arXiv subjects

Xiaodong Liu

Publications and source records attributed to Xiaodong Liu.

At least 55 records · Page 3Linked to original sources

arXiv2026

Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling

Large Language Models (LLMs) are typically evaluated for safety under single-shot or low-budget adversarial prompting, which underestimates real-world risk. In practice, attackers can exploit large-scale parallel sampling to repeatedly probe a model until a harmful response is produced. While recent work shows that attack success increases with repeated sampling, principled methods for predicting large-scale adversarial risk remain limited. We propose a scaling-aware Best-of-N estimation of risk, SABER, for modeling jailbreak vulnerability under Best-of-N sampling. We model sample-level success probabilities using a Beta distribution, the conjugate prior of the Bernoulli distribution, and derive an analytic scaling law that enables reliable extrapolation of large-N attack success rates from small-budget measurements. Using only n=100 samples, our anchored estimator predicts ASR@1000 with a mean absolute error of 1.66, compared to 12.04 for the baseline, which is an 86.2% reduction in estimation error. Our results reveal heterogeneous risk scaling profiles and show that models appearing robust under standard evaluation can experience rapid nonlinear risk amplification under parallel adversarial pressure. This work provides a low-cost, scalable methodology for realistic LLM safety assessment. We will release our code and evaluation scripts upon publication to future research.

cs.AI↗

arXiv2026

EMSEdit: Efficient Multi-Step Meta-Learning-based Model Editing

Large Language Models (LLMs) power numerous AI applications, yet updating their knowledge remains costly. Model editing provides a lightweight alternative through targeted parameter modifications, with meta-learning-based model editing (MLME) demonstrating strong effectiveness and efficiency. However, we find that MLME struggles in low-data regimes and incurs high training costs due to the use of KL divergence. To address these issues, we propose $\textbf{E}$fficient $\textbf{M}$ulti-$\textbf{S}$tep $\textbf{Edit (EMSEdit)}$, which leverages multi-step backpropagation (MSBP) to effectively capture gradient-activation mapping patterns within editing samples, performs multi-step edits per sample to enhance editing performance under limited data, and introduces norm-based regularization to preserve unedited knowledge while improving training efficiency. Experiments on two datasets and three LLMs show that EMSEdit consistently outperforms state-of-the-art methods in both sequential and batch editing. Moreover, MSBP can be seamlessly integrated into existing approaches to yield additional performance gains. Further experiments on a multi-hop reasoning editing task demonstrate EMSEdit's robustness in handling complex edits, while ablation studies validate the contribution of each design component. Our code is available at https://github.com/xpq-tech/emsedit.

cs.CL↗

arXiv2026

GeoNorm: Unify Pre-Norm and Post-Norm with Geodesic Optimization

The placement of normalization layers, specifically Pre-Norm and Post-Norm, remains an open question in Transformer architecture design. In this work, we rethink these approaches through the lens of manifold optimization, interpreting the outputs of the Feed-Forward Network (FFN) and attention layers as update directions in optimization. Building on this perspective, we introduce GeoNorm, a novel method that replaces standard normalization with geodesic updates on the manifold. Furthermore, analogous to learning rate schedules, we propose a layer-wise update decay for the FFN and attention components. Comprehensive experiments demonstrate that GeoNorm consistently outperforms existing normalization methods in Transformer models. Crucially, GeoNorm can be seamlessly integrated into standard Transformer architectures, achieving performance improvements with negligible additional computational cost.

cs.LG↗

arXiv2026

EMP: Enhance Memory in Data Pruning

Recently, large language and vision models have shown strong performance, but due to high pre-training and fine-tuning costs, research has shifted towards faster training via dataset pruning. Previous methods used sample loss as an evaluation criterion, aiming to select the most "difficult" samples for training. However, when the pruning rate increases, the number of times each sample is trained becomes more evenly distributed, which causes many critical or general samples to not be effectively fitted. We refer to this as Low-Frequency Learning (LFL). In other words, LFL prevents the model from remembering most samples. In our work, we decompose the scoring function of LFL, provide a theoretical explanation for the inefficiency of LFL, and propose adding a memory term to the scoring function to enhance the model's memory capability, along with an approximation of this memory term. Similarly, we explore memory in Self-Supervised Learning (SSL), marking the first discussion on SSL memory. Using contrastive learning, we derive the memory term both theoretically and experimentally. Finally, we propose Enhance Memory Pruning (EMP), which addresses the issue of insufficient memory under high pruning rates by enhancing the model's memory of data, thereby improving its performance. We evaluated the performance of EMP in tasks such as image classification, natural language understanding, and model pre-training. The results show that EMP can improve model performance under extreme pruning rates. For example, in the CIFAR100-ResNet50 pre-training task, with 70\% pruning, EMP outperforms current methods by 2.2\%.

