arXiv subjects

Zirui Chen

Publications and source records attributed to Zirui Chen.

At least 19 recordsLinked to original sources

arXiv2026

Reducing ANN-SNN Conversion Error via Residual Membrane Potential Alignment

Spiking Neural Networks (SNNs) serve as core architectures for neuromorphic computing thanks to event-driven operation and ultra-low power consumption. Direct SNN training is hindered by non-differentiable spikes that induce vanishing gradients and unstable optimization. ANN-SNN conversion circumvents such issues by reusing well-trained ANN weights for low-latency, energy-efficient inference. Nevertheless, existing conversion schemes suffer from severe accuracy drops at small timesteps, large inference delays and cumulative quantization errors, even with marginal performance loss at large $T$. To address these limitations, we first analyze flaws of conventional conversion pipelines from residual membrane potential statistics and propose a novel conversion strategy combining dynamic initial potential tuning and feature enhancement. We then introduce a regularization loss $\mathcal{L}_{\mathrm{RMPD}}$ to adapt initial potential of IF neurons and mitigate systematic truncation bias from boundary aggregation. A dedicated SCR-Conv2d competitive refinement layer with grouped convolution is further built to sharpen feature discrimination, eliminate redundant spikes and stabilize encoding under tiny time windows. Integrated with the state-of-the-art QCFS baseline, our approach delivers consistent low-latency performance gains and generalizes to ReLU CNNs, ANN Transformers, and multi-threshold SNN variants. Evaluations on CIFAR-10, CIFAR-100 and ImageNet verify prominent accuracy improvements at $T=2,4,8$, with negligible extra computation overhead. This work offers an effective conversion paradigm to facilitate real-world SNN deployment on neuromorphic chips.

cs.NE↗

arXiv2026

Algebraic Attack on Convolutional Neural Networks with Max Pooling

Recovering the weights and biases of deep neural networks (DNNs) via black-box input-output queries, known as parameter extraction attacks, has been extensively studied for ReLU-based fully connected neural networks (FCNNs), but remains unexplored for convolutional neural networks (CNNs) with the max pooling function, a core architecture for computer vision and multimedia processing. The key challenge lies in the CNN max pooling layer, which introduces an additional non-linearity and hides ReLU critical points, rendering existing FCNN extraction methods inapplicable. To address this gap, we propose the first cryptanalytic extraction attack tailored for CNNs with the max pooling function. First, we establish an algebraic representation of CNNs, formally proving that CNNs are piecewise linear functions enabling the extension of linearity-based extraction principles. We then identify two novel types of critical points in CNNs: ReLU-Pooling Critical Points (RPCPs) and Pooling Switching Points (PSPs). We design complementary extraction techniques: a pattern matching method for RPCPs to recover partial signatures and signs, and an internal differential extraction attack for PSPs, inspired by cryptographic internal differential analysis, to recover high-accuracy signatures. Given that PSPs are far more abundant than RPCPs and yield a highly efficient extraction method, and that RPCPs are indispensable for bias recovery, we integrate both methods: the PSP method enables efficient signature extraction, while a single RPCP recovers the sign and bias. We evaluate our attack on multiple CNN architectures, including modern adaptations of LeNet-5, trained on random data, MNIST, and CIFAR-10. Experimental results demonstrate that our approach achieves high extraction accuracy with polynomial query complexity and runtime, even for deep CNN layers. This work fills a research gap in CNN security.

