arXiv Science⌕ Search

arXiv subjects

Ning Zhang

Publications and source records attributed to Ning Zhang.

At least 19 recordsLinked to original sources
arXiv2026

Graph-diameter criteria and sharp dissipation in discrete Wasserstein-Fisher geometry

We study the probability simplex of a finite connected weighted graph with an Onsager operator combining logarithmic-mean transport and mass-conserving Fisher reaction. For every fixed positive reaction parameter, we prove that the entropy Hessian has a finite global lower bound if and only if the original transport graph has diameter at most two. Near a boundary probability, the corresponding criterion is that its positive support reaches every vertex in at most two steps. The proof controls all potential directions under arbitrary multiscale boundary degeneration. For graphs of diameter at most two, the optimal lower bound is Lipschitz on bounded parameter intervals, including the pure-transport endpoint. We also determine the largest instantaneous logarithmic-amplitude dissipation function depending only on the graph and the current amplitude, and construct two-level probabilities attaining it. Its positivity has the same two-step criterion. As consequences, we obtain graph-dependent entropy-decay estimates and exact projective contraction bounds without assuming nonnegative entropic curvature.

math.PR↗
arXiv2026

RoboAuto: Autonomous Robot Program Search through Multi-Level Physical Understanding

Recently, LLM-based autonomous agents have shown strong capabilities in iteratively generating, evaluating, and refining executable solutions. In robotic manipulation, Code-as-Policy lets these agents search over modular and editable robot programs. However, effective program search requires physical understanding: agents must understand how objects can be manipulated, how scene geometry constrains actions, and why interactions succeed or fail. Existing methods rely mainly on execution feedback for program refinement, often leaving these physical questions unresolved. We introduce RoboAuto, a framework for robot program search that explicitly organizes physical understanding at the object, scene, and interaction levels through three components. First, a hierarchical knowledge base combines executable skills with object-centric knowledge of affordances, spatial relations, and action effects, learned from embodied data and online task solving. Second, scene grounding connects this knowledge to the current environment by identifying relevant objects and resolving action-critical quantities. Third, multi-stage planning with self-designed experiments checks whether each stage produces its expected physical effects and actively tests competing hypotheses to resolve physical uncertainties. RoboAuto achieves superior performance across five benchmark families, attaining an 89.1% success rate on short-horizon LIBERO-PRO tasks and more than twice the mean success rate of ASPIRE on LIBERO-PRO Long and LIBERO-Plus. It also outperforms ASPIRE and $π_{0.5}$ on three challenging long-horizon real-robot tasks requiring precise manipulation. We further show that the knowledge base transfers across simulators and embodiments, and that program search performance scales with its size. Project page: https://roboauto-ai.github.io/

cs.RO↗
arXiv2026

Multireference Second-Order Perturbation Theories Based on Iterative Configuration Interaction with Selection

Under the assumption that the static correlation can well be described by selected configuration interaction, to the extent that the residual dynamic correlation can be accounted for accurately by a second-order perturbation theory (PT2), a family of multireference PT2s (iCI-MRPT2) based on the iterative configuration interaction with selection are proposed and compared. The first step is to partition a large complete active space (CAS) $P$ into the direct sum of a primary ($P_m$) and a secondary ($P_s$) subspace via a parameter $C_{\mathrm{min}}$. The former serves as the actual reference space, whereas the latter is treated via Epstein-Nesbet PT2. An MRPT2 is then invoked to account for the dynamic correction of the $Q=1-P$ space to the $P_m$ space. Different MRPT2s are distinguished by the underlying zeroth-order Hamiltonians. To circumvent the prohibitive computational cost and memory footprint associated with high-order reduced density matrices in the fully internally contracted scheme and the exponential growth of external functions (XF) in the uncontracted scheme, a partial contraction strategy is employed for constructing the XFs: those involving one or two inactive (core or virtual) orbitals are kept uncontracted, whereas those involving three or four inactive orbitals are internally contracted. They span the uncontracted ($Q_u$) and contracted ($Q_c$) portions of $Q$, respectively. The former is further split into two subspaces $Q_u^c$ and $Q_u^u$ via a parameter $Q_{\mathrm{min}}$, which are to be treated in coupled and uncoupled manners, respectively. Extrapolations to zero $Q_{\mathrm{min}}$ and $C_{\mathrm{min}}$ can be performed, so as to approach CAS-based MRPT2. Calculations with active spaces as large as CAS(56e,58o) can now be performed. The size-consistency of the iCI-MRPT2s is also analyzed in detail.

