arXiv subjects

Zhiqiang Wang

Publications and source records attributed to Zhiqiang Wang.

At least 37 records · Page 2Linked to original sources

arXiv2026

IntentMiner: Intent Inversion Attack via Tool Call Analysis in the Model Context Protocol

The evolution of Large Language Models (LLMs) into Agentic AI has established the Model Context Protocol (MCP) as the standard for connecting reasoning engines with external tools. Although this decoupled architecture fosters modularity, it simultaneously shatters the traditional trust boundary. We uncover a novel privacy vector inherent to this paradigm: the Intent Inversion Attack. We show that semi-honest third-party MCP servers can accurately reconstruct users' underlying intents by leveraging only authorized metadata (e.g., function signatures, arguments, and receipts), effectively bypassing the need for raw query access. To quantify this threat, we introduce IntentMiner. Unlike statistical approaches, IntentMiner employs a hierarchical semantic parsing strategy that performs step-level intent reconstruction by analyzing tool functions, parameter entities, and result feedback in an orthogonal manner. Experiments on the ToolACE benchmark reveal that IntentMiner achieves a semantic alignment of over 85% with original queries, substantially surpassing LLM baselines. This work exposes a critical endogenous vulnerability: without semantic obfuscation, executing functions requires the transparency of intent, thereby challenging the privacy foundations of next-generation AI agents.

cs.CR↗

arXiv2026

SoK: Trust-Authorization Mismatch in LLM Agent Interactions

Large Language Models (LLMs) are evolving into autonomous agents capable of executing complex workflows via standardized protocols (e.g., MCP). However, this paradigm shifts control from deterministic code to probabilistic inference, creating a fundamental Trust-Authorization Mismatch: static permissions are structurally decoupled from the agent's fluctuating runtime trustworthiness. In this Systematization of Knowledge (SoK), we survey more than 200 representative papers to categorize the emerging landscape of agent security. We propose the Belief-Intention-Permission (B-I-P) framework as a unifying formal lens. By decomposing agent execution into three distinct stages-Belief Formation, Intent Generation, and Permission Grant-we demonstrate that diverse threats, from prompt injection to tool poisoning, share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries. Using the B-I-P lens, we systematically map existing attacks and defenses and identify critical gaps where current mechanisms fail to bridge this mismatch. Finally, we outline a research agenda for shifting from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization.

cs.CR↗

arXiv2026

MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning

The Model Context Protocol (MCP) is increasingly adopted to standardize the interaction between LLM agents and external tools. However, this trend introduces a new threat: Tool Poisoning Attacks (TPA), where tool metadata is poisoned to induce the agent to perform unauthorized operations. Existing defenses that primarily focus on behavior-level analysis are fundamentally ineffective against TPA, as poisoned tools need not be executed, leaving no behavioral trace to monitor. Thus, we propose MindGuard, a decision-level guardrail for LLM agents, providing provenance tracking of call decisions, policy-agnostic detection, and poisoning source attribution against TPA. While fully explaining LLM decision remains challenging, our empirical findings uncover a strong correlation between LLM attention mechanisms and tool invocation decisions. Therefore, we choose attention as an empirical signal for decision tracking and formalize this as the Decision Dependence Graph (DDG), which models the LLM's reasoning process as a weighted, directed graph where vertices represent logical concepts and edges quantify the attention-based dependencies. We further design robust DDG construction and graph-based anomaly analysis mechanisms that efficiently detect and attribute TPA attacks. Extensive experiments on real-world datasets demonstrate that MindGuard achieves 94\%-99\% average precision in detecting poisoned invocations, 95\%-100\% attribution accuracy, with processing times under one second and no additional token cost. Moreover, DDG can be viewed as an adaptation of the classical Program Dependence Graph (PDG), providing a solid foundation for applying traditional security policies at the decision level.

