arXiv subjects

Qing Guo

Publications and source records attributed to Qing Guo.

At least 19 recordsLinked to original sources

arXiv2026

Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection

Tool-using large language model (LLM) agents are vulnerable to indirect prompt injection (IPI), in which malicious instructions embedded in external observations manipulate subsequent agent decisions and actions. Most existing adaptive attacks rely on repeatedly querying and refining against the target agent, whereas realistic attackers may have only a single opportunity to interact with an unknown target agent. We propose SAVOR (Strategy Abstraction Via Outcome-Conditioned Reflection), which shifts attack adaptation from test-time iteration to offline strategy distillation. SAVOR performs outcome-conditioned reflection over successful and failed trajectories collected from disjoint training environments, validates context-conditioned candidate strategies, and iteratively consolidates them into a reusable strategy memory. At test time, the frozen memory guides the generation of a single payload for each unseen target, requiring only one target-agent query and no target-agent feedback. Across two benchmarks and three victim models, SAVOR attains the highest average attack success rate in all six settings, leading the strongest prior attack by 2.5 to 11.8 points and the same injection channel without strategy learning by 23.1 points on Agent Security Bench, which holds out attacker tools, and 28.6 points on OpenClaw-IPI, an executable benchmark we introduce that holds out attack goals and verifies attacks through tool interactions and execution receipts. A memory learned under one defense also transfers to another.

cs.CR↗

arXiv2026

Morse index, Leray-Schauder degree and local uniqueness for multi-peak concentrating solutions of a fractional Schrödinger equation

We study positive $k$-peak solutions of the semiclassical fractional Schrödinger equation $\varepsilon^{2s}(-Δ)^s u+V(x)u=u^p$ in $\mathbb{R}^N$, concentrating at different nondegenerate critical points $ξ_1^0,\ldots,ξ_k^0$ of $V$. For every such family satisfying the natural energy quantization, we determine the complete low spectrum of the linearized operator. The first $k$ eigenvalues remain uniformly negative, the next $kN$ eigenvalues are of order $\varepsilon^2$ and are governed by the Hessians $D^2V(ξ_j^0)$, while the remaining spectrum is uniformly separated from zero. Consequently, the Morse index equals $k$ plus the total number of negative eigenvalues of these Hessians, and every such solution is nondegenerate. Combining a unique modulation parametrization with a Leray--Schauder degree computation, we further prove that, for all sufficiently small $\varepsilon$, the prescribed concentrating class contains exactly one positive solution. The result applies to the whole energy-quantized class, not only to a particular solution.

math.AP↗

arXiv2026

ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization

Foundation models have achieved remarkable success across diverse tasks, but they remain vulnerable. To investigate such vulnerabilities, semantic-shift jailbreaks have recently emerged as a promising attack paradigm. They bypass explicit safety mechanisms by replacing harmful terms in original harmful questions with benign alternatives and leveraging contextual information to induce the target model to reinterpret these alternatives as their corresponding harmful concepts. However, existing semantic-shift jailbreaks often achieve limited effectiveness. In this work, we reveal that this limitation arises from overlooking the semantic-shift capability of contexts. Through systematic analysis, we find that contexts exhibit substantially different abilities in inducing semantic shifts: contexts with stronger semantic-shift capabilities are more likely to guide models toward recovering harmful meanings and achieving successful jailbreaks. Based on this finding, we systematically identify and distill the characteristics of effective contexts and propose a black-box context-aware semantic-shift jailbreak framework with Iterative Context Optimization (ICO). In each iteration, ICO leverages these characteristics and feedback from the target model to optimize contexts. Extensive experiments on three datasets and eight target foundation models demonstrate that ICO consistently outperforms eight state-of-the-art baselines, achieving an average attack success rate of 74.6%.

