arXiv subjects

Xianlong Wang

Publications and source records attributed to Xianlong Wang.

At least 19 recordsLinked to original sources

arXiv2026

TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models

Recent commercial image-generation models can generate high-quality images with readable text (e.g., posters, infographics, and manuals), attracting considerable attention. Yet we first show that this same capability also introduces a previously unreported safety vulnerability: these systems may refuse to generate harmful text directly, yet permit the same content when rendered as text within generated images, i.e., safety alignment does not reliably transfer from textual outputs to text embedded in images. In this paper, unlike existing visual jailbreaks against image-generation models, which primarily induce models to generate harmful visual objects or scenes, we introduce the concept of instruction-dense visual jailbreaks, in which image-generation models produce detailed, readable, and actionable harmful instructions within images. Such outputs can amplify harm because the rendered instructions can be readily read and widely spread. To instantiate this threat, we propose TYPO, a black-box framework that exploits this safety gap by automatically generating adversarial TYPOgraphy prompts, which covertly steer image-generation models to express harmful intent as highly legible, typographically structured text. Specifically, TYPO decomposes prompt generation into two channels: a textual channel for reframing the target intent, and a visual channel for specifying its presentation form. We formulate these two channels as a dual-channel textual-visual strategy space and optimize candidate strategy combinations through an adaptive combinatorial search. Extensive experiments across four commercial models (i.e., GPT-Image-2, Nano Banana Pro, Qwen-Image-2, and Seedream 5.0 Lite) show that TYPO substantially outperforms nine representative jailbreak attacks by 50.2% in ASR on average, while incurring an average query cost of only $0.04.

cs.CR↗

arXiv2026

GhostPrompt: Cross-Image Adversarial Prompt for Vision-Language Models

Vision-Language Models (VLMs) are known to be vulnerable to adversarial attacks, where subtle perturbations to images or texts induce erroneous outputs. However, most text-based attacks are adapted from language-model-centric methods, in which the visual input is fixed during optimization, resulting in adversarial prompts that are tied to specific images and thus limiting their attack effectiveness. To this end, we first introduce a new research perspective: cross-image transferability for adversarial prompts. We then propose GhostPrompt, an adversarial prompt that is optimized once and reused to steer VLM outputs toward attacker-specified responses across diverse images. GhostPrompt employs a joint optimization that distills image-invariant adversarial features into the prompt by "worst-case" generation. Specifically, it alternates between constructing hard visual conditions for the current prompt and updating the prompt to remain effective under these conditions. Extensive experiments on prevalent VLMs verify that \ourmethod achieves an improvement of over 30% in attack success rates compared to state-of-the-art (SoTA) baselines, while reducing computation time by ~70%. Our code is avalable at https://github.com/Ye-ze-yu/GhostPrompt.

cs.CR↗

arXiv2026

Image-to-Video Diffusion: From Foundations to Open Frontiers

Diffusion-based \textit{image-to-video} (I2V) generation has become a central direction in generative models by turning a reference image, with optional conditions, into a temporally coherent video. Compared with broader video generation settings, this task places stricter demands on content consistency, identity preservation, and motion coherence. Although the literature grows rapidly, existing works mostly discuss I2V generation within broader topics and still lack a dedicated taxonomy together with a systematic analysis centered on this field. This work addresses that gap by treating diffusion I2V generation as a standalone subject. It first reviews the task formulation, model architectures, datasets, and evaluation metrics, and then organizes existing methods through a taxonomy based on architecture and training paradigm. It further distills four core designs, namely condition encoding, temporal modeling, noise prior design, and spatial-temporal upsampling, and discusses representative application scenarios together with major open challenges.

