Search arXiv⌕ Search

arXiv subjects

Wonjun Lee

Publications and source records attributed to Wonjun Lee.

At least 19 recordsLinked to original sources
arXiv2026

Defending Against Dormant Poisoning Attacks Across Language and Multimodal Agents

Recent work shows that attackers can implant dormant malicious behaviors that remain hidden at release but emerge after benign fine-tuning. As foundation models are used as agents, whether dormant poisoning extends to harmful agent actions and multimodal settings remains unclear. We show two agentic risks: (1) harmful behaviors activated by benign fine-tuning can extend to unseen actions; (2) multiple harmful behaviors can coexist and be jointly activated by benign downstream fine-tuning. Existing defenses often rely on external safe responses, which are hard to obtain for agent actions, or a trusted clean reference model. We exploit a key property of dormant poisoning: the attacker must preserve safe behavior at release to conceal poisoning, and this behavior can serve as a safety reference. Leveraging this property, we automatically construct a Safety Buffer pairing harmful inputs with the released model's responses and benign versions generated by the same model to remove harmful intent. The Safety Buffer can replace external safe responses in existing defenses, but these defenses do not distinguish updates that weaken safety from those that preserve it, often increasing over-refusal or reducing utility. To address this limitation, we introduce LookAhead Defense, which previews benign fine-tuning updates using the Safety Buffer and penalizes only updates predicted to weaken safe behavior on harmful inputs or increase the likelihood of refusals on benign versions in the Safety Buffer. Across language models, language agents, and multimodal agents, LookAhead Defense reduces harmful behavior in agents from up to 93.9% to at most 14.2% and harmful responses in language models from up to 92.5% to at most 2.0% versus vanilla fine-tuning, while maintaining competitive utility and low over-refusal. It remains effective against other poisoning methods.

cs.CR↗
arXiv2026

Wasserstein Bounds for Ambient and Latent Smoothing on Data Manifolds

Smoothing empirical data can fill gaps between observations, while noise in the surrounding space can move mass away from the manifold supporting the data. We derive Wasserstein error bounds for ambient Gaussian smoothing and for smoothing through an encoder--decoder representation. For a compact connected smooth manifold without boundary and a smooth positive target density, established heat-flow and entropy estimates imply that sufficiently small intrinsic heat smoothing improves the squared intrinsic Wasserstein error. Coupling this estimate with ambient noise yields a bound whose quadratic term includes ambient dimension and a curvature correction. Our main latent bound tracks reconstruction error, tangential distortion, and the decoder's response to orthogonal latent noise. Its quadratic surrogate gives bandwidth rules and explicit conditions under which the latent upper-bound surrogate is smaller than the ambient one. These surrogate comparisons do not assert an ordering of the exact Wasserstein errors. Synthetic experiments examine the predicted scaling and latent geometry on spheres and a product of spheres.

math.NA↗
arXiv2026

Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge

LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect and defend against attacks including defenses at decoding stage that leverage models' hidden states. However, existing decoding-stage defenses suffer from two limitations. First, they introduce a trade-off between safety and over-refusal, where strengthening safety degrades the model's helpfulness on benign queries. Second, many of these methods rely on internal hidden states and are thus restricted to specific architectures, incurring substantial overhead and limited generalization across models. To address these limitations, we introduce LADE (Latent Safety Signals for Defense), which leverages latent safety signals extracted by contrasting harmful and benign queries from dark knowledge (i.e., information carried by the output probability distribution beyond its argmax) in the first-token output probability distribution. Our key insight is that, beyond surface-level refusal tokens, the dark knowledge in the first-token distribution contains latent safety signals, defined as tokens whose probabilities differ sharply between harmful and benign queries. We show that these signals consistently align across LLMs, forming a model-agnostic direction that emerges from safety alignment. LADE consists of three components: (1) Extracting Latent Safety Signals from Dark Knowledge, which selects top-k safety-discriminative tokens from the first-token probability distribution; (2) Tokenizer Mapping, which maps these tokens across different tokenizers to enable model-agnostic application; and (3) kNN-based Discrimination, which classifies queries via a k-Nearest Neighbors search over the mapped tokens. Across diverse LLMs and benchmarks, LADE is robust against a wide range of jailbreak attacks and lowers attack success rates while maintaining a competitive safety-utility trade-off.

