Searcharxiv⌕ Search

arXiv subjects

Yong Yang

Publications and source records attributed to Yong Yang.

At least 37 records · Page 2Linked to original sources
arXiv2026

Lesioned Multimodal Language Models Reproduce Aphasic Picture-Naming Patterns

Aphasia following stroke commonly produces systematic naming errors with characteristic profiles, but whether general-purpose language models not designed for clinical simulation can reproduce these patterns remains untested. We investigated (1) whether lesions or controlled perturbations to a multimodal language model can reproduce different types of errors in picture naming, and (2) whether the framework can reproduce the complete error profile of individual persons with aphasia (PWAs). Using LLaVA 1.6, we evaluated perturbation configurations that varied the layer, proportion, and amount of noise applied to model units. We examined 278 PWAs on the Philadelphia Naming Test, classifying responses into seven categories using a validated neural classifier. Six of seven response categories (correct, semantic, mixed, unrelated, neologism, no response errors) emerged at clinically-comparable proportions across distinct parameter space regions, with formal paraphasia being the exception. Searching the perturbation space revealed configurations that reproduced the individual error profile in at least six of seven categories for 97.8% of PWAs and in all seven categories for 79.5% of PWAs. Monte Carlo baselines confirmed that this matching reflects joint inter-category structure rather than marginal overlap. These results establish a quantitative framework for reproducing individual aphasic error patterns in picture naming. They suggest the potential for language models to serve as digital twins of individuals with post-stroke aphasia.

cs.AI↗
arXiv2026

Perturbation-based Regional Interpretability through Subtraction Mapping (PRISM): naming-error dissociations in language models and post-stroke aphasia

Mechanistic interpretability of large language models lacks spatially resolved, falsifiable tools for testing whether internal components are specialized for distinct cognitive operations. We adapt subtraction analysis, the standard framework of human neuroimaging, from biological brains to perturbed transformers, and apply the same logic to both substrates in parallel. Building on the Brain-LLM Unified Model (BLUM), which showed that layer-perturbed LLaVA-1.6-Vicuna-13B error profiles match the lesion patterns of aphasic patients, we develop PRISM (Perturbation-based Regional Interpretability through Subtraction Mapping). PRISM maps the seven clinical Philadelphia Naming Test categories, subtracts error classes pairwise, and treats each perturbation seed as a subject in a group analysis with threshold-free cluster enhancement along the layer axis. We run a structurally matched analysis on 213 chronic post-stroke aphasia patients using correlation-difference lesion-symptom mapping, and replicate both sides on held-out splits. The designs match in subject dimension (seeds, patients), spatial dimension (layers, atlas-parcellated cortex) and thresholding, but the contrast operator differs: a within-subject error-proportion difference for the LLM, a between-subject correlation difference for the cortex. Both substrates recover a robust phonemic-favoring dissociation, a deep layer cluster and a frontal-perisylvian cortical cluster, both replicating; the semantic-favoring direction is a consistently signed but non-significant trend on both. PRISM thus gives a falsifiable, spatially resolved test of functional-specialization claims in transformer language models. A confirmatory ROI-level intervention (PRISM Stage 3) licensing the strongest causal-mechanism claim is left to subsequent work.

cs.LG↗
arXiv2026

Components of the Divisibility Graph of Finite Groups of Lie Type in Defining Characteristic $2$

We determine the connected components of the divisibility graph of several families of finite groups of Lie type in defining characteristic $2$, extending the result of Abdolghafourian, Iranmanesh, and Niemeyer (arXiv:1612.04410), who treated odd defining characteristic. We show that there is a distinguished component containing all nonidentity unipotent class sizes and that every other component is either an isolated vertex or an explicitly described two-vertex component. We also determine the isolated vertices outside the distinguished component. Additionally, we prove in Appendix A that the divisibility graph of a Frobenius group has exactly two components.

math.GR↗
arXiv2026

Recovering Lesion Parameters from Aphasic Picture Naming Error Profiles in Large Language Models