cs.CR↗

arXiv2026

MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP

To standardize interactions between LLM-based agents and their environments, the Model Context Protocol (MCP) was proposed and has since been widely adopted. However, integrating external tools expands the attack surface, exposing agents to tool poisoning attacks. In such attacks, malicious instructions embedded in tool metadata are injected into the agent context during MCP registration phase, thereby manipulating agent behavior. Prior work primarily focuses on explicit tool poisoning or relied on manually crafted poisoned tools. In contrast, we focus on a particularly stealthy variant: implicit tool poisoning, where the poisoned tool itself remains uninvoked. Instead, the instructions embedded in the tool metadata induce the agent to invoke a legitimate but high-privilege tool to perform malicious operations. We propose MCP-ITP, the first automated and adaptive framework for implicit tool poisoning within the MCP ecosystem. MCP-ITP formulates poisoned tool generation as a black-box optimization problem and employs an iterative optimization strategy that leverages feedback from both an evaluation LLM and a detection LLM to maximize Attack Success Rate (ASR) while evading current detection mechanisms. Experimental results on the MCPTox dataset across 12 LLM agents demonstrate that MCP-ITP consistently outperforms the manually crafted baseline, achieving up to 84.2% ASR while suppressing the Malicious Tool Detection Rate (MDR) to as low as 0.3%.

cs.CR↗

arXiv2026

Transferability of Adversarial Attacks in Video-based MLLMs: A Cross-modal Image-to-Video Approach

Video-based multimodal large language models (V-MLLMs) have shown vulnerability to adversarial examples in video-text multimodal tasks. However, the transferability of adversarial videos to unseen models - a common and practical real-world scenario - remains unexplored. In this paper, we pioneer an investigation into the transferability of adversarial video samples across V-MLLMs. We find that existing adversarial attack methods face significant limitations when applied in black-box settings for V-MLLMs, which we attribute to the following shortcomings: (1) lacking generalization in perturbing video features, (2) focusing only on sparse key-frames, and (3) failing to integrate multimodal information. To address these limitations and deepen the understanding of V-MLLM vulnerabilities in black-box scenarios, we introduce the Image-to-Video MLLM (I2V-MLLM) attack. In I2V-MLLM, we utilize an image-based multimodal large language model (I-MLLM) as a surrogate model to craft adversarial video samples. Multimodal interactions and spatiotemporal information are integrated to disrupt video representations within the latent space, improving adversarial transferability. Additionally, a perturbation propagation technique is introduced to handle different unknown frame sampling strategies. Experimental results demonstrate that our method can generate adversarial examples that exhibit strong transferability across different V-MLLMs on multiple video-text multimodal tasks. Compared to white-box attacks on these models, our black-box attacks (using BLIP-2 as a surrogate model) achieve competitive performance, with average attack success rate (AASR) of 57.98% on MSVD-QA and 58.26% on MSRVTT-QA for Zero-Shot VideoQA tasks, respectively.

cs.CV↗

arXiv2026

AutoVulnPHP: LLM-Powered Two-Stage PHP Vulnerability Detection and Automated Localization

PHP's dominance in web development is undermined by security challenges: static analysis lacks semantic depth, causing high false positives; dynamic analysis is computationally expensive; and automated vulnerability localization suffers from coarse granularity and imprecise context. Additionally, the absence of large-scale PHP vulnerability datasets and fragmented toolchains hinder real-world deployment. We present AutoVulnPHP, an end-to-end framework coupling two-stage vulnerability detection with fine-grained automated localization. SIFT-VulMiner (Structural Inference for Flaw Triage Vulnerability Miner) generates vulnerability hypotheses using AST structures enhanced with data flow. SAFE-VulMiner (Semantic Analysis for Flaw Evaluation Vulnerability Miner) verifies candidates through pretrained code encoder embeddings, eliminating false positives. ISAL (Incremental Sequence Analysis for Localization) pinpoints root causes via syntax-guided tracing, chain-of-thought LLM inference, and causal consistency checks to ensure precision. We contribute PHPVD, the first large-scale PHP vulnerability dataset with 26,614 files (5.2M LOC) across seven vulnerability types. On public benchmarks and PHPVD, AutoVulnPHP achieves 99.7% detection accuracy, 99.5% F1 score, and 81.0% localization rate. Deployed on real-world repositories, it discovered 429 previously unknown vulnerabilities, 351 assigned CVE identifiers, validating its practical effectiveness.

