arXiv Science⌕ Search

arXiv subjects

Qing Wang

Publications and source records attributed to Qing Wang.

At least 55 records · Page 3Linked to original sources
arXiv2026

OrchJail: Jailbreaking Tool-Calling Text-to-Image Agents by Orchestration-Guided Fuzzing

Tool-calling text-to-image (T2I) agents can plan and execute multi-step tool chains to accomplish complex generation and editing queries. However, this capability introduces a new safety attack surface: harmful outputs may arise from tool orchestration, where individually benign steps combine into unsafe results, making prompt-only jailbreak techniques insufficient. We present OrchJail, an orchestration-guided fuzzing framework for jailbreaking tool-calling T2I agents. Its core idea is to exploit high-risk tool-orchestration patterns: by learning from successful jailbreak tool-calling traces and their causal relationships to prompt wording, OrchJail directly guides the fuzzing search toward prompts that are more likely to trigger unsafe multi-step tool behaviors, rather than relying on surface-level textual perturbations. Extensive experiments demonstrate that OrchJail improves jailbreak effectiveness and efficiency across representative toolcalling T2I agents, achieving higher attack success rates, better image fidelity, and lower query costs, while remaining robust against common jailbreak defenses. Our work highlights tool orchestration as a critical, previously unexplored attack surface and provides a novel framework for uncovering safety risks in T2I agents.

cs.MA↗
arXiv2026

Classification of the irreducible ordinary modules for affine vertex operator superalgebras

Let $\mathfrak{g}$ be a basic classical Lie superalgebra, $\mathcal{k}=\frac{h^{\vee}}{u}-h^{\vee}$ a boundary admissible level of $\widehat{\mathfrak{g}}$, where $u$ is a positive integer and $h^{\vee}$ is the dual Coxeter number of $\mathfrak{g}$. In this paper, we classify the irreducible ordinary modules for the affine vertex operator superalgebra $L_{\widehat{\mathfrak{g}}}(\mathcal{k},0)$ associated to any basic classical Lie superalgebra $\mathfrak{g}$. More specifically, if $\mathfrak{g}$ is a basic classical Lie superalgebra of type I, we prove that $L_{\widehat{\mathfrak{g}}}(\mathcal{k},0)$ has exactly $u$ inequivalent irreducible ordinary modules. If $\mathfrak{g}$ is a finite dimensional simple Lie algebra or a basic classical Lie superalgebra of type II, we prove that $L_{\widehat{\mathfrak{g}}}(\mathcal{k},0)$ itself is the only irreducible ordinary $L_{\widehat{\mathfrak{g}}}(\mathcal{k},0)$-module.

math.RT↗
arXiv2026

Affine vertex operator superalgebra $L_{\hat{sl(2|1)}}(\mathcal{k},0)$ at boundary admissible level

Let $L_{\widehat{sl(2|1)}}(\mathcal{k},0)$ be the simple affine vertex operator superalgebra associated to the affine Lie superalgebra $\widehat{sl(2|1)}$ with admissible level $\mathcal{k}$. We conjecture that $L_{\widehat{sl(2|1)}}(\mathcal{k},0)$ is rational in the category $\mathcal{O}$ at boundary admissible level $\mathcal{k}$ and there are finitely many irreducible weak $L_{\widehat{sl(2|1)}}(\mathcal{k},0)$-modules in the category $\mathcal{O}$, where the irreducible modules are exactly the admissible modules of level $\mathcal{k}$ for $\widehat{sl(2|1)}$. In this paper, we first prove this conjecture at boundary admissible level $-\frac{1}{2}$. Then we give an example to show that outside of the boudary levels, $L_{\widehat{sl(2|1)}}(\mathcal{k},0)$ is not rational in the category $\mathcal{O}$. Furthermore, we consider the $\mathbb{Q}$-graded vertex operator superalgebras $(L_{\widehat{sl(2|1)}}(\mathcal{k},0),ω_ξ)$ associated to a family of new Virasoro elements $ω_ξ$, where $0<ξ<1$ is a rational number. We determine the Zhu's algebra $A_{ω_ξ}(L_{\widehat{sl(2|1)}}(-\frac{1}{2},0))$ of $(L_{\widehat{sl(2|1)}}(-\frac{1}{2},0),ω_ξ)$ and prove that $(L_{\widehat{sl(2|1)}}(-\frac{1}{2},0),ω_ξ)$ is rational and $C_2$-cofinite. Finally, we consider the case of non-boundary admissible level $\frac{1}{2}$ to support our conjecture, that is, we show that there are infinitely many irreducible weak $L_{\widehat{sl(2|1)}}(\frac{1}{2},0)$-modules in the category $\mathcal{O}$ and $(L_{\widehat{sl(2|1)}}(\frac{1}{2},0),ω_ξ)$ is not rational.