physics.chem-ph↗
arXiv2026

OpenStripe supports open-set identification and spatial stripe profiling in wild Amur tigers

Non-invasive camera-trap monitoring of endangered wildlife requires open-set individual identification---grouping field images into identities without predefined classes or a known population size---yet pose deformation and cluttered backgrounds complicate image comparison. Here, we present OpenStripe, a multi-agent framework that reconstructs canonical two-dimensional (2D) tiger torso patterns and encodes four interpretable local stripe structures: breakpoints, bifurcations, irregular structures, and round structures. We evaluated OpenStripe on 100 camera-trap records from 28 wild Amur tigers (Panthera tigris altaica), representing nearly one-third of the documented population in the Northeast China Tiger and Leopard National Park. Combining all four complementary structures enabled automatic identity grouping with 0.90 matched accuracy and a 0.85 adjusted Rand index (ARI), outperforming 49 baseline configurations under the same backend (up to 0.43 accuracy and 0.14 ARI). In addition, results from OpenStripe indicate that stripe similarity in Amur tigers declines with geographic distance and suggest that traits such as fractal dimension and inter-stripe spacing are associated with geographic proximity. OpenStripe thus provides an interpretable representation that connects automated individual grouping with spatial phenotypic profiling in wild populations.

cs.CV↗
arXiv2026

Symbolic Guidance for LLM Agents in Distributed Multiagent Coordination

Large language models (LLMs) are increasingly deployed as autonomous agents in multi-agent systems, yet their ability to reliably execute distributed coordination protocols remains poorly understood. While AgentsNet, a benchmark framework for distributed coordination among LLM agents, enables such coordination, granting full reasoning autonomy often leads to inconsistent or degraded performance in complex domains. We hypothesize that coordination can be improved by regulating agent autonomy through symbolic guidance derived from established algorithms. To investigate this, we introduce the \emph{Symbolic Guidance Taxonomy (SGT)}, which characterizes a spectrum of autonomy ranging from open-ended natural language reasoning to fully prescribed algorithmic execution, with intermediate levels providing partial pseudocode guidance. Our results show that intermediate autonomy levels consistently outperform both unguided agents and fully prescriptive specifications. These findings identify autonomy regulation as a key design principle for LLM-based distributed coordination.

cs.AI↗
arXiv2026

One-shot federated unsupervised domain adaptation with Smoothed Knowledge Distillation and teacher refinement

Federated unsupervised domain adaptation (FUDA) addresses the challenge of adapting models to an unlabeled target domain using decentralized source domains while preserving data privacy. However, existing FUDA methods typically require multiple communication rounds, rely on complex aggregation strategies, and often struggle with noisy pseudo labels and inconsistent source knowledge. To address these challenges, we propose SKD-ETR, a novel one-shot FUDA framework that combines Smoothed Knowledge Distillation (SKD) and Exponential moving average-based Teacher Refinement (ETR). SKD trains a student model on the target domain using smoothed soft pseudo labels generated by the ensemble of source models. This reduces overconfidence, mitigates noise, and improves robustness. ETR further refines each source model by interpolating its parameters toward the student via exponential moving average (EMA), thereby transferring target-domain knowledge back to the teachers. This bidirectional refinement enhances pseudo-label quality and student generalization without additional communication overhead. SKD-ETR eliminates complex aggregation by initializing the student model randomly and performing a single-round distillation process. Extensive experiments on OfficeHome, Office-Caltech, and DomainNet demonstrate that SKD-ETR achieves competitive performance while being communication- and computation-efficient, and robust under noisy supervision. The code for this paper is available at https://github.com/A-Abedi/SKD_ETR.