cs.CR↗

arXiv2026

Algebraic Cryptanalytic Extraction on Hard-Label Neural Networks

Although the state-of-the-art neural network model extraction attack in the hard-label setting by Carlini et al. at EUROCRYPT 2025 has polynomial-time complexity in theory, its dual-point clustering relies on singular value decomposition (SVD) with a time complexity of $\mathcal{O}(n^2 \cdot (d^{(k)})^3)$, resulting in huge runtime in practice. To address this computational bottleneck, this work transforms Carlini et al.'s geometric-view hard-label attack into an algebraic framework, and proposes a novel Approximate Signature Vector (ASV) method to achieve efficient parameter extraction on Fully Connected Neural Networks (FCNNs) by leveraging two key observations: high-dimensional random vectors are nearly orthogonal, and neurons in practical DNNs tend to learn disentangled features. The proposed ASV method replaces SVD-based rank checking with simple inner-product operations, reducing the clustering complexity to $\mathcal{O}(n \cdot (d^{(k)})^3)$ on average. Furthermore, this paper presents the first model extraction attack against hard-label max-pooling Convolutional Neural Networks (CNNs) by proposing an advanced ASV method with a kernel-centric clustering scheme instead of the neuron-centric clustering, which fully exploits the property of weight sharing in convolutions and fills the cryptanalysis gap. Experiments on a 64-64$\times$4-10 FCNN and LeNet-5 (CNN) with max pooling demonstrate that our ASV method drastically cuts clustering time, and improves the overall efficiency in the model extraction.

cs.CR↗

arXiv2026

TouchWorld: A Predictive and Reactive Tactile Foundation Model for Dexterous Manipulation

Dexterous manipulation in everyday environments requires both anticipation and reaction: a robot must predict how contact should evolve while rapidly correcting local errors caused by slip, misalignment, unstable grasping, or force mismatch. Vision and language provide semantic and geometric guidance, but they cannot reliably reveal hidden contact states such as force, slip, and contact stability. Although tactile sensing exposes these physical cues, most existing policies treat touch as a low-frequency observation stream within a monolithic action model, coupling slow task reasoning, action generation, and fast contact feedback in a single loop. We introduce TouchWorld, a predictive-and-reactive tactile foundation model for dexterous manipulation. TouchWorld uses a hierarchical policy that separates vision-language subtask planning, tactile world-model prediction, visuo-tactile goal-conditioned action generation, and high-frequency tactile residual refinement. A High-Level Planning Layer produces executable subtasks and predicts tactile subgoals; a Visuo-Tactile Goal-Conditioned Policy generates nominal action chunks; and a Tactile-Conditioned Refinement Policy performs online residual correction using recent tactile and proprioceptive feedback. By using touch as both a predictive contact reference and a fast feedback signal, TouchWorld preserves the semantic generalization of vision-language-action policies while improving local contact adaptation. Across six long-horizon and contact-rich dexterous manipulation tasks, TouchWorld achieves 65.0% success in the clean setting and 53.7% success under human perturbations, outperforming the strongest baseline by 15.7 and 18.5 percentage points, respectively.

cs.RO↗

arXiv2026

Refploit: Facilitating Exploit Construction via Code-Agent Trajectory Repair

Vulnerability exploits play a crucial role in assessing the downstream impact of Java library vulnerabilities. While some vulnerabilities are accompanied by disclosed exploit references, automatically reproducing such references into runnable exploits remains challenging because they are often incomplete, unstructured, or only describe partial reproduction steps. Recent code agents provide a promising way to automate this process, but our study shows that their generated exploits often appear successful without triggering the actual vulnerable logic, such as replacing vulnerable APIs with self-implemented functions. To address this, we propose Refploit, an LLM-based trajectory recovery framework for facilitating vulnerability reproduction from public exploit references. The key insight is that a failed agent trajectory is not entirely useless. It may have already completed some reproduction subtasks while also revealing misleading directions that should be avoided. Refploit first validates an agent-generated exploit through differential execution. When the exploit is ineffective, Refploit analyzes its reproduction progress, locates the trajectory segments associated with the reproduction progress, and derives constraints to guide focused recovery. We evaluate Refploit on three open-source Java vulnerability datasets, covering 172 exploit references for 143 vulnerabilities. Under DeepSeek-V4-Flash, Refploit successfully reproduces 138 exploits, achieving a reproduction rate of 80.2%. It achieves a 64.3% relative improvement over the initially generated trajectories and outperforms both the SOTA exploit-generation method PoCGen and advanced code agents such as Codex with GPT-5.4. We further adapt Refploit to another code agent and observe consistent improvements, demonstrating its generality.

cs.SE↗

arXiv2026

AC$^2$P$^2$SL: Adaptive Communication-Computation Pipeline Parallel Split Learning over Edge Networks

