arXiv subjects

Qian Ma

Publications and source records attributed to Qian Ma.

At least 19 recordsLinked to original sources

arXiv2026

How to Backdoor Image Knowledge Distillation

Knowledge distillation is widely used to transfer behavior from a large teacher model to a smaller student. It is often assumed to be safe when the teacher is clean, because classic backdoor attacks rely on poisoned labels and triggers in supervised training, whereas distillation trains the student to match a teacher's outputs. We show that this assumption can fail when the distillation dataset itself is poisoned. Our attack injects triggered and manipulated images that a clean teacher already predicts as an attacker chosen target label, which causes the student to learn a backdoor even though the teacher remains unaffected. We evaluate this threat across multiple manipulation strategies, including targeted adversarial perturbations and targeted GAN based class transitions, and study how distillation settings influence both accuracy and attack success. We show that the attack remains effective even at a 10% poisoning rates. The results demonstrate that a clean teacher alone is not a sufficient safeguard: poisoned distillation data can produce a strongly backdoored student while maintaining competitive performance on clean images. These findings show that the integrity and provenance of distillation data are part of the security boundary of data intensive KD pipelines, even when the teacher itself is trusted.

cs.CR↗

arXiv2026

How Finely Can Vision-Language Models See Biology? Bio-VQA: A Benchmark for Taxonomic, Morphological, Spatial and Individual Reasoning

In biodiversity monitoring, a single image raises several questions: which taxon, how many, which trait, and whether the individual has been seen before. Vision-language models (VLMs) could answer all of these from the image, but their ability is largely untested in biology, as existing benchmarks focus mostly on species identification within a few taxonomic groups. We present Bio-VQA, the largest biological visual question answering (VQA) benchmark and the only one to span four aspects of biological visual understanding: hierarchical taxonomic reasoning, fine-grained attribute grounding, quantitative spatial reasoning, and individual re-identification. Bio-VQA contains 1.86M questions over 217K images from 11 public datasets, and extends right-or-wrong scoring to graded scoring, so a near-miss counts for more than a distant one. Evaluating 18 open-weight models from 3.75B to 38.4B parameters, we find that general visual capabilities do not transfer to biological organisms: the best model counts animals exactly on 41.7% of images with 2 to 10 individuals, less than half its accuracy on everyday objects at the same counts. Taxonomic accuracy falls to one sixth, from 0.72 at phylum to 0.12 at scientific name, and scaling helps mostly at coarse ranks. The gap to a domain specialist widens accordingly, from 0.731 against BioCLIP-2's 0.874 at class (1.2x) to 0.269 against 0.544 at scientific name (2x). On trait size measurement, 15 of the 18 models do no better than an image-blind baseline that predicts one fixed number for every specimen, and on re-identification, 17 of the 18 models fall below chance under adversarial conditions. These failures persist across a tenfold range of model size. We hope Bio-VQA becomes a standard test of how well VLM capabilities transfer to the biological domain.

cs.CV↗

arXiv2026

Pedagogical Friction in Password Creation

Users often make security- and privacy-relevant decisions without a clear understanding of the rules that govern safe behavior. We introduce pedagogical friction, a design approach that inserts brief, instructional interactions at the moment of action. We evaluate this approach in the context of password creation, a familiar task with clear quality criteria. We conducted a randomized study with 128 participants across four interface conditions that varied the depth and interactivity of guidance. We assessed three outcomes: (1) rule compliance in a subsequent password task without guidance, (2) accuracy on survey questions tied to password rules, and (3) behavior-knowledge alignment, which captures whether participants who correctly followed a rule also recognized it on the survey. Across the guided conditions, participants corrected most rule violations in the follow-up task and showed high behavior-knowledge alignment. Survey results suggested clearer advantages for some rule types, especially symbol related questions. These results position pedagogical friction as a lightweight intervention for security- and privacy-critical interfaces.

cs.HC↗

arXiv2026

CircuitGate: Logic-Consistent Circuit-Level Functional Modeling for And-Inverter Graphs