cs.CV↗
arXiv2026

FogTTA: Online Test-Time Adaptation for Robust Transformer-based Object Detection in Foggy Weather

Object detection models for autonomous driving commonly experience substantial performance drops when deployed under adverse weather due to the domain shift between training data and real-world operating conditions. This degradation is especially evident when models trained on clear-weather images encounter foggy environments with reduced visibility and contrast. To address this challenge, we introduce FogTTA, an online test-time adaptation framework designed to improve the robustness of Transformer-based object detectors in fog. Using RF-DETR as the underlying object detector, FogTTA enables real-time adaptation to the streaming target domain without requiring source data or retraining. The framework follows a teacher-student design, where the deployed model serves as the teacher and generates pseudo labels from weakly augmented target inputs. These predictions are subsequently refined through non-maximum suppression and confidence filtering. The student model then learns from strongly augmented target sample using the Varifocal loss to mitigate pseudo-label noise. The teacher is updated via exponential moving averaging to ensure stable and continuous adaptation. Experiments show that FogTTA outperforms prior baselines, delivering improved detection accuracy and stability while maintaining real-time performance.

cs.CV↗
arXiv2026

Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models

Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage. Given an adversarial target, which can be either a reference NSFW image or a malicious text description, Mirage conceals the target within an imperceptible perturbation applied to a benign input image. Mirage exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts. Such semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details. We further employ lightweight black-box query refinement to improve evasion near the unknown safety boundary. We implemented Mirage on Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2, and evaluated it on two cross-modal NSFW datasets, covering both text-to-image and image-to-image generation scenarios. The experimental results demonstrate that Mirage achieves strong targeted jailbreak performance across diverse post-generation safety checkers with limited black-box queries while preserving high semantic alignment with the adversarial targets.

cs.CR↗
arXiv2026

Not Where You Think: Protecting Location Privacy Against Reasoning-Based Geolocation

Recent large reasoning models can infer where ordinary photos were taken using only visual information, creating a serious location privacy risk even when metadata and obvious geographic identifiers are removed. To understand the mechanism behind such fine-grained localization, we develop GeoTrace, a structured reasoning attack that exposes how models extract location-relevant visual clues and compose them through coarse-to-fine geographic reasoning. We evaluate GeoTrace on a worldwide benchmark of 525 ordinary images spanning natural, urban, residential, and human-centered scenes while excluding famous landmarks and direct location indicators. Our results show that GeoTrace localizes 25.71% of images within 1 km with Gemini-3-Flash and 16.95% with GPT-5-mini. More importantly, our analysis reveals a key insight in the visual clue chain: broad scene properties mainly support coarse localization, whereas precise localization disproportionately relies on small, distinctive, and editable local clues. Building on this insight, we develop GeoShift, a proactive user-side defense that breaks the visual clue chain before image release. Rather than simply removing geographic evidence, GeoShift preserves stable scene properties, selects a visually compatible false target location, and strategically rewrites high-impact geo-revealing clues to construct a coherent alternative geographic hypothesis. Experiments show that GeoShift reduces street-level localization from 16.95% to 2.48% under GPT-5-mini and from 25.71% to 3.81% under Gemini-3-Flash, while preserving visual quality and remaining effective against adaptive attacks.

cs.CR↗
arXiv2026

Stability Analysis of Signed Graphs under Structural Perturbations

Signed graph learning has emerged as a powerful framework for modeling networks with both positive and negative interactions. While graph-filter-based methods have achieved promising empirical performance on signed networks, their stability under edge perturbations remains less well understood. Existing stability analyses primarily focus on unsigned graphs and do not account for sign-flip perturbations. In this paper, we study the stability of signed graph filters under edge additions, deletions, and sign flips. Our theoretical analysis reveals how signed edge perturbations and node feature correlations jointly determine the learned representation stability. Based on this analysis, we propose a theory-guided perturbation strategy that selects structurally influential signed-edge modifications. Experiments on synthetic and real signed graphs show that the proposed method consistently induces larger embedding drift, polarity change, and downstream link prediction degradation than baselines. These results highlight the importance of \textit{sign-aware} and \textit{distribution-aware} stability analysis for signed graph learning.