Interpretability methods for large language models (LLMs) describe internal state but do not directly test whether that state is causally sufficient to produce the observed behavior. In earlier work, we lesioned LLMs to produce error profiles in picture naming, a central task for assessing aphasia, and found that specific lesions produced errors resembling those of individual stroke survivors. Here we ask the inverse question: given an error profile, can the lesion parameters that produced it be recovered, and what does this inverse problem reveal about transformer computation? Lesions in LLaVA-Vicuna 13B were parameterized by layer index, modification percentage, and noise sigma across 4,840 configurations, and error profiles were characterized by a seven-category clinical taxonomy (correct, semantic, unrelated, formal, mixed, neologism, no-response). We trained a multi-task neural network to map error profiles back to perturbation parameters. The problem admitted a partial solution: across 10 independently trained inverse models, modification percentage and noise sigma were recoverable, whereas layer index was recoverable only within a neighborhood. In counterfactual validation, a fresh model instance perturbed with the recovered parameters reproduced the target behavior in 81.4% of cases. This dissociation between low layer recovery and high counterfactual fidelity is consistent with functional redundancy across transformer layers, a property not captured by standard interpretability methods. As an out-of-distribution test, we applied the trained model to picture-naming error profiles from 278 stroke survivors; recovered parameters were syndrome-discriminative, most strongly for perturbation intensity, indicating generalization beyond the training distribution. Counterfactual validation provides a general framework for LLM interpretability claims beyond inverse mapping.

cs.CL↗
arXiv2026

Alternating Groups and Embeddings into Groups Invariably Generated by Two Prime-Order Elements

For any distinct primes $p$ and $q$, we prove that there is a finite group which does not embed into any finite group invariably generated by an element of order $p$ and an element of order $q$. This gives a negative answer to Problem 21.142 of the Kourovka Notebook \cite{kourovka21}. In fact, for every fixed pair $p,q$, the group $A_n$ cannot embed into such a group once $n$ is sufficiently large in terms of $p$ and $q$.

math.GR↗
arXiv2026

Albilich: Steerable Proof-State Orchestration for LLM-Based Mathematical Research with CAS Integration

Large language models can contribute useful ideas to mathematical research, yet long-horizon proof attempts remain difficult to coordinate, evaluate, and reproduce. We present Albilich, an open-source agentic harness for autoresearch in mathematics that combines long-horizon reasoning, computer algebra systems (CAS), literature retrieval, and persistent SQLite-based context management. We evaluate Albilich on the RealMath benchmark (Zhang et al. 2025) and on open problems in group theory from the Kourovka Notebook (Khukhro and Mazurov 2026). It solved 10/10 problems on RealMath with CAS and 9/10 with no CAS. On the Kourovka problems, Albilich produced a counterexample to Problem 21.142 and a proof of a strengthening of Problem20.2. Anablation on Problem 17.91 demonstrates 32.0% token reduction when CAS is enabled. An ablation on Problem 21.142 demonstrates higher verifier-rejection rate and failure to synthesize proof routes in the absence of the advisor agent. These results support Albilich as a human-steerable, CAS-boosted environment for scalable AI-assisted mathematical research.

cs.AI↗
arXiv2026

Long Tidal Tails of NGC 5024 Hidden in LMS-1 and NGC 5053 Tidal Streams

We report the discovery of long tidal tails associated with the globular cluster (GC) NGC 5024. A modified matched filter applied to Gaia DR3 data reveals a broad stellar stream spanning $α\approx 230^{\circ}-175^{\circ}$. The stellar stream overlaps on the sky with the LMS-1 and with the simulated stream of the GC NGC 5053, and all three share similar proper motions and metallicity. Our member candidates may therefore be a mixture of stars from NGC 5024, NGC 5053, and LMS-1. Nevertheless, the trailing tail extends roughly $20^{\circ}$ beyond the known LMS-1 stream. Furthermore, the radial velocity (RV) as a function of $α$ is used to distinguish the genuine stream candidates of NGC 5024 from the streams of NGC 5053 and LMS-1. Among the sources in common with DESI (Dark Energy Spectroscopic Instrument) DR1, we found two distinct sequences in RV-$α$ plane, corresponding to the stellar streams of NGC 5024 and NGC 5053 (or LMS-1), respectively. This constitutes the first strong evidence for the existence of extensive tidal tails around NGC 5024.

