arXiv subjects

Zijian Zhang

Publications and source records attributed to Zijian Zhang.

At least 55 records · Page 3Linked to original sources

arXiv2026

Rosetta: Composable Native Multimodal Pretraining

Achieving true artificial general intelligence requires foundation models capable of integrating new modalities without forgetting prior knowledge. However, accommodating continuous generative objectives alongside discrete understanding tasks causes severe gradient conflicts. Existing architectures, including standard Mixture-of-Experts (MoE), are highly susceptible to representation overwriting. Even structurally partitioned paradigms like Mixture-of-Transformers (MoT) remain vulnerable to catastrophic forgetting, severely impeding multimodal scalability. In this work, we introduce Rosetta, a composable native multimodal pretraining framework designed for seamless and non-destructive modality expansion. Rosetta adopts a modular paradigm where core foundational knowledge is preserved within global shared experts, while modality-specific capabilities are distributed across plug-and-play experts. To guarantee non-destructive composition, we propose Momentum-Anchored Orthogonal Projection (MAOP). MAOP leverages the optimizer's momentum state as an implicit semantic anchor, selectively neutralizing conflicting gradient components from new modalities while preserving synergistic updates. Extensive evaluations demonstrate that, while standard MoE and MoT architectures suffer catastrophic forgetting of previously acquired knowledge, Rosetta robustly preserves established language and visual understanding. Furthermore, it delivers superior image generation and unlocks cross-modal synergy, paving the way for truly composable and unified multimodal foundation models. To facilitate further multimodal research, we release our code and checkpoints to the community. Project page at https://rosetta-lmm.github.io/.

cs.CV↗

arXiv2026

JWST COSMOS-3D: Spectroscopic Census and Luminosity Function of [O III] Emitters at 6.75<z<9.05 in COSMOS

We present a catalogue of spectroscopically selected [OIII]+Hb emitters at 6.75<z<9.05 and the resulting [OIII] 5008 ÅLuminosity Function (LF) in the COSMOS field. We leverage the 0.33 deg$^2$ covered by COSMOS-3D using NIRCam/WFSS F444W to perform the largest spectroscopic search for [OIII] emitters at 6.75<z<9.05. We present our catalogue of 249 [OIII] emitters and their associated completeness function. The inferred constraints on the [OIII] LF enable us to characterise the knee of the [OIII] LF, resulting in improved [OIII] LF constraints at z~7,8. Notably, we find evidence for a decline of the [OIII] luminosity density between z~7 and z~8, which could be expected if the metallicity of [OIII] emitters, as well as the cosmic star-formation rate density, is declining at these redshifts. We find that theoretical models that reproduce the z~7,8 [OIII] LF do not reproduce well the [OIII] equivalent width distribution, pointing to potential challenges in the modelling of[OIII] and other nebular lines in the early Universe. Finally, we provide the first constraints on the cosmic variance of [OIII] emitters, estimating at 15% the fractional uncertainty for the z~7,8 [OIII] LF in the 0.33 deg$^2$ field. This estimate is in good agreement with that inferred from clustering, and shows that the [OIII] LF derived from smaller extragalactic legacy fields is strongly affected by cosmic variance. Our results highlight the fundamental role that wide-area JWST slitless surveys play to map the galaxy large-scale structure down into the reionisation era, serving as a springboard for a variety of science cases.

astro-ph.GA↗

arXiv2026

Symbiotic-MoE: Unlocking the Synergy between Generation and Understanding

Empowering Large Multimodal Models (LMMs) with image generation often leads to catastrophic forgetting in understanding tasks due to severe gradient conflicts. While existing paradigms like Mixture-of-Transformers (MoT) mitigate this conflict through structural isolation, they fundamentally sever cross-modal synergy and suffer from capacity fragmentation. In this work, we present Symbiotic-MoE, a unified pre-training framework that resolves task interference within a native multimodal Mixture-of-Experts (MoE) Transformers architecture with zero-parameter overhead. We first identify that standard MoE tuning leads to routing collapse, where generative gradients dominate expert utilization. To address this, we introduce Modality-Aware Expert Disentanglement, which partitions experts into task-specific groups while utilizing shared experts as a multimodal semantic bridge. Crucially, this design allows shared experts to absorb fine-grained visual semantics from generative tasks to enrich textual representations. To optimize this, we propose a Progressive Training Strategy featuring differential learning rates and early-stage gradient shielding. This mechanism not only shields pre-trained knowledge from early volatility but eventually transforms generative signals into constructive feedback for understanding. Extensive experiments demonstrate that Symbiotic-MoE achieves rapid generative convergence while unlocking cross-modal synergy, boosting inherent understanding with remarkable gains on MMLU and OCRBench.

