arXiv subjects

Dongfang Zhao

Publications and source records attributed to Dongfang Zhao.

At least 19 recordsLinked to original sources

arXiv2026

PixCrypt: Fast Fine-Grained FHE with Range-Aware Caching

Many analytics tasks require secure computation over encrypted data. In particular, fine-grained data such as pixel-level images require higher precision, as every pixel can directly affect outcomes in tasks like tumor segmentation and anomaly detection. While Multi-Party Computation (MPC) is interactive, Differential Privacy (DP) protects only aggregate values, and Partially Homomorphic Encryption (PHE) lacks multiplicative support, none of them can efficiently handle fine-grained data analytics. Fully Homomorphic Encryption (FHE) uniquely enables arbitrary operations on encrypted pixels but remains computationally expensive, posing significant challenges for both software and hardware accelerators. We present PixCrypt, a caching-based acceleration mechanism for fine-grained fully homomorphic encryption. PixCrypt replaces expensive fresh ciphertext generation with cache retrieval and coefficient-level operations across CKKS, BFV, and BGV, while randomized reconstruction ensures that ciphertexts do not repeat. Its linear noise growth reduces the need for bootstrapping and lowers NTT load, improving hardware accelerator efficiency. This design yields up to 35x faster fine-grained encryption and maintains IND-CPA (Indistinguishability under Chosen Plaintext Attack) security. Experiments on five real-world pixel-level image processing tasks show that PixCrypt significantly improves the practicality of FHE for privacy-preserving analytics.

cs.CR↗

arXiv2026

LOCUS: Task-Aware Low-Rank Post-Training for Token-Efficient Language Generation

Large language model serving costs scale directly with output sequence length, yet standard preference alignment often inflates response verbosity without improving utility. We study whether the parameterization of post-training updates affects generation length: low-rank subspaces alter sequence length without modifying the alignment loss. We present LOCUS, a method that selects a task-aware low-rank adaptation subspace to minimize output-token cost subject to a utility constraint. Within this subspace, post-training retains the native preference objective with a frozen backbone. Across Anthropic HH-RLHF dialogue preferences, we evaluate two $\sim$3B decoder backbones, Pythia-2.8B and Qwen2.5-3B, against protocol-matched full-parameter DPO and DrDPO branches and the released SamPO checkpoint. LOCUS reduces continuation length by up to 39.84\% on Pythia-2.8B and by 14.87--17.58\% on Qwen2.5-3B while updating only 0.24--0.28\% of model parameters, with no material change in the internal preference diagnostic.

cs.CL↗

arXiv2026

AdaWidth: Query-Adaptive Embedding Width for Dense Retrieval

High-dimensional embeddings are central to dense retrieval, but not all of these dimensions need to be evaluated at retrieval time. Existing methods reduce dimensions in two ways: truncating the same leading dimensions for every query, or masking a different subset for each query while still storing and accessing the full embedding. Yet queries within a single task differ widely in the number of dimensions they need for their rankings to stabilize. We introduce AdaWidth, which adapts the number of evaluated dimensions to each query within a shared prefix representation. An orthogonal prefix adapter applies a single learned rotation to queries and documents alike, concentrating discriminative signal in leading coordinates while leaving every full width inner product unchanged. A lightweight router then reads order statistics off the ranking a query has already produced, and evaluates more dimensions only for the queries whose top results would change. We further derive a prefix sufficiency analysis showing that the required number of dimensions is set by the competing documents at the retrieval cutoff: it grows logarithmically with corpus size, decreases logarithmically with retrieval depth, and remains heavy-tailed across queries. Across six retrieval tasks and five frozen encoders, AdaWidth matches the NDCG@10 of state-of-the-art dimensionality reduction using 55% to 84% fewer dimensions per query.

cs.IR↗

arXiv2026

Balancing Privacy and Efficiency: Music Information Retrieval via Additive Homomorphic Encryption

Modern music retrieval runs on vector embeddings, and once these embeddings are shared for search or matching they can be copied, probed, or used to train generative models. Fully homomorphic encryption can compute on them but is impractical at scale because of ciphertext--ciphertext multiplication and bootstrapping. We observe that when only one operand is encrypted, the query or the database, similarity search reduces to ciphertext addition and ciphertext--plaintext multiplication, which additive homomorphic encryption supports cheaply (through Paillier, or CKKS restricted to additive operations). Building on this observation, we (i) implement two music-specific inference attacks and quantify the privacy--utility tradeoff of provable mitigations, (ii) introduce structure-aware additive primitives with learned per-block weighting at no extra cryptographic cost, and (iii) show across four audio datasets that additive search preserves nearest-neighbor rankings exactly while avoiding the ciphertext--ciphertext multiplication and bootstrapping of full-depth FHE and scaling far better in embedding dimension than a true-additive Paillier baseline.