cs.CL↗

arXiv2026

CoLT: Teaching Multi-Modal Models to Think with Chain of Latent Thoughts

Chain-of-thought (CoT) reasoning has enabled multi-modal large language models (MLLMs) to tackle complex visual reasoning tasks by generating explicit intermediate reasoning steps in natural language. However, this text-based reasoning paradigm is inherently slow at inference time with even thousands of tokens and fundamentally constrained by the expressiveness of natural language. In this paper, we propose CoLT, (Chain of Latent Thoughts), a novel framework that teaches multi-modal models to reason through a chain of latent thought representations instead of verbose text tokens, which can perform thinking with as few as 3 steps. Naively forcing the model to think with latent states easily produces meaningless semantics and makes training unstable. To effectively regulate the latent reasoning process, we introduce a lightweight external decoder that provides step-level supervision for each latent reasoning step in two complementary directions: a forward mode that decodes latent thoughts into the textual reasoning of the next step, and a backward mode that aligns decoder hidden states with the model's latent thoughts given preceding textual context. We further incorporate internal supervision that encourages coherent step-by-step latent transitions. The decoder and internal supervision are removed during inference to maintain high efficiency of latent reasoning. Extensive experiments on eight benchmarks demonstrate that CoLT not only outperforms existing latent reasoning methods such as CODI and SIM-CoT, but also surpasses latent visual reasoning approaches that rely on auxiliary images with costly annotation requirements. Compared to text CoT methods, CoLT can notably reduce the inference time by 10.1$\times$ and text decoding time by 22.6$\times$. Code is released at https://github.com/hulianyuyy/CoLT.

cs.CV↗

arXiv2026

Segregated Bubbling Solutions for a Critical Schrödinger System of Brezis--Nirenberg Type with Sublinear Competitive Coupling

We construct segregated bubbling solutions for a two-component critical Schrödinger system of Brezis--Nirenberg type in a smooth bounded domain $Ω\subset\mathbb R^N$, $N\geq5$, with any fixed competitive coupling $β<0$. Suppose that the Robin function has two distinct prescribed critical points, each satisfying a local degree condition. For every sufficiently small $ε>0$, the system admits a nonnegative weak solution with both components nontrivial. Each component has a single-bubble profile and concentrates at one of the prescribed points. Each component also vanishes identically in a ball centered at the other concentration point; after rescaling by the natural bubble length, the radius of this ball tends to infinity. The main obstruction is that $p=N/(N-2)\in(1,2)$, so the gradient of the interaction potential $(s,t)\mapsto |s|^p|t|^p$ is not differentiable when one component vanishes and the other is nonzero. Hence the usual global Lyapunov--Schmidt reduction cannot be applied directly. We first solve a nonlinear exterior problem variationally. The resulting dead cores remove the cross-component coupling from the inner localization regions, where a projected critical reduction can then be carried out. The remaining scale and center equations are solved by Brouwer degree theory.

math.AP↗

arXiv2026

CARE: Anti-entanglement Ultrasound Image Segmentation via Channel-Aware Region Extrication

Accurate ultrasound image segmentation is fundamentally challenged by target-context entanglement, where lesion cues are easily mixed with surrounding tissues and artifacts of similar appearance. Although existing methods often localize suspicious regions reasonably well, they remain vulnerable to ambiguous predictions because they mainly strengthen feature extraction or context aggregation, rather than explicitly organizing how lesion and interference cues are represented and distinguished. To address this limitation, we propose Channel-Aware Region Extrication (CARE), a segmentation framework that improves ultrasound segmentation by progressively extricating lesion evidence from visually entangled context. Instead of merely reweighting features, CARE explicitly separates encoded responses according to their lesion relevance and then re-evaluates the resulting complementary representations through reciprocal region interaction, so that suppressed lesion cues can be recovered while misleading contextual activations are corrected. In this way, CARE promotes target-context discrimination directly in the learned representation, without sacrificing localization quality. Extensive experiments on BUSI, BUSIS, and TN3K benchmarks show that CARE consistently achieves superior performance, thereby validating representation extrication as an effective solution for addressing the inherent visual ambiguity in ultrasound segmentation.

