arXiv subjects

Ziqi Zhang

Publications and source records attributed to Ziqi Zhang.

At least 19 recordsLinked to original sources

arXiv2026

OCR in the Foundation Model Era: From Specialist Models to Unified Models

Optical Character Recognition (OCR) is among the oldest and most widely deployed applications of artificial intelligence. This survey reviews its development, focusing on the Foundation Model Era. We define OCR through faithful transcription: within a specified visual scope, OCR should completely reconstruct the text, notation, and document structure observable in the source image, and every textual, notational, or structural element in the output must be verifiable from visual evidence in that image. We trace the development from specialist OCR models toward unified models, examining joint text detection and recognition, structured sequence generation, and the use of pretrained vision-language models (VLMs). We organize contemporary OCR systems into five coexisting families: modular toolkits and task-specific models, specialized document VLMs, hybrid workflows, general-purpose VLMs, and commercial products and managed services. We compare their architectures, data, and training, examining hallucination and omission, insufficient spatial grounding, and inference cost in generative OCR. We review evaluation from character and scene text recognition to parsing individual structural elements and full-page transcription, highlighting gaps in consistent output definitions, attribution of performance to individual components, and coverage of real capture conditions and visible content and structure. Finally, we summarize the challenges facing OCR and discuss directions for future research. We continuously track related work at https://github.com/zhihengli-casia/Awesome-OCR-in-the-Foundation-Model-Era.

cs.CV↗

arXiv2026

Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?

LLM agents have been increasingly adopted for security-focused code review, but existing benchmarks mostly derive the reviewed changes from their later fixes instead of the real-world bug-introducing commits. In this paper, we present SecPRBench, the first comprehensive benchmark for evaluating agentic security review on validated real-world code changes. More specifically, we have built an automated agentic pipeline to autonomously harvest, build, and validate massive real-world bug-introducing commits for popular software systems. To ensure precise evaluation, we also adopt LLM-as-a-judge to credit the findings matching ground-truth vulnerabilities. To date, we have collected 265 tasks from nine critical systems, including Firefox, V8, and OpenSSL with millions of lines of code. Across eight frontier models, recall ranges from 32.5% to 78.1%, with Grok 4.6 and GPT-6 sol ranking at the top. Our study also shows that most misses are not simply oversights: in 68% of them, the agent reports on a file that holds the flaw but argues for a different mechanism. Security-focused harnesses also behave differently: OpenAI's Codex Security lowers recall by 8.3 points, mostly by abstaining, while Anthropic's Defending Code harness raises it by 7.7 points, at a higher cost.

cs.SE↗

arXiv2026

BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

On-device deployment of large language models (LLMs) is increasingly adopted due to latency and privacy requirements, but exposes proprietary models to reverse engineering and intellectual property theft. Trusted Execution Environments (TEEs) provide hardware-enforced isolation for on-device inference, yet most TEE-based parameter obfuscation relies on unilateral matrix transformations that obfuscate only the output side. We identify a vulnerability in this design, termed the Solution Determinacy Property (SDP): the obfuscation secret is uniquely determined, exposing the structure of the true key and enabling attackers to break the protection. Under our attacks, representative methods GroupCover and ArrowCloak are reduced to negligible protection, with attack accuracy reaching over 2.4 times the full-shielding black-box baseline and recovering near-complete model functionality. To address this vulnerability, we propose BiShield-TEE, a bilateral framework that induces Ambiguous Solutions through joint obfuscation of input and output dimensions, hiding the true key among many equally valid candidates. Experiments across diverse models and datasets show that BiShield-TEE confines attack accuracy to the full-shielding black-box baseline, while achieving higher inference efficiency than prior methods on real hardware. Our code is available at https://github.com/laduiw/BiShield-TEE.

cs.CR↗

arXiv2026

VeriRouter: Towards Verifiable LLM Routing

Large language model (LLM) routers are increasingly deployed to optimize quality, latency, and cost through dynamic model selection and request rewriting. However, a compromised router can cause ineligible selection on the control plane, unendorsed rewriting or unfaithful relay on the data plane, undermining LLM routing integrity. We present VeriRouter, a verifiable LLM routing framework. Under an endorsed public context binding a private semantic index and rewrite banks, VeriRouter combines ZK proofs with a provider-issued serving certificate to establish integrity across both planes while keeping the router's private routing assets hidden from clients. For model selection, we design an efficient ZK proof for semantic search. For rewriting, local checks enforce message preservation and additions from committed banks. On real-world workloads, VeriRouter's model-selection and rewrite proofs average 21.92~s and 4.24~s, yielding 1,307$\times$ and 101$\times$ speedups over the fastest completing baselines. Relative to serving without verification, VeriRouter adds only 4.08 s under per-turn selection and 0.11 s under session-pinned selection.