And-Inverter Graphs (AIGs) are fundamental representations for logic synthesis and verification in Electronic Design Automation (EDA). As structured representations of complex digital systems, AIGs require models to capture functional dependencies beyond local structure and remain robust to functionality-preserving transformations. In learning-based AIG representation, existing approaches are predominantly based on GNNs and rely on local gate-level message passing, limiting their ability to capture circuit-level functional context and making the learned representations sensitive to topology-specific patterns. Therefore, we propose CircuitGate, a function-aware AIG representation learning framework that advances from gate-level semantics to circuit-level functional modeling. CircuitGate explicitly encodes global primary-input (PI) support and models support-overlap-aware reconvergence between fanins, while incorporating logic-inspired Boolean constraints to encourage functionally consistent representations. We evaluate CircuitGate on the large-scale ForgeEDA benchmark and further validate it on the EPFL and ITC'99 benchmarks. Across equivalent-gate identification and signal-probability prediction tasks, CircuitGate consistently outperforms existing methods, achieving up to 21.7% and 14.2% reductions in MAE, respectively. Under direct ForgeEDA-to-OpenABC transfer without fine-tuning, CircuitGate also achieves the best equivalent-gate identification performance, demonstrating strong cross-dataset generalization. These results demonstrate the effectiveness of modeling circuit-level functional dependencies beyond local topology.

cs.LG↗

arXiv2026

VeriTS: Verifiable Model-Enhanced Time-Series Queries on Blockchain Systems

Every blockchain transaction carries a timestamp, and the chain imposes a total order. On-chain data therefore forms per-source time-series streams. However, existing systems support only basic lookups on blocks and transactions, and cannot answer time-series queries such as time-range retrieval and windowed aggregation. Offloading queries off-chain restores expressiveness, but the off-chain query layer is untrusted, so results must be verifiable. To this end, we propose VeriTS, the first verifiable time-series query framework for blockchain systems. It supports efficient range and aggregation queries. VeriTS maintains an off-chain query layer. In this layer, each stream is kept under one tree whose nodes carry authenticated aggregates, so the query index is itself the authenticated data structure. A light client thus verifies a windowed aggregate from a logarithmic number of authenticated nodes rather than from every record. VeriTS further answers error-tolerant queries from compact model representations of a stream, and extends the completeness and soundness guarantees to such approximate answers. As VeriTS never trusts the model behind a representation, a faulty or adversarial model can only widen an answer's certified interval, never falsify it. Experiments offer evidence that on windowed aggregation, VeriTS improves verification efficiency by more than two orders of magnitude over per-record proofs. On range retrieval, proofs shrink by up to 14.5x.

cs.DB↗

arXiv2026

Demonstrably Informed Consent in Privacy Policy Flows: Evidence from a Randomized Experiment

Privacy policies govern how personal data is collected, used, and shared. Yet, in most privacy-policy consent flows, agreement is operationalized as a single click at the end of a long, opaque policy document. Recent privacy-law scholarship has argued for a standard of demonstrably informed consent. That is, the party drafting and designing privacy-policy consent mechanisms must generate reliable evidence that a person demonstrates comprehension of the consequential terms to which they agree. To this end, we study pedagogical friction as a design framing: minimal interventions embedded within a privacy-policy consent flow that aim to support demonstrated comprehension while keeping burden on the user low. In a randomized experiment, we tested pedagogical friction for demonstrably informed consent in the context of a privacy policy for an edtech app for young children. We recruited 293 parents of kids ages 3-8 to review the app's privacy policy under one of six conditions that varied presentation format and pacing, then complete a six-question comprehension quiz. Three conditions offered a second policy review and quiz retake for participants who did not pass this quiz on their first attempt. We find that the slide-based condition (G3) achieved the highest first-attempt threshold attainment (>=80%) (41.7%), followed by the paced, sectioned condition (G4) (30.6%). In the retake conditions, 64.9% of participants who completed a second attempt improved their score. Notably, in conditions that did not gate consent on demonstrated comprehension, 97.3% of participants who scored below the threshold still chose to consent, suggesting that ungated consent flows can record agreement without demonstrated comprehension. Our results suggest that pedagogical friction can strengthen the evidentiary basis of consent and clarify what it costs in time and burden.

cs.HC↗

arXiv2026

Transparentize A Shallow Cryosphere: High-Resolution Subsurface Imaging using UAV-Borne GPR A review and prospective

Accurate characterization of shallow cryosphere subsurface structures is critical for understanding snow and ice dynamics, evaluating environmental hazards, and informing climate-related decision making. Recent advances in unmanned aerial vehicles (UAVs) and compact radar instrumentation have enabled UAV-borne ground penetrating radar (GPR) as a non-contact alternative for subsurface sensing in these environments. By combining the safety-constrained mobility of unmanned aerial platforms with the penetration capability of radar, UAV-borne GPR facilitates rapid, wide-coverage and flexible surveys over snow and ice surfaces in cryosphere that are often inaccessible to traditional ground-based methods. This contribution reviews recent progress in UAV-borne GPR for cryosphere investigations, encompassing system architectures, operational strategies, and representative deployment practices. Furthermore, key data-processing methodologies are summarized for their roles in enhancing subsurface imaging and reconstruction fidelity. A case study from Mochou Lake in East Antarctica, illustrates these capabilities, yielding an ice-thickness estimation error of only 0.03 m when benchmarked against drilling measurements. Finally, the remaining challenges, particularly those associated with scanning coverage, real-time data processing, and detection accuracy, are discussed for future cryosphere applications.