cs.CV↗

arXiv2026

ToE: A Hierarchical and Explainable Claim Verification Framework with Dynamic Multi-source Evidence Retrieval and Aggregation

The rapid spread of fake news poses increasing threats to information ecosystems, especially as AI-generated misinformation under Generative Engine Optimization (GEO) poisoning allows adversarially crafted content to be systematically surfaced by retrieval systems, contaminating LLM reasoning. In this paper, we propose Tree of Evidence (ToE), a hierarchical evidence reasoning framework for automated fact-checking that models each claim as a dynamically expanding argument tree. ToE integrates a reinforcement learning-driven multi-source retrieval agent, an evidence evaluation agent, and an argument tree aggregation algorithm to iteratively decompose, retrieve, and verify claims through an explainable evidence chain. We further provide a theoretical analysis of the retrieval process, deriving a formal error bound that guarantees the learned policy converges to a neighborhood of the information-theoretically optimal policy. Experiments across multiple datasets and backbone LLMs demonstrate that ToE achieves improvements ranging from 4 to 24 percentage points over competitive baselines, with particularly pronounced gains on adversarially poisoned inputs.

cs.AI↗

arXiv2026

The Best of the Two Worlds: Harmonizing Semantic and Hash IDs for Sequential Recommendation

Conventional Sequential Recommender Systems (SRS) typically assign unique hash IDs (HID) to construct item embeddings, which mainly capture collaborative signals from historical user-item interactions. However, such embeddings are vulnerable in long-tail scenarios where most items are rarely consumed. Recent methods that incorporate auxiliary information often face noisy collaborative sharing from co-occurrence signals or semantic homogeneity caused by flat dense embeddings. In contrast, Semantic IDs (SID), with their support for code sharing and multi-granular semantic modeling, offer a promising alternative. Nevertheless, SID-based methods are hindered by a collaborative overwhelming phenomenon: commonly adopted quantization mechanisms compromise the identifier uniqueness needed to model head items, resulting in a performance trade-off between head and tail items. To address this challenge, we propose H2Rec, a novel framework that harmonizes SID and HID. We design a dual-branch modeling architecture that simultaneously captures the multi-granular semantics of SID while preserving the unique collaborative identity provided by HID. Moreover, we introduce a dual-level alignment strategy to bridge the two representations, enabling effective knowledge transfer and robust preference modeling. Extensive offline experiments on three public benchmarks and online experiments on a large-scale commercial platform demonstrate that H2Rec achieves a better balance between head and tail recommendation quality and consistently outperforms existing baselines.

cs.IR↗

arXiv2026

OPERA: Aligning Open-Ended Reasoning via Objective Perplexity-based Reinforcement Learning

Reinforcement Learning (RL) has enabled LLMs to excel in objective reasoning tasks such as mathematics and code generation. However, applying RL to open-ended tasks, such as creative writing, remains challenging because LLM-as-a-judge reward models often exhibit stylistic biases and positional inconsistencies, leading to unstable supervision. To address this, we propose OPERA (Objective Perplexity-based Reflective Alignment), which replaces unreliable external judges with intrinsic rewards derived from perplexity dynamics. Specifically, we derive an intrinsic reward signal from perplexity dynamics, quantifying uncertainty reduction at critical reflective states. During the cold-start phase, we introduce a data synthesis method that leverages carefully designed guiding words to generate diverse reasoning traces, along with perplexity-prioritized rollouts that utilize internal log-probabilities to identify logically consistent reasoning branches. This pipeline yields a large-scale dataset comprising 20,000 high-quality reasoning trajectories. Empirical evaluations consistently demonstrate the scalability and efficacy of our approach in alignment for open-ended tasks. Implementing OPERA on Qwen3-8B establishes a new state-of-the-art among open-source models, achieving parity with or surpassing proprietary models like Gemini2.5 and MiniMax-M2.5 in some open-ended tasks. The code is available at https://github.com/pangpang-xuan/OPERA.