cs.CV↗

arXiv2026

Systematic Literature Reviews With Two Multi-Agentic Systems And Human-In-The-Loop

Systematic literature review of clinical trials drives regulatory decision-making, but conventional screening and extraction are time-consuming, labor-intensive, and vulnerable to study selection bias. We propose two fit-to-purpose multi-agentic systems (MAS) for systematic literature review, with human-in-the-loop. The screening MAS uses multiple LLM agents with heterogeneous personas and multiround cross-review, and uniformly improves accuracy over a single-LLM baseline. The extraction MAS combines standardization, an iterative correction loop, and retrieval-based context control to ensure accuracy and scalability. Both MAS are specifically designed to support Human-In-The-Loop which is essential for clinical decisions. The novelty of the proposed approach lies in the system architecture rather than in any single foundation tools: the system can naturally benefit from future improvements in the underlying tools, for instance, stronger LLM agents, retrieval engines, image recognition methods, etc. As a real-world application, a published network meta-analysis is reproduced by the MAS. The result recovers all trials from the original study and identifies additional eligible trials missed by manual review, leading to updated clinical conclusions.

stat.AP↗

arXiv2026

Thinking Ahead: Foresight Intelligence in MLLMs and World Model

In this work, we define Foresight Intelligence as the capability to anticipate and interpret future events-an ability essential for applications such as autonomous driving, yet largely overlooked by existing research. To bridge this gap, we introduce FSU-QA, a new Visual Question-Answering (VQA) dataset specifically designed to elicit and evaluate Foresight Intelligence. Using FSU-QA, we conduct the first comprehensive study of state-of-the-art Vision-Language Models (VLMs) under foresight-oriented tasks, revealing that current models still struggle to reason about future situations. Beyond serving as a benchmark, FSU-QA also enables the assessment of world models by measuring the semantic coherence of their generated predictions, quantified through performance gains when VLMs are augmented with such outputs. Our experiments further demonstrate that FSU-QA can effectively enhance foresight reasoning: even small VLMs fine-tuned on FSU-QA surpass much larger, advanced models by a substantial margin. Together, these findings position FSU-QA as a principled foundation for developing next-generation models capable of truly anticipating and understanding future events. Furthermore, beyond model performance, we examine whether WM-generated predictions remain semantically consistent by using VLM-based proxy judges, and validate this evaluation protocol through shuffled control experiments. Fine-tuning models on FSU-QA leads to substantial improvements in foresight understanding, demonstrating the dataset's effectiveness and offering a principled foundation for future research.

cs.CV↗

arXiv2026

Towards Long-Horizon Vessel Trajectory and Destination Forecasting with Reasoning Large Language Models

Long-horizon maritime trajectory prediction is important for shipping management, logistics planning, and maritime risk analysis, yet month-level forecasting remains insufficiently studied. Existing deep learning methods mainly focus on short- and mid-term coordinate extrapolation and often struggle to preserve route feasibility and destination correctness over extended horizons. This paper investigates joint long-horizon vessel trajectory and destination forecasting with reasoning-capable large language models, and develops a Maritime LLM post-training framework based on Reinforcement Learning with Verifiable Reward (RLVR). An AIS-based benchmark is constructed with 60-day historical trajectories and 30-day forecasting horizons, where trajectories are converted into semantic textual representations for RL prompt construction. RLVR aligns LLMs with maritime forecasting objectives by enforcing physical validity, providing early-weighted trajectory supervision, and evaluating destination correctness through hierarchical matching and curriculum learning. Experimental results show that RLVR-trained LLMs substantially improve over zero-shot LLMs and representative deep learning baselines, especially on destination-related metrics. Among the evaluated RLVR-trained variants, 4B LLMs achieve the best overall performance, suggesting that reward-compatible optimization and task-specific capacity matching are more important than simply using larger 8B or 14B LLMs. The results also show that LSTM remains a strong deep learning baseline under limited fine-tuning data, while Transformer-style spatio-temporal models typically require larger datasets and richer structured inputs. Overall, this work advances semantic, verifier-aligned maritime forecasting for operational decision support.

