arXiv subjects

Xingyu Zhao

Publications and source records attributed to Xingyu Zhao.

At least 19 recordsLinked to original sources

arXiv2026

Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents

Large Language Model (LLM) agents are vulnerable to adversarial inputs that induce attacker-specified malicious behaviors, commonly referred to as jailbreaking. Existing optimization-based jailbreak attacks primarily employ first-order (FO) methods that leverage gradient information or zeroth-order (ZO) methods that rely on function-value feedback. However, their complementarity and optimization ordering remain underexplored. We systematically investigate four strategies: pure ZO, pure FO, ZO->FO, and FO->ZO, and develop a ZO-FO framework that explores adversarial prefixes through ZO optimization and refines their corresponding suffixes through FO optimization. To coordinate the two processes, we introduce Pair-aware optimization, which retains multiple prefix candidates, conditionally refines their suffixes and selects among the resulting prefix-suffix pairs. We further investigate agent jailbreaking from a more general stochastic-generation perspective, where the same adversarial input can induce diverse reasoning trajectories and actions that a single greedy output cannot capture. Accordingly, we adopt consistent stochastic decoding during both optimization and evaluation. Experiments across malicious-instruction and malicious-environment benchmarks demonstrate that hybrid optimization improves attack effectiveness over single-optimizer methods, while optimization order substantially influences performance.

cs.LG↗

arXiv2026

Bootstrapping Classical and Quantum Query Lower Bounds for Finding Tarski Fixed Points

The Tarski fixed-point problem asks for a fixed point of a monotone map on a $k$-dimensional grid lattice of width $n$ and has applications in game theory, economics, and verification. Substantial gaps remain between the known upper and lower bounds on its quantum query complexity. We prove two hardness bootstrapping theorems for quantum query lower bounds. Starting from a hard instance family whose instances have pair-wise incomparable unique fixed points, and a lower bound established by the nonnegative adversary method, we bootstrap this lower bound by (i) a factor of $Ω(t)$ when the dimension is multiplied by $t$ and the width remains unchanged, and (ii) a factor of $Ω(\log m)$ when the width is multiplied by $m$ and the dimension is doubled. Applying these theorems, we obtain three consequences: (i) an $Ω(k\log^2 n)$ lower bound for $k\geq 4$, improving previously best-known classical and quantum lower bounds; (ii) for every fixed constant $α>0$, there exists a constant $δ(α)>0$ such that $Q_ε(\text{Tarski}(n,k))=Ω(kn^{δ(α)})$ whenever $k>n^α$, and in particular, an $Ω(kn^{0.0072})$ lower bound for $k>n^{2/203}$, the first lower bound with simultaneous linear dependence on the dimension and polynomial dependence on the width; and (iii) a superpolynomial lower bound of $(k/\log k)^{Ω(\log k)}$ for exponentially wide grids, where $n=2^{Θ(k)}$. The last result rules out a route to polynomial-time algorithms for simple stochastic games and ARRIVAL through generic polynomial-query black-box Tarski solvers.

quant-ph↗

arXiv2026

From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents

When the harmfulness of an LLM agent's output can be quantified, a natural jailbreaking objective is to maximize expected harmfulness over admissible input modifications. An alternative approach constructs or selects harmful target outputs and modifies the input to increase their likelihood. We establish a precise connection between these two approaches through a probabilistic reformulation. Specifically, we show that the gradient of the logarithm of expected harmfulness with respect to the input equals the expected input gradient of the model's log-likelihood under a harmfulness reweighted output distribution. This identity provides a unified interpretation of expected harmfulness and target likelihood optimization. Building on this connection, we propose OPUR, a sampling distribution designed to generate highly harmful target outputs and use the resulting samples to guide likelihood-based input optimization. Experiments demonstrate the effectiveness of the resulting method in jailbreaking LLM agents.