cs.CL↗

arXiv2026

Local Analogs of Little Red Dots: Optical Variability and Evidence for an Active Galatic Nucleus Origin

Little red dots (LRDs) draw extensive attention because of their unique observational characteristics and apparent overabundance in the early Universe, raising new insights into early black hole formation and growth. Early studies show that LRDs exhibit weak variability in broad-band photometry and emission-line fluxes, suggesting a preference for super-Eddington accretion or disfavouring an AGN origin. However, the cadence of the current data, and therefore, the resulting light curves for LRDs, is limited, preventing us from placing strong constraints on their variability. Based on Zwicky Transient Facility (ZTF) light curves with a baseline of $\sim6$ years, we here study the optical variability of seven previously reported local analogs of LRDs at $z \sim 0.3$, offering an insight into LRDs from a low-redshift sample. Three out of seven local analogs show excess variances on all three bands of their light curves, and two of them can be fitted with the damping random walk model, supporting their AGN origins for the variability. The remaining sources show weak variance in at least one band, but no detectable variability at the current sensitivity level, exhibiting $\rm SF_\infty$ upper limits consistent with estimates from high-redshift (high-$z$) LRDs. Their non-detection of variability is likely due to the large photometric uncertainty. As an implication, by simulating long baseline light curves with the variability amplitude of local analogs and adopting JWST observation cadence, we investigate the limitation of the variability amplitude estimate for LRDs. Our mock observations imply that the current constraints on LRDs' variability are probably underestimated. This underestimation might be induced by the short temporal baseline of observations, as well as the intrinsic scatter of the empirical $M_{\rm BH}-τ$ relation.

astro-ph.GA↗

arXiv2026

MoE Enhanced Federated Learning for Spatiotemporal Prediction

Traffic prediction is fundamental to intelligent transportation systems and urban computing, yet many cities continue to suffer from traffic data scarcity due to limited sensor deployment and uneven urban development. Cross-city knowledge transfer has thus attracted increasing attention, enabling data-rich cities to assist data-scarce ones. However, centralized approaches raise privacy concerns, while existing federated methods struggle with pronounced spatiotemporal heterogeneity across cities. To address these challenges, we propose MoE-FedTP, a personalized federated cross-city spatiotemporal prediction framework based on lightweight Mixture-of-Experts (MoE) networks. MoE-FedTP first employs spatiotemporal neural networks to extract features from both source and target cities, then introduces a set of expert networks derived from different source cities through partial parameter sharing. A gating mechanism dynamically fuses the experts to capture diverse traffic dynamics, achieving fine-grained modeling of urban heterogeneity while preserving privacy. Experiments on four real-world traffic datasets show that MoE-FedTP consistently outperforms state-of-the-art cross-city and federated learning baselines, demonstrating its effectiveness in enhancing prediction accuracy for data-scarce cities.

cs.LG↗

arXiv2026

VFEM: Visual Feature Empowered Multivariate Time Series Forecasting with Cross-Modal Fusion

Large time series foundation models often adopt channel-independent architectures to handle varying data dimensions, but this design ignores crucial cross-channel dependencies. Meanwhile, existing cross-modal methods predominantly rely on textual modalities, leaving the spatial pattern recognition capabilities of vision models underexplored for time series analysis. To address these limitations, we propose VFEM, a cross-modal forecasting model that leverages pre-trained large vision models (LVMs) to capture complex cross-variable patterns. VFEM transforms multivariate time series into visual representations, enabling LVMs to perceive spatial relationships that are not explicitly modeled by channel-independent models. Through a dual-branch architecture, visual and temporal features are independently extracted and then fused via cross-modal attention, allowing complementary information from both modalities to enhance forecasting. By freezing the LVM and training only 7.45% of the total parameters, VFEM achieves competitive performance on multiple benchmarks, offering a new perspective on multivariate time series forecasting.

cs.LG↗

arXiv2026

ABCD: The Nuclear Structure of the Little Red Dots Revealted through Absorption, Break, Continuum, and Decrement