cs.LG↗

arXiv2025

Identifying convex obstacles from backscattering far field data

The recovery of anomalies from backscattering far field data is a long-standing open problem in inverse scattering theory. We make a first step in this direction by establishing the unique identifiability of convex impenetrable obstacles from backscattering far field measurements. Specifically, we prove that both the boundary and the boundary conditions of the convex obstacle are uniquely determined by the far field pattern measured in backscattering directions for all frequencies. The key tool is Majda's asymptotic estimate of the far field patterns in the high-frequency regime. Furthermore, we introduce a fast and stable numerical algorithm for reconstructing the boundary and computing the boundary condition. A key feature of the algorithm is that the boundary condition can be computed even if the boundary is not known, and vice versa. Numerical experiments demonstrate the validity and robustness of the proposed algorithm.

math.NA↗

arXiv2025

The Illusion of Readiness in Health AI

Large language models have demonstrated remarkable performance in a wide range of medical benchmarks. Yet underneath the seemingly promising results lie salient growth areas, especially in cutting-edge frontiers such as multimodal reasoning. In this paper, we introduce a series of adversarial stress tests to systematically assess the robustness of flagship models and medical benchmarks. Our study reveals prevalent brittleness in the presence of simple adversarial transformations: leading systems can guess the right answer even with key inputs removed, yet may get confused by the slightest prompt alterations, while fabricating convincing yet flawed reasoning traces. Using clinician-guided rubrics, we demonstrate that popular medical benchmarks vary widely in what they truly measure. Our study reveals significant competency gaps of frontier AI in attaining real-world readiness for health applications. If we want AI to earn trust in healthcare, we must demand more than leaderboard wins and must hold AI systems accountable to ensure robustness, sound reasoning, and alignment with real medical demands.

cs.AI↗

arXiv2025

The Radon Transform-Based Sampling Methods for Biharmonic Sources from the Scattered Fields

This paper presents three quantitative sampling methods for reconstructing extended sources of the biharmonic wave equation using scattered field data. The first method employs an indicator function that solely relies on scattered fields $ u^s$ measured on a single circle, eliminating the need for Laplacian or derivative data. Its theoretical foundation lies in an explicit formula for the source function, which also serves as a constructive proof of uniqueness. To improve computational efficiency, we introduce a simplified double integral formula for the source function, at the cost of requiring additional measurements $Δu^s$. This advancement motivates the second indicator function, which outperforms the first method in both computational speed and reconstruction accuracy. The third indicator function is proposed to reconstruct the support boundary of extended sources from the scattered fields $ u^s$ at a finite number of sensors. By analyzing singularities induced by the source boundary, we establish the uniqueness of annulus and polygon-shaped sources. A key characteristic of the first and third indicator functions is their link between scattered fields and the Radon transform of the source function. Numerical experiments demonstrate that the proposed sampling methods achieve high-resolution imaging of the source support or the source function itself.

math-ph↗

arXiv2025

SAS: Simulated Attention Score

The attention mechanism is a core component of the Transformer architecture. Various methods have been developed to compute attention scores, including multi-head attention (MHA), multi-query attention, group-query attention and so on. We further analyze the MHA and observe that its performance improves as the number of attention heads increases, provided the hidden size per head remains sufficiently large. Therefore, increasing both the head count and hidden size per head with minimal parameter overhead can lead to significant performance gains at a low cost. Motivated by this insight, we introduce Simulated Attention Score (SAS), which maintains a compact model size while simulating a larger number of attention heads and hidden feature dimension per head. This is achieved by projecting a low-dimensional head representation into a higher-dimensional space, effectively increasing attention capacity without increasing parameter count. Beyond the head representations, we further extend the simulation approach to feature dimension of the key and query embeddings, enhancing expressiveness by mimicking the behavior of a larger model while preserving the original model size. To control the parameter cost, we also propose Parameter-Efficient Attention Aggregation (PEAA). Comprehensive experiments on a variety of datasets and tasks demonstrate the effectiveness of the proposed SAS method, achieving significant improvements over different attention variants.