eess.SP↗

arXiv2026

Geometry-Decoupled Deep Unfolding for Gridless Super-Resolution TomoSAR Under Nonuniform Baselines

Super-resolution SAR tomography (TomoSAR) is performed on a discretized elevation grid, leading to off-grid bias and spectral leakage. Classical Toeplitz-Vandermonde gridless formulations avoid elevation discretization but rely on uniform sampling, whereas covariance- or subspace-based estimation is difficult in single-look repeat-pass TomoSAR. We propose DUSG-Tomo-Net, a geometry-decoupled deep unfolding framework for gridless inversion under nonuniform baselines. In DUSG-Tomo-Net, pairwise products of a single observation vector are related to a latent Toeplitz-compatible virtual-lag sequence through an analytical geometry operator and modeled as noisy covariance surrogates containing multi-scatterer cross terms, measurement noise, and lag-interpolation errors. Each unfolded layer combines learned lag-domain regularization, closed-form geometry-dependent data consistency, and finite-step Dykstra projection toward the set of Hermitian Toeplitz positive semidefinite matrices. Root-MUSIC then retrieves scatterer elevations in the continuous domain without an elevation dictionary. Because the trainable modules operate only on the common virtual-lag representation, the learned parameterization can be reused across representationally compatible acquisition geometries by recomputing the geometry operator. At 6 dB, simulations under nonuniform baselines yield a single-scatterer RMSE of 0.703 m and an effective detection rate of approximately 0.90 for two scatterers at the Rayleigh limit, while demonstrating reliable sub-Rayleigh separation. A model trained with 20 acquisitions remains applicable to perturbed configurations containing 8-28 acquisitions without retraining. Experiments on a 16-image CH-1 stack show that DUSG-Tomo-Net produces coherent urban elevation maps and more continuous double-scatterer structures than the gridless baseline method TADCG.

eess.SP↗

arXiv2026

Aggregation-Aware Synthetic Text Generation Against Authorship Re-Identification

Online users often release multiple texts under the same identity, giving attackers an author profile that can reveal more than any single text. Existing authorship obfuscation methods optimize privacy independently for each document, leaving them blind to cross-document correlations that make aggregation dangerous. We propose Aggregation-Aware Synthetic Text Generation (AAST), a framework that addresses this gap by jointly selecting synthetic texts at the bundle level rather than optimizing each text in isolation. AAST targets attribution and verification attacks, including cross-genre settings where attacker references come from a genre not observed during generation or selection. Experiments across same-genre, cross-genre, neural, and independent non-neural stylometric attacks show that AAST lowers account-level linkability as bundle size grows, while preserving semantic quality, linguistic acceptability, and sentiment alignment.

cs.AI↗

arXiv2026

Private Seeds, Public LLMs: Realistic and Privacy-Preserving Synthetic Data Generation

Large language models (LLMs) have emerged as a powerful tool for synthetic data generation. A particularly important use case is producing synthetic replicas of private text, which requires carefully balancing privacy and utility. We propose Realistic and Privacy-Preserving Synthetic Data Generation (RPSG), which uses private seeds and integrates privacy-preserving strategies, including a formal differential privacy (DP) mechanism in the candidate selection, to generate realistic synthetic data. Comprehensive experiments against state-of-the-art private synthetic data generation methods demonstrate that RPSG achieves high fidelity to private data while providing strong privacy protection.

cs.CR↗

arXiv2026

Metasurface embodied intelligence through electromagnetic world model

Mastering invisible electromagnetic (EM) environment and sculpting radio waves with the dexterity of manipulating light or matter have long been aspirations in physics and information science. While information metasurfaces (IMSs) provide the physical interface to program EM wavefields, their real-world autonomy is fundamentally limited by environmental 'blindness' and the prohibitive overhead of site-specific and trial-and-error retraining. Here we propose metasurface embodied intelligence through world model (metaEI-WM), a universal and out-of-the-box paradigm that achieves expert-level performance without on-site fine-tuning. In contrast to purely data-driven agents, metaEI-WM establishes a fundamental understanding of the EM dynamics by integrating fully automated semantic environment modelling with embedded electrodynamic priors. By anticipating future scenarios in silico, it optimizes the IMS coding configurations to dynamically shape EM environments on demand. We show that metaEI-WM successfully enables zero-latency non-line-of-sight signal enhancements, symbiotic communications, and contactless physiological sensing across highly complex and unseen indoor scenarios. To the best of our knowledge, metaEI-WM is the first paradigm to achieve end-to-end automation of complex spatial channel manipulation tasks ab initio, requiring neither human-annotated data nor online training. This framework bridges the gap between digital intelligence and physical-layer wave dynamics, offering a scalable solution for robust and self-managing wireless ecosystems.

