arXiv subjects

Minghui Xu

Publications and source records attributed to Minghui Xu.

At least 19 recordsLinked to original sources

arXiv2026

LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense

Large language models (LLMs) perform remarkably well on complex tasks, yet remain highly vulnerable to prompt injection attacks, where malicious instructions embedded in external data can override user intent. Existing defenses remain limited by model fine-tuning requirements, vulnerability to adaptive attacks, or reliance on brittle handcrafted prompts. We argue that a fundamental source of this vulnerability is the lack of an explicit representation of trust provenance. To address this, we introduce Learnable Trust-Boundary Delimiters (LTBD), a lightweight defense that explicitly encodes trust boundaries in the input while keeping the LLM parameters unchanged. LTBD uses a small number of learnable delimiters to distinguish trusted user instructions from untrusted external data, enabling the model to better respect the intended trust hierarchy. Experimental results show that LTBD substantially outperforms inference-time defenses and performs competitively with training-based approaches, while preserving benign-task utility and introducing negligible inference overhead. In particular, LTBD achieves 0.00% ASR on AlpacaFarm and only 0.11-0.19% ASR on TaskTracker. LTBD also remains effective under adaptive attacks, where adversaries have full knowledge of the defense and explicitly attempt to bypass it.

cs.CR↗

arXiv2026

Dimensions of Bedford-McMullen type sets in $\mathbb Z^2$

We study forward orbits in $\mathbb Z^2$ generated by the expanding affine maps $(x,y)\mapsto(mx+i,ny+j)$, where $m\ge n\ge2$ are integers and $(i,j)$ ranges over a nonempty digit set $Λ\subseteq\{0,\ldots,m-1\}\times\{0,\ldots,n-1\}$. We obtain explicit formulae for the mass, Beurling, discrete packing, and Assouad dimensions, the discrete Hausdorff dimension and its lower variant, and the lower entropy index. When $m=n$, all these dimensions equal $\log_m\#Λ$. When $m>n$, they can differ, and several depend on the starting point through the sizes of the endpoint columns of $Λ$. The two Hausdorff dimensions coincide and admit a pressure variational formula. Our proofs use finite symbolic models and approximate squares to relate digit counts to coverings in centered windows, translated windows, and annuli. We also characterize invariant lattice sets and determine their dimensions. Finally, we compare the orbit dimensions with semigroup growth and the dimensions of the compact dual attractor. In particular, the mass and Beurling dimensions need not equal the semigroup growth exponent, in contrast to the corresponding one-dimensional theory.

math.DS↗

arXiv2026

Utility-Aware Data Pricing: Token-Level Quality and Empirical Training Gain for LLMs

Traditional ``row-count $\times$ quality coefficient'' approaches fail to capture the nonlinear utility of data for Large Language Model (LLM) capabilities. We present a utility-aware data valuation framework that moves from static accounting toward utility-based pricing. The framework combines token-level information density and data quality, empirical training contribution estimated by influence functions, proxy models, and Data Shapley values, and cryptographic mechanisms based on hash commitments, Merkle trees, and tamper-evident training ledgers. Preliminary evaluation includes a smoke-scale multi-domain study and a synthetic duplication test. Results show that proxy-based empirical gain achieves strong ranking agreement with proxy-defined realized utility and substantially outperforms row-count and token-count baselines in the tested setting, while the prototype provides a controlled sanity check of the valuation pipeline and its sensitivity to duplication-based manipulation.

cs.LG↗

arXiv2026

Geometry-aware Latent Autoregressive Generative Model for PDEs in Complex Domains

Solving multiphysics partial differential equations (PDEs) remains a major challenge in scientific computing, especially for highly complex $μ$m-scale tortuous geometries critical to energy and chemical engineering. We address this challenge by proposing a Geometry-aware Latent Autoregressive generative Model for PDEs (GeoLAMP), which solves physics within highly irregular and tortuous structures by decoupling flow and transport physics. GeoLAMP introduces a dual-encoder architecture on graph representations to jointly capture global topology and fine-scale geometric features, enabling an effective transition from real-space fields to compact latent representations. In the latent space, we propose a causal self-attention transformer with flow matching to model temporal dynamics, allowing stable and scalable block-wise autoregressive prediction. In addition, we propose a grid-graph data fusion scheme that projects low-resolution grid-based approximate priors onto graph representations, improving prediction of flow in tortuous structures. We establish three multiphysics benchmark datasets in complex geometries, covering reactive flow, heat convection, and elasticity. GeoLAMP consistently achieves the most stable autoregression performance on these datasets. Our results provide a systematic study of geometry-aware learning for PDEs in $μ$m-scale complex geometries and offer new insights into block-wise time marching of latent autoregressive PDE modeling via a flow matching framework.

