arXiv subjects

Hongwei Li

Publications and source records attributed to Hongwei Li.

At least 19 recordsLinked to original sources

arXiv2026

Quantum identity authentication protocol via perturbed probability amplitudes

Quantum identity authentication is an effective solution for establishing mutual trust between communicating parties in the post-quantum era. To address the risk of partial secret information leakage under special measurements, this paper designs a quantum identity authentication protocol based on perturbed probability amplitudes. The protocol first proposes a method of encoding a random sequence onto the probability amplitudes of quantum entangled states, forming perturbed probability amplitudes, thereby reducing the involvement of shared information between the sender and receiver. Furthermore, it presents a method for generating n-bit random authentication information based on the n-bit pre-shared information, enhancing the randomness of the authentication information relative to an attacker. The proposed protocol can resist impersonation attack, CNOT attack, and entanglement measurement attack, and ensures backward security. Under equivalent security conditions, the amount of shared information is 1/n that in Chen et al.'s scheme and half that in Dutta et al.'s scheme. And each bit of the secret message has no risk of leakage under special measurements. It can also be extended to a bi-directional quantum identity authentication protocol.

quant-ph↗

arXiv2026

Beyond Sensitive APIs: Detecting Access Control Flaws at Sensitive Callsites in Android Firmware

Existing studies of vulnerable pre-installed Android apps identify dangerous behavior by checking whether an app invokes an API from a predefined set of security-sensitive APIs. These sets usually exclude generic APIs to avoid false positives; unfortunately, this misses a class of vulnerabilities in which a generic API, such as a database read, appears benign in general but becomes security-sensitive when operating on protected data, yet is left without sufficient access control. While this class of vulnerabilities appears addressable via access control analysis, existing studies focus only on the presence of checks, not on whether those checks enforce sufficient protection for the operation at a given callsite. In this work, we propose Callix, which first assesses callsite sensitivity by jointly analyzing the invoked API functionality and the data involved in the operation, then recovers each security check on the execution path as an explicit security property, and finally introduces the notion of restriction context to decide whether these checks are sufficient for the identified sensitive operation. We evaluated Callix on 1,750 distinct pre-installed apps from the 10 top-tier Android vendors as of 2025. In total, Callix discovered 819 vulnerable paths across these vendors, 42.1% of which allow reading or modifying private user data through generic database operations. Manual validation of a random 60% sample shows a precision of 95.1%. Many of our findings have been confirmed and rewarded through vendor bug bounty programs.

cs.CR↗

arXiv2026

Evaluating Generalization and Long-Term Stability of Smartwatch-Based Cuffless Blood Pressure Monitoring

Smartwatch-based cuffless blood pressure (BP) monitoring is a promising low-burden solution for long-term cardiovascular management, but practical deployment remains constrained by model complexity, uncertain cross-dataset generalization, and insufficient evidence on long-term tracking stability. This study presents an efficient Signal-Context Gated Fusion Network (SCGBPNet) for cuffless BP estimation from photoplethysmography (PPG) signals. SCGBPNet integrates signal-level representations through self-attention and further incorporates subject-specific contextual information via a compact gated fusion module. On Aurora-BP, SCGBPNet achieved SBP/DBP mean absolute errors (MAEs) of 7.08/4.90 mmHg, compared with 6.44/4.89 mmHg under within-dataset validation on the private smartwatch dataset, indicating a modest within-dataset discrepancy. Cross-dataset transfer from Aurora-BP to the smartwatch dataset increased the MAEs to 8.98/6.47 mmHg, demonstrating substantial cross-dataset degradation. For long-term stability, the proposed method showed low week-to-week performance variation and a low daily decay rate, indicating good stability over a follow-up period of more than one month. Nevertheless, estimation accuracy deteriorated when BP deviated substantially from an individual's baseline. These findings indicate that favorable aggregate MAE alone should not be interpreted as evidence of deployment-ready performance. More systematic and stratified evaluation across dataset settings, BP ranges, and baseline-deviation levels is needed to assess the practical reliability of smartwatch-based cuffless BP monitoring.

