Search arXiv⌕ Search

arXiv subjects

Jingyu Zhang

Publications and source records attributed to Jingyu Zhang.

At least 19 recordsLinked to original sources
arXiv2026

Route Before Response: Fail-Closed Routing for LLM-Enabled Customer-Service Software

LLM-enabled customer-service software in financial institutions must choose a downstream service before responding. Classifiers and LLM routers can identify a relevant label or destination, but a composed application must still verify dispatch permission and entity registration. We study this integration problem as boundary-aware pre-response routing. We present RouteBR, a controller in which one model call proposes a primary service action and registered object, then deterministic code checks identifiers and versioned rules before dispatch or a specified non-dispatch outcome. Lower-ranked candidates cannot replace a blocked primary route. We construct 600 privacy-preserving scenarios from recurring confidential-request patterns at a real financial institution; three engineers jointly reviewed the scenarios and labels. On the 200-case CONFIRM MAIN split, RouteBR reaches 97.5% final-path exact match. A matched one-call baseline given the same rules reaches 95.5%, whereas a diagnostic baseline without the rule program obtains 94.0% action accuracy but only 41.0% final-path exact match. Across 166 non-dispatch MAIN and FLIP cases, RouteBR produces no false dispatch. The artifact pairs all 1,960 prediction rows with raw receipts while excluding gold and reviewer fields from model requests. These results support separating model proposals from code-owned, replayable execution. Our implementation is available at https://github.com/YgcCoder/RouteBR.

cs.SE↗
arXiv2026

Bug2Scenario: Root-Cause-Preserving Test Scenario Amplification for Autonomous Driving Software

Simulation-based fuzzing exposes autonomous driving system (ADS) failures by repeatedly mutating and executing scenarios, but converting one failure into reusable regression scenarios remains difficult. Such variants test whether the mechanism persists after software changes, for example by varying weather or actor placement while retaining a collision's actor-route conflict. We present Bug2Scenario, a root-cause-guided post-fuzzing framework. From scenario data, traces, and oracle evidence, it extracts a root-cause pattern. An LLM proposes semantic variations over actors, missions, routes, and weather. Deterministic rules construct DriveFuzz-compatible scenarios. Execution evidence and manual review assess preservation. Separating these responsibilities prevents fluency, syntax, or recurring labels from masquerading as causal evidence. Under matched seeds, six LLM backbones, candidate budget, and execution pipeline, Bug2Scenario improves strict preservation by 6.7 percentage points (p=0.104; not significant) and boundary-inclusive preservation by 10.6 points (p=0.011). Feedback helps some initially unsuccessful seeds yield a strictly preserved candidate. Seed-level stopping then avoids further API calls and simulator runs. Remaining failures reflect actor-placement constraints, simulator instability, and incomplete or conflicting causal evidence. Bug2Scenario thus produces reliable ADS regression assets. Our implementation is available at https://github.com/YgcCoder/Bug2Sce.

cs.SE↗
arXiv2026

SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

Prompt-security claims for large language models (LLMs) are often compared as properties of individual attacks or defenses, although measured harmfulness depends on the target model, access setting, attack and defense configuration, prompt sample, and judger. We systematize 272 studies through three linked, multi-label taxonomies of jailbreak attacks, defenses, and model vulnerabilities. To make these dependencies explicit, we introduce an access-compatible evaluation protocol over configured $\langle M,A,D,S,J\rangle$ tuples and instantiate it in PromptSecurity, an open-source platform that records method settings, outputs, judgments, and query costs. We release two complementary datasets: JailbreakDB, with 445,752 jailbreak system-user prompt pairs and 1,094,122 benign prompts, and PromptSecurity-Eval, with 166,200 harmful-query and 25,800 benign-utility output records. We evaluate 11 target models, 20 attacks, nine defenses, and three automated judgers under a matched, single-turn protocol using 100 harmful queries and separate benign-utility tasks. Lower attack success can reflect failure to execute transformed requests rather than stronger safety; attack-category advantages can reverse when one method is excluded, and attack success varies with assistant choice. Defenses can reduce harmful outputs while degrading benign-task utility or causing backfire. Rejudging identical outputs also shows that measured attack success is sensitive to the behavior supplied to the judger, highlighting the need to report judger configurations alongside ASR. These findings motivate configuration-aware reporting rather than context-free method rankings. Resources: https://datasec-lab.github.io/PromptSecurityLeaderboard/ https://huggingface.co/datasets/youbin2014/JailbreakDB https://huggingface.co/datasets/youbin2014/PromptSecurity-Eval https://github.com/datasec-lab/PromptSecurity

cs.CR↗
arXiv2026

Beyond Reasoning Gains: Mitigating General-Capability Forgetting in Large Reasoning Models