cs.LG↗

arXiv2026

UNBIND: UNlearning By INference-time Directional Steering for Code LLMs

Code large language models acquire programming capabilities from large code corpora, but can also memorize implementations that later require removal. Code unlearning is needed to control their continued reproduction when copyright or security concerns arise. However, targeted and retained code share computational patterns, creating a tension between forgetting specific implementations and preserving general programming ability. We propose \textbf{UNBIND}, a code unlearning framework that separately considers which hidden states correspond to the target code and how to suppress its reproduction. By constructing separate directions for these objectives, UNBIND achieves selective unlearning at inference time while keeping model weights fixed. Our evaluation covers fourteen baselines across two code models and two corpora. UNBIND achieves the highest joint forgetting and utility score in every setting. It reduces target code reproduction by 97.3\% to 99.1\% as measured by F-BLEU, with at most two fewer HumanEval+ and six fewer MBPP+ problems solved than the original models. In repeated extraction tests under a fixed budget, the number of targets yielding exact spans of at least 50 tokens falls from 188--262 to 0--2 out of 300 per setting. No extracted span reaches 100 tokens, and the mean best recovery ratio ranges from 0.43\% to 6.45\%. Multilingual and related-code evaluations further show effective forgetting with limited impact on useful programming capabilities, supporting UNBIND as a practical approach to selective code unlearning.

cs.SE↗

arXiv2026

SilentLedger: Privacy-Preserving Auditing for Blockchains with Complete Non-Interactivity

Privacy-preserving blockchain systems are essential for protecting transaction data, yet they must also provide auditability that enables auditors to recover participant identities and transaction amounts when warranted. Existing designs often compromise the independence of auditing and transactions, introducing extra interactions that undermine usability and scalability. Moreover, many auditable solutions depend on auditors serving as validators or recording nodes, which introduces risks to both data security and system reliability. To overcome these challenges, we propose SilentLedger, a privacy-preserving transaction system with auditing and complete non-interactivity. To support public verification of authorization, we introduce a renewable anonymous certificate scheme with formal semantics and a rigorous security model. SilentLedger further employs traceable transaction mechanisms constructed from established cryptographic primitives, enabling users to transact without interaction while allowing auditors to audit solely from on-chain data. We formally prove security properties including authenticity, anonymity, confidentiality, and soundness, provide a concrete instantiation, and evaluate performance under a standard 2-2 transaction model. Our implementation and benchmarks demonstrate that SilentLedger achieves superior performance compared with state-of-the-art solutions.

cs.CR↗

arXiv2026

Starfish: Rebalancing Multi-Party Off-Chain Payment Channels

Blockchain technology has revolutionized the way transactions are executed, but scalability remains a major challenge. Payment Channel Network (PCN), as a Layer-2 scaling solution, has been proposed to address this issue. However, skewed payments can deplete the balance of one party within a channel, restricting the ability of PCNs to transact through a path and subsequently reducing the transaction success rate. To address this issue, the technology of rebalancing has been proposed. However, existing rebalancing strategies in PCNs are limited in their efficiency and applicability under realistic network topologies. Cycle-based approaches only enable rebalancing among nodes that form cycles, while non-cycle-based approaches incur high on-chain operation costs. In this study, we propose Starfish, a rebalancing approach designed for the locally star-like structures formed by high-degree routing hubs and their incident channels in real-world PCNs. By leveraging a hub-centric structure, Starfish reduces the on-chain overhead of rebalancing from quadratic to linear in the number of channels, achieving high rebalancing efficiency. We formally prove the security of Starfish and conduct comparative experiments against existing rebalancing techniques to demonstrate its effectiveness.

cs.CR↗

arXiv2026

Learning to Use Tools: Reinforcement Learning for Tool-Integrated Mathematical Reasoning

Current large language models (LLMs) increasingly benefit from external tool integration, especially for tasks requiring reliable computation and verification. Motivated by this, we study calculator tool calling for improving mathematical reasoning on the Countdown task. We first analyze reasoning failures and find that calculation errors account for a substantial portion of incorrect responses. We then construct supervised fine-tuning datasets to teach the model useful tool-use patterns and how to interpret returned outputs. Building on this tool-formatted policy, we apply several on-policy reinforcement learning methods, including RLOO, RLOO++, GRPO, and DAPO, using automatically verifiable final-answer rewards. To enable a more reliable evaluation, we construct a fresh 1,024-problem held-out Countdown benchmark with no exact overlap with the training data. Our results show that calculator tool integration consistently improves both SFT and RL baselines, yielding roughly 10 percentage-point gains across pass@k. Among the RL methods, Tool-DAPO achieves the strongest performance, improving pass@1 from 35.8% for Tool-SFT to 66.0%. Further analysis shows that RL encourages more effective tool use even when only final-answer rewards are provided. These findings suggest that tool integration reduces arithmetic and verification errors, while RL increases the probability of correct reasoning traces.