eess.SP↗

arXiv2026

Identifying and Resolving Pitfalls of Knowledge-Based VQA Benchmarks: Auditing, Repairing, and Augmenting

Knowledge-Based Visual Question Answering (KB-VQA) aims to evaluate whether Visual Language Models (VLMs) can retrieve, ground, and reason over external structured knowledge beyond visual evidence. In practice, answer accuracy is widely adopted as the primary evaluation metric, implicitly treating correctness as a proxy for knowledge-grounded reasoning. However, for existing KB-VQA benchmarks, this proxy relies on critical assumptions that are often overlooked and rendered unreliable by benchmark issues: annotated answer must be derivable from the associated knowledge base, question must be well-posed with sufficient constraints, and visual setting must meaningfully require grounded disambiguation. In this work, we show that these assumptions are systematically violated in existing KB-VQA benchmarks. Our audit reveals substantial instances with missing or contradicted answers and underspecified questions that render accuracy a misleading metric. Furthermore, we find that existing datasets rely on visually trivial, single-entity scenes that bypass the need for sophisticated visual-to-knowledge mapping. We demonstrate that even with controlled architectures, these flaws lead to distorted model rankings and overestimations of reasoning capabilities. To address this, we introduce (1) a principled audit-and-repair protocol that restores answer derivability and question clarity, and (2) a controlled multi-entity augmentation protocol that introduces visual ambiguity to challenge initial retrieval and grounded reasoning. Re-evaluation under corrected and augmented settings yields markedly different performance trends. Our findings call for rethinking evaluation protocols and designing more interaction-aware KB-VQA benchmarks that prioritize verifiable reasoning over simple matching.

cs.CL↗

arXiv2026

ReplicatorBench: Benchmarking LLM Agents for Replicability in Social and Behavioral Sciences

The literature has witnessed an emerging interest in AI agents for automated assessment of scientific papers. Existing benchmarks focus primarily on the computational aspect of this task, testing agents' ability to reproduce or replicate research outcomes when having access to the code and data. This setting, while foundational, (1) fails to capture the inconsistent availability of new data for replication as opposed to reproduction, and (2) lacks ground-truth diversity by focusing only on reproducible papers, thereby failing to evaluate an agent's ability to identify non-replicable research. Furthermore, most benchmarks only evaluate outcomes rather than the replication process. In response, we introduce ReplicatorBench, an end-to-end benchmark, including human-verified replicable and non-replicable research claims in social and behavioral sciences for evaluating AI agents in research replication across three stages: (1) extraction and retrieval of replication data; (2) design and execution of computational experiments; and (3) interpretation of results, allowing a test of AI agents' capability to mimic the activities of human replicators in real world. To set a baseline of AI agents' capability, we develop ReplicatorAgent, an agentic framework equipped with necessary tools, like web search and iterative interaction with sandboxed environments, to accomplish tasks in ReplicatorBench. We evaluate ReplicatorAgent across four underlying large language models (LLMs), as well as different design choices of programming language and levels of code access. Our findings reveal that while current LLM agents are capable of effectively designing and executing computational experiments, they struggle with retrieving resources, such as new data, necessary to replicate a claim. All code and data are publicly available at https://github.com/CenterForOpenScience/llm-benchmarking.

cs.AI↗

arXiv2026

Ground Then Rank: Revisiting Knowledge-Based VQA with Training-Free Entity Identification

Knowledge-Based Visual Question Answering (KB-VQA) requires grounding visual queries to external knowledge beyond directly observable content in images. While recent multi modal large language models (MLLMs) show strong perceptual abilities, they struggle on KB-VQA tasks requiring groundings from both fine-grained entity and evidence levels. Most existing multi-modal retrieval augmented generation (MM-RAG) methods tightly couple entity discrimination and section-level evidence ranking into a single re-ranking stage, leading to high cost and limited generalization. In this work, we revisit existing MM-RAG solutions from a workflow perspective and argue both entity-level and fact-level groundings are key bottlenecks. We observe that although MLLMs often fail under open-ended entity naming, they can better identify the correct entity when selecting from a small set of candidate names. Based on this insight, we propose a simple and training-free identify-before-answer IBA framework that decouples entity identification from section-level re-ranking. Our approach prompts an MLLM to select high-confidence entities using only candidate names, followed by an off-the-shelf textual re-ranker for evidence selection. Experiments on Encyclopedic-VQA and InfoSeek show that our method consistently outperforms fine-tuned multi-modal re-ranking baselines while reducing training and inference complexity. Additional analyses reveal that the improvements arise not only from better entity identification, but also from selecting more informative evidence once correct entity is fixed. Our implementation is made public to ease reproducibility.