cs.AI↗

arXiv2026

Cross-Trait Transfer in Subliminal Learning

Subliminal learning is a phenomenon where a student language model acquires a teacher model's behavioral traits by training on semantically unrelated outputs. It is a subtle statistical phenomenon as trait transmission relies on weak statistical patterns in the generated data. To understand trait transmission between teacher-student pairs, we study cross-trait transfer: how data generated under one teacher trait changes the student's preferences of other traits. To this end, we introduce a directed trait-transfer matrix that quantifies these effects using log-probability gains for student answers. We find that the trait-transfer matrix reveals clusters of related traits, with students sometimes developing preferences for traits similar, but not identical, to the teacher's trait. Such cross-trait structure can be partially captured by output distribution metrics and representation-based metrics. Further, we analyze trait development and interaction: learning dynamics shows a progression from broad shared shifts toward more trait-specific transfer, and multi-trait experiments suggest that opposed traits can enhance such differentiation. Together, our findings reveal salient statistical structures over trait transfer and competition, thus providing a broader view of how hidden preferences are transmitted in subliminal learning.

cs.LG↗

arXiv2026

Let the Carrier Carry the Attack: Preserving the Subject in Adversarial Image Generation

Strong unrestricted adversarial attacks can distort the primary object of an image, hereafter referred to as the subject. To preserve subject integrity without compromising attack magnitude, we introduce the carrier: a secondary visual element that provides an auxiliary region to facilitate the attack under global classifier guidance. We demonstrate three key findings: 1. A carrier mitigates subject distortion by absorbing a larger share of globally normalized attack updates. 2. A carrier improves cross-model transferability, governed by the strength of target-related features that balance semantic separation and transfer performance. 3. Successful targeted attacks retain the personalized subject as the primary content perceived by humans while successfully misleading the classifier. Our results demonstrate that a visually secondary carrier offers an auxiliary spatial pathway for adversarial changes, enabling strong and transferable attacks while improving subject preservation.

cs.CV↗

arXiv2026

Probabilistic Adversarial Training

Building on a probabilistic perspective in which adversarial examples arise from the overlap between a distance-based distribution $p_{\mathrm{dis}}$ and a victim-classifier-induced distribution $p_{\mathrm{vic}}$, we start from a simple intuition: adversarial examples become harder to generate when these two distributions are pushed apart, as their overlap becomes smaller, thereby increasing robustness. This intuition naturally motivates a KL-based robustness objective. We then prove that $\mathrm{KL}(p_{\mathrm{dis}}\|p_{\mathrm{vic}})-\log Z_{\mathrm{vic}}$ is a lower bound on probabilistic robustness (PR), where $Z_{\mathrm{vic}}$ denotes the normalizing constant of $p_{\mathrm{vic}}$. Since PR is generally intractable to compute directly, maximizing this KL-based lower bound provides a tractable surrogate objective for improving PR. We further show that this objective recovers a scaled form of adversarial training, offering a probabilistic interpretation of adversarial training and a principled route to robustness improvement. We call the resulting method probabilistic adversarial training. Experiments show that it consistently improves PR, and ablation studies demonstrate that the induced scaling factor can even enhance the PR of non-probabilistic adversarial training methods.

cs.LG↗

arXiv2026

SubZero+: Memory-Efficient Adaptive Zeroth-Order LLM Fine-Tuning in Random Subspaces

Zeroth-order (ZO) optimization with SGD in random subspaces enables memory-efficient fine-tuning of large language models without backpropagation. However, high gradient estimation noise fundamentally undermines adaptive optimizers like Adam. We propose SubZero+, which achieves practical adaptive ZO optimization through a carefully designed dual low-dimensionality strategy: (i) multi-query forward-difference gradient estimation in periodically refreshed random subspaces to mitigate noise amplification in moment buffers, and (ii) Adam updates with periodic restarts performed directly in low-dimensional space rather than full-parameter space. In experiments, this dual design retains memory overhead comparable to momentum-free ZO methods while achieving stronger optimization performance than the evaluated ZO baselines. Theoretically, in the exact-directional limit, $K$-query averaging preserves conditional unbiasedness, while the coefficient estimator's covariance and mean-squared error, as well as query-induced second-moment inflation, scale exactly as $1/K$. Extensive experiments across SuperGLUE with models from 1.3B to 32B parameters under both full fine-tuning and LoRA schemes demonstrate consistent improvements over competing ZO methods. SubZero+ significantly narrows the performance gap with first-order optimization while preserving ZO's inference-time memory efficiency.

cs.LG↗

arXiv2026

Observability Inequalities and the Logvinenko--Sereda Theorem for the Dunkl Transform