cs.AI↗

arXiv2026

CIDER: Continual Interactive Distillation for Embodied Reinforcement Learning

Human-in-the-loop real-world reinforcement learning enables rapid acquisition of effective robotic manipulation policies for individual tasks, often within tens of minutes. Yet it remains unclear how to extend this paradigm to continual learning, where a single policy must acquire new skills without losing previously learned behaviors. Existing real-world continual learning methods do not explicitly constrain prior behaviors, leading to severe catastrophic forgetting. We introduce Continual Interactive Distillation for Embodied Reinforcement Learning (CIDER), a continual reinforcement learning framework that freezes the accumulated historical policy as a teacher before learning each new task and interleaves task learning with distillation-based retention. We further introduce gradient routing to separate the gradients used for acquiring new tasks from those used for preserving prior behaviors. We evaluate our method with a single shared actor on six real-world household and industrial manipulation tasks. Interactive Distillation maintains high measured success on previously learned tasks across our six-task real-robot sequence while acquiring each new task in 10 to 20 minutes, whereas every baseline forgets at least one previous task. Additional ablations reveal the key design choices that govern the tradeoff between stability and plasticity in real-world continual reinforcement learning.

cs.RO↗

arXiv2026

Reverse Iterated Function Systems: Density, Dimensions, and $p$-adic Extension

Strichartz initiated the study of reverse iterated function systems (RIFSs) on integer lattices and the dimensions of their invariant sets. We develop a dimension theory for RIFSs through forward orbits, first on locally compact complete metric spaces and then for one-dimensional affine systems. For an affine RIFS $\mathcal F=\{f_i(x)=r_i x+b_i\}_{i=1}^m$ on $\mathbb R$, we introduce the semigroup-growth exponent\[ d_{\mathcal F}=\lim_{R\to\infty}\frac{\log\#\{g\in G^*(\mathcal F):|g'|\le R\}}{\log R}, \] where $G^*(\mathcal F)$ is the semigroup of distinct maps generated by $\mathcal F$. We prove that this limit exists and that $\dim_{\mathrm B}K(\mathcal F^{-1})\le d_{\mathcal F}\le s$. Every forward orbit has mass dimension $d_{\mathcal F}$ if it is locally finite and infinity otherwise; its Beurling dimension is $d_{\mathcal F}$ if it is uniformly locally finite and infinity otherwise. These formulas extend to suitably discrete invariant sets. Moreover, $d_{\mathcal F}=s$ if and only if the dual IFS has no exact overlaps, while $d_{\mathcal F}=0$ if and only if $\mathcal F$ is degenerate. Under finite overlaps, we obtain two-sided polynomial orbit-counting estimates. For non-overlapping uniformly locally finite orbits, renewal theory gives a limiting central density in the non-arithmetic case and a multiplicatively periodic asymptotic profile in the arithmetic case. We also determine the lower and discrete Hausdorff dimensions of rational lattice orbits with finite overlaps. Finally, for expansion ratios that are signed powers of a fixed prime $p$, we identify the Euclidean mass and Beurling dimensions of every rational orbit with the $p$-adic box-counting dimensions of the orbit and its attractor, without any separation assumption.

math.DS↗

arXiv2026

OBLIVION: Workflow-Level Operational Skill Unlearning for Deployed Agents

Large language model agents are becoming operational interfaces to files, memories, registries, and external tools. This deployment shift creates a new skill revocation problem: after a skill is removed from an explicit registry, an agent may still reconstruct it from residual carriers such as archives, transcripts, schemas, or memory entries. We study this problem as operational skill unlearning, where the goal is not parameter-level forgetting, but preventing a deployed agent from rebuilding a revoked skill through primitive tools. We introduce OBLIVION, a controlled benchmark and defense harness for revoked-skill resurrection. OBLIVION models each episode as a source-to-sink workflow, applies Cross-Surface Coherent Erasure to reduce residual carriers, and uses frozen workflow remediation near dangerous sinks. On the locked 88 attack episodes, the no-defense arm reaches formal attack success rate 1.0. OBLIVION reduces the rate to 0.114 and impact-weighted exposure to 0.115 while keeping locked utility at 1.0 and benign block rate at 0. In a separate skill-attack-derived sandbox, OBLIVION reduces attack success from 1.0 to 0.2 and impact-weighted exposure from 1.0 to 0.213 while preserving all utility controls. These results support workflow-level evaluation beyond checking explicit skill entries.

