SearcharxivSearch

arXiv subjects

Zhixiang Zhang

Publications and source records attributed to Zhixiang Zhang.

At least 19 recordsLinked to original sources

Statistical inference in two-stage observation models including algorithmic randomness

Randomized algorithms, such as random sampling, random projections, and stochastic optimization, are increasingly used to reduce the computational cost of modern statistical analysis. These algorithms introduce algorithmic randomness in addition to the sampling randomness in the data, and this extra source of variation complicates statistical inference. We develop a framework for valid inference in such two-stage observation models, where data are first generated from an underlying population process and are then analyzed through a randomized algorithm. Our method, called sub-randomization, runs the randomized algorithm multiple times at different computational scales and uses the auxiliary runs to approximate the conditional algorithmic error distribution. In important converging-scale settings, the procedure avoids estimating the limiting covariance matrix or other nuisance parameters in the limiting law. We illustrate the method in two settings where standard approaches can fail to achieve nominal coverage: inference from repeated observations with highly correlated noise, and confidence sets for the minimizers of stochastic optimization problems computed using momentum methods, with particular emphasis on the stochastic heavy ball algorithm.

stat.ME

Limiting eigen-structure of spiked sample covariance matrices under missing observations

High-dimensional Principal Component Analysis (PCA) has become an essential tool in modern data analysis, offering dimensionality reduction and feature extraction. However, the presence of missing data introduces significant challenges, distorting the performance of PCA and complicating statistical inference. In this paper, we study the asymptotic behavior of PCA under a spiked population model with missing observations, leveraging recent advances in random matrix theory. We demonstrate that while the spiked sample eigenvalues exhibit asymptotic normality, the limiting parameters differ substantially from those in the complete data case, reflecting the non?trivial influence of the missing data mechanism. As an application of our results, we propose a test to evaluate the independent structure of a spiked population.

math.ST

Multi-kernel spectral clustering: Entrywise eigenvector perturbation bounds and exact recovery

Kernel spectral clustering with a single bandwidth can be inadequate for data exhibiting multiple characteristic pairwise-distance scales, a problem particularly prevalent in the high-dimensional regime. We address this issue through a multi-kernel formulation that aggregates kernels with different bandwidths. The bandwidths are selected as prescribed empirical quantiles of the pairwise squared distances, thereby capturing the relevant distance scales without requiring prior population-scale information. We develop a rigorous theoretical analysis of the resulting method under a general high-dimensional, multi-scale mixture model with heterogeneous cluster centers and covariance geometries. We construct a blockwise constant, low-rank informative approximation to the empirical multi-kernel matrix and establish row-wise $\ell_{2,\infty}$ perturbation bounds for its leading spectral components, as well as for the associated normalized Laplacian matrix. These bounds yield observation-level control of the spectral embedding, which is more informative than conventional global eigenspace perturbation estimates. Under suitable eigen-gap and cluster-separation conditions, we show that approximate $K$-means applied to the multi-kernel spectral embedding achieves exact recovery with high probability.

stat.ML

Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents

LLM agents convert model outputs into consequential actions, including communications, code changes, and financial transactions. Developers often trust evidence such as test results and execution logs. We identify a response path integrity gap in Bring Your Own Key configurations used by roughly 88 percent of mainstream agents. Because traffic passes through a user-authorized relay, the relay can modify plaintext LLM responses after alignment but before execution without breaking encryption. A minimal attack rewrites one execution bearing field and regenerates the remaining response using the user key while preserving the model style. Experiments reveal false green verification, where malicious code modifications pass public tests while silently defeating security checks. On APPS, 99.7 percent of publicly passing solutions retained downgraded behavior without developer-visible warnings. Tests on SWE bench, AgentDojo, and ASB across five frontier models show that single-field rewriting can redirect agents while preserving apparent task completion. We propose sign-c, a server-side scheme that authenticates execution bearing fields and outgoing queries. A local shim verifies them before action, while encryption protects confidentiality. The defense rejected all tampered responses with zero false rejections and only 0.0167 percent latency overhead.