cs.DB↗

arXiv2026

DIVE: Embedding Compression via Self-Limiting Gradient Updates

High-dimensional language-model embeddings increase storage and search costs, while supervised compressors can overfit when relevance labels are scarce. We present DIVE (Dimensionality reduction with Implicit View Ensembles), a residual compression adapter codesigned with a self-limiting hinge loss, geometry distillation, and head-wise NT-Xent over implicit coordinate views. The hinge stops updating satisfied ranking constraints, while the dense objectives stabilize the compressed representation; only the first head is retained at inference. Under query-disjoint evaluation with two LLM2Vec backbones, five BEIR benchmarks, 128d and 256d outputs, and six baselines, DIVE is the strongest adapter on all five primary benchmarks. It also outperforms PCA and an autoencoder in comparisons against unsupervised compressors.

cs.CL↗

arXiv2026

SHEAF: Self-profiled Hardness Estimation from Answer-set Flux for Predicting Query Hardness in Graph-based ANN Search

Graph-based approximate nearest neighbor (ANN) search is usually governed by a beam-width parameter that trades recall for throughput and is fixed for the whole workload. Yet, queries may not be equally hard: for example, on the widely used data set SIFT1M, the beam that a query needs to reach 95\% recall varies by more than $32\times$. Therefore, serving each query at its own width would help if the system could tell, cheaply and in advance, how hard it is. The prevailing proxy for this difficulty is called local intrinsic dimensionality (LID); however, LID is static and geometric, which makes it only weakly predict the minimum beam. This paper presents a new measure, namely Self-profiled Hardness Estimation from Answer-set Flux (SHEAF), which represents a query's hardness as how much its own top-$k$ answer set changes between two shallow probe widths. We design a self-profiling estimator that turns this flux into a deployable per-query beam predictor; furthermore, we develop a fixed-probe evaluation protocol that scores each measure over all queries with an observed minimum sufficient beam. On popular ANN indexes such as CAGRA and HNSW across four diverse data sets, SHEAF predicts the per-query beam better than five baseline measures on both GPU and CPU by up to $1.55\times$ in held-out correlation, using only two shallow probe searches and no query-time ground truth.

cs.IR↗

arXiv2026

A Large-Scale Comprehensive Measurement of AI-Generated Code in Real-World Repositories

Large language models (LLMs) are rapidly transforming software engineering by enabling developers to generate code ranging from small snippets to entire projects. As AI-assisted code becomes increasingly integrated into real-world systems, understanding its characteristics and impact is critical. Existing study on AI-generated code is usually limited in the lab setting with synthetic benchmarks and small-scale coding tasks and covers limited metrics. AI-assisted code's manifestation in real-world codebases and its differences between human-written one remain unclear. To close this gap, we perform a first large-scale measurement study of AI-assisted code, in comparison with the human-written, in real-world repositories. We study a comprehensive set of metrics including both code-level aspects (e.g., structural and graph-level complexity, coding style, security quality, etc.) and commit-level characteristics (e.g., commit size, frequency, post-commit stability, etc.). Our results provide new findings and insights: some contrast previous observations in the lab setting (e.g., we conclude that real-world AI-Human differences on code-level metrics are rather small instead of more pronounced), some extend prior results with finer-grained observations (e.g., the variance of security quality across different programming languages), yet more are presented for the first time on aspects not covered before (e.g., code duplication rate, commit size and stability, etc.). Based on these comprehensive real-world results, we also discuss the practical implications of AI-assisted programming.

cs.SE↗

arXiv2026

ETALE: Evolving Topology with Accelerated Lock-free Execution for Dynamic Graph ANN Search on GPUs