cs.AI↗

arXiv2026

Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks

Large language models (LLMs) are safety-aligned before deployment to reduce harmful content generation. Yet neuron-level pruning attacks show that refusal can depend on a small set of removable units: disabling them can remove safety behavior while leaving much of the model usable. To address this problem, we introduce Mask2Shield (M2S), a masked-forward alignment method that trains a model under this functional pruning. The masked student must recover a safe refusal through the remaining computation, while a frozen, unmasked teacher supplies complete benign answers to limit capability drift. Across ten model configurations, M2S reduces successful recomputed pruning attacks from 80--279 to 1--44 out of 313 prompts while generally preserving four capability benchmarks. We also evaluate M2S with TwinBreak, which uses a different neuron-selection rule and iterative pruning procedure. Together, these results show that M2S makes targeted pruning less effective by reducing reliance on a small, removable safety-neuron set.

cs.CR↗

arXiv2026

Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems

The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision may implicitly grant access to multiple, potentially untrusted callers.Our empirical study reveals that most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication, regardless of the caller. In addition, many MCP servers fail to enforce authentication at the per-tool level, enabling unauthorized access to sensitive operations.These findings demonstrate that one-time authorization and server-level trust significantly expand the attack surface of MCP-based systems, highlighting the need for explicit caller authentication and fine-grained authorization mechanisms.

cs.CR↗

arXiv2026

Digital measurement of droplet flame diameter in microgravity combustion images using Segment Anything Model 2 with automatic prompt selection

Flame diameter is a key measurable parameter in microgravity droplet combustion, but its extraction from self-illuminated frames remains difficult because soot tails, blurred luminous boundaries, chamber reflections, and droplet drift introduce substantial measurement bias and operator dependence. This work presents an AI-enabled digital measurement workflow for automated flame diameter from combustion images. The workflow integrates automatic prompt-point generation into Segment Anything Model 2, employing Random Sample Consensus (RANSAC)-based circle fitting. The automatic prompt strategy removes subjective manual point selection, while the video memory mechanism maintains temporal consistency for drifting droplets, and the RANSAC fitting rejects soot-tail pixels as geometric outliers. The method is validated by 19,537 flame images of n-heptane, n-decane, and n-octane droplets with varying initial diameters. Compared with manual-reference measurements, the proposed workflow achieves a mean relative agreement of 96.9%, a mean absolute percentage error of 3.1%, and substantially outperforms conventional Hough circle detection, which performed worse under the same evaluation conditions. The results also show that the measurement accuracy improves with increasing droplet size. The proposed workflow has a combined standard uncertainty of 8.54% and achieves approximately a 229-fold improvement in efficiency over manual measurement. These results demonstrate that the proposed SAM2-based workflow provides a reproducible, fully automated, and metrologically characterized digital measurement system for extracting flame diameter from challenging combustion images. The approach supports high-throughput combustion diagnostics and illustrates that AI-based segmentation can be integrated into quantitative measurement workflows for digitalized image-based metrology.

cs.CV↗

arXiv2026

Experimental and model-assisted analysis of lamella thinning and breakup in diesel-surrogate fuel-droplet wall impingement under Leidenfrost conditions

Hot-wall fuel-droplet impingement affects liquid redistribution, secondary droplet formation, and droplet evaporation in diesel-relevant spray-wall systems. This study investigates the spreading and breakup of single n-hexadecane droplets, used as a single-component diesel surrogate, on a heated stainless-steel wall at 300-500 °C over a Weber number (We) range of 5.77-208.61. High-speed backlit images were recorded during experiments and used to classify deposition, rebound, ejection, fragmentation, and splashing regimes, and to measure spreading-factor histories. The measured spreading histories were compared with a lamella-rim model to evaluate its predictive capability before droplet breakup and to infer the lamella state at experimentally observed breakup instants. The 300 °C cases did not enter the Leidenfrost regime under the present impact conditions and therefore serve as a non-Leidenfrost reference, deviating from the model predictions. For Leidenfrost cases at 350-500 °C, the model captures the pre-breakup spreading trajectory, including higher-We cases that later undergo breakup. Wall temperature has a limited influence on the early spreading stage but more strongly affects later breakup timing after lamella thinning, especially in the intermediate-We regime. At high We, breakup becomes increasingly inertia-dominated. Model-inferred lamella thicknesses evaluated at experimentally observed breakup instants are mainly concentrated between 0.010 and 0.017 of the initial droplet diameter. These results suggest that model-inferred lamella thickness can complement conventional Weber-number and temperature-based regime maps by providing local-state information for breakup timing in hot-wall fuel-droplet impingement models.