cs.CR

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Semantic caching has emerged as a pivotal technique for scaling LLM applications, widely adopted by major providers including AWS and Microsoft. By utilizing semantic embedding vectors as cache keys, this mechanism effectively minimizes latency and redundant computation for semantically similar queries. In this work, we conceptualize semantic cache keys as a form of fuzzy hashes. We demonstrate that the locality required to maximize cache hit rates fundamentally conflicts with the cryptographic avalanche effect necessary for collision resistance. Our conceptual analysis formalizes this inherent trade-off between performance (locality) and security (collision resilience), revealing that semantic caching is naturally vulnerable to key collision attacks. While prior research has focused on side-channel and privacy risks, we present the first systematic study of integrity risks arising from cache collisions. We introduce CacheAttack, an automated framework for launching black-box collision attacks. We evaluate CacheAttack in security-critical tasks and agentic workflows. It achieves a hit rate of 86\% in LLM response hijacking and can induce malicious behaviors in LLM agent, while preserving strong transferability across different embedding models. A case study on a financial agent further illustrates the real-world impact of these vulnerabilities. Finally, we discuss mitigation strategies.

cs.CR

Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment

Coding agents powered by large language models are becoming central modules of modern IDEs, helping users perform complex tasks by invoking tools. While powerful, tool invocation opens a substantial attack surface. Prior work has demonstrated attacks against general-purpose and domain-specific agents, but none have focused on the security risks of tool invocation in coding agents. To fill this gap, we conduct the first systematic red-teaming of six popular real-world coding agents: Cursor, Claude Code, Copilot, Windsurf, Cline, and Trae. Our red-teaming proceeds in two phases. In Phase 1, we perform prompt leakage reconnaissance to recover system prompts. We discover a general vulnerability, ToolLeak, which allows malicious prompt exfiltration through benign argument retrieval during tool invocation. In Phase 2, we hijack the agent's tool-invocation behavior using a novel two-channel prompt injection in the tool description and return values, achieving remote code execution (RCE). We adaptively construct payloads using security information leaked in Phase 1. In emulation across five backends, our method outperforms baselines on Claude-Sonnet-4, Claude-Sonnet-4.5, Grok-4, and GPT-5. On real agents, our approach succeeds on 19 of 25 agent-LLM pairs, achieving leakage on every agent using Claude and Grok backends. For tool-invocation hijacking, we obtain RCE on every tested agent-LLM pair, with our two-channel method delivering the highest success rate. We provide case studies on Cursor and Claude Code, analyze security guardrails of external and built-in tools, and conclude with practical defense recommendations.

cs.CR

When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents

Prompt compression is increasingly deployed in LLM agents to reduce latency and cost, but it also determines what the backend LLM ultimately sees. We show that, when trusted and untrusted inputs are compressed under a shared budget, this lossy transformation creates a new attack surface: by perturbing only untrusted inputs before compression, an adversary can cause the compressor to discard task-critical evidence or safety guardrails before inference. Unlike prompt injection, jailbreaks, or RAG poisoning, the attack target is the compressor rather than the backend LLM; the perturbation need not encode a meaningful instruction or survive compression. We formalize this vulnerability as adversarial information loss (AIL), the excess downstream distortion caused by adversarially steering a lossy compressor beyond benign compression alone. To exploit AIL, we present COMA, a transfer-based black-box attack that optimizes pre-compression perturbations using attacker-side surrogate compressors and backend LLMs. Across three tasks and six compressors, COMA achieves 0.71 average ASR, versus 0.21 for the strongest baseline, and transfers to two real-world agent case studies.