We present a spectroscopic analysis of 14 little red dots (LRDs) at redshifts $2.2 < z < 6.7$ using NIRSpec/MSA prism and medium-resolution grating observations, aiming to constrain the nuclear gas structure through Balmer emission-line profiles, absorption features, relative line intensities, and continuum properties. We simultaneously decompose the broad, narrow, and absorption components of ${\rm H α}$, ${\rm H β}$, and ${\rm H γ}$, and measure both integrated line ratios and velocity-resolved Balmer decrements. The narrow-line Balmer decrements are broadly consistent with Case~B recombination modified by mild dust attenuation, while the broad-line decrements are elevated to levels consistent with photoionization models of high-density gas at $n_{\rm H} \gtrsim 10^9\ {\rm cm^{-3}}$. Velocity-resolved Balmer decrements in five sources with highest signal-to-noise ratio are centrally peaked. Assuming virialized broad-line region dynamics, our model can reproduce the Balmer decrement profiles in three sources using a radial density profile with a power-law index $β<2$. The Balmer absorption lines detected in six sources yield absorber covering factors exceeding $50\%$. Sources with blueshifted absorption lines tend to have elevated narrow-line Balmer decrement, suggesting a connection between dust content and the presence of outflow. Comparing the incident luminosity inferred from broad and narrow ${\rm H α}$ emission with the continuum suggests that both the UV and optical continuum and the line emission are linked by photoionization. We propose that the distinctive spectral and continuum properties of LRDs can be explained via a viewing angle-dependent nuclear structure in which an optically thick, clumpy gaseous torus surrounds the central accretion disk, with broad-line clouds and absorbers distributed along the less-obscured polar directions.

astro-ph.GA↗

arXiv2026

Little red dots as a cosmological probe: constraining $H_0$ with quasi-periodic pulsations

The James Webb Space Telescope (JWST) has uncovered a population of ``little red dots'' (LRDs) at $z \gtrsim 4$, potentially representing early supermassive black holes embedded in dense gaseous envelopes. The recent discovery of the lensed LRD RXJ2211-RX1 reveals significant variability on rest-frame timescales of decades, which may be interpreted as quasi-periodic variation that has a potential physical parallel to stellar pulsations. In this work, we derive an idealized, self-consistent period-luminosity-temperature ($P$-$L$-$T_{\rm eff}$) relation based on the hydrostatic envelope model. If this theoretical relation holds and can be empirically validated/calibrated, it would offer a novel framework for constraining the Hubble constant ($H_0$). The current sparse sampling of \tgta\ yields a preliminary $H_0 = 120.7_{-46.5}^{+47.0} \text{ km s}^{-1}\text{ Mpc}^{-1}$ as a proof-of-concept, with the error budget dominated by the uncertainty of the pulsation period. Our forecasting analysis shows that continuous monitoring over a 10-year baseline can reduce the $H_0$ uncertainty to 3-20\%, depending on the intrinsic pulsation period, while the systematic uncertainty floor remains to be fully characterized. This method offers a potential independent probe to measure luminosity distances in the early universe.

astro-ph.GA↗

arXiv2026

GaussianDream: A Feed-Forward 3D Gaussian World Model for Robotic Manipulation

Vision-language-action (VLA) policies have advanced language-conditioned robotic manipulation by transferring semantic priors from pretrained vision-language models to action generation. However, standard action-imitation learning often lacks sufficient modeling of explicit 3D spatial information, dense geometric supervision, and future environment evolution, all critical for precise robotic interaction. To address this, we propose \textbf{GaussianDream}, a feed-forward 3D Gaussian world-model plug-in. Specifically, we introduce learnable GaussianDream Queries in the encoder, enabling the model to capture current-frame 3D spatial structure and short-horizon future evolution. During training, the latent GaussianDream prefix is processed by a static reconstruction head and a future prediction head to produce current 3D Gaussian scene states and future Gaussian evolution states. The current branch is supervised by RGB rendering and depth, while the future branch uses future RGB, depth, and pseudo 3D scene-flow signals. During inference, GaussianDream discards all auxiliary heads and retains only the learned prefix to condition action generation, without test-time Gaussian reconstruction or future prediction. Experimental results demonstrate that GaussianDream achieves state-of-the-art performance across multiple robotic manipulation benchmarks, reaching \textbf{98.4\%} on LIBERO, \textbf{54.8\%} on RoboCasa Human-50, and \textbf{50.0\%} on real-robot tasks. Compared with existing 3D-enhanced VLA methods, GaussianDream achieves strong accuracy while providing higher inference efficiency than video-based world-model approaches.

cs.RO↗

arXiv2026

Beyond Benchmark Islands: Toward Representative Trustworthiness Evaluation for Agentic AI

