arXiv subjects

Tobias Braun

Publications and source records attributed to Tobias Braun.

At least 19 recordsLinked to original sources

arXiv2026

GEM: Geometric Erasure by Contrastive Velocity Matching in Rectified Flows

While the rapid adoption of multimodal generative models offers immense potential, it has also increased the risks of harmful content synthesis, deepfakes, and copyright infringements. To address these challenges, concept erasure has emerged as a prospective safeguard. However, as the field gradually transitions from U-Net-based diffusion models to Rectified Flow Transformers, erasure research has struggled to keep pace. In this work, we introduce GEM, a simple but highly effective erasure framework for Rectified Flow models. As part of our contribution, we establish a principled bridge between trajectory-based unlearning grounded in Generative Flow Networks and classic teacher-guided erasure: we translate trajectory-based signals into a teacher-guided flow-matching setup that unifies the strengths of both paradigms. Concretely, a teacher provides complementary attraction and repulsion signals that we combine into a single geometric guidance objective, yielding targeted suppression of unwanted concepts while preserving benign generation.

cs.LG↗

arXiv2026

Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheating

The widespread adoption of generative AI enables students to outsource cognitive effort to increasingly capable assistants, creating an illusion of competence while undermining the independent reasoning that education aims to cultivate. We investigate whether adversarial machine learning can be repurposed to protect educational exercises against such corrosive reliance. Our approach uses multimodal multiple-choice questions whose visual components can be protected with subtle visual perturbations that steer AI solvers toward designated incorrect answers. These responses form a statistical fingerprint: students who blindly copy a solver reproduce the induced answer pattern more frequently than genuine students. We study the feasibility of this paradigm under realistic black-box assistant assumptions using three of the most common state-of-the-art multimodal language models: Anthropic's Claude, Google's Gemini, and OpenAI's ChatGPT. By using accessible surrogate models, we optimize adversarial perturbations that induce consistent response patterns. Those patterns enable principled detection through statistical hypothesis testing. These findings establish both the promise and the limitations of fighting machine-assisted reasoning with the vulnerabilities of the machines themselves.

cs.AI↗

arXiv2026

VETO: Towards Protecting Images From Frontier AI Editing

The rise of powerful, accessible image-editing models such as FLUX.2 has brought high-fidelity editing within broad reach. Their capabilities now extend beyond localized modifications to extracting and recontextualizing objects and identities in entirely new scenes. By allowing prompt and generation tokens to attend directly to reference-image tokens, modern models blur the boundary between conventional editing and text-to-image synthesis. This expanded generative freedom also broadens the space of potential misuse, as harmful transformations are no longer confined to a predictable set of localized edits. Existing anti-edit defenses are designed to disrupt the semantic bottleneck of the reference-image encoding in legacy diffusion pipelines. However, newer editors distill reference information through joint-attention blocks, thereby often circumventing these protections. We therefore introduce VETO, a subtle anti-edit cloak that disrupts this inner mechanism through which modern models read the source image. Additionally, as existing editing benchmarks leave comprehensive recontextualizations largely untested, we introduce VetoBench, which evaluates defenses not only on conventional localized edits but also on broader contextual shifts. Across two contemporary editing models and three benchmarks, VETO consistently outperforms existing defenses while providing a stronger protection-fidelity trade-off.

cs.CV↗

arXiv2026

Obliviate: Erasing Concepts from Autoregressive Image Generation Models

The widespread adoption of generative AI models has intensified concerns about misuse, including the creation of unsafe or disturbing imagery. To mitigate such issues, several concept erasure approaches have been proposed to remove harmful content from multimodal generative models. Yet concept erasure for autoregressive image generation remains largely unexplored, despite the growing relevance of these models in recent trends toward unified multimodal architectures. In this work, we fill this gap by introducing Obliviate, a guidance-based concept erasure method for autoregressive image generation. Our method builds on three key design choices: KL-based supervision over visual token distributions, trajectory-level updates over full autoregressive rollouts, and aligned visual prefixes for stable target construction. We evaluate Obliviate on three state-of-the-art autoregressive text-to-image models, Liquid, Emu3-Gen, and Janus-Pro, covering the erasure of explicit content, graphic violence, and branded imagery. Obliviate consistently outperforms current alternatives, reducing nudity on the defensive RAB benchmark from 91.58 to 3.15 while preserving overall model utility.