Graph-based approximate nearest neighbor (ANN) indexes on the GPU are originally built for static collections and must reconstruct the affected window to absorb any update, while the dynamic graph indexes that update incrementally run on the CPU and cannot exploit GPU parallelism. This paper presents a new ANN index, namely ETALE (Evolving Topology with Accelerated Lock-free Execution), which is among the first GPU-native graph ANN indexes to support streaming insertion and deletion without a global rebuild. The core of ETALE is a lock-free copy-on-write slab graph whose deletion state and adjacency share a single atomically published word, which yields a provable deletion-monotonicity invariant together with a bounded reclaim of GPU memory that is sublinear in accumulated deletions. We have implemented ETALE in CUDA and evaluate it on five diverse multimodal datasets against four state-of-the-art indexes: Tagore (GPU static, SIGMOD'26), DIGRA (CPU dynamic, SIGMOD'26), CAGRA (GPU static, ICDE'24), and HNSW (CPU dynamic, TPAMI'20). Under continuous churn, ETALE maintains the index in hundreds of milliseconds per round at recall above $0.95$, which is $4.8$--$8.8\times$ faster than CAGRA's per-window rebuild, $1.8$--$2.5\times$ faster than the more recent Tagore, and $3.3$--$147\times$ faster than the CPU dynamic indexes. In addition, the memory footprint of ETALE stays bounded where tombstone-only systems grow indefinitely.

cs.DC↗

arXiv2026

Slipstream: Locality-Aware Graph Index Construction for Streaming Approximate Nearest Neighbor Search

Graph indexes are widely used for high-recall approximate nearest neighbor search (ANNS), but many real-time applications require streaming ANNS. In these real-time applications, continuously arriving embeddings must search the existing graph for candidate neighbors before updating graph edges, which makes repeated index construction a bottleneck for streaming ingestion workloads. We propose Slipstream, a new method that significantly reduces the computational cost of frequent insertions in graph indexes for ANNS. The core idea of Slipstream is exploiting the continuity in vector streams: the newly arrived point starts from promising candidates found during the previous insertion rather than searching from the entry point. More technically, Slipstream evaluates distinct subsets of starting candidates followed by an adaptive controller that narrows or widens the range according to the stream's stability. We further show that Slipstream is beyond heuristic: We derive an abstract model to characterize Slipstream's performance and analyze its theoretical bounds. We have implemented Slipstream in two popular open-source libraries (Faiss, HNSWLib) and compared it with four baseline methods on five streaming vector datasets. Experimental results show that Slipstream achieves up to 30.8$\times$ higher end-to-end throughput than baselines while maintaining at least 0.95 recall@10.

cs.IR↗

arXiv2026

Reliable Non-Leveled Homomorphic Encryption for Web Services

With the ubiquitous deployment of web services, ensuring data confidentiality has become a challenging imperative. Fully Homomorphic Encryption (FHE) presents a powerful solution for processing encrypted data; however, its widespread adoption is severely constrained by two fundamental bottlenecks: substantial computational overhead and the absence of a built-in automatic error correction mechanism. These limitations render the deployment of FHE in real-world, complex network environments impractical. To address this dual challenge, this work puts forward a new FHE framework that enhances computational efficiency and integrates an automatic error correction capability through new encoding techniques and an algebraic reliability layer.Our prototype is evaluated through encrypted low-degree activation timing, one experimental public Refresh skeleton invocation, and transport-fault simulations for the Ring--BCH layer. Our current prototype quantifies the cost of encrypted low-degree activation evaluation, the additional latency of an experimental public Refresh skeleton, and the robustness gained from the Ring--BCH transport layer. The Refresh prototype should be interpreted as a skeleton rather than a complete CKKS bootstrapping implementation, since it uses a low-degree surrogate rather than a validated EvalMod circuit. In transport-fault simulations, the BCH interleaver reduces failure rates to below $0.5\%$ under bursty faults and keeps the modeled accuracy within $0.5$ percentage points of the plaintext baseline.

cs.CR↗

arXiv2026

EGA: Adapting Frozen Encoders for Vector Search with Bounded Out-of-Distribution Degradation

Vector search systems built on frozen vision encoders face queries from unseen classes at deployment, yet existing adapter training collapses under this shift: high-capacity adapters with global contrastive losses silently reassign unseen-class samples to wrong seen-class clusters, dropping worst-case Label Precision by over 40 points below the frozen baseline in our tests. We propose Euclidean Geodesic Alignment (EGA), a residual adapter that couples three principles: zero initialization, local triplet loss, and hypersphere projection. These collectively induce a self-limiting dynamic: triplets that already satisfy a small margin stop producing gradients, so the adapter automatically stops updating where the local geometry is already correct. Our experiments show that at convergence $96.5\%$ of triplets are gradient-free, leaving unseen-class regions largely untouched while still enabling full-capacity refinement of seen classes. Across five diverse out-of-distribution (OOD) benchmarks, EGA achieves the highest worst-case Label Precision on the four primary splits and a consistent improvement on the fifth. The design also transfers to stronger backbones in addition to CLIP, and we provide an analytical justification linking gradient sparsity to bounded OOD perturbation.