cs.CV↗

arXiv2026

Dual-branch Robust Unlearnable Examples

Unlearnable examples (UEs) aim to compromise model training by injecting imperceptible perturbations to clean samples. However, existing UE schemes exhibit limited robustness against advanced defenses due to their heuristic design or narrowly scoped domain perturbations. To address this, we propose \texttt{DUNE}, a \underline{\textbf{D}}ual-branch \underline{\textbf{UN}}learnable \underline{\textbf{E}}nsemble perturbation optimization approach. Specifically, \texttt{DUNE} separately optimizes perturbations in the spatial and color domains to establish the mapping between perturbations and shift-induced labels. This design extends the perturbation domain to increase noise intensity for improving robustness and drives the models to learn perturbation-oriented features with degraded generalization, thereby achieving unlearnability. To strengthen \texttt{DUNE}'s performance, we further propose an unlearnability-enhancing ensemble strategy that aggregates diverse pre-trained models during the dual-branch optimization. Extensive experiments on benchmark datasets CIFAR-10 and ImageNet verify that \texttt{DUNE}'s robustness outperforms 12 SOTA UE schemes under 7 mainstream defenses, yielding a lower average test accuracy of 14.95% to 50.82%.

cs.CV↗

arXiv2026

Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulation

Robotic manipulation policies are increasingly empowered by \textit{large language models} (LLMs) and \textit{vision-language models} (VLMs), leveraging their understanding and perception capabilities. Recently, inference-time attacks against robotic manipulation have been extensively studied, yet backdoor attacks targeting model supply chain security in robotic policies remain largely unexplored. To fill this gap, we propose \texttt{TrojanRobot}, a backdoor injection framework for model supply chain attack scenarios, which embeds a malicious module into modular robotic policies via backdoor relationships to manipulate the LLM-to-VLM pathway and compromise the system. Our vanilla design instantiates this module as a backdoor-finetuned VLM. To further enhance attack performance, we propose a prime scheme by introducing the concept of \textit{LVLM-as-a-backdoor}, which leverages \textit{in-context instruction learning} (ICIL) to steer \textit{large vision-language model} (LVLM) behavior through backdoored system prompts. Moreover, we develop three types of prime attacks, \textit{permutation}, \textit{stagnation}, and \textit{intentional}, achieving flexible backdoor attack effects. Extensive physical-world and simulator experiments on 18 real-world manipulation tasks and 4 VLMs verify the superiority of proposed \texttt{TrojanRobot}

cs.RO↗

arXiv2026

One-Dimensional Metallic Polymeric Nitrogen

The pressure-induced metallic states of light elements attract significant attention, because of potential applications as high-temperature superconductor and high-energy-density material, especially for hydrogen and nitrogen1-10. Several semiconducting polymeric nitrogen phases with three- or two-dimensional sp3-bonded networks were synthesized6-10, but its metallic form remains unobserved. Here, we report the synthesis of a metallic polymeric nitrogen with one-dimensional feature (1D-PN) at 130-140 GPa and above 3000 K. Synchrotron XRD and Raman spectroscopy, supported by DFT calculations, reveal that it adopts an infinite arm-chair like chain with sp2-hybridized pi-bonds. Simulations predict a superconducting transition at 21.19 K under 113 GPa, higher than that reported in high-pressure experiments for non-metallic elements. At ambient pressure, this phase acquiring an energy density of as high as 8.78 kJ/g is not only kinetically stable but also thermodynamically more stable than cubic gauche nitrogen. This multifunctional property profile positions 1D-PN as a disruptive candidate for both electronic and energetic applications.

cond-mat.mtrl-sci↗

arXiv2026

Towards Long-Horizon Interpretability: Efficient and Faithful Multi-Token Attribution for Reasoning LLMs

Token attribution methods provide intuitive explanations for language model outputs by identifying causally important input tokens. However, as modern LLMs increasingly rely on extended reasoning chains, existing schemes face two critical challenges: (1) efficiency bottleneck, where attributing a target span of M tokens within a context of length N requires O(M*N) operations, making long-context attribution prohibitively slow; and (2) faithfulness drop, where intermediate reasoning tokens absorb attribution mass, preventing importance from propagating back to the original input. To address these, we introduce FlashTrace, an efficient multi-token attribution method that employs span-wise aggregation to compute attribution over multi-token targets in a single pass, while maintaining faithfulness. Moreover, we design a recursive attribution mechanism that traces importance through intermediate reasoning chains back to source inputs. Extensive experiments on long-context retrieval (RULER) and multi-step reasoning (MATH, MorehopQA) tasks demonstrate that FlashTrace achieves over 130x speedup over existing baselines while maintaining superior faithfulness. We further analyze the dynamics of recursive attribution, showing that even a single recursive hop improves faithfulness by tracing importance through the reasoning chain.