cs.CR↗
arXiv2026

Understanding Latent Diffusability via Fisher Geometry

Diffusion models often degrade in latent spaces, yet the formal causes remain poorly understood. We quantify latent-space diffusability via the rate of change of the Minimum Mean Squared Error (MMSE) along the diffusion trajectory. Our framework decomposes this MMSE rate into contributions from Fisher Information (FI) and Fisher Information Rate (FIR). We show that isometric embeddings preserve intrinsic FI and establish quantitative intrinsic-FI bounds for a broader class of bi-Lipschitz encoders with controlled weak volume distortion, whereas FIR is governed by the interplay between encoder and data geometries. Our analysis separates four geometric contributions in local stability bounds for Gaussian-smoothed FIR: dimensional compression, tangential distortion, high-frequency encoder curvature, and curvature of data manifold. Experiments across diverse autoencoding architectures provide qualitative support for the geometric mechanisms identified by the theory and show that empirical FI and FIR track several measures of generation quality and latent-space geometry in the settings tested. We establish FI and FIR as a comprehensive analytical framework for understanding latent diffusability.

cs.LG↗
arXiv2026

Sustained growth of quantum circuit complexity in many-body Hamiltonian dynamics

The quantum circuit complexity of an evolving many-body quantum system is believed to exhibit a sustained growth, maintained for timescales much longer than the onset of thermalization. Most previous works have focused on models which violate energy conservation, such as random unitary circuits. Here we study generic, local time-independent Hamiltonian dynamics. We unconditionally prove that for generic local Hamiltonians and typical initial product states at high effective temperature, the robust quantum circuit complexity must grow over a very long period of time, attaining an exponentially large value at late times. Our approach relies on two structural properties that we prove rigorously: (i) generic local Hamiltonians satisfy generalized spectral no-resonance conditions of arbitrary order, and (ii) typical high-temperature product states are effectively supported in exponentially many energy eigenstates. These properties have been widely assumed without proof in prior works. As corollaries of this result, we show the late-time state displays robust volume-law entanglement that is irremovable by polynomial-size circuits, and we establish a no fast-forwarding result for generic local Hamiltonians. We also lower bound the complexity of preparing sufficiently large subsystems with local quantum channels, in contrast with sufficiently small thermalizing regions which we show retain low complexity at late times.

quant-ph↗
arXiv2026

StreamTTO: Efficient Online Test-Time Optimization for Video Depth Completion

Monocular depth foundation models generalize across diverse scenes, but recovering accurate metric depth consistent with a target sensor remains challenging under sensor variation and domain shift. Test-time optimization (TTO) guided by sparse depth addresses this limitation, yet independent per-frame adaptation incurs substantial computational cost. We propose StreamTTO, an online test-time optimization framework for video depth completion that reuses visual features and adaptation state. A frozen feature extractor with causal temporal attention incorporates past visual context into features cached for repeated decoder optimization. Causal Sliding-Window Optimization directly updates a shared depth decoder using cached features and sparse observations from recent frames, requiring only two passes over the window per incoming frame after initialization. Reusing recent observations and the adapted decoder substantially reduces optimization steps. We also introduce MS-Depth, comprising approximately 1.45M synchronized RGB--LiDAR frames from 40 hours of recordings. Its uninterrupted sequences capture transitions among indoor, underground, and outdoor environments under daytime and nighttime conditions, enabling evaluation of adaptation to changes in illumination, scene structure, and depth range. Experiments on KITTI, Bonn, NYUv2 Raw, TUM RGB-D, DDAD, and MS-Depth demonstrate competitive depth completion accuracy. On MS-Depth, StreamTTO achieves average processing speeds of approximately 15~FPS with VGGT and 25~FPS with MoGe-2 at an input resolution of 518 X 392.

cs.CV↗
arXiv2026

How Can Incentives and Cut Layer Selection Influence Data Contribution in Split Federated Learning?

To alleviate the training burden in federated learning while enhancing convergence speed, Split Federated Learning (SFL) has emerged as a promising approach by combining the advantages of federated and split learning. However, despite its advantages, existing SFL studies have largely overlooked the strategic interactions among self-interested participants during the SFL process. In this framework, the SFL model owner can choose the cut layer to balance the training load between the server and clients, ensuring the necessary level of privacy for the clients. Additionally, the SFL model owner sets incentives to encourage client participation in the SFL process. The optimization strategies employed by the SFL model owner influence clients' decisions regarding the amount of data they contribute, taking into account the shared incentives over clients and anticipated energy consumption from both computation and networking during SFL. To address this framework, we model the problem using a hierarchical decision-making approach, formulated as a single-leader multi-follower Stackelberg game. We demonstrate the existence and uniqueness of the Nash equilibrium among clients and analyze the Stackelberg equilibrium by examining the leader's game. Furthermore, we discuss privacy concerns related to differential privacy and the criteria for selecting the minimum required cut layer. Our findings show that the Stackelberg equilibrium solution maximizes the utility for both the clients and the SFL model owner while achieving a well-balanced trade-off between model accuracy and the associated computing and networking overhead during the SFL process.