cs.CR↗

arXiv2026

HyWe: Unifying Search and Operation for Real-World Hybrid Web Tasks

Real-world hybrid web tasks need both information gathering and page interaction, yet search-based and operation-based agents are developed and evaluated separately. To bridge this gap, we introduce HyWe, a framework that unifies both capabilities within one model and trajectory. Its two modes use dedicated prompts and tool sets to sustain sub-goal execution; explicit switching selects the needed capability, and shared history lets each mode build on the other's findings. To provide demonstrations of these behaviors, we develop HyWeCollector, a fully automatic pipeline that uses task prototypes, four switching patterns, and multi-agent synthesis to produce verified hybrid trajectories. We train HyWe-35B on these demonstrations to unify efficient information gathering and browser interaction in a single 35B web agent. To evaluate hybrid task completion, we introduce HyWeBench: 100 human-written tasks on websites distinct from training, with human-written sub-goal checklists and an outcome-based evaluation pipeline. Hybrid training enables HyWe-35B to achieve 47.0% success on this benchmark, improving on the untrained base model by 19.0 percentage points and outperforming existing search-based and operation-based agents. Even before training, the same base model solves 28.0% of tasks with HyWe, versus 11.0% with all tools under one prompt. Beyond hybrid tasks, HyWe-35B achieves 59.0% and 88.3% success on Online-Mind2Web and WebVoyager, outperforming existing open-source baselines and cutting action cost per successful task by 48.3% and 51.9% compared with Fara-7B.

cs.AI↗

arXiv2026

Do in-silico metrics filter designed enzymes for catalysis?

Computational metrics are widely used to prioritize enzyme designs for experimental testing, yet their ability to capture catalytic function remains poorly established. Here, we systematically evaluate 33 in-silico metrics across four complementary tasks: distinguishing active from inactive enzymes, identifying substrate specificity, ranking enzyme variants by activity, and detecting perturbations to catalytic residues. We assess these capabilities using natural enzymes, computationally designed enzymes, activity-altering variants, and controlled structural perturbations that compare catalytic residues with matched non-catalytic sites. No single metric consistently captures all aspects of catalytic function. In activity discrimination, catalytic-residue intra-residue repulsion achieves the highest AUROC among the evaluated metrics for both natural enzymes (0.61) and 192 designs that passed the filters of their original design campaign (0.80). For substrate discrimination, interface predicted TM-score (ipTM) performs best (AUROC 0.70), whereas the catalytic pKa range shows the strongest association with activity across single-point variants of BglB (Spearman's rho = 0.48). In controlled perturbation tests, the minimum per-chain predicted TM-score (pTM) has a mean probability of 0.75 of responding more strongly to perturbations at catalytic residues than to matched perturbations at non-catalytic sites. These results reveal substantial variation in what current computational metrics capture, underscoring the need to distinguish structural confidence and physical plausibility from direct evidence of catalytic function when prioritizing enzyme designs.

cs.CE↗

arXiv2026

Color Lorentz force on a transversely polarized quark in the nucleon

The $x^2$ moment of the genuine twist-3 component of the unpolarized scalar parton distribution function $e(x)$ is related to the average transverse color Lorentz force experienced by a transversely polarized quark in an unpolarized nucleon. This higher-twist quantity probes quark--gluon correlations and provides unique insight into the nonperturbative dynamics of quantum chromodynamics. For the first time, we study the corresponding off-forward matrix element and derive its Lorentz-covariant decomposition in terms of generalized form factors. We calculate these form factors from light-front wave functions obtained by solving the light-front Hamiltonian eigenvalue problem within the Basis Light-Front Quantization framework. Their Fourier transforms provide a spatial picture of the transverse color forces in impact-parameter space. In particular, $\mathscr{F}_2$, whose forward limit is directly related to the twist-3 matrix element $e_2$, can be interpreted as the impact-parameter-space representation of the Boer--Mulders force, providing an intuitive spatial picture of the final-state interaction mechanism underlying the Boer--Mulders effect.

hep-ph↗

arXiv2026

Dynamical gluon effects in twist-3 generalized parton distributions of the proton