cs.CL↗

arXiv2025

Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities

Recent research has shown that Large Language Models (LLMs) are vulnerable to automated jailbreak attacks, where adversarial suffixes crafted by algorithms appended to harmful queries bypass safety alignment and trigger unintended responses. Current methods for generating these suffixes are computationally expensive and have low Attack Success Rates (ASR), especially against well-aligned models like Llama2 and Llama3. To overcome these limitations, we introduce ADV-LLM, an iterative self-tuning process that crafts adversarial LLMs with enhanced jailbreak ability. Our framework significantly reduces the computational cost of generating adversarial suffixes while achieving nearly 100\% ASR on various open-source LLMs. Moreover, it exhibits strong attack transferability to closed-source models, achieving 99\% ASR on GPT-3.5 and 49\% ASR on GPT-4, despite being optimized solely on Llama3. Beyond improving jailbreak ability, ADV-LLM provides valuable insights for future safety alignment research through its ability to generate large datasets for studying LLM safety. Our code is available at: https://github.com/SunChungEn/ADV-LLM

cs.CL↗

arXiv2025

High Thermoelectric Cooling Performance of Junction Thermoelectric Transistors

To achieve high performance thermoelectric materials and devices, thermoelectric transistors, which integrate thermoelectric effects with transistor technology, represent a promising approach. Here p type Bi0.5Sb1.5Te3 and n type Bi2Te2.97Se0.03 are used as the constituent materials for an NPN transistor. By applying forward bias to the emitter and reverse bias to the collector to form a common-base triode configuration, the thermoelectric effect, transistor effect, and interfacial effects within the NPN heterostructure are coupled. This NPN heterostructure induces temperature increase (heat release) at the forward biased end and temperature decrease (heat absorption) at the reverse biased end. Therefore, this device becomes a new type of thermoelectric transistor cooler. Furthermore, a DC equivalent circuit method is introduced to analyze the cooling performance of the thermoelectric transistor cooler. The results show that when the emitter voltage of the NPN thermoelectric transistor cooler is 0.01925V, the collector voltage is 0.2124V, the corresponding base region width is 0.17nm, the maximum temperature difference of 242.89K can be obtained. Even if the base region width is limited to a level of 10 nanometers, for example when the base region width is 12.78nm, the maximum temperature differenced can still reach 174.15K. The research results above indicate that the thermoelectric transistor, which synergistically combines the thermoelectric effect with transistor technology, can effectively enhance the maximum temperature difference that typical thermoelectric cooling can achieve.

physics.app-ph↗

arXiv2025

FlowRL: Matching Reward Distributions for LLM Reasoning

We propose FlowRL: matching the full reward distribution via flow balancing instead of maximizing rewards in large language model (LLM) reinforcement learning (RL). Recent advanced reasoning models adopt reward-maximizing methods (\eg, PPO and GRPO), which tend to over-optimize dominant reward signals while neglecting less frequent but valid reasoning paths, thus reducing diversity. In contrast, we transform scalar rewards into a normalized target distribution using a learnable partition function, and then minimize the reverse KL divergence between the policy and the target distribution. We implement this idea as a flow-balanced optimization method that promotes diverse exploration and generalizable reasoning trajectories. We conduct experiments on math and code reasoning tasks: FlowRL achieves a significant average improvement of $10.0\%$ over GRPO and $5.1\%$ over PPO on math benchmarks, and performs consistently better on code reasoning tasks. These results highlight reward distribution-matching as a key step toward efficient exploration and diverse reasoning in LLM reinforcement learning.

cs.LG↗

arXiv2025

DANCER: Dance ANimation via Condition Enhancement and Rendering with diffusion model