eess.SP↗

arXiv2026

CyberArena: Benchmarking AI Agents in Live Symmetric Attack-and-Defense Combat

AI agents are demonstrating increasingly strong offensive and defensive cybersecurity capabilities in the real world. Current benchmarks mostly evaluate agents in isolation against static targets. Real cyber operations, however, are dynamic and coupled: security postures constantly change as attackers and defenders adapt to each other in real time. Static benchmarks quickly saturate and miss an agent's ability to attack and defend simultaneously under live pressure. To address this gap, we present CyberArena, a dynamic, symmetric adversarial benchmark built around multi-round attack-and-defense combat. In isolated sandboxes, two agents compete under identical rules, acting concurrently as both attackers and defenders over continuously changing services. This converts static targets into evolving, semi-open challenges, directly testing an agent's speed and precision in discovering, exploiting, and patching vulnerabilities. To sustain the benchmark's longevity, an automated agentic pipeline continuously generates, reviews, and validates new environments. Furthermore, because pairwise contests are notoriously hard to quantify, we introduce a dynamical model that maps match dynamics into unified, multidimensional scores across offensive, defensive, and domain-specific capabilities. Evaluating 12 frontier LLM agents across 40 challenges in 466 matches, CyberArena separates model capabilities where single-agent baselines hit a ceiling. The trajectories read like a fight rather than an exam: defenders patch one hole and miss the next and certify repairs on stale evidence, while capable agents think a move ahead, planting backdoors for later rounds and, in one case, writing their own packet sniffer to watch the opponent. Beyond a benchmark, CyberArena serves as an adaptable, scalable experimental platform for future research on cybersecurity agents.

cs.CR↗

arXiv2026

Improving Large Language Models for Code through Runtime Program-State Reasoning

Large language models receive limited explicit training in reasoning about runtime program states. We study whether training models to reason about runtime program states improves downstream software-engineering capabilities. We introduce two complementary program-state reasoning tasks. Buggy input-output reasoning requires a model to generate a concrete input that exposes a behavioral difference between a buggy program and a hidden correct implementation and to predict the resulting execution behavior. Precondition-postcondition reasoning requires an agent to symbolically characterize a bug-triggering precondition, predict the expected postcondition, explain their causal connection, and instantiate this reasoning as an executable regression test. By incorporating these two tasks into a staged post-training pipeline, we develop Comet-9B, a 9B language model based on Qwen3.5-9B Base. We evaluate the resulting checkpoints on repository-level patch generation, regression-test generation, and security PoC generation. Adding both program-state reasoning tasks to supervised fine-tuning (SFT) on issue resolution improves success rates by 7.25 percentage points on SWE-bench Pro and 9.70 points on SWT-Bench Verified. Sequential reinforcement learning on the two tasks yields further gains of 7.25, 26.79, and 4.67 percentage points on SWE-bench Pro, SWT-Bench Verified, and CyberGym, respectively. Despite having only 9B parameters, Comet-9B achieves a score comparable to the reported GPT-5.2 result on SWE-bench Pro and matches the reported success rate of a GPT-4o-based agent on SWT-Bench Verified.

cs.AI↗

arXiv2026

FragToken: Amplifying LLM Inference Costs through Noncanonical Token Generation

As large language model (LLM) inference becomes increasingly expensive, resource-consumption attacks pose a growing threat to model providers. Existing attacks typically amplify cost by inducing abnormally long or repetitive outputs on attacker-controlled or triggered requests, making them easier to detect and limiting their deployment-wide impact when benign traffic dominates. In this work, we uncover a previously overlooked token-level attack surface arising from the many-to-one mapping from token sequences to decoded text. Although standard LLMs predominantly generate the canonical token sequences induced by their tokenizers, the same text can also be represented by substantially longer non-canonical sequences. This representational flexibility exposes a new avenue for resource-consumption attacks: an attacker can train the model to favor such sequences, systematically increasing the number of autoregressive decoding steps without a proportional increase in visible response length. However, we empirically find that directly maximizing token fragmentation substantially degrades model utility, producing conspicuous answer-quality failures that undermine attack stealthiness. To address this challenge, we propose FragToken, a training-time framework that combines source-model self-distillation, capacity-aware filtering and budgeting, and BPE-Aligned Merging to induce fragmented generation under ordinary prompts while largely preserving model utility. We evaluate FragToken on four LLMs across three benchmarks. Across the four models, FragToken achieves a three-benchmark average token inflation ratio (TIR) ranging from 1.99 to 2.46, while causing only minor degradation in model utility. Our work reveals a covert LLM supply-chain threat that increases inference cost without requiring large volumes of attack requests while largely preserving utility.