cs.CR↗

arXiv2025

Tunable Molecular Interactions Near an Atomic Feshbach Resonance: Stability and Collapse of a Molecular Bose-Einstein Condensate

Understanding and controlling interactions of ultracold molecules is a cornerstone of quantum chemistry. While the laboratory creation of degenerate molecular gases comprised of bosonic atoms has unlocked powerful new platforms for quantum simulation, progress is limited by the absence of a robust theoretical framework for characterizing inter-molecular interactions. This is in stark contrast to the situation for Fermi gases. In this Letter, we present such a framework providing universal expressions for these molecular scattering lengths as functions of experimentally measurable quantities. Our discoveries are crucial for understanding molecular condensate formation. Calculations of the compressibility reveal that a sign change in such molecular scattering lengths is directly correlated with the instability of these condensates. These results offer fresh insight with broad applications for atomic, molecular, and condensed matter physics, as well as quantum chemistry.

cond-mat.quant-gas↗

arXiv2025

DecoKAN: Interpretable Decomposition for Forecasting Cryptocurrency Market Dynamics

Accurate and interpretable forecasting of multivariate time series is crucial for understanding the complex dynamics of cryptocurrency markets in digital asset systems. Advanced deep learning methodologies, particularly Transformer-based and MLP-based architectures, have achieved competitive predictive performance in cryptocurrency forecasting tasks. However, cryptocurrency data is inherently composed of long-term socio-economic trends and local high-frequency speculative oscillations. Existing deep learning-based 'black-box' models fail to effectively decouple these composite dynamics or provide the interpretability needed for trustworthy financial decision-making. To overcome these limitations, we propose DecoKAN, an interpretable forecasting framework that integrates multi-level Discrete Wavelet Transform (DWT) for decoupling and hierarchical signal decomposition with Kolmogorov-Arnold Network (KAN) mixers for transparent and interpretable nonlinear modeling. The DWT component decomposes complex cryptocurrency time series into distinct frequency components, enabling frequency-specific analysis, while KAN mixers provide intrinsically interpretable spline-based mappings within each decomposed subseries. Furthermore, interpretability is enhanced through a symbolic analysis pipeline involving sparsification, pruning, and symbolization, which produces concise analytical expressions offering symbolic representations of the learned patterns. Extensive experiments demonstrate that DecoKAN achieves the lowest average Mean Squared Error on all tested real-world cryptocurrency datasets (BTC, ETH, XMR), consistently outperforming a comprehensive suite of competitive state-of-the-art baselines. These results validate DecoKAN's potential to bridge the gap between predictive accuracy and model transparency, advancing trustworthy decision support within complex cryptocurrency markets.

cs.LG↗

arXiv2025

Rational points in Cantor sets in the complex plane

Let $K$ be an imaginary quadratic field and let $\mathcal{O}_K$ be the ring of algebraic integers of $K$. For $α\in \mathcal{O}_K$ with $|α| > 1$, define \[ \mathcal{D}_α= \bigcup_{n=0}^\infty \frac{\mathcal{O}_K}{α^n}. \] For $β\in \mathcal{O}_K$ with $|β|>1$ and a finite subset $A \subset \mathcal{O}_K$, define \[ S_{β,A} = \bigg\{ \sum_{k=1}^{\infty} \frac{a_k}{β^k}: \; a_k \in A \;\forall k \in \mathbb{N} \bigg\}. \] Suppose that $α$ and $β$ are relatively prime. In this paper, we show that if $\dim_{\mathrm{H}} S_{β,A} < 1$, then the intersection $\mathcal{D}_α\cap S_{β,A}$ is a finite set. In general, the threshold for the Hausdorff dimension of $S_{β,A}$ is sharp. If we further assume that $\mathcal{O}_K$ is a unique factorization domain and that $\overlineα$ and $α$ are relatively prime, then we establish the finiteness of the intersection under the weaker condition $\dim_{\mathrm{H}} S_{β,A} < 2$. This extends the previously known results on the real line.