cs.CL↗

arXiv2026

Local Differential Privacy via Dynamic Quantization in Distributed Online Stochastic Optimization

Distributed online stochastic optimization has received extensive attention in large-scale distributed learning and other related fields due to its unique advantage in processing streaming data. However, information exchange through the communication network during the optimization process may lead to privacy leakage. To address this issue, this paper proposes a locally differentially private distributed online stochastic optimization algorithm that employs an elaborately designed dynamic stochastic quantizer to mask the exchanged information prior to communication. Theoretical analysis shows that the proposed algorithm not only converges almost surely to the optimal solution but also achieves $(0,δ^i)$-local differential privacy for each agent $i$ even when the number of iterations tends to infinity. Furthermore, the algorithm is fully distributed and applicable to scenarios where the interaction network among agents is a directed graph. To the best of our knowledge, this is the first work on distributed online stochastic optimization that simultaneously achieves exact convergence and rigorous local differential privacy over a directed graph by exploiting quantization effects. Numerical experiments of distributed online training on the mushroom classification dataset, handwritten digits recognition dataset, and brain-computer interface dataset verify the effectiveness of the proposed method.

math.OC↗

arXiv2026

Dual Privacy Guarantees for Distributed Nash Equilibrium Seeking in Aggregative Games

This paper investigates the privacy-preserving distributed Nash equilibrium seeking problem for aggregative games. A novel differential privacy mechanism is designed by incorporating stochastic event-triggering with stochastic quantization, which provides strong privacy protection by obfuscating the temporal patterns of information exchange among players and quantizing the transmitted information at triggering instants. Based on this mechanism, a differentially private distributed Nash equilibrium seeking algorithm with dual randomness is proposed. By embedding a decaying factor sequence into both the triggering condition and interaction terms among players, it is proved that the proposed algorithm can achieve rigorous $(0,δ)$-differential privacy at each iteration while maintaining provable convergence. Crucially, this privacy guarantee is sustained over infinite iterations for a sufficiently large quantization interval and a sufficiently small trigger threshold tuning coefficient. Moreover, the synergy between event-triggered communication and quantization significantly enhances communication efficiency. Simulation results verify the validity of the proposed approach.

math.OC↗

arXiv2026

Attacks Meet Interpretability (AmI) Evaluation and Findings

To investigate the effectiveness of the model explanation in detecting adversarial examples, we reproduce the results of two papers, Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples and Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples. And then conduct experiments and case studies to identify the limitations of both works. We find that Attacks Meet Interpretability(AmI) is highly dependent on the selection of hyperparameters. Therefore, with a different hyperparameter choice, AmI is still able to detect Nicholas Carlini's attack. Finally, we propose recommendations for future work on the evaluation of defense techniques such as AmI.

cs.CR↗

arXiv2026

Ultrafast microwave sensing and automatic recognition of dynamic objects in open world using programmable surface plasmonic neural networks

The evolution toward next-generation intelligent sensing requires microwave systems to move beyond static detection and achieve high-speed and adaptive perception of dynamic scenes. However, the existing microwave sensing systems have bottlenecks owing to their sequential digital processing chain, limiting the refresh rates to hundreds of hertz, while the existing integrated microwave processors are lack of programmable and scalable capabilities for robust and open-world deployment. To break the bottlenecks, here we report a programmable surface plasmonic neural network (P-SPNN) that enables real-time microwave sensing and automatic recognition of dynamic objects in open-world environment. With a perception latency of 25 ns and a refresh rate exceeding 10 kHz, the P-SPNN system operates more than two orders of magnitude faster than the conventional millimeter-wave sensors, while achieving an energy efficiency of 17 TOPS per W. With 288 programmable phase-modulated neurons, we demonstrate real time and robust classification of persons and cars with 91-97% accuracy in the open road scenarios. By further integrating beam-scanning function, P-SPNN enables multi-dimensional spatial temporal frequency sensing without the digital preprocessing. These results establish P-SPNN as a programmable, scalable, and low-power platform for high-speed perception tasks in realistic world, with broad implications for autonomous driving, intelligent sensing, and next-generation artificial intelligence hardware.

cs.IT↗