Let $R$ be a normalized root system in $\mathbb{R}^d$ with reflection group $G$, let $k$ be a $G$-invariant multiplicity function, and let $\mathcal{F}_k$ be the associated Dunkl transform. We write $k_α=k(α)>0$ and $\mathrm{d}μ_k(x)=w(x)\,\mathrm{d}x$, where $w(x)=\prod_{α\in R_+}|\langle x,α\rangle|^{2k_α}$. We study observability, Hölder-type interpolation, and spectral inequalities for the Dunkl heat equation on $\mathbb{R}^d$. We establish a Bernstein inequality for ordinary derivatives and a Logvinenko--Sereda theorem with a spectral constant of the form $e^{C(1+N)}$ for functions whose Dunkl transforms are supported in $\overline{B(0,N)}$. We characterize observable sets as the measurable sets that are thick with respect to $μ_k$, and prove the equivalence of the observability, Hölder-type interpolation, and spectral inequalities.

math.AP↗

arXiv2026

Design and characterization of large-size monolithic layers of 3D-segmented plastic scintillator

Three-dimensional fine-grained plastic scintillator detectors are extensively used in high-energy physics experiments where particle tracking, identification, calorimetry and sub-nanosecond timing information are required. Moreover, the low cost of plastic scintillator makes, in principle, the scalability to multi-tonne detectors possible. In order to circumvent the difficulties related to the long production time and the challenging assembly of millions of tiny independent scintillating voxels, a new technology consisting of gluing a few thousand $9 \times 9 \times 9$ mm$^3$ plastic scintillator cubes in a single large monolithic layer with machining precision, while ensuring an efficient optical separation, was developed and demonstrated. In this work we demonstrate that such technology can be reliably extended to a monolithic layer of $48 \times 48$ optically-isolated scintillating cubes, the size required for future ton-scale detectors, fulfilling the requirements of future neutrino detectors and sampling calorimeters.

physics.ins-det↗

arXiv2026

Quantum neural network equipped with backpropagation on a qudit processor

Quantum neural networks (QNNs), one of the fundamental algorithms in quantum machine learning, have been widely used in classification and identification tasks. However, the capabilities of QNNs are constrained by their size, which is determined by the dimension of the Hilbert space of the underlying quantum processor. Multi-level quantum digits (qudits) offer access to a higher-dimensional Hilbert space compared to two-level qubits, enabling the construction of more expressive QNNs. In this work, we report an experimental demonstration of qudit-based QNN using a trapped $\rm ^{40}Ca^+$ ion. We train the QNN using a hybrid quantum-classical implementation of backpropagation and achieve an experimental classification accuracy of $95.7\%$ on a test image set. This demonstration highlights the potential of qudit-based processors to QNN architectures and provides a framework for implementing qudit-based QNNs across various quantum devices.

quant-ph↗

arXiv2026

Quantum Query Complexity of Finding a Tarski Fixed Point on a High-Dimensional Grid

The Knaster-Tarski fixed-point theorem states that every monotone function over a complete lattice has a fixed point. Beyond its fundamental role in order theory, the theorem and its algorithmic variants have found broad applications in areas such as economics, game theory, and programming languages. While the query complexity of finding a Tarski fixed point has been extensively studied in classical models, comparatively little is known in the quantum setting. We prove an $Ω(k\log n)$ quantum query lower bound for finding a fixed point of a monotone function on $[n]^k$, using the nonnegative spectral adversary method. In the two extremal regimes $n = 2$ and $k = 1$, our quantum lower bound matches the previous classical lower bounds $Ω(k)$ and $Ω(\log n)$, respectively. For $n, k\geq 2$, our bound improves the best previous classical lower bound when $n < k$ and is within a factor of $\log n / \log k$ compared to the known classical lower bound when $n \geq k$. To construct the adversary matrix, we develop the Tree--Filtration Adversary Method. Besides yielding our lower bound, the method offers a more transparent combinatorial interpretation of the nonnegative spectral adversary method. When the hard instances of a problem admit a tree-like organization and suggest an intuition analogous to classical decision-tree lower bounds, our method provide a promising approach to establishing quantum complexity lower bounds.