cs.LG↗
arXiv2026

BitMTP: When Multi-Token Prediction Meets Low-Bit Large Language Models

For efficient deployment of large language models (LLMs), methods of ultra-low-bit backbones reduce weight storage, memory traffic, and linear-layer execution cost, while multi-token prediction (MTP) methods reduce sequential decoding steps by predicting multiple future tokens in parallel. Although complementary, the direct combination of these methods cannot accelerate decoding at comparable quality: masked drafting lacks intermediate token input supplied in next-token training, while wider computation and causal key-value (KV) updates can offset the savings from fewer steps. To address these challenges, we propose BitMTP, an algorithm-system co-design framework for efficient MTP on ultra-low-bit LLM backbones. A joint next-token prediction and MTP objective equips a single model with both autoregressive (AR) generation and block-causal drafting. Confidence-only decoding, speculative-only decoding, and hybrid decoding provide different quality-throughput operating points without using separate draft and verifier models. Accepted-prefix alignment keeps the committed prefix, materialized causal KV boundary, and CUDA Graph replay state consistent for continued generation. BitMTP uses this contract to select width-specialized low-bit execution and reuse captured graphs over shared KV storage. On NVIDIA H20, BitMTP with hybrid decoding achieves five-task mean speedups of 2.2x on BitNet b1.58-2B and 2.1-2.4x on 1.7B-4B Bonsai models at comparable task quality. On RTX 3090 and Jetson Orin, it further achieves up to 2.0x in five-task mean throughput and 3.3x on MBPP+, respectively. These results demonstrate that BitMTP accelerates ultra-low-bit LLM generation across backbones, model sizes, and GPU types. The source code is released at https://github.com/PolyU-VCLab/BitMTP

cs.CL↗
arXiv2026

COSMOS: Model-Agnostic Personalized Federated Learning with Clustered Server Models and Pseudo-Label-Only Communication

Federated learning (FL) in heterogeneous environments remains challenging because client models often differ in both architecture and data distribution. While recent approaches attempt to address this challenge through client clustering and knowledge distillation, simultaneously handling architectural and statistical heterogeneity remains difficult. We introduce COSMOS, a model-agnostic framework that enables server-side personalization using only pseudo-label communication. Clients train local models and predict on the public data; the server clusters clients by prediction similarity, trains a cluster-specific model for each group using its own compute, and distills the resulting models back to clients. We provide the first theoretical analysis showing that distillation from the learned cluster models can yield exponential personalization risk contraction, going beyond the convergence-to-stationarity guarantees typically provided in model-agnostic FL. Experiments across benchmarks demonstrate that COSMOS consistently outperforms all model-agnostic FL baselines while remaining competitive with state-of-the-art personalized FL methods. More broadly, our results highlight personalized server-side learning with pseudo-labels as a promising paradigm for scalable and model-agnostic federated learning in highly heterogeneous environments.

cs.LG↗
arXiv2026

AutoRedClaw: Automated Red-Teaming for Claw-Style Agents

Agent systems are shifting from task-scoped tool-use agents to persistent, personalized assistants such as OpenClaw. These claw-style agents maintain configuration files (e.g., AGENTS.md), long-term memory, and reusable skills. Once poisoned, this persistent state is repeatedly reloaded into the agent's context, creating persistent threats across tasks and sessions. Existing security evaluation systems struggle to evaluate these complex claw-style systems since they rely heavily on manually constructed test cases and environments, which limits their scale and coverage; in addition, these manually designed cases quickly become outdated as agents evolve, and their evaluation settings leave a gap with how claw-style agents are deployed in practice. To address this, we introduce AutoRedClaw, an automated red-teaming framework that generates end-to-end attacks together with the environments needed to execute them. AutoRedClaw combines a strict quality-checking protocol with execution-based validation to ensure the correctness, realism, and effectiveness of generated samples, and adopts task-driven environment construction to keep costs low. To achieve broad coverage, it organizes generation along risk categories, attack strategies, attack stages, and attack surfaces, and uses experience-guided exploration to steer generation toward under-explored regions. AutoRedClaw achieves an effective attack rate above 30% at less than $0.10 per successful sample. From its outputs, we construct RedClaw-Bench, a 330-case benchmark that yields substantially higher attack success rates (ASRs) than AgentDojo, AgentDyn, and DTap. Across seven harnesses and four frontier models, most agent systems exceed 50% ASR, showing that our red-teaming pipeline provides a strong evaluation signal even for the most advanced agent systems. Our code and benchmark are released at https://github.com/SaFo-Lab/AutoRedClaw.