physics.flu-dyn↗

arXiv2026

Bridging Diffusion Pruning and Step Distillation with Teacher-Aligned Repair

Diffusion models generate high-quality images, but their inference cost comes from two sources: large denoising networks and repeated denoising steps. Existing compression pipelines usually attack these costs separately. Pruning reduces the network, but most pruning methods still rely on a long post-pruning retraining stage to recover a many-step sampler. Step distillation reduces the number of denoising steps, but it usually assumes a student that can already follow the teacher well enough to receive useful distillation gradients. This paper asks whether post-pruning retraining can be replaced by step distillation. We find that the direct replacement fails: after pruning an EDM2-XS teacher, starting SiDA from the pruned checkpoint produces unusable samples. We introduce a short teacher-alignment repair stage as a bridge between pruning and step distillation. The bridge matches the pruned generator to the teacher on noisy real-image latents, then hands the repaired checkpoint to one-step distillation. On ImageNet-512, the original EDM2-XS baseline uses 124.713M parameters and 63 network evaluations, reaching an FID of 3.53. With a suitable distillation objective, our 20% pruned one-step generator uses 98.826M parameters and one network evaluation, reaching an FID of 3.12. With 30% pruning, the model uses 88.029M parameters and one network evaluation, with an FID of 4.26.

cs.CV↗

arXiv2026

Bad company corrupts good morals: Understanding and Measuring Narrative-Induced Moral Reasoning Degradation in LLMs

Large language models are deployed in long-context, emotionally interactive environments like digital humans, AI companions, educational assistants, and counseling systems. Unlike jailbreak attacks with explicit adversarial prompts, these systems interact with emotionally charged narratives involving bullying, betrayal, loneliness, social hostility, and institutional unfairness. This raises an important question: can prolonged narrative exposure reshape the reasoning and alignment stability of LLMs? We present the first systematic study of narrative-induced alignment degradation in LLMs. We design BreakingBad, a three-stage framework that measures how negative narrative immersion affects moral reasoning, behaviors, and deployment risks. It combines ethical decision evaluation, behavioral probing, and digital-human interaction analysis. Our experiments reveal three findings. First, negative narrative exposure degrades moral accuracy across multiple LLMs, with average drops of 12%-31%, especially in ambiguous scenarios and those involving vulnerable individuals. Second, the degradation is structured: different narratives induce distinct shifts, and first-person narratives produce stronger effects than third-person. Third, these shifts propagate into real deployments. Across counseling, education, medical, and financial/legal scenarios, narrative-conditioned models increasingly normalize hopelessness, cynicism, emotional detachment, and ethically questionable reasoning while remaining superficially policy-compliant. More broadly, our findings suggest alignment robustness is not static but a dynamically conditioned state shaped by long-term semantic environments and interaction history. These results reveal a new class of alignment risk that existing safety defenses largely fail to capture.

cs.CY↗

arXiv2026

"What Happens Locally, Leaks Globally": Detecting Privacy Leakage Risks in MCP Servers

The Model Context Protocol (MCP) has rapidly become the de facto standard for connecting large language models (LLMs) to external resources, but it also introduces a class of privacy risks that existing tools are ill-equipped to detect. Unlike conventional exfiltration bugs, leakage in MCP servers is largely protocol-induced: credentials, API keys, and Personally Identifiable Information (PII) cross the local/LLM boundary simply by being returned, logged, or raised inside a tool handler, with no explicit outbound request in the source code. We present MCPPrivacyDetector, a context-aware cross-language static analysis framework that detects such leakage in multilingual MCP servers. MCPPrivacyDetector lifts heterogeneous code implemented across different programming language (e.g., Python) into a unified program representation, applies context-aware semantic filtering to isolate genuinely sensitive values and protocol-specific implicit sinks (e.g., @mcp.tool handlers), and performs taint analysis to enumerate feasible flows. Applied to 10,655 real-world MCP servers, MCPPrivacyDetector finds leakage rates above 10%. Case studies confirm concrete exposures including leaked Bearer tokens, propagated API keys, and plaintext authentication credentials, arguing for systematic, protocol-aware safeguards in the emerging LLM agent toolchain.

cs.CR↗