cs.LG↗

arXiv2025

ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agents

Vision-Language Models (VLMs), with their strong reasoning and planning capabilities, are widely used in embodied decision-making (EDM) tasks in embodied agents, such as autonomous driving and robotic manipulation. Recent research has increasingly explored adversarial attacks on VLMs to reveal their vulnerabilities. However, these attacks either rely on overly strong assumptions, requiring full knowledge of the victim VLM, which is impractical for attacking VLM-based agents, or exhibit limited effectiveness. The latter stems from disrupting most semantic information in the image, which leads to a misalignment between the perception and the task context defined by system prompts. This inconsistency interrupts the VLM's reasoning process, resulting in invalid outputs that fail to affect interactions in the physical world. To this end, we propose a fine-grained adversarial attack framework, ADVEDM, which modifies the VLM's perception of only a few key objects while preserving the semantics of the remaining regions. This attack effectively reduces conflicts with the task context, making VLMs output valid but incorrect decisions and affecting the actions of agents, thus posing a more substantial safety threat in the physical world. We design two variants of based on this framework, ADVEDM-R and ADVEDM-A, which respectively remove the semantics of a specific object from the image and add the semantics of a new object into the image. The experimental results in both general scenarios and EDM tasks demonstrate fine-grained control and excellent attack performance.

cs.CV↗

arXiv2025

Edge Exposure as the Trigger for Structural Instability in LP-N and HLP-N

LP-N and HLP-N are promising high-energy-density materials. However, these materials synthesized under high pressure cannot be maintained stable at ambient conditions. The mechanism behind their instability remains unclear. Our research, based on first-principles calculations and ab initio molecular dynamics simulations, reveals that while not edge exposed, LP-N and HLP-N exhibit substantial structural, dynamic, and mechanical stability under ambient conditions. The stability of HLP-N is governed by an interlocking mechanism, which becomes ineffective upon exposure of the edges, leading to internal breakdown. As a result, H saturated adsorption has no impact on it. In contrast, LP-N benefits modestly from H saturated adsorption due to its edge-initiated dissociation. The interlocking mechanism offer valuable insights into the design of new materials.

cond-mat.mtrl-sci↗

arXiv2025

Unsaturated Dinitrogen Difluoride under Pressure: toward high-Energy Density Polymerized NF Chains

Based on first-principles calculations and ab initio molecular dynamics simulations, the polymerisation of the unsaturated cis dinitrogen-difluoride (cis-N2F2) molecular compound is investigated. The thermodynamic, dynamical and thermal stabilities of the nitrogen fluorine NF system are investigated at conditions of 0-3000 K and 0-200 GPa. The cis-N2F2 molecule is a suitable precursor to obtain one-dimensional polymerized nitrogen-fluorine (poly-NF) chains at a pressure above 90 GPa and at a temperature around 1900 K. Importantly, these poly-NF chains can be quenched to room conditions, and potentially serve as a High-energy-density materials (HEDM). It has been established that when Al is utilised as a reducing agent, poly-NF chains exhibit a gravimetric energy density of 13.55 kJ/g, which exceeds that of cubic gauche nitrogen (cg-N, 9.70 kJ/g). This is attributable to the presence of both polymerised nitrogen and strong oxidising F atoms.