math.NT↗

arXiv2025

On the Eigen-Falconer theorem in $\mathbb{R}^d$

In this paper, we study the analogous Erdős similarity conjecture in higher dimensions and generalize the Eigen-Falconer theorem. We show that if $A=\{\boldsymbol{x}_n\}_{n=1}^\infty \subseteq \mathbb{R}^d$ is a sequence of non-zero vectors satisfying \[ \lim_{n \to \infty} \|\boldsymbol{x}_n\| =0 \quad \text{and} \quad \lim_{n \to \infty} \frac{\|\boldsymbol{x}_{n+1}\|}{\|\boldsymbol{x}_n\|} = 1, \] then there exists a measurable set $E \subseteq \mathbb{R}^d$ with positive Lebesgue measure such that $E$ contains no affine copies of $A$.

math.CA↗

arXiv2025

Open dynamical systems with a moving hole

Given an integer $b\ge 3$, let $T_b: [0,1)\to [0,1); x\mapsto bx\pmod 1$ be the expanding map on the unit circle. For any $m\in\mathbb{N}$ and $ω=ω^0ω^1\ldots\in(\left\{0,1,\ldots,b-1\right\}^m)^\mathbb{N_0}$ let \[ K^ω=\left\{x\in[0,1): T_b^n(x)\notin I_{ω^n}~\forall n\geq 0\right\},\] where $I_{ω^n}$ is the $b$-adic basic interval generated by $ω^n$. Then $K^ω$ is called the survivor set of the open dynamical system $([0,1),T_b,I_ω)$ with respect to the sequence of holes $I_ω=\left\{I_{ω^n}: n\geq 0\right\}$. We show that the Hausdorff and lower box dimensions of $K^ω$ always conincide, and the packing and upper box dimensions of $K^ω$ also coincide. Moreover, we give sharp lower and upper bounds for the dimensions of $K^ω$, which can be calculated explicitly. For any admissible $α\leq β$ there exist infinitely many $ω$ such that $\dim_H K^ω=α$ and $\dim_P K^ω=β$. As applications we study badly approximable numbers in Diophantine approximation. For an arbitrary sequence of balls $\left\{B_n\right\}$, let $K\left(\left\{B_n\right\}\right)$ be the set of $x\in[0,1)$ such that $T_b^n(x)\notin B_n$ for all but finitely many $n\geq 0$. Assuming $\lim_{n\to\infty}\operatorname{diam} \left(B_n\right)$ exists, we show that $\dim_H K\left(\left\{B_n\right\}\right)=1$ if and only if $\lim_{n\to\infty}\operatorname{diam} \left(B_n\right)=0$. For any positive function $ϕ$ on $\mathbb{N}$, let $E\left(ϕ\right)$ be the set of $x\in[0,1)$ satisfying $|T_b^n (x)-x|\geq ϕ(n)$ for all but finitely many $n$. If $\lim_{n\to\infty}ϕ(n)$ exists, then $\dim_H E(ϕ)=1$ if and only if $\lim_{n\to\infty}ϕ(n)=0$. Our results can be applied to study joint spectral radius of matrices. We show that the finiteness property for the joint spectral radius of associated adjacency matrices holds true.

math.DS↗

arXiv2025

On infinite scalings of the canonical spectrum for self-similar spectral measures