math.RT↗
arXiv2026

STAR: Decode-Phase Rescheduling for LLM Inference

Large Language Model (LLM) inference has emerged as a fundamental paradigm, however, variations in output length cause severe workload imbalance in the decode phase, particularly for long-output reasoning tasks. Existing systems, such as PD disaggregation architectures, rely on static prefill-to-decode scheduling, which often results in SLO violations and OOM failures under evolving decode workloads. In this paper, we propose STAR, a decode rescheduling system powered by length prediction to anticipate future workloads. Our core contributions include: (1) A lightweight and continuous LLM-native prediction method that leverages LLM hidden state to model remaining generation length with high precision (reducing MAE by 49.42%) and low overhead (cutting predictor parameters by 93.28%); (2) A rescheduling solution in decode phase with a dynamic balancing mechanism that integrates current and predicted workloads, reducing P99 TPOT by 75.1% and achieving 2.63 times higher goodput.

cs.DC↗
arXiv2026

Nonparametric Testing and Variable Selection for ARCH-m(X) Model

We introduce the ARCH-m(X) model, a semiparametric extension of the ARCH-X framework in which the effect of a multivariate exogenous covariate vector X on the conditional variance is modeled through an unknown nonparametric function m(), accommodating complex nonlinear relationships between external predictors and financial volatility. Within this model, we develop a novel hypothesis test for the significance of covariates constructed with an artificial one-way ANOVA. Under some regularity conditions, the test statistic is shown to converge in distribution to the standard Normal. Another key contribution of this paper is the construction of a variable selection procedure based on the Benjamini-Yekutieli false discovery rate correction applied to covariate-level p-values. We show that the resulting index set coincides with the true set of relevant covariates with probability tending to one as n goes to infinity. Extensive simulations confirm that the proposed methods outperform existing competitors, and an empirical application to SP500 return volatility illustrates the practical utility of the proposed variable selection framework.

stat.ME↗
arXiv2026

Where Did It Go Wrong? Capability-Oriented Failure Attribution for Vision-and-Language Navigation Agents

Embodied agents in safety-critical applications such as Vision-Language Navigation (VLN) rely on multiple interdependent capabilities (e.g., perception, memory, planning, decision), making failures difficult to localize and attribute. Existing testing methods are largely system-level and provide limited insight into which capability deficiencies cause task failures. We propose a capability-oriented testing approach that enables failure detection and attribution by combining (1) adaptive test case generation via seed selection and mutation, (2) capability oracles for identifying capability-specific errors, and (3) a feedback mechanism that attributes failures to capabilities and guides further test generation. Experiments show that our method discovers more failure cases and more accurately pinpoints capability-level deficiencies than state-of-the-art baselines, providing more interpretable and actionable guidance for improving embodied agents.

cs.MA↗
arXiv2026

Seeing the Whole Elephant: A Benchmark for Failure Attribution in LLM-based Multi-Agent Systems

Failure attribution, i.e., identifying the responsible agent and decisive step of a failure, is particularly challenging in LLM-based multi-agent systems (MAS) due to their natural-language reasoning, nondeterministic outputs, and intricate interaction dynamics. A reliable benchmark is therefore essential to guide and evaluate attribution techniques. Yet existing benchmarks rely on partially observable traces that capture only agent outputs, omitting the inputs and context that developers actually use when debugging. We argue that failure attribution should be studied under full execution observability, aligning with real-world developer-facing scenarios where complete traces, rather than only outputs, are accessible for diagnosis. To this end, we introduce TraceElephant, a benchmark designed for failure attribution with full execution traces and reproducible environments. We then systematically evaluate failure attribution techniques across various configurations. Specifically, full traces improve attribution accuracy by up to 76\% over a partial-observation counterpart, confirming that missing inputs obscure many failure causes. TraceElephant provides a foundation for follow-up failure attribution research, promoting evaluation practices that reflect real-world debugging and supporting the development of more transparent MASs.

cs.MA↗
arXiv2026

Fall into a Pit, Gain in a Wit: Cognitive-Guided Harmful Meme Detection via Misjudgment Risk Pattern Retrieval