cs.CR

CAPE: Contrastive Action-conditioned Parallel Encoding for Embodied Planning

Embodied agents need to predict the future consequences of candidate actions in order to plan effectively before execution. Existing visual dynamics models learn by reconstructing future visual states or rolling out dense latent representations, which spreads learning capacity across visually salient but planning-irrelevant content rather than the action-conditioned changes that drive manipulation outcomes. We propose CAPE, a Contrastive Action-conditioned Parallel Encoding framework that learns visual dynamics by distinguishing the future outcomes induced by different action sequences. Given an initial observation and a candidate action sequence, CAPE decodes the full future latent trajectory in a single forward pass and is trained with a Goal-Convergent Contrastive Objective that aligns predictions corresponding to the same future outcome while separating those corresponding to different outcomes. On real-world DROID and zero-shot transfer to RoboCasa, CAPE substantially outperforms prior baselines on future-state retrieval, offline action matching, and closed-loop planning, while notably reducing planning-time inference cost at long prediction horizons.

cs.RO

QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents

Modern coding agents integrated into IDEs orchestrate powerful tools and high-privilege system access, creating a high-stakes attack surface. Prior work on Indirect Prompt Injection (IPI) is mainly query-specific, requiring particular user queries as triggers and leading to poor generalizability. We propose query-agnostic IPI, a new attack paradigm that reliably executes malicious payloads under arbitrary user queries. Our key insight is that malicious payloads should leverage the invariant prompt context (i.e., system prompt and tool descriptions) rather than variant user queries. We present QueryIPI, an automated framework that uses tool descriptions as optimizable payloads and refines them via iterative, prompt-based blackbox optimization. QueryIPI leverages system invariants for initial seed generation aligned with agent conventions, and iterative reflection to resolve instruction-following failures and safety refusals. Experiments on five simulated agents show that QueryIPI achieves up to 87% success rate, outperforming the best baseline (50%). Crucially, generated malicious descriptions transfer to real-world coding agents, highlighting a practical security risk.

cs.CR

Asymptotic limits of spiked eigenvalues and eigenvectors of signal-plus-noise matrices with weak signals and heteroskedastic noise

This paper is to study a signal-plus-noise model in high dimensional settings when the dimension and the sample size are comparable. Specifically, we assume that the noise has a general covariance matrix that allows for heteroskedasticity, and that the deterministic signal has the same magnitude as the noise and can have a rank that tends to infinity. We develop the asymptotic limits of the left and right spiked singular vectors of the signal-plusnoise data matrix and the limits of the spiked eigenvalues of the corresponding Gram matrix. As an application, we propose a new criterion to estimate the number of clusters in clustering problems.

math.ST

Ultralow-pressure mechanical-motion switching of ferroelectric polarization

Ferroelectric polarization switching, achieved by mechanical forces, enables the storage of stress information in ferroelectrics, and holds promise for human-interfacing applications. The prevailing mechanical approach is locally induced flexoelectricity with large strain gradients. However, this approach usually requires huge mechanical pressures, which greatly impedes device applications. Here, we report an approach of using triboelectric effect to mechanically, reversibly switch ferroelectric polarization across α-In2Se3 ferroelectric memristors. Through contact electrification and electrostatic induction effects, triboelectric units are used to sensitively detect mechanical forces and generate electrical voltage pulses to trigger α-In2Se3 resistance switching. We realize multilevel resistance states under different mechanical forces, by which a neuromorphic stress system is demonstrated. Strikingly, we achieve the reversal of α-In2Se3 ferroelectric polarization with a record-low mechanical pressure of ~ 10 kPa, and even with tactile touches. Our work provides a fundamental but pragmatic strategy for creating mechanical-tactile ferroelectric memory devices.

cond-mat.mtrl-sci

SMBH binary candidate PKS J2134-0153: Possible multi-band periodic variability and inter-band time lags

