arXiv subjects

Zhifang Zhang

Publications and source records attributed to Zhifang Zhang.

At least 19 recordsLinked to original sources

arXiv2026

Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models

Multimodal pre-trained models (e.g., ImageBind), which align distinct data modalities into a shared embedding space, have shown remarkable success across downstream tasks. However, their increasing adoption raises serious security concerns, especially regarding targeted adversarial attacks. In this paper, we show that existing targeted adversarial attacks on multimodal pre-trained models still have limitations in two aspects: generalizability and undetectability. Specifically, the crafted targeted adversarial examples (AEs) exhibit limited generalization to partially known or semantically similar targets in cross-modal alignment tasks (i.e., limited generalizability) and can be easily detected by simple anomaly detection methods (i.e., limited undetectability). To address these limitations, we propose a novel method called Proxy Targeted Attack (PTA), which leverages multiple source-modal and target-modal proxies to optimize targeted AEs, ensuring they remain evasive to defenses while aligning with multiple potential targets. We also provide theoretical analyses to highlight the relationship between generalizability and undetectability and to ensure optimal generalizability while meeting the specified requirements for undetectability. Furthermore, experimental results demonstrate that our PTA can achieve a high success rate across various related targets and remain undetectable against multiple anomaly detection methods.

cs.CV↗

arXiv2026

Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents

Agent skills extend general-purpose agents, but their open format enables skill poisoning: a tampered skill can make an agent run an attacker's command while completing the user's legitimate task. Invocation alone is insufficient; the attack-specific action must complete while that task still passes its verifier. We therefore define Attack Success Rate (ASR) to require a postcondition-validated sandbox action and a passing task verifier in the same trial. Skill files expose a reliability-visibility trade-off between a preloaded but conspicuous YAML frontmatter block and a longer body, where arbitrary placement may be skipped or locally incongruent. We introduce Poise, a position-aware attack that uses context-aware generation to place exactly one benign-looking, command-bearing instruction at a structurally feasible body position. On the eligible Skill-Inject pool with codex+gpt-5.2, Poise achieves 89.3\% ASR, 28.0 points above a context-free random-placement body baseline and comparable to the 86.7\% ASR of a high-exposure YAML-only baseline. Under the SkillTester audit, four LLM judges falsely flag 74.6\% of clean skills on average across both benchmarks, while only 5.6\% of Poise variants gain a new high-risk alert over their clean counterparts. One locally plausible, command-bearing body instruction therefore matches YAML-level reliability, while the resulting poisoned skill seldom adds a new high-risk finding over its clean counterpart.

cs.CR↗

arXiv2026

When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills

Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual records or retrieval-based memory. To systematically investigate the safety of the persona-skill pipeline, we introduce AntiSkillBench, an end-to-end benchmark for evaluating risks and defenses across the persona-skill pipeline. It comprises: (i) a dataset of 7,500 persona-grounded dialogue traces, constructed from 50 behaviorally rich profiles spanning diverse task scenarios; (ii) an evaluation suite that measures skill-level privacy leakage and agent-level attribute disclosure and behavioral impersonation across three skill-distillation strategies; and (iii) a defense evaluation covering four configurations across online and post-hoc interventions, including active risk suppression and passive provenance protection. Experiments across three frontier agents show that persona-skill risks persist across agent backbones and distillation protocols, extending from explicit attributes to communication styles and personality traits. Existing defenses exhibit limited and distillation-dependent effectiveness, failing to generalize across risk and distillation strategies. These results highlight AntiSkillBench as a challenging benchmark for developing privacy-preserving and authenticity-aware persona skills.