cs.CR↗
arXiv2026

PASPT2: a size-extensive and size-consistent partial-active-space multi-state multi-reference second-order perturbation theory for strongly correlated electrons

A partial-active-space (PAS) multi-state (MS) multi-reference second-order perturbation theory (MRPT2) for the electronic structure of strongly correlated systems of electrons, dubbed PASPT2, is formulated by linearizing the intermediate normalization-based general-model-space state-universal coupled-cluster theory with singles and doubles [IN-GMS-SU-CCSD; J. Chem. Phys. 119, 5320 (2003)]. At variance with the existence of disconnected terms in the IN-GMS-SU-CCSD amplitude equations, the disconnected terms in the PASPT2 amplitude equations can be avoided completely by choosing a special reference-specific zeroth-order Hamiltonian. The corresponding effective/intermediate Hamiltonian can also be made connected and closed, so as to render the energies obtained by diagonalization fully connected. As such, PASPT2 is strictly size-extensive, in sharp contrast with the parent IN-GMS-SU-CCSD. It is also size-consistent when the PAS of a supermolecule is chosen to be the direct product of those of the physically separated, non-interacting fragments. Prototypical systems are taken as showcases to reveal the efficacy of PASPT2.

physics.chem-ph↗
arXiv2026

Neuromorphic Decoding and Dynamical Image Reconstruction from Populations of Spiking Retinal Ganglion Cells

Decoding visual stimuli from the spiking activity of retinal ganglion cells (RGCs) informs both our understanding of the retinal code and the design of visual prostheses. Natural vision is dynamic, yet state-of-the-art decoders mostly reconstruct single frames with artificial neural networks that process dense, continuous-valued signals rather than the retina's sparse, asynchronous spikes. We asked whether dynamic scenes can be reconstructed and tracked entirely within the spike domain, and at what computational cost. We built an end-to-end spiking neural network (SNN) whose neurons integrate the recorded RGC spikes over time. Populations of up to 1836 RGCs were recorded ex vivo from mouse retina on high-density microelectrode arrays while flashed images, moving bars, drifting gratings and randomly moving handwritten digits were presented. For moving digits, one shared spiking encoder fed two readouts, one reconstructing the image and one decoding the digit's position. Compute energy was estimated from counted synaptic operations. The SNN decoded what and where at once. It reconstructed the stimuli with a structural similarity (SSIM) of up to 0.93, refining the reconstruction as spikes accumulated, and tracked a randomly moving target with a mean error of 1.33 pixels on a $32\times32$ grid. Its fidelity nearly matched that of the best of 17 larger spiking and artificial decoders (5.9 million to 1.7 billion parameters, versus 5.4 million), and at a mean firing rate of 14.2% it needed an estimated $\sim$70-fold less compute energy than a dense artificial network of the same architecture. Dynamic visual scenes can thus be decoded from retinal population activity in the spike domain, with a compact network and at a compute cost compatible with implantable and wearable neural interfaces, supporting spike-native decoders for visual prostheses.