cs.AI↗

arXiv2026

Density-Guided Robust Counterfactual Explanations on Tabular Data under Model Multiplicity

Counterfactual explanations (CEs) are essential for actionable recourse, yet their reliability is often compromised in low-density regions, where classifiers exhibit high variance. Unlike existing methods that rely on expensive ensemble intersections to define stability, we propose \textit{DensityFlow}, a generative framework that constructs robust CEs by adhering to the high-confidence data manifold. Specifically, we model the counterfactual generation as continuous-time dynamics parameterized by Neural ODE, guided by a differentiable density score to actively avoid uncertain, low-density areas. This density score is learned via Noise Contrastive Estimation, effectively leveraging a $(K{+}1)$-way discriminator to estimate density ratios. For black-box settings, we introduce a local proxy distillation mechanism that aligns a lightweight surrogate with the target model strictly within the trajectory of CE generation, enabling efficient gradient-based optimization with minimal queries. Experiments demonstrate that \textit{DensityFlow} achieves superior validity under model multiplicity while significantly reducing query costs compared to ensemble-based baselines. Our implementation is available at https://github.com/G-AILab/DensityFlow.

cs.LG↗

arXiv2026

PRBench: A Standardized Probabilistic Robustness Benchmark

Deep learning models are notoriously vulnerable to imperceptible perturbations. Most existing research centers on adversarial robustness (AR), which evaluates models under worst-case scenarios by examining the existence of deterministic adversarial examples (AEs). In contrast, probabilistic robustness (PR) adopts a statistical perspective, measuring the probability that predictions remain correct under stochastic perturbations. While PR is widely regarded as a practical complement to AR, dedicated training methods for improving PR are still relatively underexplored, albeit with emerging progress. Among the few PR-targeted training methods, we identify three limitations: i non-comparable evaluation protocols; ii limited comparisons to strong AT baselines despite anecdotal PR gains from AT; and iii no unified framework to compare the generalization of these methods. Thus, we introduce PRBench, the first benchmark dedicated to evaluating improvements in PR achieved by different robustness training methods. PRBench empirically compares most common AT and PR-targeted training methods using a comprehensive set of metrics, including clean accuracy, PR and AR performance, training efficiency, and generalization error (GE). We also provide theoretical analysis on the GE of PR performance across different training methods. Main findings revealed by PRBench include: AT methods are more versatile than PR-targeted training methods in terms of improving both AR and PR performance across diverse hyperparameter settings, while PR-targeted training methods consistently yield lower GE and higher clean accuracy. A leaderboard comprising 229 trained models across 7 datasets and 10 model architectures is publicly available at https://wellzline.github.io/PRBenchLeaderboard/.

cs.CV↗

arXiv2026

PaceVGGT: Pre-Alternating-Attention Token Pruning for Visual Geometry Transformers

Visual Geometry Transformer (VGGT) is a strong feed-forward model for multiple 3D tasks, but its Alternating-Attention (AA) stack scales quadratically in the total token count, making long clips expensive. Existing token-reduction accelerators operate inside AA, leaving the patch grid that enters AA uncompressed. We introduce PaceVGGT, a pre-AA token pruning framework that prunes DINO patch tokens before the first AA block of a frozen VGGT. PaceVGGT trains a lightweight Token Scorer that estimates per-token importance from DINO features. The scorer is first distilled against an AA-internal attention target from the unpruned backbone, then refined under downstream camera, depth, and point-map losses. A per-frame keep budget fixes the backbone-visible sequence length, while an importance-adaptive merge/prune assignment preserves residual content from high-saliency frames under a fixed total merge budget. A Feature-guided Restoration module reconstructs the dense spatial grid required by the prediction heads. On ScanNet-50 and 7-Scenes, PaceVGGT remains on the reconstruction quality--latency frontier while reducing inference latency. On ScanNet-50, it reduces latency by $5.1\times$ over unmodified VGGT at $N=300$ and $1.47\times$ over LiteVGGT at $N=1000$. These results identify pre-AA pruning as a viable acceleration route for frozen VGGT-style geometry transformers.