Within the Basis Light-Front Quantization framework, we systematically investigate the subleading-twist (twist-3) generalized parton distributions (GPDs) of the proton's valence quarks beyond the Wandzura--Wilczek (WW) approximation. The twist-3 GPDs are not independent; through the equations of motion they decompose into a non-genuine contribution and a genuine twist-3 term. The latter encodes quark--quark--gluon correlations and involves interference between the light-front Fock sectors |qqq> and |qqqg>, which are typically neglected in the WW approximation. Using light-front wave functions obtained from diagonalizing the proton light-front Hamiltonian for its |qqq> and |qqqg> Fock components, we compute these GPDs via their overlap representations. To further explore their physical implications, we also evaluate several twist-3--related quantities, including the quark orbital angular momentum, the total quark spin contribution, and the quark spin--orbit correlation. Our results provide new nonperturbative input on higher-twist dynamics particularly multi-parton interference effects relevant for future measurements at the EicC and the EIC.

hep-ph↗

arXiv2026

Twist-3 Generalized Parton Distribution for the Proton from Basis Light-Front Quantization

We investigate the twist-3 generalized parton distributions (GPDs) for the valence quarks of the proton within the basis light-front quantization (BLFQ) framework. We first solve for the mass spectra and light-front waved functions (LFWFs) in the leading Fock sector using an effective Hamiltonian. Using the LFWFs we then calculate the twist-3 GPDs via the overlap representation. By taking the forward limit, we also get the twist-3 parton distribution functions (PDFs), and discuss their properties. Our prediction for the twist-3 scalar PDF agrees well with the CLAS experimental extractions.

hep-th↗

arXiv2026

Transverse force tomography inside a proton from Basis Light-front Quantization

The twist-3 transverse spin--dependent nucleon structure function $g_2$ arises in high-energy processes involving a transversely polarized nucleon. Its connection to quark--gluon correlations allows for an interpretation in terms of the average transverse color Lorentz force acting on unpolarized quarks inside a transversely polarized nucleon. In this work, we investigate this force using light-front wave functions obtained by diagonalizing the light-front Hamiltonian with quantum chromodynamics inputs within the Basis Light-front Quantization approach. We evolve our results to a common scale of $5~\mathrm{GeV}^2$ and present the corresponding form factors in momentum space as well as the transverse force components in impact-parameter space. These distributions provide a complementary perspective on the Sivers asymmetry in transversely polarized deep-inelastic scattering. In the forward limit, we extract the twist-3 reduced matrix element $d_2$, and our results are found to be comparable with those from other theoretical calculations and experimental determinations.

hep-ph↗

arXiv2026

Structured Interaction, Visual Localization, and Robust Execution for Complex Web Tasks: A Technical Report on the WebRetriever Challenge

This report presents the web agent system developed for the WebRetriever Challenge. The system follows a structuredinteraction- first strategy, using semantic webpage information for routine browser operations and invoking visual perception only when structured representations are insufficient. Three key designs are introduced: grid-assisted visual localization for difficult-to-access controls, hierarchical context management for reducing redundant page and interaction history, and fault-aware execution mechanisms for stable multi-browser task processing. The system achieved a pass rate of up to 79% in local evaluation on Protocol 1. In the official Protocol 3 competition, it achieved a 59% pass rate with eight concurrent browser workers and ranked first overall, winning the WebRetriever Challenge.

cs.IR↗

arXiv2026

How Far Is Document Parsing from Solved? PureDocBench: A Source-Traceable Benchmark across Clean, Degraded, and Real-World Settings

Document parsing models are improving rapidly, but existing benchmarks are still insufficient for a comprehensive evaluation of their capabilities. We introduce PureDocBench, a benchmark with 10 domains, 66 subcategories, and 1,475 pages. Each page has matched Clean, Digital, and Real versions, covering clean renders, simulated degradation, and real capture or sharing conditions. The resulting 4,425 images have source-derived annotations for text, formulas, tables, and reading order, checked through automated validation and human review. Keeping page content and annotations fixed allows direct comparisons across image conditions. We evaluate 58 models, including pipeline-based parsers, end-to-end parsers, and general vision-language models. The best three-track average score is 79.69 out of 100, and the mean across models is 63.84. Scores drop by 3.34 points on Digital and 11.61 points on Real on average, relative to Clean. TeleOCR leads on Clean, GLM-5.3-Flash on Digital, and Gemini 3.6 Flash on Real. The benchmark dataset, source documents, generation tools, and evaluation code are publicly available at https://github.com/zhihengli-casia/PureDocBench.