quant-ph↗

arXiv2026

Molecular Insights into Gas Nanofilms Confined Between Bulk Liquid Phases

Nanometer-thick fluid films play a critical role in confined multiphase processes, yet the thermodynamics and stability of free gas nanofilms remain poorly understood compared with their liquid counterparts. Here, molecular dynamics (MD) simulations are employed to systematically investigate gas nanofilms confined between bulk liquid phases using Lennard-Jones argon as a model system. The results show that the surface tension decreases exponentially with decreasing film thickness, accompanied by an increasing magnitude of the negative disjoining pressure. Upon thinning, the planar gas film undergoes a distinct morphological transition from a stable planar state to a transient or persistent spherical bubble through the formation and growth of a liquid bridge. The film surface area strongly affects its thermodynamic properties, with larger areas producing stronger thickness dependence and larger deviations from classical density functional theory (cDFT) predictions. The closer agreement between MD and cDFT at smaller surface areas suggests that the discrepancy primarily arises from thermal capillary-wave fluctuations, which are included in MD but omitted in mean-field cDFT. Moreover, at small film thicknesses, the magnitude of the disjoining pressure increases with decreasing temperature, consistent with the enhanced sensitivity of the confined gas phase to thickness variations and contrasting with the trend generally reported for liquid nanofilms. These findings provide molecular insights into the thermodynamics and stability of gas nanofilms, with implications for confined multiphase transport and droplet coalescence.

physics.chem-ph↗

arXiv2026

Fractal Uncertainty and Quantitative Uniqueness for the Fourier Bessel Transform

We establish quantitative uniqueness and a fractal uncertainty principle for the Fourier Bessel transform. In arbitrary dimension, we prove a quantitative uniqueness estimate on relatively dense sets for functions whose Fourier Bessel transforms decay according to a quasi-analytic weight. In dimension one, if $X\subset[0,1]$ and $Y\subset[a,a+h^{-1}]$ are$δ$-regular on the relevant scales, then, for $a\geq a_0h^{-1}$, \[ \operatorname{supp}\mathcal H_νf\subset Y \quad\Longrightarrow\quad \|\mathbf 1_Xf\|_{L^2_ν} \leq Ch^β\|f\|_{L^2_ν}. \] The lack of translation invariance prevents a direct application of the classical Fourier argument. We overcome this by constructing damping functions adapted to translated regular sets and combining Beurling Malliavin multipliers with large-argument Bessel asymptotics and a Bourgain Dyatlov multiscale iteration.

math.CA↗

arXiv2026

Shattered Compositionality: Counterintuitive Learning Dynamics of Transformers for Arithmetic

Large language models (LLMs) often achieve strong benchmark accuracy yet remain brittle under small distribution shifts. While recent mechanistic studies reveal the discrepancy between LLMs and humans in skill compositions, the learning dynamics of skill acquisition and the role of data distributions remain elusive. In this study, we train transformers on synthetic arithmetic tasks with black-box model-agnostic metrics for analyzing non-human skill compositions. We discover that transformers often acquire skills for arithmetic in reverse order or in parallel instead of human-like sequential rules--a phenomenon we refer to as shattered compositionality. To explain these behaviors, we provide evidence that correlational matching to the training data, rather than causal or procedural composition, shapes learning dynamics. As a consequence, this non-human acquisition creates competition between partially learned skills, producing characteristic mixing errors and weaker robustness under controlled distribution shifts. We further show that the same qualitative behavior persists in modern LLMs and is not mitigated by pure model scaling or scratchpad supervision. Our results highlight a mismatch between training-time skill acquisition and the human-like hierarchical compositions, with implications for reasoning reliability and out-of-distribution robustness.

cs.LG↗

arXiv2026

Reusing Operational Evidence After Context Changes: A Conservative Bayesian Framework for Autonomous Vehicle Safety

Operational evidence, i.e., evidence of operation without failure is an important component of confidence in the safety or reliability of a system in service, but it is costly to collect. When the context of operation changes, the relevance of previously collected operational evidence becomes unclear. This problem arises, for example, when an autonomous vehicle that has operated safely in one operational environment (the Target Operational Domain, TOD) is deployed in a different but related TOD. Existing practice often treats such evidence in an all-or-nothing manner: either it is fully reused, or it is discarded. Neither position is satisfactory when there are good reasons to believe that the new context is no worse than the previous one, but that belief is itself uncertain. This paper studies how to make post-change reliability claims by combining evidence from two TODs using Conservative Bayesian Inference (CBI), which combines the evidence from the new context with a weighted amount of previous context and partial prior knowledge through constraints on a set of admissible priors. This yields conservative posterior bounds on quantities of interest. A numerical example illustrates how pre-existing evidence from a previous TOD can be transferred, conservatively and transparently, to support reliability claims in the changed TOD.