In wireless edge networks, split learning (SL) enables base station (BS) to utilize the distributed data and computing power across user equipments (UEs) to achieve collaborative model training while protecting local data privacy. However, the inherent sequential execution of computation and communication processes in conventional SL usually leads to long training times. To overcome this limitation, this paper proposes an adaptive communication-computation pipeline parallel split learning (AC$^2$P$^2$SL) framework. By conceptualizing the communication and computation processes of UEs and the BS as a unified pipeline, AC$^2$P$^2$SL achieves fine-grained pipeline parallelism across multiple micro-batches. Through this approach, effective overlapping of communication and computation is achieved which results in significant reduction of the overall training latency. Moreover, by considering the system constraints in the communication, computation, and storage dimensions as well as the heterogeneity of UEs, we formulate a joint optimization problem to minimize the training time and propose a corresponding split and pre-allocation algorithm to further enhance the pipeline efficiency. Additionally, accounting for the practical dynamic environments for the UEs, we design an adaptive re-allocation strategy to enhance the system resilience. Extensive experimental results demonstrate the effectiveness and robustness of AC$^2$P$^2$SL in reducing training time while ensuring data privacy preservation.

cs.DC↗

arXiv2026

Full-Domain Coupler: A Wireless Native Neural Backbone for Channel Representation and Deduction

Data representation is a fundamental issue in deep learning. However, as wireless data scales and deeply couples across many physical domains such as time, space, and frequency, existing wireless artificial intelligence (AI) technologies lack dedicated representation solutions. Instead, they mainly rely on stitching general-purpose networks, a tool-driven paradigm that inevitably results in structural redundancy and bottlenecks in information flow. To fill this gap, this paper proposes Coupler, a wireless native-AI neural backbone designed for representation learning of channel state information (CSI)--the pivotal data in wireless systems. Leveraging the revealed physical insights of channel tensors, Coupler decomposes representation learning into individual domains on a layer-by-layer basis, and then couples the learned domain-specific features through a dimension-staggered cascade. This full-domain interleaved learning architecture enables superior parameter efficiency and fine-grained multi-domain feature fusion. Based on this backbone, we use the complex-domain multilayer perceptrons (CMLPs) as spatial and frequency domain learners, while employing three optional mechanisms--convolution, attention, or gating--to capture temporal dependencies. This results in a series of efficient channel learning schemes with diverse functionalities and extreme lightweights, showcasing the compactness, versatility and flexibility of Coupler. We evaluate these schemes on channel deduction, a general representation task encompassing channel estimation, interpolation, prediction, and feedback. Extensive experimental evaluations validate their significant performance gains and robust applicability even for real-world measured data, demonstrating the potential of Coupler as a promising basic architecture in the design of wireless foundation models.

eess.SP↗

arXiv2026

Synergizing Global Pattern Learning and Time Order Characterization in Mobile Channel Prediction: An RWKV-Based Approach

Owing to the potential to reduce pilot overhead and mitigate channel aging, channel prediction is emerging as an important research topic in wireless communications. Meanwhile, deep neural networks are becoming a foundational technology for high-precision prediction thanks to their excellent non-linear representation capabilities. In this paper, we conceive a task-driven prediction network, which aims to deeply synergize the following two functions: learning global patterns for shareable features across adjacent time slots and structurally encoding time order to characterize the inherent causality within the channel dynamics. To implement channel prediction accuracy, we employ RWKV (receptance weighted key value) as network backbone and adapt it to the task's specific characteristics, utilizing its deep interleaved learning architecture to extract global patterns across multiple channel samples and leveraging its unique exponential decay to characterize temporal order. These task-driven unique designs significantly improve the learning efficiency of prediction network. Comprehensive experimental evaluations demonstrate the superiority of the proposed method over current data-driven methods, such as long short-term memory and Transformer, in the channel prediction task, including 1.84~4.29 dB gains in normalized mean squared error and 2.6~10.5 percentage point gains in cosine correlation.