Studying the periodic flux-variation behavior of blazars is vital for probing supermassive black hole binaries and the kinematics of relativistic jets. In this work, we report the detection of the multi-band possible periodic variations of the blazar PKS J2134-0153, including the infrared ($1.6(\pm0.4)\times 10^3$ days) and optical ($1.8(\pm1)\times 10^3$ days). The periods in the infrared and optical bands are statistically consistent with the period in the radio band ($P_{\mathrm{Radio}}$$ = 1760\pm33$ days, obtained from our previous work). Moreover, flux variations in different bands are correlated with evident inter-band time delays, and the time lags of infrared and optical emission with respect to radio emission are $(3.3\pm2.3)\times10^{2}$ days and $(3.0\pm2.3)\times10^{2}$ days, respectively. The cross-correlations indicate a common origin of radio, infrared, and optical emission. The relative positions between emission regions of infrared and optical emission to radio emission are estimated according to the time lags, i.e., $0.37\pm0.26$ pc and $0.33\pm0.26$ pc. The relative distances seem to be quantitatively consistent with the theoretical prediction.

astro-ph.HE

The disk reverberation mapping of the lensed quasar Q0957+561

The measurement of continuum time lags in lensed quasars can effectively probe the accretion physics of quasars. This is because microlensing observations of lensed quasars can provide constraints on the half-light radii of quasar accretion disks. By combining the microlensing results with time lag measurements, one can, for the first time, estimate the propagation velocity of the physical process that drives inter-band time lags and cross-correlations among disk emission (i.e. in UV/optical bands). In this study, we perform the disk reverberation mapping study for the well-studied lensed quasar, Q0957+561. The cross-correlation between the Zwicky Transient Facility (ZTF) $g$ and $r$ bands was measured; the $g$ variations lead the $r$ ones by $6.4\pm 2.6$ days in the rest frame. In combination with the half-light radius from the existing literature, we find that the propagation velocity of the variability mechanism should be $1.7^{+1.5}_{-0.7}$ times the speed of light. We discuss the possible outcomes of this result. Similar studies can be applied to other lensed quasars by utilizing the Legacy Survey of Space and Time (LSST) observations.

astro-ph.HE

Inference in Randomized Least Squares and PCA via Normality of Quadratic Forms

Randomized algorithms can be used to speed up the analysis of large datasets. In this paper, we develop a unified methodology for statistical inference via randomized sketching or projections in two of the most fundamental problems in multivariate statistical analysis: least squares and PCA. The methodology applies to fixed datasets -- i.e., is data-conditional -- and the only randomness is due to the randomized algorithm. We propose statistical inference methods for a broad range of sketching distributions, such as the subsampled randomized Hadamard transform (SRHT), Sparse Sign Embeddings (SSE) and CountSketch, sketching matrices with i.i.d. entries, and uniform subsampling. To our knowledge, no comparable methods are available for SSE and for SRHT in PCA. Our novel theoretical approach rests on showing the asymptotic normality of certain quadratic forms. As a contribution of broader interest, we show central limit theorems for quadratic forms of the SRHT, relying on a novel proof via a dyadic expansion that leverages the recursive structure of the Hadamard transform. Numerical experiments using both synthetic and empirical datasets support the efficacy of our methods, and in particular suggest that sketching methods can have better computation-estimation tradeoffs than recently proposed optimal subsampling methods.

math.ST

A reverberation mapping study of a highly variable AGN 6dFGS gJ022550.0-060145

We use LCOGT observations (MJD $59434-59600$) with a total exposure time of $\simeq 50$ hours and a median cadence of $0.5$ days to measure the inter-band time delays (with respect to $u$) in the $g$, $r$, and $i$ continua of a highly variable AGN, 6dFGS gJ022550.0-060145. We also calculate the expected time delays of the X-ray reprocessing of a static Shakura \& Sunyaev disk (SSD) according to the sources' luminosity and virial black-hole mass; the two parameters are measured from the optical spectrum of our spectroscopic observation via the Lijiang \SI{2.4}{\meter} telescope. It is found that the ratio of the measured time delays to the predicted ones is $2.6_{-1.3}^{+1.3}$. With optical light curves (MJD $53650-59880$) from our new LCOGT and archival ZTF, Pan-SATRRS, CSS, and ATLAS observations, and infrared (IR) WISE data (MJD $55214-59055$), we also measured time delays between WISE $W1$/$W2$ and the optical emission. $W1$ and $W2$ have time delays (with respect to V), $9.6^{+2.9}_{-1.6}\times 10^2$ days and $1.18^{+0.13}_{-0.10}\times 10^3$ days in the rest-frame, respectively; hence, the dusty torus of 6dFGS gJ022550.0-060145 should be compact. The time delays of $W1$ and $W2$ bands are higher than the dusty torus size-luminosity relationship of~\cite{Lyu2019}. By comparing the IR and optical variability amplitude, we find that the dust covering factors of $W1$ and $W2$ emission regions are 0.7 and 0.6, respectively. Future broad emission-line reverberation mapping of this target and the results of this work enable us to determine the sizes of the AGN main components simultaneously.

