterization proving the optimality of the adaptive weight, (ii) an instance-dependent size analysis in terms of a \emph{Sensitivity Heterogeneity Index}, and (iii) tractable sensitivity oracles for kernel ridge regression, regularized logistic regression, and linear SVM. Reproducibility is supported by precise pseudocode for the algorithm, sensitivity oracles, and evaluation pipeline. Empirical results align with the theory. We conclude with open problems on instance-optimal oracles, deterministic streaming, and fairness-constrained ERM.

stat.ML↗
arXiv2025

Reliability, Embeddedness, and Agency: A Utility-Driven Mathematical Framework for Agent-Centric AI Adoption

We formalize three design axioms for sustained adoption of agent-centric AI systems executing multi-step tasks: (A1) Reliability > Novelty; (A2) Embed > Destination; (A3) Agency > Chat. We model adoption as a sum of a decaying novelty term and a growing utility term and derive the phase conditions for troughs/overshoots with full proofs. We introduce: (i) an identifiability/confounding analysis for $(\alpha,\beta,N_0,U_{\max})$ with delta-method gradients; (ii) a non-monotone comparator (logistic-with-transient-bump) evaluated on the same series to provide additional model comparison; (iii) ablations over hazard families $h(\cdot)$ mapping $\Delta V \to \beta$; (iv) a multi-series benchmark (varying trough depth, noise, AR structure) reporting coverage (type-I error, power); (v) calibration of friction proxies against time-motion/survey ground truth with standard errors; (vi) residual analyses (autocorrelation and heteroskedasticity) for each fitted curve; (vii) preregistered windowing choices for pre/post estimation; (viii) Fisher information & CRLB for $(\alpha,\beta)$ under common error models; (ix) microfoundations linking $\mathcal{T}$ to $(N_0,U_{\max})$; (x) explicit comparison to bi-logistic, double-exponential, and mixture models; and (xi) threshold sensitivity to $C_f$ heterogeneity. Figures and tables are reflowed for readability, and the bibliography restores and extends non-logistic/Bass adoption references (Gompertz, Richards, Fisher-Pry, Mansfield, Griliches, Geroski, Peres). All code and logs necessary to reproduce the synthetic analyses are embedded as LaTeX listings.

cs.AI↗
arXiv2025

Alpay Folded Prime Enumerator via gcd and Floors: Exact Enumeration, Record-Lift, and Non-Synonymy/Minimality Certificates

A single closed expression $f_{\text{Alpay},U}(x)$ is presented which, for every integer $x\ge 0$, returns the $(x+1)$-th prime $p_{x+1}$. The construction uses only integer arithmetic, greatest common divisors, and floor functions. A prime indicator $I(j)$ is encoded through a short $\gcd$-sum; a cumulative counter $S(i)=\sum_{j\le i}I(j)$ equals $\pi(i)$; and a folded step $A(i,x)$ counts precisely up to the next prime index without piecewise branching. A corollary shows that for any fixed integer $L\ge 2$, the integer $P^\star=f_{\text{Alpay},U}(L)$ is prime and $P^\star>L$. Two explicit schedules $U(x)$ are given: a square schedule $U_{\text{sq}}(x)=(x+1)^2$ and a near-linear schedule $U_{\text{Alpay-lin}}(x)=\Theta(x\log x)$ justified by explicit bounds on $p_n$. We include non-synonymy certificates relative to Willans-type enumerators (schedule and operator-signature separation) and prove an asymptotic minimality bound: any forward-count enumerator requires $U(x)=\Omega(x\log x)$ while $U_{\text{Alpay-lin}}$ achieves $O(x\log x)$. We also provide explicit operation counts (''form complexity'') of the folded expression.

math.NT↗
arXiv2025

Anchored Implication & Event-Indexed Fixed Points in Hilbert Spaces: Uniqueness and Quantitative Rates

We develop a synthesis of orthomodular logic (projections as propositions) with operator fixed-point theory in Hilbert spaces. First, we introduce an anchored implication connective $A \Rightarrow^{\mathrm{comm}}_{P} B$, defined semantically so that it is true only when either $A$ is false or else $A$ is true and $B$ is true in a ''commuting'' context specified by a fixed nonzero projection $P$. This connective refines material implication by adding a side condition $[E_B,P]=0$ (commutation of $B$ with the anchor) and reduces to classical implication in the Boolean (commuting) case. Second, we study fixed-point convergence under event-indexed contractions. For a single nonexpansive (not necessarily linear) map $T$, we prove that the event-indexed condition is equivalent to the classical assertion that some power $T^N$ is a strict contraction; thus the ''irregular events'' phrasing does not add generality in that setting. We then present the genuinely more general case of varying operators (switching/randomized): if blocks of the evolving composition are contractive with bounded inter-event gaps and a common fixed point exists, we obtain uniqueness and an explicit envelope rate. Finally, with an anchor $P$ that commutes with $T$, the same reasoning ensures convergence on $PH$ under event-indexed contraction on that subspace. We include precise scope conditions, examples, and visual explanations.

math.FA↗
arXiv2025

Logically Contractive Mappings: Fixed Points and Event-Indexed Rates

We introduce "logically contractive mappings" nonexpansive self-maps that contract along a subsequence of iterates and prove a fixed-point theorem that extends Banach's principle. We obtain event-indexed convergence rates and, under bounded gaps between events, explicit iteration-count rates. A worked example shows a nonexpansive map whose square is a strict contraction, and we clarify relations to Meir--Keeler and asymptotically nonexpansive mappings. We further generalize to variable-factor events and show that $\prod_k \lambda_k = 0$ (equivalently $\sum_k -\ln \lambda_k = \infty$) implies convergence. These results unify several generalized contraction phenomena and suggest new rate questions tied to event sparsity.

math.FA↗