eess.SP↗

arXiv2026

ATTAIN: Automated Exploit Failure Analysis through Trace-Driven Diff Analysis

Exploits are widely used to check whether library vulnerabilities appear in different versions and to mark affected version ranges. Exploit-based checks sometimes fail because exploits stop running on many versions after API or environment changes. Commit-based methods, such as SZZ-style analysis, sometimes miss the right introduce commits and spread labels incorrectly along long version chains. These problems leave many affected versions unlabeled or wrongly labeled and make manual exploit failure analysis very expensive and impractical at scale. We present ATTAIN, a trace-driven diff analysis framework with three modules to assess vulnerability presence across evolving library versions. The modules are trace construction, diff exploration, and affected-version judgment. The trace construction module executes an exploit across historical library versions and compares their behaviors to capture cross-version execution divergences. Using these divergences, the diff exploration module guides an LLM through a finite-state tool loop to autonomously search over version changes and collect vulnerability-relevant diff hunks. The affected-version judgment module reasons over the collected evidence to determine whether the vulnerability exists in each version and outputs the affected version range. We evaluate ATTAIN on an extensive dataset comprising 224 CVEs and 25,943 library versions across 128 libraries. ATTAIN achieves an F1-score of 93.24%, outperforming the commit-based methods V-SZZ and LLM4SZZ by 116.28% and 33.30%, respectively. ATTAIN uses short tool-guided prompts and a fixed number of iterations, keeping token usage low. It matches or surpasses existing methods on frequent CWE types, including cases where exploit runs fail for non-vulnerability reasons or commit messages do not clearly delimit affected versions.

cs.SE↗

arXiv2026

Clumps in a Cocoon: Geometry and Mixing Set the Universal X-ray to H$\alpha$ Surface Brightness Ratio

Recent observations reveal a universal X-ray to H$\alpha$ surface-brightness ratio, ${\rm SB}_{\rm X}/{\rm SB}_{\rm H\alpha}\sim 3$, in galactic winds, ram-pressure stripped tails, and cluster filaments. This is surprising because H$\alpha$ traces cold ($\sim 10^4$ K) gas while X-rays trace much hotter ($\sim 10^{6}$--$10^{7}$ K) gas. Plane-parallel mixing-layer models do not recover this ratio, and can be off by orders of magnitude. Motivated by recent work showing that geometry controls the temperature PDF of multiphase gas (Chen & Oh 2026), we run 3D wind-tunnel simulations in the high density contrast ($\chi\sim 10^3$) regime. In this limit, the cold phase shatters into many small H$\alpha$-emitting clumps, while X-ray-emitting gas forms a volume-filling cocoon around them. After smoothing on the tail-width scale, the measured surface-brightness ratio converges to the observed value, which can be understood theoretically. The H$\alpha$ luminosity fraction is set by atomic physics, whereas the X-ray luminosity fraction is set by the residence time of gas in the X-ray-emitting band. This residence time is much shorter than the cooling time at X-ray temperatures, but scales roughly inversely with pressure, suggesting that it is tied to the cooling time at a lower-temperature outlet of the mixing cascade. This framework naturally explains why the observed ratio is order unity, and robust to changes in gas pressure.

astro-ph.GA↗

arXiv2026

Implicit Action Chunking for Smooth Continuous Control

Reinforcement learning often produces high-frequency oscillatory control signals that undermine the safety and stability required for physical deployment. Explicit action chunking addresses this by predicting fixed-horizon trajectories but scales the policy output dimension proportionally with the horizon length, leading to optimization difficulties and incompatibility with standard step-wise interaction. To overcome these challenges, this paper proposes Dual-Window Smoothing (DWS), an implicit action chunking framework for smooth continuous control. Unlike explicit methods, DWS enforces temporal coherence without expanding the action space. It uses a dual-window design: an execution window that ensures physical smoothness through deterministic modulation, and a value window that aligns temporal-difference targets over the horizon to correct critic bias caused by open-loop execution. DWS also includes a lightweight actor-side temporal regularizer based on first-order action differences to promote global continuity. This design effectively bridges the gap between temporal abstraction and reactive step-wise control. Experiments on benchmarks including the DeepMind Control Suite and industrial energy management tasks show that DWS outperforms state-of-the-art (SOTA) baselines. In complex vision-based autonomous driving tasks, DWS achieves smoother control, safer behavior with reduced jitter, and attains a 100% success rate.

cs.RO↗

arXiv2026

Geometry-Aided Channel Deduction: A Robust Channel Acquisition Framework Utilizing Coarse Scenario Prompt