cs.CR↗

arXiv2026

CounterPersona: Append-Only Defense Against Unauthorized Persona Skill Distillation

Persona skill distillation can extract recurring patterns from personal information and encode them into reusable skills, enabling AI systems to closely replicate an individual's behavior. However, such replication also raises serious concerns regarding personal privacy and labor autonomy. Unlike existing perturbation-based defenses that require individuals to modify their data before collection, once historical records are collected by an attacker, they can no longer be altered, sanitized, or revoked. Therefore, such defenses are difficult to adapt to this append-only setting. To solve this challenge, we introduce CounterPersona, which constructs targeted counter-persona evidence, packs compatible behavioral states into compact realization units, and strengthens them through rationale-guided consistency rewriting. We conduct extensive experiments showing that CounterPersona achieves strong and consistent effectiveness across lexical, semantic, and LLM-based measures, while remaining robust across distillers. Our work establishes a skill anti-distillation paradigm for protecting personal privacy and labor autonomy against unauthorized skill distillation.

cs.CR↗

arXiv2026

RAPID: A Real-Time Defense Against Unauthorized Model Distillation for Text-to-Image Services

Diffusion-based text-to-image (T2I) models are increasingly used for visual content creation, making their generation capability a valuable intellectual property asset. However, this capability is vulnerable to black-box output-based distillation, where an adversary queries the service, collects prompt-image pairs, and trains an unauthorized substitute model that mimics its generation behavior. Existing perturbation-based defenses apply sample-wise optimization to make generated images disruptive to unauthorized training, but introduce substantial computation and latency that reduce the usability of online T2I services. A natural solution is to integrate defensive perturbations into the VAE decoder, allowing the protected model to generate defended images directly without online sample-wise optimization. However, existing sample-wise objectives struggle to transfer to the shared decoder setting. We empirically find that a defensive shared decoder induces a substantially smaller latent shift than sample-wise optimization, suggesting that objective reachability matters more than destructiveness in this setting. To overcome this limitation, we propose RAPID, a self-referenced latent maximization framework that removes external dependencies and encourages the same model update to induce consistently disruptive effects across training samples, thereby improving reachability. We further introduce reconstruction-guided color regularization that blocks the latent shortcut and reinforces visual disruption. Extensive experiments on four T2I models and four datasets, with comparisons against five representative baselines, show that RAPID consistently degrades substitute-model generation quality while preserving service visual fidelity. Our work establishes a paradigm for real-time protection against unauthorized distillation in deployed T2I systems.

cs.CR↗

arXiv2026

Machine-learning-enabled characterization of individual ring resonators in integrated photonic lattices

Accurately determining the underlying physical parameters of individual elements in integrated photonics is increasingly difficult as device architectures become more complex. Inferring these parameters directly from spectral measurements of the system as a whole provides a practical alternative to traditional calibration, allowing characterization of photonic systems without relying on detailed device-specific models. Here, we introduce a supervised machine-learning strategy to learn the onsite losses and resonant frequency shifts of each individual ring in an array of coupled ring resonators from measured spectral power distributions of the whole array. The neural network infers these parameters with high accuracy across multiple experimental configurations. Our methodology provides a scalable and non-invasive method for extracting intrinsic parameters in coupled photonic platforms, paving the way for future development of automated calibration and control methods.

physics.optics↗

arXiv2026

Topology and criticality in non-Hermitian multimodal optical resonators through engineered losses