Recently, diffusion models have shown their impressive ability in visual generation tasks. Besides static images, more and more research attentions have been drawn to the generation of realistic videos. The video generation not only has a higher requirement for the quality, but also brings a challenge in ensuring the video continuity. Among all the video generation tasks, human-involved contents, such as human dancing, are even more difficult to generate due to the high degrees of freedom associated with human motions. In this paper, we propose a novel framework, named as DANCER (Dance ANimation via Condition Enhancement and Rendering with Diffusion Model), for realistic single-person dance synthesis based on the most recent stable video diffusion model. As the video generation is generally guided by a reference image and a video sequence, we introduce two important modules into our framework to fully benefit from the two inputs. More specifically, we design an Appearance Enhancement Module (AEM) to focus more on the details of the reference image during the generation, and extend the motion guidance through a Pose Rendering Module (PRM) to capture pose conditions from extra domains. To further improve the generation capability of our model, we also collect a large amount of video data from Internet, and generate a novel datasetTikTok-3K to enhance the model training. The effectiveness of the proposed model has been evaluated through extensive experiments on real-world datasets, where the performance of our model is superior to that of the state-of-the-art methods. All the data and codes will be released upon acceptance.

cs.CV↗

arXiv2025

Testing for Peer Effects without Specifying the Network Structure

This paper proposes an Anderson-Rubin (AR) test for the presence of peer effects in panel data without the need to specify the network structure. The unrestricted model of our test is a linear panel data model of social interactions with dyad-specific peer effect coefficients for all potential peers. The proposed AR test evaluates if these peer effect coefficients are all zero. As the number of peer effect coefficients increases with the sample size, so does the number of instrumental variables (IVs) employed to test the restrictions under the null, rendering Bekker's many-IV environment. By extending existing many-IV asymptotic results to panel data, we establish the asymptotic validity of the proposed AR test. Our Monte Carlo simulations show the robustness and superior performance of the proposed test compared to some existing tests with misspecified networks. We provide two applications to demonstrate its empirical relevance.

econ.EM↗

arXiv2025

Stand on The Shoulders of Giants: Building JailExpert from Previous Attack Experience

Large language models (LLMs) generate human-aligned content under certain safety constraints. However, the current known technique ``jailbreak prompt'' can circumvent safety-aligned measures and induce LLMs to output malicious content. Research on Jailbreaking can help identify vulnerabilities in LLMs and guide the development of robust security frameworks. To circumvent the issue of attack templates becoming obsolete as models evolve, existing methods adopt iterative mutation and dynamic optimization to facilitate more automated jailbreak attacks. However, these methods face two challenges: inefficiency and repetitive optimization, as they overlook the value of past attack experiences. To better integrate past attack experiences to assist current jailbreak attempts, we propose the \textbf{JailExpert}, an automated jailbreak framework, which is the first to achieve a formal representation of experience structure, group experiences based on semantic drift, and support the dynamic updating of the experience pool. Extensive experiments demonstrate that JailExpert significantly improves both attack effectiveness and efficiency. Compared to the current state-of-the-art black-box jailbreak methods, JailExpert achieves an average increase of 17\% in attack success rate and 2.7 times improvement in attack efficiency. Our implementation is available at \href{https://github.com/xiZAIzai/JailExpert}{XiZaiZai/JailExpert}

cs.CR↗

arXiv2025

Camel: Energy-Aware LLM Inference on Resource-Constrained Devices

Most Large Language Models (LLMs) are currently deployed in the cloud, with users relying on internet connectivity for access. However, this paradigm faces challenges such as network latency, privacy concerns, and bandwidth limits. Thus, deploying LLMs on edge devices has become an important research focus. In edge inference, request latency is critical as high latency can impair real-time tasks. At the same time, edge devices usually have limited battery capacity, making energy consumption another major concern. Balancing energy consumption and inference latency is essential. To address this, we propose an LLM inference energy management framework that optimizes GPU frequency and batch size to balance latency and energy consumption. By effectively managing the exploration-exploitation dilemma in configuration search, the framework finds the optimal settings. The framework was implemented on the NVIDIA Jetson AGX Orin platform, and a series of experimental validations were conducted. Results demonstrate that, compared to the default configuration, our framework reduces energy delay product (EDP) by 12.4%-29.9%, achieving a better balance between energy consumption and latency.