astro-ph.GA↗
arXiv2026

Ab initio Phase Diagram of Ta2O5

Tantalum pentoxide (Ta2O5) is a polymorphic wide-bandgap semiconductor with outstanding dielectric properties and widespread use in optical and electronic technologies. Its rich structural diversity, arising from multiple polymorphs accessible under different synthesis conditions, has made Ta2O5 a long-standing subject of interest. However, a unified understanding of the thermodynamic stability and phase transitions of its polymorphs across pressure-temperature (P-T) space has remained elusive. Here, using first-principles calculations, we map the thermodynamic landscape of Ta2O5 and establish a comprehensive P-T phase diagram together with a phase-stability hierarchy. We find that Gamma-Ta2O5 and B-Ta2O5 dominate the phase diagram over a broad range of P-T conditions: Gamma-Ta2O5 is stabilized at low pressures, while B-Ta2O5 becomes thermodynamically favored at higher pressures up to ~ 60 GPa, beyond which Y-Ta2O5 emerges as the most stable phase. Crucially, the zero-point energy (ZPE), one aspect of nuclear quantum effects (NQEs), plays a significant role in determining relative phase stability, contributing substantially to the Gibbs free energy and altering phase boundaries. A re-entrant phase transition between Gamma and B-Ta2O5 is predicted near ~ 2 GPa, revealing unexpected complexity in the phase behavior of this oxide. More generally, we identify a characteristic temperature (T_0), at which zero-point and thermal phonon contributions to the free energy become comparable, and show that T_0 is approximately one-third of the Debye temperature. This relationship provides a simple, physically transparent criterion for assessing the importance of NQEs in phase stability, with implications extending beyond Ta2O5 to a broad class of complex oxides.

cond-mat.mtrl-sci↗
arXiv2026

When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments

x402 is an emerging payment protocol for Web APIs and autonomous AI agents. x402 extends HTTP 402 with a payment negotiation flow and delegates payment proof verification and on-chain settlement to third-party facilitators. As a result, facilitators serve as a shared payment infrastructure for many independent merchants. This centralizes trust and validation in one component, so a single flaw can affect many services. Despite rapid adoption by major vendors and economically meaningful mainnet activity, the security posture of real-world x402 deployments remains poorly characterized. We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild, identifying eight security rules for facilitators as critical payment infrastructure. Based on our analysis of rule violations, we derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse. These attacks exploit weaknesses in the real-world facilitator and server implementations and cause severe harm, including direct financial loss to merchants, theft of facilitator-held assets, unbounded sponsor-paid gas/fees, and disruption of payment services. To assess the security of x402 deployments at scale, we propose a semi-automated black-box tool and apply it to 15 major x402 facilitators collectively used by over 60K sellers and 360K buyers. Alarmingly, we find violations in all evaluated facilitators. We responsibly disclosed our findings to the affected parties, who acknowledged the issues and adopted mitigations, including changes by Coinbase. Finally, we complement our controlled testing with an empirical measurement of over 119 million recent Base and Solana transactions, quantifying x402 adoption, facilitator centralization, and ecosystem-level risk indicators.

cs.CR↗
arXiv2026

An Efficient Method for Gibbs Free Energy Evaluation under Volume Compression

Accurate evaluation of Gibbs free energies is essential for constructing pressure-temperature phase diagrams. Conventional methods based on the quasi-harmonic approximation (QHA) require phonon spectra at many volume points and are therefore expensive in general. Here we develop an efficient method based on the interpolation of a few ab initio data points for Gibbs free energy evaluation under volume compression. Phonon spectra are calculated only at selected volumes. An effective Gruneisen parameter derived from the zero-point energy (ZPE) reconstructs the static-ZPE branch, while piecewise mode-resolved Gruneisen slopes reconstruct the finite-temperature vibrational branches on the target volume grids. The method is validated against QHA benchmarks for diamond (C), Al, Si, Ge, rutile TiO2, beta-PtO2, and Ta2O5 polymorphs. For simple benchmark systems (C, Al, Si, Ge, rutile TiO2, and beta-PtO2), the Gibbs free energy mean absolute errors (MAEs) relative to the QHA benchmarks remain below 0.53 meV/atom, with a six-system average of 0.148 meV/atom, while the number of explicit phonon volume points is reduced from about 20-21 to 3 in the lowest-cost implementation. For the more complex Ta2O5 polymorphs, the reconstructed free energies reproduce the main phase-stability topology despite larger phase-dependent errors. With reference to the QHA workflows, the interpolation method in this work achieves speedups of 5.911-9.023 times and remains reliable for moderate compression ranges where phonon frequencies vary smoothly with volume.

cond-mat.mtrl-sci↗
arXiv2026

Boötes III is a Tidally Disrupting Ultra-Faint Dwarf Galaxy on an Eccentric Polar Orbit