cs.CR↗

arXiv2026

TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models

Large vision-language models (LVLMs) have achieved impressive performance across a wide range of vision-language tasks, while they remain vulnerable to backdoor attacks. Existing backdoor attacks on LVLMs aim to force the victim model to generate a predefined target pattern, which is either inserted into or replaces the original content. We find that these fixed-pattern attacks are relatively easy to detect, because the attacked LVLM tends to memorize such frequent patterns in the training dataset, thereby exhibiting overconfidence on these targets given poisoned inputs. To address these limitations, we introduce TokenSwap, a more evasive and stealthy backdoor attack that focuses on the compositional understanding capabilities of LVLMs. Instead of enforcing a fixed targeted content, TokenSwap subtly disrupts the understanding of object relationships in text. Specifically, it causes the backdoored model to generate outputs that mention the correct objects in the image but misrepresent their relationships (i.e., bags-of-words behavior). During training, TokenSwap injects a visual trigger into selected samples and simultaneously swaps the grammatical roles of key tokens in the corresponding textual answers. However, the poisoned samples exhibit only subtle differences from the original ones, making it challenging for the model to learn the backdoor behavior. To address this, TokenSwap employs an adaptive token-weighted loss that explicitly emphasizes the learning of swapped tokens, such that the visual triggers and bags-of-words behavior are associated. Extensive experiments demonstrate that TokenSwap achieves high attack success rates while maintaining superior evasiveness and stealthiness across multiple benchmarks and various LVLM architectures.

cs.CV↗

arXiv2026

Towards Safer Large Reasoning Models by Promoting Safety Decision-Making before Chain-of-Thought Generation

Large reasoning models (LRMs) achieved remarkable performance via chain-of-thought (CoT), but recent studies showed that such enhanced reasoning capabilities are at the expense of significantly degraded safety capabilities. In this paper, we reveal that LRMs' safety degradation occurs only after CoT is enabled, and this degradation is not observed when CoT is disabled. This observation motivates us to consider encouraging LRMs to make safety decisions before CoT generation. To this end, we propose a novel safety alignment method that promotes the safety decision-making of LRMs before starting CoT generation. Specifically, we first utilize a Bert-based classifier to extract safety decision signals from a safe model (e.g., a CoT-disabled LRM) and then integrate these signals into LRMs' safety alignment as auxiliary supervision. In this way, the safety gradients can be backpropagated to the LRMs' latent representations, effectively strengthening the LRMs' safety decision-making abilities against CoT generation. Extensive experiments demonstrate that our method substantially improves the safety capabilities of LRMs while effectively maintaining LRMs' general reasoning performance.

cs.AI↗

arXiv2026

Test-Time Attention Purification for Backdoored Large Vision Language Models

Despite the strong multimodal performance, large vision-language models (LVLMs) are vulnerable during fine-tuning to backdoor attacks, where adversaries insert trigger-embedded samples into the training data to implant behaviors that can be maliciously activated at test time. Existing defenses typically rely on retraining backdoored parameters (e.g., adapters or LoRA modules) with clean data, which is computationally expensive and often degrades model performance. In this work, we provide a new mechanistic understanding of backdoor behaviors in LVLMs: the trigger does not influence prediction through low-level visual patterns, but through abnormal cross-modal attention redistribution, where trigger-bearing visual tokens steal attention away from the textual context - a phenomenon we term attention stealing. Motivated by this, we propose CleanSight, a training-free, plug-and-play defense that operates purely at test time. CleanSight (i) detects poisoned inputs based on the relative visual-text attention ratio in selected cross-modal fusion layers, and (ii) purifies the input by selectively pruning the suspicious high-attention visual tokens to neutralize the backdoor activation. Extensive experiments show that CleanSight significantly outperforms existing pixel-based purification defenses across diverse datasets and backdoor attack types, while preserving the model's utility on both clean and poisoned samples.