cs.CV↗

arXiv2026

MCGI: Manifold-Consistent Graph Indexing for Billion-Scale Disk-Resident Vector Search

Graph-based Approximate Nearest Neighbor (ANN) search often suffers from performance degradation in high-dimensional spaces due to the Euclidean-Geodesic mismatch, where greedy routing diverges from the underlying data manifold. To address this challenge, this paper presents Manifold-Consistent Graph Indexing (MCGI), a geometry-aware and disk-resident indexing method that leverages Local Intrinsic Dimensionality (LID) to dynamically adapt search strategies to the intrinsic geometry of data. Unlike conventional algorithms that treat dimensions uniformly, MCGI modulates its beam search budget based on in-situ geometric analysis, which reduces sensitivity to data-specific hyperparameters by replacing a single scalar with a geometry-informed range that remains stable across datasets of varying dimensionality. Theoretical analysis demonstrates that MCGI provides robust approximation by preserving manifold-consistent topological connectivity. Extensive evaluations against five industry-standard baselines across five datasets up to billion scales confirm the advantages of the proposed approach.

cs.IR↗

arXiv2026

Hermes: Efficient Global Homomorphic Aggregation over Mutable Packed Ciphertexts

Fully Homomorphic Encryption (FHE) promises the ability to compute over encrypted data without revealing sensitive contents. However, enabling high-frequency updates and statistical analysis in outsourced databases remains elusive due to the structural mismatch between mutable database records and the cryptographically expensive mutability of FHE ciphertexts. This paper presents Hermes, a prototype system tailored for efficient aggregation queries and dynamic tuple updates on homomorphically encrypted databases. The core design of Hermes is twofold. First, to amortize FHE costs and accelerate unconditional aggregations, Hermes introduces a SIMD-aware packed data model that embeds precomputed aggregate statistics directly into each ciphertext, enabling constant-time global aggregations without expensive Galois automorphisms. Second, to support true in-place mutability, we develop homomorphic algorithms based on polynomial slot masking and shifting, which are provably secure under the standard IND-CPA model. We scope Hermes to unconditional global aggregations to achieve both high performance and in-place updates simultaneously, two properties that prior FHE database systems have not delivered at scale. Hermes is implemented as a suite of C++ loadable functions in MySQL. Extensive evaluations on the TPC-H benchmark and three real-world datasets demonstrate significant performance improvements in query throughput, tuple insertions, and tuple deletions compared to conventional FHE implementations, validating its efficacy for highly dynamic and analytical workloads.

cs.CR↗

arXiv2026

SIVF: GPU-Resident IVF Index for Streaming Vector Search

GPU-accelerated Inverted File (IVF) index is one of the industry standards for large-scale vector search but relies on static VRAM layouts that hinder real-time mutability. Our benchmark and analysis reveal that existing designs of GPU IVF necessitate expensive CPU-GPU data transfers for index updates, causing system latency to spike from milliseconds to seconds in streaming scenarios. We present SIVF, a GPU-native index that enables high-velocity, in-place mutation via a series of new data structures and algorithms, such as conflict-free slab allocation and coalesced search on non-contiguous memory. SIVF has been implemented and integrated into the open-source vector search library, Faiss. Evaluation against baselines with diverse vector datasets demonstrates that SIVF reduces deletion latency by orders of magnitude compared to the state-of-the-arts. Furthermore, distributed experiments on a 12-GPU cluster demonstrate that SIVF exhibits near perfect linear scalability, achieving an aggregate ingestion throughput of 4.07 million vectors/s and a deletion throughput of 108.5 million vectors/s.

cs.DB↗

arXiv2026

DSBA: Dynamic Stealthy Backdoor Attack with Collaborative Optimization in Self-Supervised Learning