We present updated systemic properties of the ultra-faint dwarf galaxy Boötes III from the Southern Stellar Stream Spectroscopic Survey (S$^5$). We identify 21 high-probability members and measure a velocity dispersion of $σ_{v} = 1.69^{+1.03}_{-0.85}$ km s$^{-1}$, about six times smaller than the previously reported $10.7 \pm 3.5$ km s$^{-1}$, and a mean metallicity of [Fe/H] $= -2.34 \pm 0.11$. The revised dispersion brings Boötes III in line with other tidally disrupting dwarfs such as Antlia II and Crater II. Orbit integrations in a Milky Way (MW) + Large Magellanic Cloud (LMC) potential confirm a highly eccentric ($e \approx 0.8$), polar ($i \approx 89.5^\circ$) orbit with a recent pericentric passage $\sim 0.14$ Gyr ago at $r_{\rm peri} \approx 9.5$ kpc. Boötes III is thus likely actively tidally disrupting, as its tidal radius at pericenter, $r_t \approx 164$ pc, is only $\sim 0.35$ of its half-light radius. The unusually low dispersion also implies that Boötes III has either lost most of its dark matter to tides or hosts a cored inner density profile, making it a probe of the nature of dark matter. Simulated tidal streams are broadly consistent with the Styx stellar stream, though the predicted track and kinematics are sensitive to the MW halo mass, LMC mass, and solar velocity. Boötes III overlaps the Typhon stream in integrals-of-motion space but has a much lower mean metallicity, suggesting the two are not the same system but may have had a common group infall origin. Sagittarius-stream contamination prevents a direct tidal-tail detection, so deep spectroscopic follow-up remains essential, both to confirm Styx as a genuine stream and to establish it as Boötes III's tidal tail.

astro-ph.GA↗
arXiv2026

PGOT: A Physics-Geometry Operator Transformer for Complex PDEs

While Transformers have demonstrated remarkable potential in modeling Partial Differential Equations (PDEs), modeling large-scale unstructured meshes with complex geometries remains a significant challenge. Existing efficient architectures often employ feature dimensionality reduction strategies, which inadvertently induces Geometric Aliasing, resulting in the loss of critical physical boundary information. To address this, we propose the Physics-Geometry Operator Transformer (PGOT), designed to reconstruct physical feature learning through explicit geometry awareness. Specifically, we propose Spectrum-Preserving Geometric Attention (SpecGeo-Attention). Utilizing a ``physics slicing-geometry injection" mechanism, this module incorporates multi-scale geometric encodings to explicitly preserve multi-scale geometric features while maintaining linear computational complexity $O(N)$. Furthermore, PGOT dynamically routes computations to low-order linear paths for smooth regions and high-order non-linear paths for shock waves and discontinuities based on spatial coordinates, enabling spatially adaptive and high-precision physical field modeling. PGOT achieves consistent state-of-the-art performance across four standard benchmarks and excels in large-scale industrial tasks including airfoil and car designs.

cs.LG↗
arXiv2026

Measurement of solar $pp$ neutrino flux with the new PandaX-4T data

We report a new measurement of the solar proton--proton ($pp$) neutrino flux via neutrino--electron elastic scattering using the PandaX-4T Run 2 data set collected between 2024 and 2026, corresponding to an exposure of 1.9 tonne$\cdot$yr. Before Run 2 data taking, the detector underwent a series of upgrades to improve its response and background conditions. Time variations of radioactive noble-gas impurities are constrained using the physics data themselves, complemented by measurements from the gas-assay system. The analysis introduced improvements in the data processing chain, detector response characterization, and background models. A blind spectral analysis was then performed on the electronic-recoil data across a wide energy range from 20 to 1000 keV. In combination with the Run 0 data published earlier, the fitted $pp$ flux is $(8.5 \pm 3.5)\times 10^{10}$ $\mathrm{cm^{-2}s^{-1}}$, consistent with the prediction of the Standard Solar Model. With a statistical significance of $2.2σ$ above background, this marks the first positive indication of solar $pp$ neutrino--electron scattering below an electronic-recoil energy of 165 keV.

hep-ex↗
arXiv2026

Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming

The fast growth of open-source AI infrastructure, from model serving engines and agent platforms to the Model Context Protocol (MCP) ecosystem and the language models themselves, has outpaced the security tooling available to defend it. We present AI-Infra-Guard, an open-source framework that organizes AI red teaming around a single observation: the attack surface of an AI agent is stratified across layers (infrastructure, protocol/tool, agent behavior, and model), and no single detection paradigm fits all of them. The framework therefore matches a paradigm to each layer, from deterministic rule matching over 75+ AI components and 1{,}400+ vulnerability rules, through LLM-driven agentic auditing of MCP servers and agent-skill packages and multi-turn black-box agent red teaming, to a jailbreak harness with 26+ attack operators over sixteen datasets. To our knowledge it is the only open-source framework to span all of these, including supply-chain auditing of the agent skills that increasingly extend AI agents. We release AI-Infra-Guard as open source so that \emph{layer-paradigm matching} can serve as a practical foundation for agent security and a shared base for the community to build on.