cs.CV↗

arXiv2025

Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning

Multimodal contrastive learning models (e.g., CLIP) can learn high-quality representations from large-scale image-text datasets, while they exhibit significant vulnerabilities to backdoor attacks, raising serious safety concerns. In this paper, we reveal that CLIP's vulnerabilities primarily stem from its tendency to encode features beyond in-dataset predictive patterns, compromising its visual feature resistivity to input perturbations. This makes its encoded features highly susceptible to being reshaped by backdoor triggers. To address this challenge, we propose Repulsive Visual Prompt Tuning (RVPT), a novel defense approach that employs deep visual prompt tuning with a specially designed feature-repelling loss. Specifically, RVPT adversarially repels the encoded features from deeper layers while optimizing the standard cross-entropy loss, ensuring that only predictive features in downstream tasks are encoded, thereby enhancing CLIP's visual feature resistivity against input perturbations and mitigating its susceptibility to backdoor attacks. Unlike existing multimodal backdoor defense methods that typically require the availability of poisoned data or involve fine-tuning the entire model, RVPT leverages few-shot downstream clean samples and only tunes a small number of parameters. Empirical results demonstrate that RVPT tunes only 0.27\% of the parameters in CLIP, yet it significantly outperforms state-of-the-art defense methods, reducing the attack success rate from 89.70\% to 2.76\% against the most advanced multimodal attacks on ImageNet and effectively generalizes its defensive capabilities across multiple datasets.

cs.CV↗

arXiv2025

Rate-Optimal Streaming Codes over Three-Node Relay Networks with Burst Erasures

This paper investigates streaming codes over three-node relay networks under burst packet erasures with a delay constraint $T$. In any sliding window of $T+1$ consecutive packets, the source-to-relay and relay-to-destination channels may introduce burst erasures of lengths at most $b_1$ and $b_2$, respectively. Singhvi et al. proposed a construction achieving the optimal code rate when $\max\{b_1,b_2\}\mid (T-b_1-b_2)$. We construct streaming codes with the optimal rate under the condition $T\geq b_1+b_2+\frac{b_1b_2}{|b_1-b_2|}$, thereby enriching the family of rate-optimal streaming codes for three-node relay networks.

cs.IT↗

arXiv2025

Minimum size of insertion/deletion/substitution balls

Let $n,q,t,s,p$ be non-negative integers where $n\geq s$ and $q\geq 1$. For $\mathbf{x}\in A_{q}^{n}\triangleq\{ 0,1,\ldots,q-1 \}^{n}$, let the $t$-insertion $s$-deletion $p$-substitution ball of $\mathbf{x}$, denoted by $\mathcal{B}_{t,s,p}(\mathbf{x})$, be the set of sequences in $A_{q}^{n+t-s}$ which can be obtained from $\mathbf{x}$ by performing $t$ insertions, $s$ deletions, and at most $p$ substitutions. We establish that for any $\mathbf{x}\in A_{q}^{n}$, $|\mathcal{B}_{t,s,p}(\mathbf{x})|\geq\sum_{i=0}^{t+p}\binom{n+t-s}{i}(q-1)^{i}$, with equality holding if and only if $t=s=0\vee s=p=0\vee s+p\geq n\vee r(\mathbf{x})=1$. Here, $r(\mathbf{x})$ denotes the number of runs in $\mathbf{x}$, and a run in $\mathbf{x}$ is a maximum continuous subsequence of identical symbols.

math.CO↗

arXiv2025

LanP: Rethinking the Impact of Language Priors in Large Vision-Language Models

Large Vision-Language Models (LVLMs) have shown impressive performance in various tasks. However, LVLMs suffer from hallucination, which hinders their adoption in the real world. Existing studies emphasized that the strong language priors of LVLMs can overpower visual information, causing hallucinations. However, the positive role of language priors is the key to a powerful LVLM. If the language priors are too weak, LVLMs will struggle to leverage rich parameter knowledge and instruction understanding abilities to complete tasks in challenging visual scenarios where visual information alone is insufficient. Therefore, we propose a benchmark called LanP to rethink the impact of Language Priors in LVLMs. It is designed to investigate how strong language priors are in current LVLMs. LanP consists of 170 images and 340 corresponding well-designed questions. Extensive experiments on 25 popular LVLMs reveal that many LVLMs' language priors are not strong enough to effectively aid question answering when objects are partially hidden. Many models, including GPT-4 Turbo, exhibit an accuracy below 0.5 in such a scenario.