cs.CV↗

arXiv2026

GUIAuditor: Enabling Post-hoc Child Safety Forensics via Action-Guided GUI Provenance on Mobile Devices

The proliferation of smart devices exposes children to online risks like grooming and financial scams that are deeply embedded within legitimate applications. Current approaches rely on automated prevention and detection, a paradigm that is fundamentally limited by its inherent fallibility. Whether rule-based or AI-driven, they inevitably produce false positives and negatives, failing to provide reliable protection. In this paper, we argue for a complementary, human-in-the-loop, post-hoc forensic paradigm. We present GUIAuditor, the first system designed to realize this vision by creating GUI Provenance: a queryable, semantic record of a child's interaction sequence. To generate this, GUIAuditor leverages a Multimodal Large Language Model (MLLM) to translate the temporal sequence of GUI events into a human-understandable narrative. To make this practical on mobile devices, a novel evidence distillation pipeline reduces the data requiring analysis by over 89.2% compared to periodic sampling approaches adopted by industry standards, with negligible impact on accuracy. On a new dataset of 295 interaction clips, GUIAuditor achieves a 95.23% Macro-F1 Score in logging significant events and, crucially, its two-stage forensic query engine successfully retrieves the correct evidence as the top result for over 90.20% of natural language questions. An end-to-end evaluation on three modern smartphones shows that the full pipeline, including on-device MLLM inference, adds 2.1W of power draw and 7.4s of per-event latency, with a peak memory footprint of ${\sim}$3.1GB. These results show that post-hoc GUI forensics can run on modern mobile devices and provide useful context for guardian-led safety review.

cs.CR↗

arXiv2026

Do Cantonese-Adapted Language Models Better Predict Cantonese Reading? A Cross-Model Eye-Tracking Evaluation

Information-theoretic measures derived from autoregressive language models are widely used to characterize the expectations that shape human reading, but whether language-variety-specific training improves such psycholinguistic alignment remains unclear. This question is still open for Cantonese, where recent NLP evaluations reported mixed benefits from Cantonese-specific training relative to Mandarin-oriented or general-purpose models. Using naturalistic Cantonese eye-tracking data, we compare two within-family adaptation contrasts: CKIP GPT-2 Tiny versus its lightly Cantonese-adapted JED351 derivative, and Qwen2.5-7B versus CantoneseLLM-7B, which underwent substantially more extensive Cantonese continued pretraining and instruction tuning. From each model, we derive lexical surprisal, POS surprisal, entropy before the target, and entropy reduction. Lexical surprisal and the joint four-metric model consistently favor CantoneseLLM-7B, followed by Qwen2.5-7B, CKIP, and JED351, whereas entropy reduction favors CKIP. These results suggest that more extensive Cantonese-specific training can be associated with stronger predictive fit, while model rankings also depend on the information-theoretic measure being evaluated.

cs.CL↗

arXiv2026

Risk and Anomaly Identification for Distribution Network Optimal Operation Based on Reinforcement Learning and Uncertainty Quantification

Reliable operation of modern distribution networks requires timely identification of operational risks and anomalous events under pervasive uncertainty. In practice, operators must identify risks that are inherent in stochastic yet in-distribution conditions, and anomalies that correspond to out-of-distribution behaviors such as unusual load patterns, extreme weather or cyber-physical attacks. This paper addresses this joint risk and anomaly identification problem for optimal distribution network operation and proposes a deep reinforcement learning framework that is explicitly uncertainty aware. We integrate distributional and Bayesian deep reinforcement learning to realize a second- order uncertainty quantification scheme that decomposes total uncertainty into aleatoric and epistemic components, which are respectively used to characterize inherent risk and out-of- distribution anomalies. The resulting epistemic estimates drive both exploration during training and out-of-distribution detec- tion with fallback control during deployment, whereas aleatoric estimates are used to characterize intrinsic operational risk. Simulation results demonstrate the performance of our DRL agent and the effectiveness of the uncertainty quantification.

cs.LG↗

arXiv2026

Certified Safety Radii in Forecast-Error Space for Wasserstein Distributionally Robust Small Signal Stability-Constrained AC Optimal Power Flow via Lifted Spectrahedral Containment