Agentic AI systems increasingly act through tool-augmented, multi-step workflows whose failures (unsafe tool use, unauthorised actions, social harm) carry deployment-level consequences. Evaluation practice remains fragmented across isolated benchmark slices, and "trustworthiness" is frequently invoked but rarely defined operationally. We argue the central limitation is twofold: (i) the absence of a measurable specification of what agent trustworthiness means, and (ii) the lack of a principled notion of representativeness allowing assessment over a socio-technical scenario distribution rather than disconnected benchmark instances. We address (i) by defining agentic trustworthiness as a five-property profile (Reliability, Robustness, Safety, Social-Ethical Alignment, Operational Integrity) grounded in current AI risk frameworks, and (ii) with the Holographic Agent Assessment Framework (HAAF), which measures this profile over a scenario manifold through static policy analysis, sandbox simulation, social-ethical alignment assessment, and distribution-aware sampling, connected through an iterative Trustworthy Optimization Factory that converts red-team diagnoses into blue-team interventions. Our contributions are: (1) an operational five-property definition of agentic trustworthiness; (2) a distribution-aware scenario-sampling framework that surfaces property-level trade-offs invisible to scalar leaderboards; and (3) a cross-family transfer experiment in which interventions designed from a single focal model generalise -- without per-model or per-scenario tuning -- to 13 systems from seven model families (Llama, Mistral, Kimi, GLM, Qwen, GPT, DeepSeek) on a 100-scenario suite, where all 13 systems improve and two reach a perfect risk-weighted profile, establishing HAAF's Factory as a model-agnostic deployment-readiness pipeline. Code: https://github.com/TonyQJH/haaf-pilot

cs.CL↗

arXiv2026

(LRDs)$^2$: The Low-ReDshift Little Red Dots Survey. II. DESI DR1 Sample

JWST has revealed a substantial population of "Little Red Dots" (LRDs) at $z>4$, challenging conventional AGN frameworks. However, the low-redshift regime remains largely unexplored. In the second paper of the (LRDs)$^2$ series, we present a systematic selection from DESI DR1 and identify 27 LRDs at $z=0.2-0.9$, yielding a number density lower limit of $7.5 \times 10^{-10}$ cMpc$^{-3}$. We conducted near-IR spectroscopic follow-up observations for 18 of them, revealing their full SED shapes and emission lines. These low-$z$ LRDs share the hallmark properties of their high-$z$ counterparts: compact morphology, V-shaped UV-optical continua, broad Balmer emission with extreme decrements (median H$α$/H$β\sim 16$), frequent Balmer absorption (67%), and blackbody-like optical-to-near-IR continua. All have low metallicity, occupy the same regions in the BPT diagram as high-$z$ LRDs, and have softer ionizing spectra than typical AGNs. The consistency between low-$z$ and high-$z$ LRD properties indicates the same physical processes at work. The correlation between broad-line Balmer luminosity and $L_{5100}$ deviates from that of local type-1 AGNs, limiting the direct application of local BH mass calibrations. Ionized [O III] outflows are ubiquitous (78%). One LRD at $z=0.196$, J1717+3807, shows robust long-term variability in $i$ and WISE bands. The optical-to-NIR continua of LRDs reveal a wide range of temperatures $\sim 2000-4700$ K (peak $0.6-1.5$ $μ$m), with a subset showing cooler and larger envelopes than those at high $z$. Low-$z$ LRDs serve not only as proximate laboratories for probing the nature of LRDs, but also trace the cosmic evolution of this population from the cosmic dawn to the present day.

astro-ph.GA↗

arXiv2026

Reading the Cell, Designing the Cure: Perturbation-Conditioned Molecular Diffusion for Function-Oriented Drug Design