Self-Supervised Learning (SSL) has emerged as a significant paradigm in representation learning thanks to its ability to learn without extensive labeled data, its strong generalization capabilities, and its potential for privacy preservation. However, recent research reveals that SSL models are also vulnerable to backdoor attacks. Existing backdoor attack methods in the SSL context commonly suffer from issues such as high detectability of triggers, feature entanglement, and pronounced out-of-distribution properties in poisoned samples, all of which compromises attack effectiveness and stealthiness. To that, we propose a Dynamic Stealthy Backdoor Attack (DSBA) backed by a new technique we term Collaborative Optimization. This method decouples the attack process into two collaborative optimization layers: the outer-layer optimization trains a backdoor encoder responsible for global feature space remodeling, aiming to achieve precise backdoor implantation while preserving core functionality; meanwhile, the inner-layer optimization employs a dynamically optimized generator to adaptively produce optimally concealed triggers for individual samples, achieving coordinated concealment across feature space and visual space. We also introduce multiple loss functions to dynamically balance attack performance and stealthiness, in which we employ an adaptive weight scheduling mechanism to enhance training stability. Extensive experiments on various mainstream SSL algorithms and five public datasets demonstrate that: (i) DSBA significantly enhances Attack Success Rate (ASR) and stealthiness while maintaining downstream task accuracy; and (ii) DSBA exhibits superior robustness against existing mainstream defense methods.

cs.CR↗

arXiv2026

BadRSSD: Backdoor Attacks on Regularized Self-Supervised Diffusion Models

Self-supervised diffusion models learn high-quality visual representations via latent space denoising. However, their representation layer poses a distinct threat: unlike traditional attacks targeting generative outputs, its unconstrained latent semantic space allows for stealthy backdoors, permitting malicious control upon triggering. In this paper, we propose BadRSSD, the first backdoor attack targeting the representation layer of self-supervised diffusion models. Specifically, it hijacks the semantic representations of poisoned samples with triggers in Principal Component Analysis (PCA) space toward those of a target image, then controls the denoising trajectory during diffusion by applying coordinated constraints across latent, pixel, and feature distribution spaces to steer the model toward generating the specified target. Additionally, we integrate representation dispersion regularization into the constraint framework to maintain feature space uniformity, significantly enhancing attack stealth. This approach preserves normal model functionality (high utility) while achieving precise target generation upon trigger activation (high specificity). Experiments on multiple benchmark datasets demonstrate that BadRSSD substantially outperforms existing attacks in both FID and MSE metrics, reliably establishing backdoors across different architectures and configurations, and effectively resisting state-of-the-art backdoor defenses.

cs.CR↗

arXiv2026

ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning

Federated Self-Supervised Learning (FSSL) integrates the privacy advantages of distributed training with the capability of self-supervised learning to leverage unlabeled data, showing strong potential across applications. However, recent studies have shown that FSSL is also vulnerable to backdoor attacks. Existing attacks are limited by their trigger design, which typically employs a global, uniform trigger that is easily detected, gets diluted during aggregation, and lacks robustness in heterogeneous client environments. To address these challenges, we propose the Attention-Driven multi-party Collusion Attack (ADCA). During local pre-training, malicious clients decompose the global trigger to find optimal local patterns. Subsequently, these malicious clients collude to form a malicious coalition and establish a collaborative optimization mechanism within it. In this mechanism, each submits its model updates, and an attention mechanism dynamically aggregates them to explore the best cooperative strategy. The resulting aggregated parameters serve as the initial state for the next round of training within the coalition, thereby effectively mitigating the dilution of backdoor information by benign updates. Experiments on multiple FSSL scenarios and four datasets show that ADCA significantly outperforms existing methods in Attack Success Rate (ASR) and persistence, proving its effectiveness and robustness.

cs.CR↗

arXiv2026

HPE: Hallucinated Positive Entanglement for Backdoor Attacks in Federated Self-Supervised Learning

Federated self-supervised learning (FSSL) enables collaborative training of self-supervised representation models without sharing raw unlabeled data. While it serves as a crucial paradigm for privacy-preserving learning, its security remains vulnerable to backdoor attacks, where malicious clients manipulate local training to inject targeted backdoors. Existing FSSL attack methods, however, often suffer from low utilization of poisoned samples, limited transferability, and weak persistence. To address these limitations, we propose a new backdoor attack method for FSSL, namely Hallucinated Positive Entanglement (HPE). HPE first employs hallucination-based augmentation using synthetic positive samples to enhance the encoder's embedding of backdoor features. It then introduces feature entanglement to enforce tight binding between triggers and backdoor samples in the representation space. Finally, selective parameter poisoning and proximity-aware updates constrain the poisoned model within the vicinity of the global model, enhancing its stability and persistence. Experimental results on several FSSL scenarios and datasets show that HPE significantly outperforms existing backdoor attack methods in performance and exhibits strong robustness under various defense mechanisms.

cs.CR↗