cs.CV↗

arXiv2026

Erased but Not Forgotten: How Backdoors Compromise Concept Erasure

The expansion of text-to-image diffusion models has raised concerns about harmful outputs, from fabricated depictions of public figures to sexually explicit imagery. To mitigate such risks, prior work has proposed concept erasure methods that aim to sever unwanted concepts from the model via fine-tuning, yet it remains unclear whether these approaches truly remove all links to the harmful concept or merely conceal superficial connections. In this work, we reveal a critical vulnerability, the Erasure Evasion Backdoor (EEB): an adversary binds a backdoor trigger to a concept slated for removal, and this malicious link survives subsequent erasure. We show that both black-box and white-box adversaries can instantiate this threat. Across six state-of-the-art erasure methods, including robust ones that explicitly search for alternative representations of the target concept, EEB consistently exposes harmful content: up to 82% success against celebrity-identity unlearning, up to 94% for object erasure, and up to 16 times amplification of explicit-content exposure. While EEB uncovers a blind spot in current erasure methods, it also provides a diagnostic tool for stress-testing future concept erasure techniques.

cs.CR↗

arXiv2026

Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models

Unified autoregressive models (UAMs) are transformer models that generate text as well as image tokens within a single autoregressive pass. Shared parameters and a multimodal vocabulary simplify the training pipeline and facilitate flexible multimodal generation, yet might introduce new vulnerabilities. In particular, we are the first to show that this unified architecture enables multimodal backdoor attacks, where a trigger can propagate malicious effects across multiple output modalities. Specifically, we present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, exploring both data-based and model-based poisoning strategies. We demonstrate that innocuous characters or even common words can be transformed into triggers that elicit harmful behavior in autoregressive image generation. ToBAC can jointly manipulate visual outputs and accompanying text, increasing the perceived authenticity of fabricated content. With model access, ToBAC enables attacks on the unified Liquid model in which a subtle word (e.g., ``cool'') induces modality-aligned brand promotion or ideological influence in 55% of generations. Without model access, ToBAC can be induced through data poisoning, achieving an average success rate of 63.1% against JanusPro.

cs.CR↗

arXiv2026

Tuning Just Enough: Lightweight Backdoor Attacks on Multi-Encoder Diffusion Models

As text-to-image diffusion models become increasingly deployed in real-world applications, concerns about backdoor attacks have gained significant attention. Prior work on text-based backdoor attacks has largely focused on diffusion models conditioned on a single lightweight text encoder. However, more recent diffusion models that incorporate multiple large-scale text encoders remain underexplored in this context. Given the substantially increased number of trainable parameters introduced by multiple text encoders, an important question is whether backdoor attacks can remain both efficient and effective in such settings. In this work, we study Stable Diffusion 3, which uses three distinct text encoders and has not yet been systematically analyzed for text-encoder-based backdoor vulnerabilities. To understand the role of text encoders in backdoor attacks, we define four categories of attack targets and identify the minimal sets of encoders required to achieve effective performance for each attack objective. Based on this, we further propose Multi-Encoder Lightweight aTtacks (MELT), which trains only low-rank adapters while keeping the pretrained text encoder weight frozen. We demonstrate that tuning fewer than 0.2% of the total encoder parameters is sufficient for successful backdoor attacks on Stable Diffusion 3, revealing previously underexplored vulnerabilities in practical attack scenarios in multi-encoder settings.