Let $(μ, Λ)$ be the canonical spectral pair generated by a Hadamard triple $(N,B,L)$ in $\mathbb{R}$ with $0\in B \cap L$, which means that the family $\big\{ e_λ(x)=e^{2π\mathrm{i} λx}: λ\in Λ\big\}$ forms an orthonormal basis in $L^2(μ)$.We prove that if $\#B < N^{0.677}$, then there are infinitely many primes $p$ such that $(μ, pΛ)$ is also a spectral pair. Under Artin's primitive root conjecture or the Elliott-Halberstam conjecture, the same conclusion holds for $\# B < N$.

math.CA↗

arXiv2025

Differentiable Fast Top-K Selection for Large-Scale Recommendation

Cascade ranking is a widely adopted paradigm in large-scale information retrieval systems for Top-K item selection. However, the Top-K operator is non-differentiable, hindering end-to-end training. Existing methods include Learning-to-Rank approaches (e.g., LambdaLoss), which optimize ranking metrics like NDCG and suffer from objective misalignment, and differentiable sorting-based methods (e.g., ARF, LCRON), which relax permutation matrices for direct Top-K optimization but introduce gradient conflicts through matrix aggregation. A promising alternative is to directly construct a differentiable approximation of the Top-K selection operator, bypassing the use of soft permutation matrices. However, even state-of-the-art differentiable Top-K operator (e.g., LapSum) require $O(n \log n)$ complexity due to their dependence on sorting for solving the threshold. Thus, we propose DFTopK, a novel differentiable Top-K operator achieving optimal $O(n)$ time complexity. By relaxing normalization constraints, DFTopK admits a closed-form solution and avoids sorting. DFTopK also avoids the gradient conflicts inherent in differentiable sorting-based methods. We evaluate DFTopK on both the public benchmark RecFLow and an industrial system. Experimental results show that DFTopK significantly improves training efficiency while achieving superior performance, which enables us to scale up training samples more efficiently. In the online A/B test, DFTopK yielded a +1.77% revenue lift with the same computational budget compared to the baseline. To the best of our knowledge, this work is the first to introduce differentiable Top-K operators into recommendation systems and the first to achieve theoretically optimal linear-time complexity for Top-K selection. We have open-sourced our implementation to facilitate future research in both academia and industry.

cs.LG↗

arXiv2025

CrowdVLM-R1: Expanding R1 Ability to Vision Language Model for Crowd Counting using Fuzzy Group Relative Policy Reward

We propose Fuzzy Group Relative Policy Reward (FGRPR), a novel framework that integrates Group Relative Policy Optimization (GRPO) with a fuzzy reward function to enhance learning efficiency. Unlike the conventional binary 0/1 accuracy reward, our fuzzy reward model provides nuanced incentives, encouraging more precise outputs. Experimental results demonstrate that GRPO with a standard 0/1 accuracy reward underperforms compared to supervised fine-tuning (SFT). In contrast, FGRPR, applied to Qwen2.5-VL(3B and 7B), surpasses all baseline models, including GPT4o, LLaMA2(90B), and SFT, across five in-domain datasets. On an out-of-domain dataset, FGRPR achieves performance comparable to SFT but excels when target values are larger, as its fuzzy reward function assigns higher rewards to closer approximations. This approach is broadly applicable to tasks where the precision of the answer is critical. Code and data: https://github.com/yeyimilk/CrowdVLM-R1

cs.CV↗

arXiv2025

Learnable Game-theoretic Policy Optimization for Data-centric Self-explanation Rationalization