Reinforcement learning with verifiable rewards (RLVR) has delivered impressive gains in mathematical and multimodal reasoning and has become a standard post-training paradigm for contemporary language and vision-language models. However, the RLVR recipe introduces a significant risk of capability regression, in which models forget foundational skills after prolonged training without employing regularization strategies. We empirically confirm this concern, observing that open-source reasoning models suffer performance degradation on core capabilities such as perception and faithfulness. While imposing regularization terms like KL divergence can help prevent deviation from the base model, these terms are computed on the current task and therefore do not guarantee preservation of broader knowledge. Meanwhile, commonly used experience replay across heterogeneous domains makes it nontrivial to decide how much training emphasis each objective should receive. To address this, we propose RECAP-a replay strategy with dynamic objective reweighting for general knowledge preservation. Our reweighting mechanism adapts online using short-horizon signals of convergence and instability, shifting the post-training focus away from saturated objectives and toward underperforming or volatile ones. Our method is end-to-end and readily applicable to existing RLVR pipelines without training additional models or heavy tuning. Extensive experiments on benchmarks using Qwen2.5-VL-3B and Qwen2.5-VL-7B demonstrate the effectiveness of our method, which not only preserves general capabilities but also improves reasoning by enabling more flexible trade-offs among in-task rewards.

cs.LG↗
arXiv2026

Jet-by-jet fluctuations of the energy-energy correlator: hadronization, decays, and medium effects

Energy correlators probe how the strong interaction shapes the energy distribution within jets. Here, we study the jet-by-jet fluctuations of the energy-energy correlator (EEC). Each jet's EEC is described by a vector of densities in angular shells. Using an ensemble of these vectors, we construct the covariance matrix $C$ and Pearson correlation matrix $R$ to quantify fluctuation amplitudes and correlations between angular shells. Reconstructed jets in CMS Open Data at $\sqrt{s}=7$ TeV show positive correlations between nearby outer-angle bins and negative correlations between separated angular regions. We compare PYTHIA jets at the parton, undecayed-hadron, and final-particle stages to identify correlations already present in the shower and study how hadronization and decays reshape the angular fluctuations. PYTHIA is then coupled to linear Boltzmann transport (LBT) to study medium effects on jet-by-jet EEC fluctuations and their angular correlations. These results open a route to probing the stochastic evolution of QCD jets through jet-by-jet EEC fluctuations.

hep-ph↗
arXiv2026

OEL-AD: An Online Evolutive Learning Framework for Cross-Region Adaptive Autonomous Driving

Autonomous driving models have achieved great progress in recent years, yet most existing approaches remain static, following a train-then-deploy paradigm that lacks the ability to adjust internal parameters when encountering new environments. This limitation is particularly critical in cross-region scenarios, which are common in real-world deployments in autonomous driving where differences in road layouts, traffic patterns, and environmental conditions introduce distribution shifts. In this paper, we argue for a paradigm shift towards Online Evolutive Learning (OEL), a learning paradigm designed to enable adaptive, online model optimization through the interaction and coordination of intelligent components in dynamic environments. We introduce OEL-AD, a novel framework that instantiates this paradigm for autonomous driving. Specifically, OEL-AD leverages trajectory uncertainty from the planning module to determine whether adaptive updates are necessary. When triggered, the framework uses discrepancies between predicted agent behaviors and subsequent observations as a self-supervised learning signal to refine perception and prediction modules, thereby indirectly improving planning accuracy and safety. Experiments on the nuScenes dataset with a cross-region split between Singapore and Boston demonstrate that OEL-AD consistently improves perception and prediction performance. This enhancement in perception and prediction consequently results in improved planning capabilities, thereby confirming the promise of online evolutive learning as a fundamental approach for building adaptive and robust autonomous driving systems.

cs.RO↗
arXiv2026

Does Unlearning Survive Collaboration? Robust Unlearning for Shared-Model LLM Teams

LLM unlearning is essential for removing sensitive or unwanted knowledge while preserving useful capabilities. As LLM teams are increasingly used to solve complex problems, forgetting must remain effective during collaboration. Despite advances in forgetting effectiveness, efficiency, and robustness to relearning, team deployment remains underexplored. We find that collaboration weakens forgetting: final-answer evaluations miss recoverable evidence in team messages, including complementary clues supporting joint recovery. We establish theoretically and confirm empirically that controlling final answers or individual messages does not ensure low recovery from their combination. To address this challenge, we propose Aggregation-Conditioned Unlearning (ACU). ACU trains a shared model using reconstruction feedback from individual and pooled messages, prioritizes views with higher recovery risk, and uses replacement-based credit assignment while protecting direct and collaborative utility. TOFU evaluates trajectory-level recovery, while WMDP-bio tests native forgetting and retained utility. On TOFU, ACU lowers full-trajectory recovery from 41.8% to 19.3% in ROUGE-L recall and factual recovery from 34.2% to 18.7% versus output-supervised training, with comparable retained-task performance. These results demonstrate that ACU curbs information leakage in LLM teams and generalizes across team sizes and readers.