cond-mat.mtrl-sci↗

arXiv2025

Realizing stable zig-zag polymeric nitrogen chains in P-N compounds

The zig-zag Nitrogen (N) chain similar to the Ch-N structure has long been considered a potential high energy density structure. However, all previously predicted zig-zag N chain structures similar to Ch-N exhibit imaginary frequencies in their phonon spectra at 0 GPa. Here, we conducted a systematic investigation of P-N compounds using first-principles calculations, uncovering a series of structurally similar stable phases, C2/m-PNx (x = 6, 8, 10, 12, 14), in which N forms zig-zag N chains similar to those in Ch-N. In P-N compounds, the longest zig-zag N chain that can theoretically remain stable under ambient pressure is the N chain composed of 14 N atoms in C2/m-PN14. If the N chain continues to grow, inter-chain vibrational imaginary frequencies will arise in the system. Notably, N chains with an even number of atoms are more likely to be energetically favorable. The five C2/m-PNx phases and one metastable phase (R-PN6) exhibit both remarkable stability and excellent detonability at ambient pressure, positioning them as promising candidates for high-energy-density materials. In addition, the R-PN6 is the first structure to stabilize the N6 ring through covalent bonding, with the covalent network contributing to its high hardness (47.59 GPa).

cond-mat.mtrl-sci↗

arXiv2025

PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation

With the rapid advancement of deep learning, the model robustness has become a significant research hotspot, \ie, adversarial attacks on deep neural networks. Existing works primarily focus on image classification tasks, aiming to alter the model's predicted labels. Due to the output complexity and deeper network architectures, research on adversarial examples for segmentation models is still limited, particularly for universal adversarial perturbations. In this paper, we propose a novel universal adversarial attack method designed for segmentation models, which includes dual feature separation and low-frequency scattering modules. The two modules guide the training of adversarial examples in the pixel and frequency space, respectively. Experiments demonstrate that our method achieves high attack success rates surpassing the state-of-the-art methods, and exhibits strong transferability across different models.

cs.CV↗

arXiv2024

Detecting and Corrupting Convolution-based Unlearnable Examples

Convolution-based unlearnable examples (UEs) employ class-wise multiplicative convolutional noise to training samples, severely compromising model performance. This fire-new type of UEs have successfully countered all defense mechanisms against UEs. The failure of such defenses can be attributed to the absence of norm constraints on convolutional noise, leading to severe blurring of image features. To address this, we first design an Edge Pixel-based Detector (EPD) to identify convolution-based UEs. Upon detection of them, we propose the first defense scheme against convolution-based UEs, COrrupting these samples via random matrix multiplication by employing bilinear INterpolation (COIN) such that disrupting the distribution of class-wise multiplicative noise. To evaluate the generalization of our proposed COIN, we newly design two convolution-based UEs called VUDA and HUDA to expand the scope of convolution-based UEs. Extensive experiments demonstrate the effectiveness of detection scheme EPD and that our defense COIN outperforms 11 state-of-the-art (SOTA) defenses, achieving a significant improvement on the CIFAR and ImageNet datasets.

cs.CV↗

arXiv2024

High-pressure synthesis of K_{4}N_{6} compound entirely composed of aromatic hexazine [N_{6}]^{4-} anion

The synthesis of hexazine N_{6} ring is another milestone in nitrogen chemistry after that of aromatic [N_{5}]^{-} anion. However, due to the diversity of carried charges, realizing compounds entirely composed of aromatic hexazine N_{6} ring potentially with high-stability is a challenge. The first reported hexazine N_{6} ring is [N_{6}]^{2-} anion in K_{2}N_{6} [Nat. Chem. 14, 794 (2022)] that does not adhere to H\''uckel's rule, and subsequently, the aromatic hexazine [N_{6}]^{4-} anion mixed with [N_{5}]^{-} anion and N_{2} dimers is realized in the complex compound K_{9}N_{56} [Nat. Chem. 15, 641 (2023)], where 5.36\% of N atoms form aromatic N_{6} ring. Here, we theoretically predict that all N atoms form aromatic hexazine [N_{6}]^{4-} anion in K_{4}N_{6}, which becomes stable at 60 GPa and can stably exist up to 600 K at 0 GPa. Following this approach, based on the diamond anvil cell, K_{4}N_{6} composed of 100\% aromatic hexazine [N_{6}]^{4-} anion is synthesized at 45 GPa after laser-heating and identified by synchrotron X-ray diffraction and Raman spectroscopy. Our results bring us closer to achieving aromatic N6 rings at ambient condition.