cs.LG↗

arXiv2025

DEFAME: Dynamic Evidence-based FAct-checking with Multimodal Experts

The proliferation of disinformation demands reliable and scalable fact-checking solutions. We present Dynamic Evidence-based FAct-checking with Multimodal Experts (DEFAME), a modular, zero-shot MLLM pipeline for open-domain, text-image claim verification. DEFAME operates in a six-stage process, dynamically selecting the tools and search depth to extract and evaluate textual and visual evidence. Unlike prior approaches that are text-only, lack explainability, or rely solely on parametric knowledge, DEFAME performs end-to-end verification, accounting for images in claims and evidence while generating structured, multimodal reports. Evaluation on the popular benchmarks VERITE, AVerITeC, and MOCHEG shows that DEFAME surpasses all previous methods, establishing itself as the new state-of-the-art fact-checking system for uni- and multimodal fact-checking. Moreover, we introduce a new multimodal benchmark, ClaimReview2024+, featuring claims after the knowledge cutoff of GPT-4o, avoiding data leakage. Here, DEFAME drastically outperforms the GPT-4o baselines, showing temporal generalizability and the potential for real-time fact-checking.

cs.CV↗

arXiv2025

Universal self-similarity of hierarchical communities formed through a general self-organizing principle

Emergence of self-similarity in hierarchical community structures is ubiquitous in complex systems. Yet, there is a dearth of universal quantification and general principles describing the formation of such structures. Here, we discover universality in scaling laws describing self-similar hierarchical community structure in multiple real-world networks including biological, infrastructural, and social networks. We replicate these scaling relations using a phenomenological model, where nodes with higher similarity in their properties have greater probability of forming a connection. A large difference in their properties forces two nodes into different communities. Smaller communities are formed owing to further differences in node properties within a larger community. We discover that the general self-organizing principle is in agreement with Hakens principle; nodes self-organize into groups such that the diversity or differences between properties of nodes in the same community is minimized at each scale and the organizational entropy decreases with increasing complexity of the organized structure.

physics.soc-ph↗

arXiv2024

Revealing recurrent regimes of mid-latitude atmospheric variability using novel machine learning method

The low frequency variability of the extratropical atmosphere involves hemispheric-scale recurring, often persistent, states known as teleconnection patterns or regimes, which can have profound impact on predictability on intra-seasonal and longer timescales. However, reliable data-driven identification and dynamical representation of such states are still challenging problems in modeling dynamics of the atmosphere. We present a new method, which allows both to detect recurring regimes of atmospheric variability, and to obtain dynamical variables serving as an embedding for these regimes. The method combines two approaches from nonlinear data analysis: partitioning a network of recurrent states with studying its properties by the recurrence quantification analysis and the kernel principal component analysis. We apply the method to study teleconnection patterns in a quasi-geostrophical model of atmospheric circulation over the extratropical hemisphere as well as to reanalysis data of geopotential height anomalies in the mid-latitudes of the Northern Hemisphere atmosphere in the winter seasons from 1981 to the present. It is shown that the detected regimes as well as the obtained set of dynamical variables explain large-scale weather patterns, which are associated, in particular, with severe winters over Eurasia and North America. The method presented opens prospects for improving empirical modeling and long-term forecasting of large-scale atmospheric circulation regimes.

physics.ao-ph↗

arXiv2023

Understanding the Process of Data Labeling in Cybersecurity

Many domains now leverage the benefits of Machine Learning (ML), which promises solutions that can autonomously learn to solve complex tasks by training over some data. Unfortunately, in cyberthreat detection, high-quality data is hard to come by. Moreover, for some specific applications of ML, such data must be labeled by human operators. Many works "assume" that labeling is tough/challenging/costly in cyberthreat detection, thereby proposing solutions to address such a hurdle. Yet, we found no work that specifically addresses the process of labeling 'from the viewpoint of ML security practitioners'. This is a problem: to this date, it is still mostly unknown how labeling is done in practice -- thereby preventing one from pinpointing "what is needed" in the real world. In this paper, we take the first step to build a bridge between academic research and security practice in the context of data labeling. First, we reach out to five subject matter experts and carry out open interviews to identify pain points in their labeling routines. Then, by using our findings as a scaffold, we conduct a user study with 13 practitioners from large security companies, and ask detailed questions on subjects such as active learning, costs of labeling, and revision of labels. Finally, we perform proof-of-concept experiments addressing labeling-related aspects in cyberthreat detection that are sometimes overlooked in research. Altogether, our contributions and recommendations serve as a stepping stone to future endeavors aimed at improving the quality and robustness of ML-driven security systems. We release our resources.