cs.CL↗
arXiv2026

Agentic AI -- Physicist Collaboration in Experimental Particle Physics: A Proof-of-Concept Measurement with LEP Open Data

We present an agentic measurement of the thrust distribution in $e^{+}e^{-}$ collisions at $\sqrt{s}=91.2$ GeV using ALEPH archived data. This work was carried out through an AI agent-physicist collaboration, using interactive natural-language prompting of Anthropic Claude and OpenAI Codex. Under physicist guidance, the agents wrote and executed all analysis code and drafted the majority of the text included in this paper. A fully-corrected thrust spectrum is obtained via Iterative Bayesian Unfolding and Monte Carlo based corrections. The principal contribution of this work is the demonstration of the agentic analysis, with thrust serving as a benchmark observable for the method. Dedicated precision measurements of thrust are reported in the community elsewhere. This work represents a step toward a theory-experiment loop in which AI agents assist with experimental measurements and theoretical calculations, and synthesize insights by comparing the results, thereby accelerating the cycle that drives discovery in fundamental physics. Our work suggests that precision physics, leveraging the open LEP data and advanced theoretical landscape, provides an ideal testing ground for developing AI agent systems for scientific applications.

hep-ex↗
arXiv2026

Separating charm and bottom decay electrons with point-cloud deep learning on the charged-hadron environment

Electrons from semi-leptonic decays of charm ($D$) and bottom ($B$) hadrons are important probes in high-energy collisions, while their separation remains challenging due to the similarity of the underlying decay topologies. In this work, the charged-hadron environment associated with each electron is represented as an unordered point cloud and combined with the electron kinematics and charge. Several set-based machine learning architectures, including DeepSets, Transformer, and graph neural networks, are used to distinguish electrons from prompt $D$ and direct $B$ decays without explicit vertex observables. The three architectures achieve comparable performance. Moreover, the Transformer is found to perform better than a boosted decision tree trained on physics-motivated high-level observables. At an efficiency of about 40\%, the classifier reaches a purity level close to 80\% on the test sample. The classifier response is strongly related to the geometric and topological properties of the charged-hadron environment. The information learned by the classifier is further studied using non-prompt $D$ electrons and charged hadrons from different angular regions. Our results indicate that the learned separation is driven mainly by the later stages of the decay chain rather than by initial production effects. The angular-region study further shows that useful discriminating information extends beyond the near- and away-side cones. This method is also evaluated for mid-rapidity proton--proton collisions at both RHIC and LHC energies.

hep-ex↗
arXiv2026

Draft-KV: Learning Useful Latent Communication Between Language Models

Latent communication passes internal states between language models instead of decoded text, but higher receiver accuracy does not show that the receiver used the message content. Across five method-dataset pairs, replacing each message with one from an unrelated question changes accuracy by at most 0.60 points, even when communication adds 15.44 points over the receiver alone. Thus the interface can supply the gain while making the sharer dispensable. Draft-KV instead sends the key-value states formed while the sharer drafts an answer to the current question. Linear projections place these states in a side memory read through a gated attention branch, and progressive training moves from message reconstruction to answer supervision under a guard on harm from mismatched messages. Both models remain frozen and the interface trains 1.05M parameters, 348x fewer than C2C. With a Qwen3-8B sharer, a frozen Qwen2.5-0.5B-Instruct receiver reaches 78.04% on MMLU-Redux, versus 37.45% alone and 36.40% with reassigned messages. At fixed interface size, scaling the sharer from 0.6B to 8B raises accuracy from 46.11% to 78.04%; communication also transfers to held-out tasks and can exceed both models when each holds different evidence.

cs.CL↗
arXiv2026

Accurate but Not Humble: Evaluating Epistemic Humility in LLM Agents under Knowledge Conflict