stat.ME↗

arXiv2026

Leveraging System-Level Observations to Inform Bayesian Learning of Model Parameters for Quantitative Verification

Combining Bayesian learning and quantitative verification is a powerful toolset for analysing key quantitative properties of software systems, like reliability and response time. However, the accuracy and robustness of verification results strongly depend on the prior knowledge (PK) underlying Bayesian inference. This knowledge reflects original beliefs about the probability of events and typically depends on domain expertise. Using inaccurate or uninformative PK can negatively affect quantitative analysis, yielding incorrect verification results. Our EPIK approach tackles this important challenge by eliciting and embedding PK in quantitative verification equipped with Bayesian estimators. Unlike existing approaches that require PK on formal model transition parameters, EPIK leverages system-level properties that are directly observable and are linked to real-world semantics. EPIK formulates a twofold optimisation problem to derive the distributions of unknown transition parameters and then embeds these distributions to verify new or difficult-to-measure (elusive) properties. The detailed experimental evaluation using multiple variants of real-world case studies and diverse EPIK instantiations shows its effectiveness, flexibility and generality.

cs.SE↗

arXiv2026

Modeling Memory-Dependent Reliability of LLMs: A Hidden Markov Model

Reliability assessment of large language models (LLMs) seeks to estimate the probability that a model produces correct responses under a specified operational profile. Conventional benchmark-based evaluation, often summarized by aggregate accuracy, provides a point estimate of performance but does not characterize the uncertainty associated with reliability claims. Currently, statistical inference methods for LLM reliability assessment are emerging. However, a key assumption underlying these models is that test outcomes can be treated as independent repeated trials. This assumption may be inappropriate in sequential settings, where later responses depend on earlier interactions through retained context, error propagation, or an evolving interaction state. We extend a hierarchical Bayesian framework for LLM reliability assessment by relaxing the assumption of independent task outcomes and introducing a Hidden Markov Model to capture sequential dependence in benchmark-constructed interaction sessions. In this formulation, outcomes are generated from a latent interaction state evolving according to a first-order Markov process, capturing changes in interaction context. Through experiments using Anthropic Claude and OpenAI on four datasets, we demonstrate the potential impact of sequential dependence on reliability assessment. The results suggest that ignoring sequential dependence may lead to overconfident reliability estimates.

stat.ML↗

arXiv2026

Accounting for Nanofilm Contributions in Interfacial Free Energy Calculations Using Classical Density Functional Theory

Fluid nanofilms play a fundamental role in nanoscale interfacial thermodynamics, yet their treatment in classical density functional theory (cDFT) remains incomplete. We investigate nanofilm interfacial properties using a cDFT framework built upon the perturbed-chain statistical associating fluid theory (PC-SAFT) for both fluid-fluid and fluid-solid interfacial systems. Comparison with molecular simulations shows that the long-standing numerical discrepancies regarding free-standing nanofilms persist in the PC-SAFT functional predictions, supporting the view that they stem from thermal capillary-wave fluctuations rather than deficiencies of the density functional itself, as such fluctuations are inherently neglected in the mean-field approximation adopted by standard cDFT. Importantly, we establish a thermodynamically consistent framework for interfacial free energy (IFE) calculation, which explicitly incorporates nanofilm thermodynamic contributions and redefines the effective fluid volume by excluding the solid-phase region. The proposed method exhibits excellent consistency with another method based on the relationship between IFE and disjoining pressure for fluid systems, while both fluid-fluid and fluid-solid IFEs differ substantially from those predicted by the conventional method. We find that neglecting nanofilm contributions induces prominent size-dependent variations in the IFE and contact angle of hemicylindrical droplets, which is inconsistent with the extensive literature. Different methods also lead to opposite signs of the line tension for a hemispherical argon nanodroplet on a strongly lyophobic surface. The proposed framework provides a unified molecular-level basis for understanding interfacial processes involving nanofilms, including wetting, nucleation, adsorption, and other phenomena that rely on the accurate evaluation of IFEs.

physics.chem-ph↗