cs.GT↗
arXiv2026

Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting

Batch prompting is a practical inference strategy for large language models, but its safety implications remain underexplored. We show that the success of batch prompting for utility does not extend to safety: a harmful question that is reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions. We identify this as a distinct safety failure mode -- not reducible to known vulnerabilities such as in-context learning or long-context effects -- and analyze its causes from two complementary perspectives: alignment signal weakening and refusal signal dilution. Across widely used open-source and frontier commercial models, batch prompting consistently achieves high attack success rates as a simple black-box attack. We further show that batch-aware preference optimization effectively mitigates the vulnerability. These findings highlight a blind spot in current safety alignment and point to batch-aware alignment as a necessary step toward robust deployment. Code is available at https://github.com/96kihyun/batch_jailbreak

cs.CR↗
arXiv2026

SubT: Subspace Tuning for Few-shot Generalization of Audio-Language Models

Few-shot parameter-efficient adaptation of pretrained Audio--Language Models (ALMs) often improves seen-class performance at the cost of unseen-class generalization, leading to the base-to-new trade-off. We study this failure through zero-shot drift in the text embedding space: few-shot tuning can distort inter-class structure and move adapted embeddings away from their pretrained anchors. We therefore propose Subspace Tuning (SubT), an embedding-space adaptation method that combines a geometry-aware shared transformation with anchoring to the zero-shot prototypes. The learned transformation is transferred to unseen classes, with subspace-aware gating to mitigate negative transfer. Across 11 audio benchmarks, SubT achieves strong few-shot generalization while operating directly on precomputed text embeddings without text-encoder backpropagation. Code is available at https://github.com/jhyukjang/SubT.

cs.SD↗
arXiv2026

Where Identity Lives: Localized, Retain-Free Identity Unlearning in Multimodal Large Language Models

Removing a specific individual's information from multimodal large language models (MLLMs) is often needed after deployment, but existing methods rely on a retain set, which is hardest to obtain at that point, and rebuilding it recreates the privacy exposure that unlearning aims to remove. Forgetting from the forget set alone instead damages the shared visual-language computation, harming perception. We cast retain-free unlearning as a localization problem: causal tracing, weight transplant, and Fisher overlap all point to early-to-mid decoder MLPs as the layers where identity information is stored and, unlike other module families, can be modified without substantially disrupting vision. We turn this into Pathway-Aware Visual-attribute Anchoring (PAVA), which confines updates to these layers and pairs a forget loss with a visual-attribute anchor that preserves image-grounded behavior by distilling the model's own pre-unlearning answers from the forget images alone. On MLLMU-Bench and ReMem, PAVA gives the strongest forget-retain trade-off among forget-set-only methods and remains competitive with retain-based baselines.

cs.CL↗
arXiv2026

AIM: Anchor Identity Features, Then Match for Multimodal Large Language Model Unlearning

Multimodal large language models (MLLMs) can memorize identity-specific facts about people in their fine-tuning data, creating privacy risks when a person requests deletion. Existing MLLM unlearning methods often assume access to retain images or ground-truth answers during deletion, which is unrealistic in many practical scenarios. We study identity unlearning when retain images are unavailable at deletion time. Our analysis shows that identity and visual-perception questions occupy distinct regions in fine-tuned hidden states and are organized differently: identity questions cluster by person, whereas perception questions cluster by question type. This suggests that identity knowledge can be suppressed without erasing general visual perception. Building on this observation, we propose AIM, a two-stage method that anchors an identity-forgetting target with a universal visual prompt and then matches the vision encoder to that target under a Fisher-based constraint. Extensive experiments show that AIM achieves competitive identity forgetting while preserving non-deleted identities, prior knowledge, and visual perception on the same images.