Channel state information (CSI) is critical for multi-input multi-output (MIMO) orthogonal frequency division multiplexing (OFDM) system. Pilot-based channel estimation methods suffer from high pilot overhead and low channel acquisition quality, while pilot-free approaches typically impose impractical demands on positional or environmental information precision. This paper proposes geometry-aided channel deduction (GCD), which leverages readily available geometric information to assist channel acquisition. The environmental map and base station position together constitute the scenario geometry, which can provide geometric channel features through ray tracing. To obtain the complete channel, the user first retrieves approximate geometric features by performing neighborhood searching within a pre-extracted geometric feature set, and then converts them into pseudo channels through a priori designed feature alignment. These pseudo channels serve as contextual prompt, providing supplementary channel features beyond those derived from pilot-based estimate. Finally, a neural network fuses these pseudo channels with partial estimate to generate the complete channel. Comprehensive experiments validate the superiority of our method, which achieves the leading accuracy in channel acquisition under sparse pilot conditions, demonstrates strong generalization capabilities in new scenarios and dynamic environments, and exhibits robust resilience against user position errors and non-ideal environmental information.

eess.SP↗

arXiv2026

Guiding Vector Field Generation via Score-based Diffusion Model

Guiding Vector Fields (GVFs) are a powerful tool for robotic path following. However, classical methods assume smooth, ordered curves and fail when paths are unordered, multi-branch, or generated by probabilistic models. We propose a unified framework, termed the Score-Induced Guiding Vector Field (SGVF), which leverages score-based generative modeling to construct vector fields directly from data distributions. SGVF learns tangent fields from point clouds with unit-norm, orthogonality, and directional-consistency losses, ensuring geometric fidelity and control feasibility. This approach removes the reliance on ad-hoc path segmentation and enables guidance along complex topologies such as branching and pseudo-manifolds. The study establishes a correspondence between score vanishing in diffusion models and GVF singularities and highlights representational capacity near sharp path curvatures. Experiments on robotic navigation in planar environments demonstrate that SGVF achieves reliable path following in scenarios where classical GVFs fail, underscoring its potential as a bridge between generative modeling and geometric control. Code and experiment video are available at https://github.com/czr-gif/Guiding-Vector-Field-Generation-via-Score-based-Diffusion-Model.

cs.RO↗

arXiv2026

From Clumps to Sheets: Geometry Controls the Temperature PDF of Multi-Phase Gas

Temperature probability distribution functions (PDFs) are a compact description of the thermal structure of multi-phase turbulent gas, and are directly linked to observables such as emission/absorption line ratios and phase mass fractions. In the circumgalactic medium (CGM) literature, temperature PDFs are often interpreted using planar turbulent radiative mixing layers, for which analytic models successfully reproduce the simulated temperature structure. These PDFs are assumed to be universal. By contrast, studies of the multiphase interstellar medium (ISM) typically use turbulent-box simulations, which produce broad PDFs but lack a clear theoretical interpretation. Using 3D hydrodynamic simulations under both ISM and CGM conditions, we compare planar mixing layers with turbulent-box simulations under identical microphysical conditions. Despite identical cooling and turbulent driving, the resulting temperature PDFs differ substantially. The missing ingredient is geometry. We demonstrate that the temperature PDF can be decomposed into the product of the area of temperature isosurfaces and the thickness of the corresponding temperature layers. The thickness is controlled primarily by microphysics, such as radiative cooling and thermal conduction, and is well captured by existing mixing-layer models. The isosurface area, however, is set by morphology. In mixing layers it remains sheet-like, whereas in turbulent media cold gas forms clumps whose interfaces expand with temperature and eventually percolate into connected sheets. This geometric transition produces broad PDFs with large intermediate-temperature mass fractions. These results have implications for long-standing puzzles such as thermally unstable gas in the ISM, the large OVI reservoir in the CGM, and X-ray-H$\alpha$ correlations in jellyfish tails.