cond-mat.mtrl-sci↗

arXiv2024

Charge transfer induced cubic gauche nitrogen from azides

Cubic gauche nitrogen (cg-N) with a three-dimensional network of N-N single bonds attracted lots of attentions in last decades, since it theoretically has five times larger energy than TNT. While, extreme environments of high pressure or plasma treatment were required in traditional routes. Quite recently, in vacuum or protective gas environments, a one-step synthesis route relying solely on heating is reported giving the highest cg-N content. However, corresponding mechanism is missing, which hinders the improvement of yield and the development of simpler methods. Here, by treating KN3 in different gas environments, we find that moisture can prevent the transition from KN3 to cg-N. In a dry air environment at 260 ~ 300°C, KN3 decomposes into K and N2, and charge transfer from K to KN3 can induce cg-N. Furthermore, by grinding or loading pressure on the mixture of KN3 with Li, Na, K, Cs, Ca, Mg and Al, we find that elements with higher electronegativity, higher pressure and temperature conditions are needed to induce cg-N, while grinding alone is sufficient for alkali metals even without heating, thus confirming the charge-transfer mechanism. These findings provide guidance for the synthesis of cg-N under ambient conditions through metal-catalyzed polymerization of various azides.

cond-mat.mtrl-sci↗

arXiv2024

One-step Synthesis of Cubic Gauche Polymeric Nitrogen with High Yield Just by Heating

A high-efficient one-step synthesis of cubic gauche polymeric nitrogen was developed just by thermal treatment of KN3 powders. The Raman and infrared spectra confirm the formation of polymeric nitrogen networks. Thermogravimetric differential scanning calorimeter measurements show that the content of cubic gauche polymeric nitrogen is as high as 1.5 wt% with high thermal stability, which is the highest content value so far.

cond-mat.mtrl-sci↗

arXiv2024

Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need

Traditional unlearnable strategies have been proposed to prevent unauthorized users from training on the 2D image data. With more 3D point cloud data containing sensitivity information, unauthorized usage of this new type data has also become a serious concern. To address this, we propose the first integral unlearnable framework for 3D point clouds including two processes: (i) we propose an unlearnable data protection scheme, involving a class-wise setting established by a category-adaptive allocation strategy and multi-transformations assigned to samples; (ii) we propose a data restoration scheme that utilizes class-wise inverse matrix transformation, thus enabling authorized-only training for unlearnable data. This restoration process is a practical issue overlooked in most existing unlearnable literature, \ie, even authorized users struggle to gain knowledge from 3D unlearnable data. Both theoretical and empirical results (including 6 datasets, 16 models, and 2 tasks) demonstrate the effectiveness of our proposed unlearnable framework. Our code is available at \url{https://github.com/CGCL-codes/UnlearnablePC}

cs.CV↗

arXiv2024

DarkSAM: Fooling Segment Anything Model to Segment Nothing

Segment Anything Model (SAM) has recently gained much attention for its outstanding generalization to unseen data and tasks. Despite its promising prospect, the vulnerabilities of SAM, especially to universal adversarial perturbation (UAP) have not been thoroughly investigated yet. In this paper, we propose DarkSAM, the first prompt-free universal attack framework against SAM, including a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. We first divide the output of SAM into foreground and background. Then, we design a shadow target strategy to obtain the semantic blueprint of the image as the attack target. DarkSAM is dedicated to fooling SAM by extracting and destroying crucial object features from images in both spatial and frequency domains. In the spatial domain, we disrupt the semantics of both the foreground and background in the image to confuse SAM. In the frequency domain, we further enhance the attack effectiveness by distorting the high-frequency components (i.e., texture information) of the image. Consequently, with a single UAP, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts. Experimental results on four datasets for SAM and its two variant models demonstrate the powerful attack capability and transferability of DarkSAM.

cs.AI↗