Non-Hermitian topological matter provides a platform for engineering phenomena that go beyond the capabilities of Hermitian systems, enabling the use of losses to engineer topological phenomena. Non-Hermitian models often rely on artificial platforms made of engineered lattices because controlling losses in natural compounds is challenging. Although typical models for non-Hermitian photonic matter are often single mode, photonic systems are often multimodal, producing mixing between different normal modes in each site. In this work, we explore a generalized family of multimodal non-Hermitian lattices, featuring multiple resonant modes. We show that these multimodal models are capable of featuring topological modes and criticality, similar to the artificial single-mode models often considered. We analyze the robustness of these non-Hermitian topological modes to fluctuation of local losses, disorder, and artificial gauge field. We show that these effects can be captured via both a full microscopic model and effective multiorbital models. Specifically, we show that due to their multiorbital nature, the localization properties of non-Hermitian multiorbital models can be controlled by an external gauge field. Our results demonstrate that internal orbital degrees of freedom provide a promising strategy to engineer controllable non-Hermitian topology and criticality.

physics.optics↗

arXiv2026

Towards Scalable Fuzzy PSI via Efficient Fuzzy Matching

In this paper, we present scalable fuzzy PSI protocols for general $L_{p \in [1, \infty]}$ distance, supporting both low- and high-dimensional sets. The core technique is two efficient fuzzy matching protocols. The first is built from a role-reversed oblivious PRF (OPRF) and realizes $O(d\log δ)$ overhead, compared to $O((\log δ)^d)$ in previous works. The second leverages customized oblivious transfer (OT) with $O(d\ell)$ overhead, where $\ell$ is the bit length of inputs, which is particularly suitable for short inputs. With these new techniques, we further propose a new dual-layer hashing framework for fuzzy PSI over low-dimensional sets, instantiated with our OT-based fuzzy matching and enhanced with a domain reduction optimization. The protocols achieve an overhead linear with $n, m, \log δ, 2^d$, without the $O((\log δ)^d)$ or $O(δ)$ factors present in prior works. {For high-dimensional sets, we construct fuzzy PSI protocols based on our OPRF- and OT-based fuzzy matching, which achieve an asymptotic overhead linear with $n, m, d$, and $\log δ$ but rely on the strong globally disjoint assumption.} Extensive evaluations demonstrate that our protocols achieve up to a $145\times$ speedup in running time and a $20\times$ reduction in communication cost compared to van Baarsen and Pu~(ASIACRYPT'25), and achieve up to a $25\times$ speedup in running time and up to a $17\times$ reduction in communication cost compared to Piske et al.~(CCS'25).

cs.CR↗

arXiv2026

Trigger the Straggler: Load Hijack on Mixture-of-Experts LLMs

Expert parallelism (EP) is a common strategy for serving large Mixture-of-Experts (MoE) models across multiple GPUs by distributing experts among devices. Router decisions then determine both which experts process each token and which GPUs execute the resulting work. This procedure exposes a supply-chain attack surface in the serving schedule. We introduce Load Hijack, in which a malicious model provider modifies only a checkpoint's router weights, distributes the poisoned checkpoint, and retains a private trigger. When the trigger appears, the poisoned router concentrates token-to-expert assignments on experts co-located on one GPU. The resulting load makes that GPU a straggler and forces peer devices to wait, while routing on ordinary inputs remains near the clean reference. We find this conditional behavior difficult to achieve because an objective that rewards target-expert use on triggered inputs can also bias ordinary-input routing toward the same experts. To resolve this conflict, Load Hijack employs a three-stage optimization procedure that produces strong trigger-dependent concentration while keeping ordinary-input routing close to the clean reference. Across three MoE families and four corpora, Load Hijack directs 92.3% to 95.6% of triggered token assignments to the target experts. In live EP serving, triggered traffic produces 1.43x the time-to-first-token and 0.86x the throughput measured under ordinary traffic. These results show that poisoned routers can act as trigger-controlled device schedulers and motivate checkpoint audits of routing and runtime load.