cs.CV↗
arXiv2026

Geometry-Preserving Encoder/Decoder in Latent Generative Models

Generative modeling aims to generate new data samples that resemble a given dataset. When using diffusion models for this task, one of the main challenges is solving the problem in the input space, which tends to be very high-dimensional. To address this, recent approaches solve diffusion models in the latent space through an encoder that maps from the data space to a lower-dimensional latent space, improving training efficiency and achieving state-of-the-art results. The variational autoencoder (VAE) is the most commonly used encoder/decoder framework in this domain, known for its ability to learn latent representations and generate data samples. In this paper, we introduce a novel encoder/decoder framework with theoretical properties distinct from those of the VAE, specifically designed to preserve the geometric structure of the data distribution. We demonstrate the significant advantages of this geometry-preserving encoder in the training process of both the encoder and decoder. Additionally, we provide theoretical results proving convergence of the training process, including convergence guarantees for encoder training, and results showing faster convergence of decoder training when using the geometry-preserving encoder.

math.NA↗
arXiv2026

Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models

Fine-tuning-as-a-Service (FaaS) enables personalization of large language models (LLMs), but it can weaken safety-alignment under harmful fine-tuning attacks. Recent work has shown that activating harmful-behavior modules during fine-tuning can prevent models from learning undesired behaviors, but its mechanism remains unclear. In this paper, we revisit temporary jailbreaking as a defense against harmful fine-tuning and provide a gradient-level analysis showing that it saturates safety-degrading gradients while preserving benign task-relevant gradients. Based on this insight, we propose a Buffer-and-Reinforce fine-tuning framework that buffers harmful updates during user fine-tuning and reinforces safety after adaptation. Specifically, BufferLoRA induces temporary jailbreaking as a removable adapter to reduce harmful updates during user fine-tuning. After adaptation, ReinforceLoRA, trained to recover refusal behavior under the temporarily jailbroken state, is integrated with UserLoRA via QR decomposition-based merging to reinforce safety while preserving user-task performance. Extensive experiments show that our framework achieves superior safety and utility with no additional safety data during user fine-tuning and minimal computational cost.

cs.AI↗
arXiv2026

Jailbreaking on Text-to-Video Models via Scene Splitting Strategy

Along with the rapid advancement of numerous Text-to-Video (T2V) models, growing concerns have emerged regarding their safety risks. While recent studies have explored vulnerabilities in models like LLMs, VLMs, and Text-to-Image (T2I) models through jailbreak attacks, T2V models remain largely unexplored, leaving a significant safety gap. To address this gap, we introduce SceneSplit, a novel black-box jailbreak method that works by fragmenting a harmful narrative into multiple scenes, each individually benign. This approach manipulates the generative output space, the abstract set of all potential video outputs for a given prompt, using the combination of scenes as a powerful constraint to guide the final outcome. While each scene individually corresponds to a wide and safe space where most outcomes are benign, their sequential combination collectively restricts this space, narrowing it to an unsafe region and significantly increasing the likelihood of generating a harmful video. This core mechanism is further enhanced through iterative scene manipulation, which bypasses the safety filter within this constrained unsafe region. Additionally, a strategy library that reuses successful attack patterns further improves the attack's overall effectiveness and robustness. To validate our method, we evaluate SceneSplit across 11 safety categories from T2VSafetyBench on T2V models. Our results show that it achieves a high average Attack Success Rate (ASR) of 77.2% on Luma Ray2, 84.1% on Hailuo, 78.2% on Veo2, 78.6% on Kling V1.0, and 68.6% on Sora2, significantly outperforming the existing baselines. Through this work, we demonstrate that current T2V safety mechanisms are vulnerable to attacks that exploit narrative structure, providing new insights for understanding and improving the safety of T2V models.

cs.CV↗
arXiv2026

Dynamics Over Landscape: The Emergence of Linear Separability via Spectral Alignment in Contrastive Learning

Contrastive learning effectively clusters data despite a loss landscape filled with poor solutions, a success that is heavily dependent on the choice of data augmentations. How optimization consistently finds meaningful patterns remains an open question. We show this success stems from training dynamics rather than the loss function alone. Crucially, under a highly specific structural assumption governing the connectivity and variance of the data augmentations, we prove that once a critical spectral alignment threshold is reached, data features inevitably and rapidly separate into distinct clusters. We establish this mechanism for both discrete datasets and the macroscopic continuum limit, modeling latent dynamics as a Wasserstein gradient flow to demonstrate that this separation persists as the number of data points approaches infinity. We hypothesize that natural training dynamics inherently drive the system toward this critical state. We extensively validate this empirically across four diverse domains (synthetic shapes, images, text, and PDEs). In every setting, a sharp increase in this spectral quantity consistently precedes clean data separation, revealing that contrastive learning's success is governed by a dynamically emerging trigger tightly coupled to the underlying augmentation structure.