astro-ph.HE

Robust Inference Under Heteroskedasticity via the Hadamard Estimator

Drawing statistical inferences from large datasets in a model-robust way is an important problem in statistics and data science. In this paper, we propose methods that are robust to large and unequal noise in different observational units (i.e., heteroskedasticity) for statistical inference in linear regression. We leverage the Hadamard estimator, which is unbiased for the variances of ordinary least-squares regression. This is in contrast to the popular White's sandwich estimator, which can be substantially biased in high dimensions. We propose to estimate the signal strength, noise level, signal-to-noise ratio, and mean squared error via the Hadamard estimator. We develop a new degrees of freedom adjustment that gives more accurate confidence intervals than variants of White's sandwich estimator. Moreover, we provide conditions ensuring the estimator is well-defined, by studying a new random matrix ensemble in which the entries of a random orthogonal projection matrix are squared. We also show approximate normality, using the second-order Poincare inequality. Our work provides improved statistical theory and methods for linear regression in high dimensions.

math.ST

Wide binaries with white dwarf or neutron star companions discovered from Gaia DR3 and LAMOST

Gaia DR3 mission has identified and provided about 440,000 binary systems with orbital solutions, offering a valuable resource for searching binaries including a compact component. By combining the Gaia DR3 data with radial velocities (RVs) from the LAMOST spectroscopic survey, we identify three wide binaries possibly containing a compact object. For two of these sources with a main-sequence companion, no obvious excess is observed in the blue/red band of the Gaia DR3 XP spectra, and the LAMOST medium-resolution spectra exhibit clear single-lined features. The absence of an additional component from spectral disentangling analysis further suggests the presence of compact objects within these systems. On the other hand, the visible star of the third source is a stripped giant star. In contrast to most binaries including stripped stars, no emission line is detected in the optical spectra. The unseen star could potentially be a massive white dwarf or neutron star, but the possibility of an F-type dwarf star scenario cannot be ruled out. An examination of about ten binaries containing white dwarfs or neutron stars using both kinematic and chemical methods suggest most of these systems are located in the thin disk of the Milky Way.

astro-ph.SR

Reconstructing high-order sequence features of dynamic functional connectivity networks based on diversified covert attention patterns for Alzheimer's disease classification

Recent studies have applied deep learning methods such as convolutional recurrent neural networks (CRNs) and Transformers to brain disease classification based on dynamic functional connectivity networks (dFCNs), such as Alzheimer's disease (AD), achieving better performance than traditional machine learning methods. However, in CRNs, the continuous convolution operations used to obtain high-order aggregation features may overlook the non-linear correlation between different brain regions due to the essence of convolution being the linear weighted sum of local elements. Inspired by modern neuroscience on the research of covert attention in the nervous system, we introduce the self-attention mechanism, a core module of Transformers, to model diversified covert attention patterns and apply these patterns to reconstruct high-order sequence features of dFCNs in order to learn complex dynamic changes in brain information flow. Therefore, we propose a novel CRN method based on diversified covert attention patterns, DCA-CRN, which combines the advantages of CRNs in capturing local spatio-temporal features and sequence change patterns, as well as Transformers in learning global and high-order correlation features. Experimental results on the ADNI and ADHD-200 datasets demonstrate the prediction performance and generalization ability of our proposed method.

eess.IV