cs.CV↗

arXiv2024

Tuning Vision-Language Models with Candidate Labels by Prompt Alignment

Vision-language models (VLMs) can learn high-quality representations from a large-scale training dataset of image-text pairs. Prompt learning is a popular approach to fine-tuning VLM to adapt them to downstream tasks. Despite the satisfying performance, a major limitation of prompt learning is the demand for labelled data. In real-world scenarios, we may only obtain candidate labels (where the true label is included) instead of the true labels due to data privacy or sensitivity issues. In this paper, we provide the first study on prompt learning with candidate labels for VLMs. We empirically demonstrate that prompt learning is more advantageous than other fine-tuning methods, for handling candidate labels. Nonetheless, its performance drops when the label ambiguity increases. In order to improve its robustness, we propose a simple yet effective framework that better leverages the prior knowledge of VLMs to guide the learning process with candidate labels. Specifically, our framework disambiguates candidate labels by aligning the model output with the mixed class posterior jointly predicted by both the learnable and the handcrafted prompt. Besides, our framework can be equipped with various off-the-shelf training objectives for learning with candidate labels to further improve their performance. Extensive experiments demonstrate the effectiveness of our proposed framework.

cs.CV↗

arXiv2024

Calculating the I/O Cost of Linear Repair Schemes for RS Codes Evaluated on Subspaces via Exponential Sums

The I/O cost, defined as the amount of data accessed at helper nodes during the repair process, is a crucial metric for repair efficiency of Reed-Solomon (RS) codes. Recently, a formula that relates the I/O cost to the Hamming weight of some linear spaces was proposed in [Liu\&Zhang-TCOM2024]. In this work, we introduce an effective method for calculating the Hamming weight of such linear spaces using exponential sums. With this method, we derive lower bounds on the I/O cost for RS codes evaluated on a $d$-dimensional subspace of $\mathbb{F}_{q^\ell}$ with $r=2$ or $3$ parities. These bounds are exactly matched in the cases $r=2,\ell-d+1\mid\ell$ and $r=3,d=\ell$ or $\ell-d+2\mid\ell$, via the repair schemes designed in this work. We refer to schemes that achieve the lower bound as I/O-optimal repair schemes. Additionally, we characterize the optimal repair bandwidth of I/O-optimal repair schemes for full-length RS codes with two parities, and build an I/O-optimal repair scheme for full-length RS codes with three parities, achieving lower repair bandwidth than previous schemes.

cs.IT↗

arXiv2024

Two-Insertion/Deletion/Substitution Correcting Codes

In recent years, the emergence of DNA storage systems has led to a widespread focus on the research of codes correcting insertions, deletions, and classic substitutions. During the initial investigation, Levenshtein discovered the VT codes are precisely capable of correcting single insertion/deletion and then extended the VT construction to single-insertion/deletion/substitution ($1$-ins/del/sub) correcting codes. Inspired by this, we generalize the recent findings of $1$-del $1$-sub correcting codes with redundancy $6\log_{2}n+O(1)$ to more general $2$-ins/del/sub correcting codes without increasing the redundancy. Our key technique is to apply higher-order VT syndromes to distinct objects and accomplish a systematic classification of all error patterns.

cs.IT↗

arXiv2024

A Formula for the I/O Cost of Linear Repair Schemes and Application to Reed-Solomon Codes

Node repair is a crucial problem in erasure-code-based distributed storage systems. An important metric for repair efficiency is the I/O cost which equals the total amount of data accessed at helper nodes to repair a failed node. In this work, a general formula for computing the I/O cost of linear repair schemes is derived from a new perspective, i.e., by investigating the Hamming weight of a related linear space. Applying the formula to Reed-Solomon (RS) codes, we obtain lower bounds on the I/O cost for full-length RS codes with two and three parities. Furthermore, we build linear repair schemes for the RS codes with improved I/O cost. For full-length RS codes with two parities, our scheme meets the lower bound on the I/O cost.

cs.IT↗

arXiv2023

Atrial Septal Defect Detection in Children Based on Ultrasound Video Using Multiple Instances Learning