math.NA↗
arXiv2026

Generalizable Prompt Tuning for Audio-Language Models via Semantic Expansion

Prompt tuning has achieved remarkable progress in vision-language models (VLMs) and is recently being adopted for audio-language models (ALMs). However, its generalization ability in ALMs remains largely underexplored. We observe that conventional prompt tuning for ALMs also suffers from the Base-New Tradeoff, and we identify that this issue stems from the disrupted semantic structure of the embedding space. To address this issue, we propose Semantically Expanded Prompt Tuning (SEPT)-a plug-and-play framework that explicitly regularizes the prompt embedding space by incorporating semantic neighbors generated by large language models. SEPT introduces a novel semantic expansion loss with margin constraints that promote intra-class compactness and inter-class separability, thereby enhancing the semantic structure of the prompt embedding space. For comprehensive evaluation, we establish the first benchmark setup for prompt generalization in ALMs, covering both base-to-new generalization and cross-dataset transferability. Extensive experiments demonstrate that SEPT consistently improves generalization performance across multiple prompt tuning baselines, while maintaining computational cost during inference.

cs.SD↗
arXiv2026

Study of Low-Frequency Core-Edge Coupling in a Tokamak: I. Experimental Observation in KSTAR

Double-peaked fishbone events across multiple KSTAR discharges are investigated. The normalized beta $β_{\mathrm{N}}$ and the edge safety factor $q_{\mathrm{95}}$ under which the fishbones appear vary depending on the presence and form of external magnetic perturbations. The fishbone strength is closely related to $β_{\mathrm{N}}$ and $q_{\mathrm{95}}$: as $β_{\mathrm{N}}$ increases and $q_{\mathrm{95}}$ decreases, the fishbone strength increases. Measured fishbone-relevant signals are decomposed into amplitude envelope and phase components in the temporal domain, which are analyzed separately. In terms of the amplitude envelope component, the edge electron temperature fluctuation $\tilde T_\mathrm{e}^{\mathrm{Edge}}$ becomes more correlated with the poloidal magnetic fluctuation $\dot{B}_\mathrmθ$ compared to the core electron temperature fluctuation $\tilde T_\mathrm{e}^{\mathrm{Core}}$ as fishbone strength increases. In terms of the phase component, the phase of $\tilde T_\mathrm{e}^{\mathrm{Edge}}$ precedes the phase of $\tilde T_\mathrm{e}^{\mathrm{Core}}$ except in the case of very weak fishbones where the phase relations are inconclusive due to weak fishbone activity at the edge plasma, which is comparable to background fluctuations. The investigation suggests the possibility that the edge activity is not a mere side effect of the core activity, but could play an active role.

physics.plasm-ph↗
arXiv2026

Study of Low-Frequency Core-Edge Coupling in a Tokamak: II. Spatial Channeling & Focusing In Antenna-Driven MHD

Motivated by evidence for core-edge coupling in the form of double-peaked fishbone-like low-frequency modes ($\lesssim 20\,{\rm kHz}$) in KSTAR, which exhibit synchronized Alfvénic activity both in the central core and near the plasma edge [1], we study the nonlocal response of a tokamak plasma in a visco-resistive full MHD simulation model using the code MEGA. The waves are driven by an internal "antenna" that is localized both radially and azimuthally in the poloidal $(R,z)$ plane and has a sinusoidal form $\exp(inζ- iωt)$ with Fourier mode number $n=\pm 1$ in the toroidal angle $ζ$ and fixed angular frequency $ω$ in time $t$. By flattening the safety factor profile $q(r)$ at suitable locations in the minor radius $r$, we created plateaus in the low-frequency Alfvén continua that act as wave "receivers". First, we confirm that such continuum plateaus respond with a coherent quasi-mode even when the driving antenna is located at a distant radius. Second, by varying the antenna location, we confirm the expectation of inward drive being more efficient than outward drive, which we attribute to volumetric focusing. Third, we find that the central core also responds well at frequencies below the central Alfvénic continuum plateau, which could facilitate chirping. Our results show that a core-localized low-frequency response does not necessarily require core-localized drive nor an exactly matching continuum, but may be driven from the edge and sub-resonantly. It remains to be seen to what extent the examined effects play a role in double-peaked fishbone-like activity. Other possible contributing mechanisms are discussed to motivate further study. Our analyses also elucidate the mode structure formation process, from transients to quasi- or eigenmodes, here in the realm of MHD, and to be followed by a verification study against kinetic models.

physics.plasm-ph↗