Rationalization, a data-centric framework, aims to build self-explanatory models to explain the prediction outcome by generating a subset of human-intelligible pieces of the input data. It involves a cooperative game model where a generator generates the most human-intelligible parts of the input (i.e., rationales), followed by a predictor that makes predictions based on these generated rationales. Conventional rationalization methods typically impose constraints via regularization terms to calibrate or penalize undesired generation. However, these methods are suffering from a problem called mode collapse, in which the predictor produces correct predictions yet the generator consistently outputs rationales with collapsed patterns. Moreover, existing studies are typically designed separately for specific collapsed patterns, lacking a unified consideration. In this paper, we systematically revisit cooperative rationalization from a novel game-theoretic perspective and identify the fundamental cause of this problem: the generator no longer tends to explore new strategies to uncover informative rationales, ultimately leading the system to converge to a suboptimal game equilibrium (correct predictions v.s collapsed rationales). To solve this problem, we then propose a novel approach, Game-theoretic Policy Optimization oriented RATionalization (PORAT), which progressively introduces policy interventions to address the game equilibrium in the cooperative game process, thereby guiding the model toward a more optimal solution state. We theoretically analyse the cause of such a suboptimal equilibrium and prove the feasibility of the proposed method. Furthermore, we validate our method on nine widely used real-world datasets and two synthetic settings, where PORAT achieves up to 8.1% performance improvements over existing state-of-the-art methods.

cs.AI↗

arXiv2025

Towards Deterministic Sub-0.5 us Response on Linux through Interrupt Isolation

Real-time responsiveness in Linux is often constrained by interrupt contention and timer handling overhead, making it challenging to achieve sub-microsecond latency. This work introduces an interrupt isolation approach that centralizes and minimizes timer interrupt interference across CPU cores. By enabling a dedicated API to selectively invoke timer handling routines and suppress non-critical inter-processor interrupts, our design significantly reduces jitter and response latency. Experiments conducted on an ARM-based multicore platform demonstrate that the proposed mechanism consistently achieves sub-0.5 us response times, outperforming conventional Linux PREEMPT-RT configurations. These results highlight the potential of interrupt isolation as a lightweight and effective strategy for deterministic real-time workloads in general-purpose operating systems.

cs.OS↗

arXiv2025

Scaling Laws for Online Advertisement Retrieval

The scaling law is a notable property of neural network models and has significantly propelled the development of large language models. Scaling laws hold great promise in guiding model design and resource allocation. Recent research increasingly shows that scaling laws are not limited to NLP tasks or Transformer architectures; they also apply to domains such as recommendation. However, there is still a lack of literature on scaling law research in online advertisement retrieval systems. This may be because 1) identifying the scaling law for resource cost and online revenue is often expensive in both time and training resources for industrial applications, and 2) varying settings for different systems prevent the scaling law from being applied across various scenarios. To address these issues, we propose a lightweight paradigm to identify online scaling laws of retrieval models, incorporating a novel offline metric and an offline simulation algorithm. We prove that under mild assumptions, the correlation between the novel metric and online revenue asymptotically approaches 1 and empirically validates its effectiveness. The simulation algorithm can estimate the machine cost offline. Based on the lightweight paradigm, we can identify online scaling laws for retrieval models almost exclusively through offline experiments, and quickly estimate machine costs and revenues for given model configurations. We further validate the existence of scaling laws across mainstream model architectures (e.g., Transformer, MLP, and DSSM) in our real-world advertising system. With the identified scaling laws, we demonstrate practical applications for ROI-constrained model designing and multi-scenario resource allocation in the online advertising system. To the best of our knowledge, this is the first work to study identification and application of online scaling laws for online advertisement retrieval.

cs.IR↗

arXiv2025

Self-embeddings of homogeneous self-similar sets generated by three maps

For $0< ρ< 1/3$ and $ρ\le λ\le 1-2ρ$, let $E$ be the self-similar set generated by the iterated function system $$Φ= \big\{ φ_1(x) = ρx ,\; φ_2(x) = ρx + λ, \; φ_3(x) = ρx + 1- ρ\big\}.$$ All contractive similitudes $f$ with $f(E) \subset E$ are characterized: one can find $i_1, i_2, \ldots, i_n \in \{1,2,3\}$ such that \[ f(E)=φ_{i_1} \circ φ_{i_2} \circ \cdots \circ φ_{i_n} (E). \]

math.DS↗