When retrieved evidence contradicts an agent's prior beliefs, does it revise its answer, acknowledge uncertainty, or persist with an incorrect conclusion? Existing evaluations of agentic systems focus primarily on task success, offering limited insight into how agents handle such conflicts. We propose to evaluate agents on epistemic humility (EH): the agent's willingness to recognize, act on, and communicate uncertainty during task execution. We operationalize EH through three trajectory-level behavioral dimensions: Identify, Solve, and Escalate (ISE). Through knowledge conflict, situations where the backbone language model's parametric knowledge contradicts the evidence it encounters, or where two contextual sources disagree, we evaluate two conflict settings: (1) controlled conflict and (2) naturally occurring conflict during multi-step agentic execution, each paired with matched no-conflict controls. Evaluating four agents, we find that higher task accuracy does not necessarily correspond to greater epistemic humility: some high-accuracy configurations recognize conflicts during execution but do not communicate unresolved uncertainty in their incorrect final answers. Trajectory-level analysis further reveals that agents frequently detect conflicts in early steps of execution but fail to maintain or resolve them in later steps. Finally, we show that model-level interventions can improve EH, but often at the cost of task accuracy, suggesting that epistemic humility emerges from the interaction among the backbone model, agent harness, and evaluation environment.

cs.AI↗
arXiv2026

SIGMA: Self-Improving Alignment Generalization from a Model Spec

LLM agents are increasingly capable of executing complex tasks and of recursively improving themselves on easy-to-verify objectives such as software engineering and mathematics. Since alignment is much harder to verify, this creates a growing risk of capabilities increasing without appropriate safety alignment, especially as capabilities expand to auto-research and cybersecurity. Existing approaches focus on capability self-improvement using verifiable feedback or on alignment training with supervision from stronger models or curated data, creating an external supervision bottleneck for alignment. We ask whether current models can improve their own safety alignment, and propose SIGMA, a data generation and training pipeline enabling alignment self-improvement that generalizes to out-of-distribution settings. Given only a "Model Spec" stating the model's desired behavior, SIGMA leverages a model's reasoning capabilities to strengthen its own safety reasoning. SIGMA first performs spec-guided task synthesis, using the candidate model as a task designer agent to generate diverse alignment dilemma scenarios and convert them into training tasks that stress-test its understanding of the Model Spec. Next, SIGMA conducts self-judged alignment training through supervised fine-tuning and rubric-based reinforcement learning with the model itself as the reward model. Despite training only on single-turn chat data, SIGMA improves safety alignment in multi-turn agentic environments (AgentHarm harmfulness decreases from 22.6 to 14.8; Agentic Misalignment decreases from 79.1 to 3.8), outperforms Deliberative Alignment and Constitutional AI baselines, and retains general capability. Analyses show that a Model Spec balancing harmlessness and helpfulness, test-time reasoning for safety deliberation, and high-quality rubrics from SIGMA's task designer agent are crucial for effective self-improvement.

cs.AI↗
arXiv2026

Marginal Response Surface Elicitation for Zero-Label Tabular Learning

Tabular learning uses structured data to predict target outcomes. Traditionally, this process has relied on labeled data. However, large language models (LLMs) can be used to elicit domain priors based on the task description and feature semantics, thereby enabling predictions without labeled data. We propose Marginal Response Surface Elicitation (MARS), a method that transforms feature-level LLM priors into a reusable, zero-shot tabular classifier. To construct this classifier, MARS selects representative values for each feature from unlabeled data and prompts the LLM to provide corresponding class support scores and feature weights. It then aggregates multiple responses using the median to construct feature response functions, and makes predictions through their weighted sum without further LLM queries. Across eight tabular benchmark tasks, MARS achieves the highest average AUC and AP, outperforming direct prompting by 1.97 and 6.21 percentage points respectively, while substantially reducing end-to-end costs. Evaluations with LLMs of different sizes further demonstrate its predictive advantage over direct prompting.

cs.CL↗
arXiv2026

First measurement of the one-point charge correlator in $e^+e^-$ collisions at $\sqrt{s} = 91.2$ GeV with DELPHI Open Data

The chiral structure of the $Z$ couplings imprints a parity-odd flow of electric charge on hadronic $Z$ decays. The related forward-backward asymmetries, a key set of observables in the electroweak precision program, were measured at LEP and SLC using the jet charge. The one-point charge correlator offers a complementary route, measuring the hadronic charge flow directly as a function of polar angle relative to the incoming electron-beam axis, without reference to jets or a reconstructed quark direction, following the formalism developed in a companion paper. We report its first measurement, using $61~\mathrm{pb}^{-1}$ of archival DELPHI Open Data recorded at $\sqrt{s} = 91.2$~GeV in 1994 and 1995. Detector effects are corrected in two stages. The first is derived from fully simulated samples, and the second bounds the residual charge-misreconstruction difference between data and simulation using a measurement in $e^+e^-\toτ^+τ^-$ events. The measured charge correlator exhibits the characteristic parity-odd $\sin(2θ)$ modulation and agrees with the \textsc{PYTHIA}~8.3 prediction. The measurement demonstrates that the parity-odd charge flow of hadronic $Z$ decays is directly accessible in data, differentially in polar angle, and the paper discusses strategies for controlling the associated detector effects, paving the way for a new program of charge-flux measurements, both in archival $e^+e^-$ data and at future colliders.