cs.CV↗

arXiv2026

Multiple positive solutions with prescribed masses for a coupled Schrödinger system: mass mixed and Sobolev critical coupled case

The aim of this paper is to establish multiple positive normalized solutions $(u,v,λ_1,λ_2)\in H^1(\mathbb{R}^N,\mathbb{R}^2)\times \mathbb{R}^2$ to the following coupled Schrödinger system involving Sobolev critical exponent: $$ \begin{cases} -Δu+λ_1 u=μ_1|u|^{p-2}u+να|u|^{α-2}u|v|^β, x\in \mathbb{R}^N,\\ -Δv+λ_2 v=μ_2|v|^{q-2}v+νβ|v|^{β-2}v|u|^α, x\in \mathbb{R}^N,\\ \int_{\mathbb{R}^N}|u|^2\mathrm{d}x=a, \int_{\mathbb{R}^N}|v|^2\mathrm{d}x=b, \end{cases} N\geq 3, $$ where $μ_1,μ_2, ν, a, b>0$. We are particularly interested in the mass mixed case that $2 1, β>1$, and $α+β=2^*:=\frac{2N}{N-2}$. For sufficiently small $ν>0$, we demonstrate that the above system admits two positive solutions, one of which serves as a local minimizer, and the other as a mountain pass solution. By developing some new technical lemmas on the interaction estimates, we are managed to resolves Soave's open problem [{\it J. Funct. Anal.}, 2020, Remark 1.1] within the context of the system case. Notably, our existence result holds true for all dimensions $N\geq 3$. Our results also significantly extend the result of Gou and Jeanjean [{\it Nonlinearity}, 2018, Theorem 1.1] to the Sobolev critical coupled case and removing the hypothesis ``either $p,q\leq α+β-\frac{2}{N}$ or $|p-q|\leq \frac{2}{N}$" for $N\geq 5$. Additionally, we also establish a sequence of properties for the local minimizer, including local uniqueness, continuity with respect to the small parameter $ν$, and the limiting profiles for $ν\rightarrow 0^+$.

math.AP↗

arXiv2026

CuraLight: Debate-Guided Data Curation for LLM-Centered Traffic Signal Control

Traffic signal control (TSC) is a core component of intelligent transportation systems (ITS), aiming to reduce congestion, emissions, and travel time. Recent approaches based on reinforcement learning (RL) and large language models (LLMs) have improved adaptivity, but still suffer from limited interpretability, insufficient interaction data, and weak generalization to heterogeneous intersections. This paper proposes CuraLight, an LLM-centered framework where an RL agent assists the fine-tuning of an LLM-based traffic signal controller. The RL agent explores traffic environments and generates high-quality interaction trajectories, which are converted into prompt-response pairs for imitation fine-tuning. A multi-LLM ensemble deliberation system further evaluates candidate signal timing actions through structured debate, providing preference-aware supervision signals for training. Experiments conducted in SUMO across heterogeneous real-world networks from Jinan, Hangzhou, and Yizhuang demonstrate that CuraLight consistently outperforms state-of-the-art baselines, reducing average travel time by 5.34 percent, average queue length by 5.14 percent, and average waiting time by 7.02 percent. The results highlight the effectiveness of combining RL-assisted exploration with deliberation-based data curation for scalable and interpretable traffic signal control.

cs.AI↗

arXiv2026

Open-Ended Instruction Realization with LLM-Enabled Multi-Planner Scheduling in Autonomous Vehicles