cs.ET↗
arXiv2026

Putting PASPT2 on a Firmer Basis

The recently proposed partial-active-space (PAS) multi-state second-order perturbation theory (PASPT2) [Precis. Chem. 4, 997 (2026)] features connected amplitudes and a connected, closed intermediate Hamiltonian. Despite these hallmarks, PASPT2 (denoted as PASPT2H from now on) is not strictly size-extensive, as originally thought (and numerically confirmed), albeit strictly size-consistent. Nevertheless, PASPT2 is near-extensive for the states with major projections on the chosen PAS $\mathcal{M}_0$. This becomes more transparent upon introducing PASPT2X, a strictly size-extensive variant. Compared with the intruder-prone PASPT2X, the intruder-free PASPT2H merely neglects the second-order corrections that are important only for those states with major projections on the orthogonal complement $\mathcal{R}_X$ of $\mathcal{M}_0$ within the closed space $\mathcal{M}_X$ ($=\mathcal{M}_0\oplus\mathcal{R}_X$); however, such states are not supported by the chosen finite one-particle basis set. The weak violation of size-extensivity is therefore numerically insignificant for the target states supported by $\mathcal{M}_0$, reinforcing the theoretical basis of PASPT2H.

physics.chem-ph↗
arXiv2026

Nuclear mass table in deformed relativistic Hartree-Bogoliubov theory in continuum, III: nuclei with $8 \leq Z \leq 120$

The mass table in the deformed relativistic Hartree-Bogoliubov theory in continuum (DRHBc) with the PC-PK1 density functional has been established for nuclei with $8 \leq Z \leq 120$, extended from the previous works for even-even nuclei [Zhang et al. (DRHBc mass table collaboration), At. Data Nucl. Data Tables 144, 101488 (2022)] and for even-$Z$ nuclei [Guo et al. (DRHBc mass table collaboration), At. Data Nucl. Data Tables 158, 101661 (2024)]. The calculated binding energies, two- and one-nucleon separation energies, root-mean-square (rms) radii of neutron, proton, matter, and charge distributions, quadrupole deformations, neutron and proton Fermi surfaces, and the blocked neutron (proton) orbitals of odd-$N$ ($Z$) nuclei are tabulated and compared with the available experimental data. A total of 9495 nuclei are predicted to be bound, with an rms deviation of 1.444 MeV from the 2380 mass data. Good agreement with the available experimental pairing gaps, $α$ decay energies, and charge radii is also achieved. The accuracies of the calculated nuclear masses and nucleon separation energies as well as the prediction for drip lines are compared with those obtained by other relativistic and nonrelativistic density functional calculations. It turns out that the DRHBc theory with PC-PK1 provides one of the best microscopic descriptions for nuclear masses. The systematics of nucleon separation energies, pairing gaps, pairing energies, two-nucleon gaps, $α$ decay energies, rms radii, quadrupole deformations, potential energy curves, neutron density distributions, and neutron mean-field potentials are discussed.

nucl-th↗
arXiv2026

Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models

Large language models remain vulnerable to jailbreaks, and automated red teaming is the standard way to find jailbreaks in large language models at scale. Current methods either draw more samples at test time through search, rewriting, and tree expansion, or train a stronger attacker offline with reinforcement learning. Both share a limitation: once an attack on a specific target behavior begins, the attacker's weights are frozen. Any signal it gathers about the behavior stays in its context window and is discarded afterward. The attacker never adapts its proposal distribution mid-attack, so success depends almost entirely on the sampling budget, and under a budget affordable at scale, many behaviors remain unbroken. We propose Red-TTT, which updates the attacker's parameters during the attack on each behavior. At each round, the attacker samples a group of candidates, scores them against the victim's replies, and takes a policy-gradient step before drawing the next group, so what it discovers about the current victim is consolidated into weights rather than accumulated as context. We also adapt the training objective to red teaming, where success is judged by the single best sample rather than the average. Red-TTT requires only sampling access to the victim and integrates into existing attack pipelines with no other changes. Against the Best-of-N baseline, Red-TTT raises attack success rate from 55.9\% to 72.4\% on average at a budget of 120 samples, improving over the baseline in every configuration and cracking many behaviors previous method cannot. The code is available at https://github.com/SaFo-Lab/Red-TTT

cs.CL↗