cs.CR↗

arXiv2023

Realtime Spectrum Monitoring via Reinforcement Learning -- A Comparison Between Q-Learning and Heuristic Methods

Due to technological advances in the field of radio technology and its availability, the number of interference signals in the radio spectrum is continuously increasing. Interference signals must be detected in a timely fashion, in order to maintain standards and keep emergency frequencies open. To this end, specialized (multi-channel) receivers are used for spectrum monitoring. In this paper, the performances of two different approaches for controlling the available receiver resources are compared. The methods used for resource management (ReMa) are linear frequency tuning as a heuristic approach and a Q-learning algorithm from the field of reinforcement learning. To test the methods to be investigated, a simplified scenario was designed with two receiver channels monitoring ten non-overlapping frequency bands with non-uniform signal activity. For this setting, it is shown that the Q-learning algorithm used has a significantly higher detection rate than the heuristic approach at the expense of a smaller exploration rate. In particular, the Q-learning approach can be parameterized to allow for a suitable trade-off between detection and exploration rate.

eess.SY↗

arXiv2023

Laser Powder Bed Fusion of anisotropic Nd-Fe-B bonded magnets utilizing an in situ mechanical alignment approach

Nd-Fe-B bonded magnets are an important class of permanent magnets, employed in many technological sectors. The Additive Manufacturing (AM) processes enables the fabrication of net-shape bonded magnets with complex geometries, allowing to tailor their magnetic stray field specifically for a given application. A crucial challenge to be addressed concerning AM of bonded magnets is the production of magnetically anisotropic components. The common approaches presented in the literature up to now, required a post-printing procedure or the complex integration of a magnetic field source into the AM process. Here, we present a technique to fabricate anisotropic bonded magnets via Laser Powder Bed Fusion (LPBF) by utilizing the mechanical alignment of anisotropic particles in a single step, without the need for a magnetic field source. Anisotropic bonded magnets were fabricated using a mixture of anisotropic Nd-Fe-B powder (MQA-38-14) and polyamide-12 (PA12). This magnetic powder consists of ellipsoidal particles, where the easy magnetization axis is distributed perpendicular to their longest side, which can be exploited to generate magnetic texture. Depending on the particle size used as feedstock, the degree of alignment ( ) can be tailored to a maximum of = 0.78. The fabricated anisotropic bonded magnets exhibited a maximum remanence of Jr = 377 mT and an energy product of (BH)max = 28.6 kJ/m3, respectively.

physics.app-ph↗

arXiv2022

Polymer-bonded magnets produced by laser powder bed fusion: Influence of powder morphology, filler fraction and energy input on the magnetic and mechanical properties

Bonded permanent magnets are key components in many energy conversion, sensor and actuator devices. These applications require high magnetic performance and freedom of shape. With additive manufacturing processes, for example laser powder bed fusion (LPBF), it is possible to produce bonded magnets with customized stray field distribution. Up to now, most studies use spherical powders as magnetic fillers due to their good flowability. Here, the behavior of large SmFeN platelets with a high aspect ratio as filler material and its influence on the arrangement and the resulting magnetic properties are examined in comparison to a spherical magnetic filler. The 3D distribution and orientation of the magnetic filler was studied by computed tomography and digital image analysis. The platelet-shaped particles align themselves perpendicular to the buildup direction during the process, which offers a new and cost-effective way of producing composites by LPBF with anisotropic structural and functional properties. The influence of LPBF parameters on the properties of the composites is investigated. Highest filling fractions are required for high magnetic remanence, however the powder itself limits this maximum due to particle shape and required minimal polymer fraction to form mechanically stable magnets. The coercivity decreases for higher filling fractions, which is attributed to increased rotation of insufficiently embedded magnetic particles in the matrix. It is discussed how filler morphology influences the observed change in coercivity since the rotation of spherical particles in comparison to platelet-shaped particles requires less energy. Our work shows the challenges and opportunities of large platelet shaped fillers used in LPBF for the production of anisotropic functional and structural composites.