hep-ex↗
arXiv2026

Which Models Work Well Together? Measuring Heterogeneity for LLM Team Selection

The performance ceiling of an LLM team is constrained not only by individual model capabilities, but also by inter-member error resonance and predictive differences. Although heterogeneous teaming is often observed to be effective in practice, existing approaches lack complementarity metrics that are computable, interpretable, and optimizable, leaving team composition to rely on heuristics. We propose a heterogeneity-driven team selection framework that performs offline profiling to characterize individual capability along with two complementary signals: one captures decorrelation in error patterns to reduce co-failures, while the other measures divergence in predictive behavior to capture strategy diversity. We formulate team selection as a standardized quality--complementarity combinatorial objective and apply an efficient greedy search to select a small team from a candidate pool. Experiments across multiple benchmarks demonstrate that our framework consistently outperforms quality-only baselines under controlled candidate pools and team sizes, establishing reusable selection principles for multi-LLM systems.

cs.CL↗
arXiv2026

Analysis note: one-point charge correlator with DELPHI Open Data

We present the first measurement of the one-point charge correlator, the angular flux of electric charge in hadronic final states, using DELPHI Open Data collected at LEP-1 at $\sqrt{s} = 91.2$~GeV during 1994 and 1995. The data, corrected for detector effects, exhibit a clear $\sin(2θ)$ modulation, consistent with the parity-violating hadronic charge flow that the chiral structure of the $Z$ couplings imprints on the final state. The measurement demonstrates the experimental feasibility of the observable and establishes strategies for controlling associated detector effects, thereby motivating a new program to measure charge-flux observables. This note documents the experimental details supporting the companion experimental paper and the joint theory--experiment Letter.

hep-ex↗
arXiv2026

Minimally Invasive Steering of Language Models

Pre-logit steering adapts a frozen language model to a test-time reward by adding vectors to its final hidden states. Unregularized reward optimization can substantially alter the output distribution and degrade generation quality. We propose Minimally Invasive Steering Vector Optimization (MISVO), which penalizes interventions using the local KL geometry of the induced token distribution. The resulting Fisher quadratic measures distributional sensitivity and admits an analytic gradient computed through matrix--vector products with the frozen language-model head. We derive an exact decomposition of the sequence-level KL gradient into an analytic Fisher term and a suffix score-function term. For a fixed generation horizon, we show that the suffix term is second order in the steering magnitude and that three Fisher surrogates agree with the full KL gradient to first order. MISVO uses the frozen-reference surrogate to optimize position-specific interventions without updating model parameters. Across preference and code-generation tasks on models with approximately 1B--14B parameters, MISVO achieves the highest mean reward in six of seven model--task settings, with diversity and coherence scores close to those of Best-of-N.

cs.LG↗
arXiv2026

Are Finer Citations Always Better? Rethinking Granularity for Attributed Generation

Citation granularity -- whether to cite individual sentences, paragraphs, or documents -- is a critical design choice in attributed generation. While fine-grained citations are commonly preferred for precise human verification, their impact on model performance remains under-explored. We analyze four model scales (8B-120B) and demonstrate that enforcing fine-grained (sentence-level) citations forfeits gains of 2-97% (median 40%) relative to the best-performing granularity, and up to 338% on individual tasks. Strikingly, setting citation granularity to its optimal value (based on attribution quality) unlocks these substantial gains while leaving overall answer correctness essentially unchanged (between -2.3% and +4.4%). We observe a consistent pattern where attribution quality peaks at intermediate (paragraph-level) granularities: finer citations appear to sever the semantic dependencies needed to ground a claim, while excessively coarse citations introduce distracting noise. Importantly, this performance gap varies with scale: when a claim rests on a small or moderate amount of evidence, it disproportionately penalizes larger models by disrupting the multi-sentence information synthesis at which they excel. Fine-grained citation rests on the premise that a sentence is a sufficient unit of evidence on its own. Our results indicate that it often is not, and that this is a property of the model rather than of the citation standard. Standards fixed for human verifiability may therefore paradoxically degrade the very attribution they aim to ensure; effective attribution requires matching granularity to the model's semantic scope rather than fixing it by convention.

cs.CL↗