cs.NI↗

arXiv2025

Saturn's G ring: insights from the dynamical evolution of dust particles from the G-ring arc

To explore the formation and properties of Saturn's G ring, we study the dynamics of micron-sized dust particles originating from the arc of debris near the inner edge of the ring. The dynamical evolution of particles due to various perturbation forces and the plasma sputtering that erodes the particles is simulated by a well-tested numerical code. Based on the simulation results, the normal $I/F$ of the G ring observed by the Cassini spacecraft can be explained by dust particles originating from the arc. Other properties of the G ring are also estimated, including the steady-state size distribution and the number density of ring particles, the geometric optical depth, the apparent edge-on thickness, the age and the remaining lifetime of the G ring. We find that the particle size distribution of the G ring follows a power law with an exponent of 2.8, and dust particles in the size range of $[5, 10]\,μ$m are dominant within the ring. The average number density of particles of the G ring in the radial direction is about $10^{-3}$-$10^{-2}\,\mathrm{m}^{-3}$. The peak value of the edge-on geometric optical depth of the G ring is about $3.9\times10^{-2}$. The maximum apparent edge-on thickness of the G ring with the geometric optical depth larger than $1\times10^{-8}$ is approximately $9,000\,\mathrm{km}$. The age of the G ring is estimated to be $10^{6}$-$10^{7}\,\mathrm{years}$, and the remaining lifetime of the ring is on the order of $10^{4}\,\mathrm{years}$.

astro-ph.EP↗

arXiv2025

Investigation of lunar ejecta dynamics: Particles reaching the near-Earth space and their effect on Earth-based observation

Aims. Particles ejected from the lunar surface via hypervelocity impacts form a torus between the Earth and the Moon. According to our previous study (Yang et al., A\&A, 659, A120), among them about $2.3\times10^{-4}\,\mathrm{kg/s}$ particles impact the Earth after long-term orbital evolution. We mainly focus on these Earth impactors, analyze their orbital element distribution, and estimate their influence on Earth-based observations. Methods. In previous work we simulated the long-term orbital evolution of particles ejected from the lunar surface, and obtained their steady-state spatial distribution in the Earth-Moon system. In this work, we analyze the simulation results about the Earth impactors, including the fraction of impactors with different initial parameters among all impactors, the orbital element distribution, and the projection of particles onto several Earth-based observatories. Results. Particles ejected from the lunar surface are more likely to impact the Earth within a certain range of initial parameters. Most of these lunar-ejected impactors ($\sim70\%$) reach the Earth within one year, while most of the small ones ($87.2\%$ of $0.2\,\mathrm{μm}$ particles and $64.6\%$ of $0.5\,\mathrm{μm}$ particles) reach the Earth within one week. A large proportion of lunar-ejected Earth impactors can be distinguished from interplanetary dust particles according to the differences in their orbital distributions. Besides, lunar-ejected particles may exhibit distinct configurations and orientations from the perspectives of different Earth-based observatories.

astro-ph.EP↗

arXiv2025

An adaptive symplectic integrator for gravitational dynamics

This paper presents an adaptive symplectic integrator, SQQ-PTQ, developed on the basis of the fixed-step symplectic integrator SQQ. To mitigate the Runge phenomenon, SQQ-PTQ employs Chebyshev interpolation for approximating the action, enhancing both the precision and stability of the interpolation. In addition, to reduce the computational cost of evaluating interpolation functions, SQQ-PTQ introduces a projection method that improves the efficiency of these computations. A key feature of SQQ-PTQ is its use of the time transformation to implement an adaptive time step. To address the challenge of computing complicated Jacobian matrices attributed to the time transformation, SQQ-PTQ adopts a quasi-Newton method based on Broyden's method. This strategy accelerates the solution of nonlinear equations, thereby improving the overall computational performance. The effectiveness and robustness of SQQ-PTQ are demonstrated via three numerical experiments. In particular, SQQ-PTQ demonstrates adaptability in handling close-encounter problems. Moreover, during long-term integrations, SQQ-PTQ maintains the energy conservation, further confirming its advantages as a symplectic algorithm.

math.NA↗