physics.app-ph↗

arXiv2022

Recurrence flow measure of nonlinear dependence

Couplings in complex real-world systems are often nonlinear and scale-dependent. In many cases, it is crucial to consider a multitude of interlinked variables and the strengths of their correlations to adequately fathom the dynamics of a high-dimensional nonlinear system. We propose a recurrence based dependence measure that quantifies the relationship between multiple time series based on the predictability of their joint evolution. The statistical analysis of recurrence plots (RPs) is a powerful framework in nonlinear time series analysis that has proven to be effective in addressing many fundamental problems, e.g., regime shift detection and identification of couplings. The recurrence flow through an RP exploits artifacts in the formation of diagonal lines, a structure in RPs that reflects periods of predictable dynamics. By using time-delayed variables of a deterministic uni-/multivariate system, lagged dependencies with potentially many time scales can be captured by the recurrence flow measure. Given an RP, no parameters are required for its computation. We showcase the scope of the method for quantifying lagged nonlinear correlations and put a focus on the delay selection problem in time-delay embedding which is often used for attractor reconstruction. The recurrence flow measure of dependence helps to identify non-uniform delays and appears as a promising foundation for a recurrence based state space reconstruction algorithm.

physics.data-an↗

arXiv2021

Sampling rate-corrected analysis of irregularly sampled time series

The analysis of irregularly sampled time series remains a challenging task requiring methods that account for continuous and abrupt changes of sampling resolution without introducing additional biases. The edit-distance is an effective metric to quantitatively compare time series segments of unequal length by computing the cost of transforming one segment into the other. We show that transformation costs generally exhibit a non-trivial relationship with local sampling rate. If the sampling resolution undergoes strong variations, this effect impedes unbiased comparison between different time episodes. We study the impact of this effect on recurrence quantification analysis, a framework that is well-suited for identifying regime shifts in nonlinear time series. A constrained randomization approach is put forward to correct for the biased recurrence quantification measures. This strategy involves the generation of a novel type of time series and time axis surrogates which we call sampling rate constrained (SRC) surrogates. We demonstrate the effectiveness of the proposed approach with a synthetic example and an irregularly sampled speleothem proxy record from Niue island in the central tropical Pacific. Application of the proposed correction scheme identifies a spurious transition that is solely imposed by an abrupt shift in sampling rate and uncovers periods of reduced seasonal rainfall predictability associated with enhanced ENSO and tropical cyclone activity.

stat.ME↗

arXiv2021

Visually Connecting Historical Figures Through Event Knowledge Graphs

Knowledge graphs store information about historical figures and their relationships indirectly through shared events. We developed a visualization system, VisKonnect, for analyzing the intertwined lives of historical figures based on the events they participated in. A user's query is parsed for identifying named entities, and related data is retrieved from an event knowledge graph. While a short textual answer to the query is generated using the GPT-3 language model, various linked visualizations provide context, display additional information related to the query, and allow exploration.

cs.HC↗

arXiv2021

An Agnostic Domain Specific Language for Implementing Attacks in an Automotive Use Case

This paper presents a Domain Specific Language (DSL) for generically describing cyber attacks, agnostic to specific system-under-test(SUT). The creation of the presented DSL is motivated by an automotive use case. The concepts of the DSL are generic such thatattacks on arbitrary systems can be addressed.The ongoing trend to improve the user experience of vehicles with connected services implies an enhanced connectivity as well asremote accessible interface opens potential attack vectors. This might also impact safety and the proprietary nature of potential SUTs.Reusing tests of attack vectors to industrialize testing them on multiple SUTs mandates an abstraction mechanism to port an attackfrom one system to another. The DSL therefore generically describes attacks for the usage with a test case generator (and executionenvironment) also described in this paper. The latter use this description and a database with SUT-specific information to generateattack implementations for a multitude of different (automotive) SUTs.

cs.CR↗