When reliable target structures are unavailable at scale or phenotypes arise from dysregulated pathways, transcriptomic perturbations provide a system-level functional readout for drug action. In this work, we formalize \emph{Transcriptome-based Drug Design (TBDD)} as a generative inverse problem: designing drug molecules conditioned on desired transcriptomic state transitions. We analyze the inherently ill-posed nature of this task, which is further complicated by the profound domain gap between biology and chemistry and by the sparsity of transcriptomic signals. To address these challenges, we propose \textbf{\themodel{}} (A \textbf{C}ell\textbf{U}lar \textbf{R}esponse \textbf{E}ngine), a multi-resolution transcriptome-guided diffusion framework. \themodel{} features a specialized \textbf{Transcriptome Perturbation Functional Feature Extractor (TFE)} that (1) distills function-oriented perturbation embeddings from pre/post states, (2) aligns these signatures to dual chemical views to bridge the cross-modal gap, and (3) performs heterogeneity-aware aggregation to extract robust state-specific signals from noisy transcriptomic data. Extensive evaluations on both standard benchmarks and rigorous out-of-distribution protocols demonstrate that \themodel{} consistently outperforms strong baselines in structural quality and functional consistency. Furthermore, we validate its practical utility via a zero-shot gene-inhibitor design task, highlighting the potential of phenotype-driven generative discovery.

cs.LG↗

arXiv2026

CUDAHercules: Benchmarking Hardware-Aware Expert-level CUDA Optimization for LLMs

Large language models show promise for automated CUDA programming, however even the strongest coding models (e.g., Claude-Opus-4.6) may still fall short of expert-level, architecture-aware optimization. We introduce CUDAHercules, a benchmark that evaluates generated CUDA against end-to-end human-expert SOTA systems. It spans single kernels, module-level operators, full applications, and unsolved challenge tasks across Ampere, Hopper, and Blackwell GPUs, with end-to-end tasks gated by domain-specific semantic validators. Evaluating models such as Claude-Opus-4.6 and GPT-5.4 shows a large gap between runnable CUDA and expert CUDA engineering: models often compile and pass tests, but rarely recover the optimization strategies needed to match expert performance. Application semantics further reduce success, and iterative or tool-augmented feedback can improve correctness while drifting toward slow fallback implementations. These results show that automated CUDA programming remains far from fully solved and requires stronger hardware reasoning, better tool use, and training objectives that connect code understanding to hardware architecture-grounded intelligence.

cs.LG↗

arXiv2026

ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking

Low-latency anonymity networks such as Tor remain vulnerable to infrastructure-level traffic analysis that exploits side-channel information observable from encrypted communications. We introduce NATA, a non-invasive active traffic-correlation analysis algorithm that injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations. Unlike passive correlation methods, NATA does not require endpoint compromise, Tor-browser modification, or packet-payload decryption or modification. It can be carried out by an adversary that controls an upstream network gateway and observes traffic at adversary-controlled exit relays. To identify perturbed flows under substantial network variability, we develop BM-Net (Bandwidth Modulation Network), a selective state-space learning framework adapted for bandwidth-modulation detection. Given the limited availability of high-fidelity ground truth on real-world cross-continental Tor paths, BM-Net adopts a data-efficient learning strategy that separates self-supervised representation learning from supervised task-specific classification. It first learns reusable traffic representations through masked pre-training on serialized traffic traces, and then adapts these representations to binary perturbation detection and fine-grained modulation classification using task-specific labeled data. Through real Tor traffic measurements, BM-Net achieves a 99.65% binary detection F1 score and a 97.5% macro-F1 score for fine-grained modulation classification under our evaluated settings. In addition, tornettools-based scaled simulations are used to estimate exit-observation probability under bandwidth-weighted relay selection. These results suggest that active bandwidth perturbation can serve as an infrastructure-level side channel for traffic correlation under a clearly defined adversary model.

cs.CR↗

arXiv2026

Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation

The digital world is witnessing the rapid rise of LLM-based multi-agent systems (MASs) and their powerful applications. However, their security remains insufficiently understood, as existing evaluations are largely limited to narrow attack settings and may substantially underestimate the real risks of MAS deployments. Inspired by the MAS inter-agent dependencies, where upstream outputs are reinterpreted and executed by downstream agents, we propose a topology-aware attack scheme that propagates adversarial contamination from exposed edge agents to high-privilege agents to induce malicious behaviors. By combining topology reconnaissance, contamination propagation modeling, and hierarchical payload encapsulation, our approach overcomes the key challenges of black-box attacks and makes such multi-hop compromise practical. Experiments show that our approach achieves success rates of 40\%--78\% on three widely-used MAS frameworks under five topologies, and 85\% on two real-world MAS applications across 20 representative scenarios. The results reveal fundamental vulnerabilities in MASs that have been overlooked by prior studies. Based on these findings, we propose a topology-trust mitigation that blocks 94.8\% of such composite attacks.

cs.CR↗