cs.CR↗

arXiv2026

EvoTrustRAG: Evolution-Aware Conflict Attribution and Evidence Handling for Reliable Retrieval-Augmented Generation

Retrieval-Augmented Generation (RAG) improves the factuality of large language models with external knowledge, yet conflicting evidence remains a fundamental challenge in dynamic and adversarial environments. Existing approaches often treat conflicts as static inconsistencies and select more reliable knowledge, overlooking that the same conflict may arise from legitimate knowledge evolution, malicious manipulation, or unresolved uncertainty. We formulate conflict origin attribution as a new problem in RAG: identifying which explanation of conflicting evidence is supported by observable context rather than simply which fact should be trusted. We propose EvoTrustRAG, a training-free framework for evolution-aware conflict attribution and evidence handling before answer generation. EvoTrustRAG represents span-grounded retrieved facts as a conflict evidence graph, evaluates grounded evolution and directional intervention hypotheses using temporal relations, support structure, and auxiliary consistency, and projects local decisions onto a globally consistent explanation of each conflict group. The attribution determines whether earlier and later states are preserved as temporal knowledge, an intervention candidate is separated from the primary context, or an unresolved conflict remains visible to the generator. Unlike provenance-based approaches focused on post-hoc analysis, EvoTrustRAG determines during inference whether conflicting evidence follows plausible knowledge evolution, exhibits intervention-like support, or cannot be reliably attributed. Experiments show that EvoTrustRAG achieves 81.4% average accuracy on benchmark-native conflict settings, improves attribution macro-F1 from 72.2% to 79.1% over the strongest baseline, and reduces the error rate under the strongest coordinated attack from 31.2% to 16.0%.

cs.CR↗

arXiv2026

InkShield: Writing Style Protection Against Unauthorized Handwriting Mimicry

Recent handwritten text generators can reproduce a writer's style from publicly available references, posing risks of document forgery and identity misuse. An attacker may use a publicly available handwritten note or signature sample to generate forged recommendation letters or authorization forms, leading to document fraud, identity misuse, and misleading decisions. However, existing protections against unauthorized image editing or synthesis transfer poorly to handwriting style mimicry. Designed for natural images with complex backgrounds, they often optimize perturbations over the whole image. For sparse handwriting images, such global perturbations become conspicuous in blank background regions and largely degrade the visual quality. In this work, we propose InkShield, a proactive writing-style defense that protects reference images before release. InkShield selects a decoy writer to define a style-displacement direction, optimizes perturbations with a frozen handwriting-generation surrogate, and confines them to ink-stroke edges to avoid conspicuous background artifacts. On IAM, the average Top-1/Top-5 rates at which generated samples are retrieved as the target writer by two independent writer evaluators decrease from 11.94%/36.52% to 2.03%/8.79%. Meanwhile, the protected references remain visually close to the originals (LPIPS 0.0078), and the generated text remains readable. InkShield also exhibits transferability to other handwriting generators. Overall, InkShield provides practical protection against unauthorized handwriting style mimicry.

cs.CR↗

arXiv2026

Compact Representation of Mipmapped SVBRDFs via Shared Gaussians

Spatially-varying BRDFs (SVBRDFs) are central to material representation in computer graphics, but their high-resolution, multi-channel, mipmapped textures impose a substantial storage burden. Existing compression methods face a fundamental trade-off: block-based compression provides random access and hardware-friendly decoding but exploits redundancy only within local blocks; image codecs offer strong rate-distortion performance but are not designed for direct real-time texture access; and neural texture compression achieves high compression ratios but requires neural inference during decoding, which introduces additional runtime overhead, especially on mobile platforms. We present Gaussian Texture Compression (GTC), a compact 2D Gaussian-based representation for mipmapped SVBRDF texture stacks that delivers high-quality compression with flexible rate-distortion trade-offs. Our method is based on a key observation that there are two dominant sources of redundancy in such data: across mip levels and across material maps. Both share a common underlying structure: the same spatial support is reused, with only level- or map-specific information attached. This property naturally suits 2D Gaussians, since each Gaussian explicitly separates its spatial footprint from the values it carries, allowing the footprint to be shared while the values vary per level and per map. Building on this property, GTC shares Gaussians along both redundancy dimensions and is trained via a progressive optimization pipeline. Experiments show that GTC achieves higher reconstruction quality and lower memory usage than ASTC, the industry-standard GPU texture compression format, while supporting random-access, non-neural decoding suitable for real-time rendering.