Directly robustifying small-signal stability in AC optimal power flow is challenging since the stability boundary in the original uncertainty space is implicit, highly nonconvex, and changes with the operating decision. This paper exploits an alternative geometry. For a fixed model-specific stability certificate admitting suitable physical lifts, the small-signal stability requirement becomes an affine positive semidefinite constraint in the lifted variables, thereby defining a convex certified safe region. Instead of approximating the nonlinear instability boundary itself, we optimize a sample-wise safe radius in the original uncertainty space and certify, in the lifted space, that the entire power-flow image of the corresponding uncertainty ball is contained in the convex stability region. To this end, a componentwise Perron certificate guarantees existence, uniqueness, and Jacobian regularity of the target AC power-flow branch throughout each ball. An adjoint elimination then provides an exact affine-quadratic representation of the stability-relevant quantities, while rigorous matrix remainder bounds convert their nonlinear variation into finite robust PSD constraints. The resulting radii are certified lower bounds on the distances from empirical samples to failure and can therefore be coupled directly to the distance-based reformulation of a Wasserstein distributionally robust chance constraint, without directly approximating the instability boundary. Numerical studies demonstrate the effectiveness of the proposed framework.

cs.LG↗

arXiv2026

mR$^2$AG: Multimodal Retrieval-Reflection-Augmented Generation for Knowledge-Based VQA

Advanced Multimodal Large Language Models (MLLMs) struggle with recent Knowledge-based Visual Question Answering (VQA) tasks, such as INFOSEEK and Encyclopedic-VQA, due to their limited and frozen knowledge scope, often leading to ambiguous and inaccurate responses. Thus, multimodal Retrieval-Augmented Generation (mRAG) is naturally introduced to provide MLLMs with comprehensive and up-to-date knowledge, effectively expanding the knowledge scope. However, current mRAG methods have inherent drawbacks, including: 1) Performing retrieval even when external knowledge is not needed. 2) Lacking of identification of evidence that supports the query. 3) Increasing model complexity due to additional information filtering modules or rules. To address these shortcomings, we propose a novel generalized framework called \textbf{m}ultimodal \textbf{R}etrieval-\textbf{R}eflection-\textbf{A}ugmented \textbf{G}eneration (mR$^2$AG), which achieves adaptive retrieval and useful information localization to enable answers through two easy-to-implement reflection operations, preventing high model complexity. In mR$^2$AG, Retrieval-Reflection is designed to distinguish different user queries and avoids redundant retrieval calls, and Relevance-Reflection is introduced to guide the MLLM in locating beneficial evidence of the retrieved content and generating answers accordingly. In addition, mR$^2$AG can be integrated into any well-trained MLLM with efficient fine-tuning on the proposed mR$^2$AG Instruction-Tuning dataset (mR$^2$AG-IT). mR$^2$AG significantly outperforms state-of-the-art MLLMs (e.g., GPT-4o) and mRAG-based MLLMs on INFOSEEK and Encyclopedic-VQA, while maintaining the exceptional capabilities of base MLLMs across a wide range of Visual-dependent tasks.

cs.AI↗

arXiv2026

SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?

Finding a real vulnerability in complicated systems is a challenging, long-horizon task that demands reasoning across an entire codebase to produce a working proof-of-concept (PoC). However, such critical security problems remain understudied. We present SEC-bench Pro, a benchmark that measures how well frontier models hunt real vulnerabilities by reproducing working PoC inputs from disclosed reports, where each task pairs a concrete bug with the instructions for triggering it. We also demonstrate the limitations of existing rule-based judges for grading generated PoCs, and propose a novel LLM-based judge for more precise grading. We instantiate SEC-bench Pro with 344 validated vulnerabilities across three targets, the V8 and SpiderMonkey browser engines and the Linux kernel, covering critical vulnerability families including memory-safety, sandbox, JIT, race-condition, and kernel-subsystem bugs. Across six frontier commercial and open-weight models and three coding agents, the strongest, Codex with GPT-5.5, solves 58% of instances overall. We also observe that Claude Code with Opus 4.6 tends to time out but solves most instances it completes. In contrast, open-weight models struggle; for example, GLM-5 solves only 13 of the 344 instances. During construction and evaluation, SEC-bench Pro also surfaced three vulnerabilities in V8 and SpiderMonkey, including a sandbox escape that was fixed and earned a $20,000 Google Vulnerability Reward Program bounty. More recently, SEC-bench Pro has been adopted by OpenAI to evaluate the long-horizon security capabilities of its newest models. Overall, SEC-bench Pro exposes where long-horizon vulnerability discovery succeeds, where it fails, and how different grading choices change the evaluation landscape, offering insights for security-centric model evaluation and training. Our artifact is available at https://github.com/SEC-bench/SEC-bench-Pro.

cs.CR↗