Most Human-Machine Interaction (HMI) research overlooks the maneuvering needs of passengers in autonomous driving (AD). Natural language offers an intuitive interface, yet translating passenger open-ended instructions into control signals, without sacrificing interpretability and traceability, remains a challenge. This study proposes an instruction-realization framework that leverages a large language model (LLM) to interpret instructions, generates executable scripts that schedule multiple model predictive control (MPC)-based motion planners based on real-time feedback, and converts planned trajectories into control signals. This scheduling-centric design decouples semantic reasoning from vehicle control at different timescales, establishing a transparent, traceable decision-making chain from high-level instructions to low-level actions. Due to the absence of high-fidelity evaluation tools, this study introduces a benchmark for open-ended instruction realization in a closed-loop setting. Comprehensive experiments reveal that the framework significantly improves task-completion rates over instruction-realization baselines, reduces LLM query costs, achieves safety and compliance on par with specialized AD approaches, and exhibits considerable tolerance to LLM inference latency. For more qualitative illustrations and a clearer understanding.

cs.RO↗

arXiv2026

Blowing-up solutions to a critical 4D Neumann system in a competitive regime

We build blowing-up solutions to the critical elliptic system with Neumann boundary condition, \begin{equation*} \begin{cases} -Δu_1 + λu_1 = u_1^{3} -βu_1u_2^2 & \text{in } Ω, -Δu_2 + λu_2 = u_2^{3} -βu_1^2u_2 & \text{in } Ω, \frac{\partial u_1}{\partialν} = \frac{\partial u_2}{\partialν} = 0, & \text{on } \partial Ω, \end{cases} \end{equation*} when $λ>0$ is sufficiently large in a competitive regime (i.e. $ β>0$) and in a domain $Ω\subset\mathbb R^4$ with smooth protrusions.

math.AP↗

arXiv2026

Verify Claimed Text-to-Image Models via Boundary-Aware Prompt Optimization

As Text-to-Image (T2I) generation becomes widespread, third-party platforms increasingly integrate multiple model APIs for convenient image creation. However, false claims of using official models can mislead users and harm model owners' reputations, making model verification essential to confirm whether an API's underlying model matches its claim. Existing methods address this by using verification prompts generated by official model owners, but the generation relies on multiple reference models for optimization, leading to high computational cost and sensitivity to model selection. To address this problem, we propose a reference-free T2I model verification method called Boundary-aware Prompt Optimization (BPO). It directly explores the intrinsic characteristics of the target model. The key insight is that although different T2I models produce similar outputs for normal prompts, their semantic boundaries in the embedding space (transition zones between two concepts such as "corgi" and "bagel") are distinct. Prompts near these boundaries generate unstable outputs (e.g., sometimes a corgi and sometimes a bagel) on the target model but remain stable on other models. By identifying such boundary-adjacent prompts, BPO captures model-specific behaviors that serve as reliable verification cues for distinguishing T2I models. Experiments on five T2I models and four baselines demonstrate that BPO achieves superior verification accuracy.

cs.CV↗

arXiv2026

Knowledge-Guided Adversarial Training for Infrared Object Detection via Thermal Radiation Modeling

In complex environments, infrared object detection exhibits broad applicability and stability across diverse scenarios. However, infrared object detection is vulnerable to both common corruptions and adversarial examples, leading to potential security risks. To improve the robustness of infrared object detection, current methods mostly adopt a data-driven ideology, which only superficially drives the network to fit the training data without specifically considering the unique characteristics of infrared images, resulting in limited robustness. In this paper, we revisit infrared physical knowledge and find that relative thermal radiation relations between different classes can be regarded as a reliable knowledge source under the complex scenarios of adversarial examples and common corruptions. Thus, we theoretically model thermal radiation relations based on the rank order of gray values for different classes, and further quantify the stability of various inter-class thermal radiation relations. Based on the above theoretical framework, we propose Knowledge-Guided Adversarial Training (KGAT) for infrared object detection, in which infrared physical knowledge is embedded into the adversarial training process, and the predicted results are optimized to be consistent with the actual physical laws. Extensive experiments on three infrared datasets and six mainstream infrared object detection models demonstrate that KGAT effectively enhances both clean accuracy and robustness against adversarial attacks and common corruptions.

cs.CV↗