cs.GR↗

arXiv2026

Large Language Models for Fault Localization: An Empirical Study

Large Language Models (LLMs) have demonstrated strong performance on code-related tasks, particularly in automated program repair. However, repair effectiveness often depends on accurate upstream fault localization, while the statement-level fault localization capability of LLMs remains insufficiently evaluated. This paper presents a systematic empirical study of LLMs for statement-level fault localization. We evaluate four representative LLMs, including two open-weight models, Qwen2.5-Coder-32B-Instruct and DeepSeek-V3, and two closed-source models, GPT-4.1 mini and Gemini-2.5-Flash, on HumanEval-Java and Defects4J. The evaluation covers different input contexts and prompt strategies, including Zero-shot, Few-shot, and Chain-of-Thought prompting. We further assess model performance from three complementary perspectives: Exact Match, Partial Match, and output consistency, and compare LLMs with representative non-LLM baselines, including PMD and LineDef, under the same source-code-only input setting. In addition, we analyze practical efficiency and cost in terms of end-to-end response time and token-based API cost. The results show that bug report context improves observed fault localization performance on Defects4J; Few-shot prompting improves performance in some cases but does not yield consistent gains; and Chain-of-Thought prompting shows mixed effects across models. Overall, this study reveals the strengths, limitations, and practical trade-offs of LLMs in statement-level fault localization, providing empirical evidence for model selection and application in software engineering practice.

cs.SE↗

arXiv2026

Realizing Scaling Laws in Recommender Systems: A Foundation-Expert Paradigm for Hyperscale Model Deployment

Scaling laws have been established for recommender systems, yet efficiently deploying foundation model (FM) across multiple recommendation surfaces remains a major unsolved challenge. Existing methods for transfer learning face fundamental limitations in this setting: knowledge distillation suffers from transfer fidelity degradation in the large-data regime, and static user or item embeddings lack the expressiveness to capture contextualized user-item interactions. We propose the Foundation-Expert paradigm, where a central FM generates target-aware embeddings which are ingested by lightweight surface-specific expert models. Target-aware embeddings are representations that dynamically capture a user's interest in a specific item conditioned on their full interaction history. Unlike knowledge distillation, which transfers FM knowledge as soft labels, our approach provides these embeddings as input features to each expert model, enabling direct interaction with surface-specific representations. This paradigm achieves transfer ratios of 0.64--1.0 from FM to experts, substantially exceeding existing methods. Fully deployed at Meta serving tens of billions of daily requests since 2025, it delivers 0.050% statistically significant online topline metric improvement and 0.359% cumulative gains across multiple surfaces.

cs.IR↗

arXiv2026

OnePath: Efficient and Privacy-Preserving Decision Tree Inference in the Cloud

The vast storage capacity and computational power of cloud servers have led to the widespread outsourcing of machine learning inference services. While offering significant operational benefits, this practice also introduces privacy risks, such as the exposure of proprietary models and sensitive user data. In this paper, we present OnePath, a framework for secure and efficient decision tree inference in cloud environments. Unlike existing methods that traverse all internal nodes of a decision tree, our traversal protocol processes only the nodes on the prediction path, significantly improving inference efficiency while preserving privacy. To further optimize privacy and performance, OnePath is the first to employ functional encryption for evaluating decision tree nodes. Notably, our protocol enables both model providers and users to remain offline during the inference phase, offering a crucial advantage for practical deployment. We provide formal security analysis to demonstrate that OnePath provides comprehensive privacy protections during the model inference process. Extensive experimental results show that our approach processes query data in microseconds, highlighting its efficiency. OnePath offers a practical solution that strikes a balance between security and performance, making it a promising option for a wide range of cloud-based decision tree inference applications.

cs.CR↗