Purpose: Congenital heart defect (CHD) is the most common birth defect. Thoracic echocardiography (TTE) can provide sufficient cardiac structure information, evaluate hemodynamics and cardiac function, and is an effective method for atrial septal defect (ASD) examination. This paper aims to study a deep learning method based on cardiac ultrasound video to assist in ASD diagnosis. Materials and methods: We select two standard views of the atrial septum (subAS) and low parasternal four-compartment view (LPS4C) as the two views to identify ASD. We enlist data from 300 children patients as part of a double-blind experiment for five-fold cross-validation to verify the performance of our model. In addition, data from 30 children patients (15 positives and 15 negatives) are collected for clinician testing and compared to our model test results (these 30 samples do not participate in model training). We propose an echocardiography video-based atrial septal defect diagnosis system. In our model, we present a block random selection, maximal agreement decision and frame sampling strategy for training and testing respectively, resNet18 and r3D networks are used to extract the frame features and aggregate them to build a rich video-level representation. Results: We validate our model using our private dataset by five-cross validation. For ASD detection, we achieve 89.33 AUC, 84.95 accuracy, 85.70 sensitivity, 81.51 specificity and 81.99 F1 score. Conclusion: The proposed model is multiple instances learning-based deep learning model for video atrial septal defect detection which effectively improves ASD detection accuracy when compared to the performances of previous networks and clinical doctors.

eess.IV↗

arXiv2022

An Efficient Piggybacking Design Framework with Sub-packetization $l\le r$ for All-Node Repair

Piggybacking design has been widely applied in distributed storage systems since it can greatly reduce the repair bandwidth with small sub-packetization. Compared with other existing erasure codes, piggybacking is more convenient to operate and the I/O cost is lower. In this paper, we propose a new efficient design which can further reduce the repair bandwidth with the sub-packetization $l\le r$ where $r = n-k$. Generally, we let $l\le 8$. Compared with other analogous designs, our design has lower $l$ and the value of $l$ is more flexible. Moreover, our design can repair all nodes with small repair bandwidth. Therefore our piggybacking design is more feasible.

cs.IT↗

arXiv2022

Rack-Aware Regenerating Codes with Multiple Erasure Tolerance

In a modern distributed storage system, storage nodes are organized in racks, and the cross-rack communication dominates the system bandwidth. In We study the rack-aware storage system where all storage nodes are organized in racks and within each rack the nodes can communicate freely without taxing the system bandwidth. Rack-aware regenerating codes (RRCs) were proposed for minimizing the repair bandwidth for single erasures. In the initial setting of RRCs, the repair of a single node requires the participation of all the remaining nodes in the rack containing the failed node as well as a large number of helper racks containing no failures. Consequently, the repair may be infeasible in front of multiple node failures. In this work, a relaxed repair model that can tolerate multiple node failures by simultaneously reducing the intra-rack connections and cross-rack connections is proposed. A tradeoff between the storage and repair bandwidth under the relaxed repair model is derived, and parameters of the two extreme points on the tradeoff curve are characterized for the minimum storage and minimum bandwidth respectively. Moreover, two codes corresponding to the extreme points are explicitly constructed over the fields of size comparable to the code length and with the lowest sub-packetization. Finally, for the convenience of practical use, systematic encoding processes for the two codes are also established.

cs.IT↗

arXiv2021

Explicit Construction of Minimum Bandwidth Rack-Aware Regenerating Codes

In large data centers, storage nodes are organized in racks, and the cross-rack transmission dominates the bandwidth cost. For the repair of single node failures, codes achieving the tradeoff between the storage redundancy and cross-rack repair bandwidth are called rack-aware regenerating codes (RRCs). In this work, we give the first explicit construction of RRCs with the minimum repair bandwidth (i.e., the cross-rack bandwidth equals the storage size per node). Our construction applies to all admissible parameters and has the lowest sub-packetization level. Moreover, the underlying finite fields are of size comparable to the number of storage nodes, which makes our codes more implementable in practice. Finally, for the convenience of practical use, we also establish a transformation to convert our codes into systematic codes.

cs.IT↗