astro-ph.GA↗

arXiv2026

Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits

Open-source software supply chain security relies heavily on assessing affected versions of library vulnerabilities. While prior studies have leveraged exploits for verifying vulnerability affected versions, they point out a key limitation that exploits are version-specific and cannot be directly applied across library versions. Despite being widely acknowledged, this limitation has not been systematically validated at scale, leaving the actual applicability of exploits across versions unexplored. To fill this gap, we conduct the first large-scale empirical study on exploit applicability across library versions. We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.33% of vulnerabilities in Maven. Leveraging this dataset, we execute each exploit against the library version history and compare the execution outcomes with our manually annotated ground-truth affected versions. We further investigate the root causes of inconsistencies between exploit execution and ground truth, and explore strategies for exploit migration. Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools. Notably, this capability enables us to contribute 796 confirmed missing affected versions to the CPE dictionary. We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints. Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%.

cs.SE↗

arXiv2026

Every Maintenance Has Its Exemplar: The Future of Software Maintenance through Migration

Maintenance is a critical stage in the software lifecycle, ensuring that post-release systems remain reliable, efficient, and adaptable. However, manual software maintenance is labor-intensive, time-consuming, and error-prone, which highlights the urgent need for automation. Learning from maintenance activities conducted on other software systems offers an effective way to improve efficiency. In particular, recent research has demonstrated that migration-based approaches transfer knowledge, artifacts, or solutions from one system to another and show strong potential in tasks such as API evolution adaptation, software testing, and migrating patches for fault correction. This makes migration-based maintenance a valuable research direction for advancing automated maintenance. This paper takes a step further by presenting the first systematic research agenda on migration-based approaches to software maintenance. We characterize the migration-based maintenance lifecycle through four key stages: \ding{182} identifying a maintenance task that can be addressed through migration, \ding{183} selecting suitable migration sources for the target project,\ding{184} matching relevant data across systems and adapting the migrated data to the target context, and \ding{185} validating the correctness of the migration. We also analyze the challenges that may arise at each stage. Our goal is to encourage the community to explore migration-based approaches more thoroughly and to tackle the key challenges that must be solved to advance automated software maintenance.

cs.SE↗

arXiv2026

Agentic AI-RAN Empowering Synergetic Sensing, Communication, Computing, and Control

Future sixth-generation (6G) networks are expected to support low-altitude wireless networks (LAWNs), where unmanned aerial vehicles (UAVs) and aerial robots operate in highly dynamic three-dimensional environments under stringent latency, reliability, and autonomy requirements. In such scenarios, autonomous task execution at the network edge demands holistic coordination among sensing, communication, computing, and control (SC3) processes. Agentic Artificially Intelligent Radio Access Networks (Agentic AI-RAN) offer a promising paradigm by enabling the edge network to function as an autonomous decision-making entity for low-altitude agents with limited onboard resources. In this article, we propose a task-oriented Agentic AI-RAN architecture that enables SC3 task execution within a single edge node. The proposed architecture addresses the challenge of coordinating heterogeneous workloads in resource-constrained edge environments. To validate this framework, we prototype a representative low-altitude UAV system on a general-purpose Graphics Processing Unit (GPU) platform and evaluate it through an autonomous drone-navigation case study. The current prototype instantiates the platform-agnostic design through Multi-Instance GPU (MIG) partitioning and containerized deployment, providing physical resource isolation and coordinated execution between real-time communication and multimodal inference. Experimental results demonstrate low closed-loop latency, robust bidirectional communication, and stable performance under dynamic runtime conditions, highlighting the feasibility of the proposed framework for mission-critical low-altitude wireless networks in 6G.

eess.SY↗

arXiv2025

Descent-Net: Learning Descent Directions for Constrained Optimization

Deep learning approaches, known for their ability to model complex relationships and fast execution, are increasingly being applied to solve large optimization problems. However, existing methods often face challenges in simultaneously ensuring feasibility and achieving an optimal objective value. To address this issue, we propose Descent-Net, a neural network designed to learn an effective descent direction from a feasible solution. By updating the solution along this learned direction, Descent-Net improves the objective value while preserving feasibility. Our method demonstrates strong performance on both synthetic optimization tasks and the real-world AC optimal power flow problem, while also exhibiting effective scalability to large problems, as shown by portfolio optimization experiments with thousands of assets.

math.OC↗