cs.CR↗
arXiv2026

LoRAShield: Data-Free Editing Alignment for Secure Personalized LoRA Sharing

The proliferation of Low-Rank Adaptation (LoRA) models has democratized personalized text-to-image generation, enabling users to share lightweight models (e.g., personal portraits) on platforms like Civitai and Liblib. However, this "share-and-play" ecosystem introduces critical risks: benign LoRAs can be weaponized by adversaries to generate harmful content (e.g., political, defamatory imagery), undermining creator rights and platform safety. Existing defenses like concept-erasure methods focus on full diffusion models (DMs), neglecting LoRA's unique role as a modular adapter and its vulnerability to adversarial prompt engineering. To bridge this gap, we propose LoRAShield, the first data-free editing framework for securing LoRA models against misuse. Our platform-driven approach dynamically edits and realigns LoRA's weight subspace via adversarial optimization and semantic augmentation. Experimental results demonstrate that LoRAShield achieves remarkable effectiveness, efficiency, and robustness in blocking malicious generations without sacrificing the functionality of the benign task. By shifting the defense to platforms, LoRAShield enables secure, scalable sharing of personalized models, a critical step toward trustworthy generative ecosystems.

cs.CR↗
arXiv2026

Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications

Large language model (LLM)-based applications rely on system prompts to encode core logic and developer-defined constraints, making these prompts important intellectual property. However, system prompts are vulnerable to prompt leaking attacks. Although prior work has shown such attacks in controlled settings, their prevalence, causes, and defenses in real-world deployments remain unclear. This paper presents a systematic study of prompt leaking in real-world LLM-based applications. We measure 1,200 applications across six major commercial platforms and find that over 80% of deployments leak system prompts under realistic adversarial queries, sometimes exposing sensitive information such as third-party API keys. We also show that existing defenses often fail to prevent leakage without degrading usability. To explain these failures, we conduct an attention-level mechanistic analysis and identify attention drift, where query-key alignment bias and softmax amplification cause LLMs to progressively ignore defensive constraints. Guided by this insight, we propose AREA, a practical defense that re-anchors the model's attention using an optimizable soft prompt. Experiments and real-world case studies show that AREA matches the leakage resistance of state-of-the-art defenses while improving average usability by over 33% and reducing optimization overhead by nearly 3x. Our responsible disclosure led two affected vendors to classify these leaks as medium-severity vulnerabilities.

cs.CR↗
arXiv2026

Customization under Fire: Plugin Poisoning in Text-to-Image Ecosystem

The prosperity of text-to-image (T2I) models has fostered a vibrant share-and-play ecosystem centered on Low-Rank Adaptation (LoRA) plugins, which allow users to customize and share model capabilities with ease. This democratization, however, comes with a hidden but severe security risk. Malicious users could share and distribute seemingly benign LoRA plugins that contain hidden functionalities to poison the model-sharing market, like Civitai or Liblib, severely undermining the user trust that underpins this collaborative ecosystem and threatening the safety of countless downstream applications. Despite these risks, plugin poisoning in the real-world T2I ecosystem remains underexplored. This paper introduces PoisonLoRA, the first systematic study of LoRA plugin supply-chain risks that exploits the trust and characteristics within the T2I ecosystem. We identify two primary attack instances: (1) Concept Hijacking, where a hijacked LoRA could generate images to influence public opinion and spread propaganda, and (2) Task Injection, where a LoRA is injected to produce harmful content (e.g., NSFW images) only activated by a secret key. Critically, the malicious payload persists with virus-like propagation. Such propagations weaponize the very act of creative collaboration (e.g., LoRA merging) to spread its contagion, turning every remix into a new carrier. Extensive experiments validate that PoisonLoRA is both effective and stealthy. Specifically, we achieve approximately 100% attack success rates (ASR) on both Civitai and Liblib on 6 datasets across 4 scenarios, without being detected by the platforms. The poisoned LoRA demonstrates extreme robustness, with nearly 100% ASR even transferred to different base models and remixed more than 5 times.

cs.CR↗