Internet memes have emerged as a popular multimodal medium, yet they are increasingly weaponized to convey harmful opinions through subtle rhetorical devices like irony and metaphor. Existing detection approaches, including Multimodal Large Language Model (MLLM)-based techniques, struggle with these implicit expressions, leading to frequent misjudgments. This paper introduces PatMD, a novel approach that detects harmful memes by learning from and proactively mitigating these potential misjudgment risks. Our core idea is to move beyond superficial content-level matching and instead identify the underlying misjudgment risk patterns, proactively guiding the MLLMs to avoid known misjudgment pitfalls. We first construct a knowledge base where each meme is deconstructed into a misjudgment risk pattern explaining why it might be misjudged, either overlooking harmful undertones (false negative) or overinterpreting benign content (false positive). For a given target meme, PatMD retrieves relevant patterns and utilizes them to dynamically guide the MLLM's reasoning. Experiments on a benchmark of 6,626 memes across 5 harmful detection tasks show that PatMD outperforms state-of-the-art baselines, achieving an average of 8.30% improvement in F1-score and 7.71% improvement in accuracy, while exhibiting consistent robustness on unseen and adversarial memes.

cs.LG↗
arXiv2026

All Changes May Have Invariant Principles: Improving Ever-Shifting Harmful Meme Detection via Design Concept Reproduction

Harmful memes are ever-shifting in the Internet communities, which are difficult to analyze due to their type-shifting and temporal-evolving nature. Although these memes are shifting, we find that different memes may share invariant principles, i.e., the underlying design concept of malicious users, which can help us analyze why these memes are harmful. In this paper, we propose RepMD, an ever-shifting harmful meme detection method based on the design concept reproduction. We first refer to the attack tree to define the Design Concept Graph (DCG), which describes steps that people may take to design a harmful meme. Then, we derive the DCG from historical memes with design step reproduction and graph pruning. Finally, we use DCG to guide the Multimodal Large Language Model (MLLM) to detect harmful memes. The evaluation results show that RepMD achieves the highest accuracy with 81.1% and has slight accuracy decreases when generalized to type-shifting and temporal-evolving memes. Human evaluation shows that RepMD can improve the efficiency of human discovery on harmful memes, with 15$\sim$30 seconds per meme.

cs.CV↗
arXiv2026

Compact single-shot ranging and near-far imaging using metasurfaces

We present a metasurface imaging system capable of simultaneously capturing two images at close range (1-2~cm) and an additional image at long range (about 40~cm) on a shared photosensor. The close-range image pair focuses at 1.4~cm and 2.0~cm, respectively, which forms a focal stack, enabling passive ranging with an accuracy of $\pm$1~mm from 12~mm to 20~mm through a computationally efficient depth-from-defocus algorithm for a simplified scenario. The entire system is compact, with a total track length of 15~mm, making it suitable for seamless integration into edge platforms for defense and other resource-constrained applications.

eess.IV↗
arXiv2026

One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems

Large Language Models (LLMs) enhanced with Retrieval-Augmented Generation (RAG) have shown improved performance in generating accurate responses. However, the dependence on external knowledge bases introduces potential security vulnerabilities, particularly when these knowledge bases are publicly accessible and modifiable. While previous studies have exposed knowledge poisoning risks in RAG systems, existing attack methods suffer from critical limitations: they either require injecting multiple poisoned documents (resulting in poor stealthiness) or can only function effectively on simplistic queries (limiting real-world applicability). This paper reveals a more realistic knowledge poisoning attack against RAG systems that achieves successful attacks by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. Our proposed AuthChain address three challenges to ensure the poisoned documents are reliably retrieved and trusted by the LLM, even against large knowledge bases and LLM's own knowledge. Extensive experiments across six popular LLMs demonstrate that AuthChain achieves significantly higher attack success rates while maintaining superior stealthiness against RAG defense mechanisms compared to state-of-the-art baselines.

cs.CR↗
arXiv2026

Know Thy Enemy: Securing LLMs Against Prompt Injection via Diverse Data Synthesis and Instruction-Level Chain-of-Thought Learning

Large language model (LLM)-integrated applications have become increasingly prevalent, yet face critical security vulnerabilities from prompt injection (PI) attacks. Defending against PI attacks faces two major issues: malicious instructions can be injected through diverse vectors, and injected instructions often lack clear semantic boundaries from the surrounding context, making them difficult to identify. To address these issues, we propose InstruCoT, a model enhancement method for PI defense that synthesizes diverse training data and employs instruction-level chain-of-thought fine-tuning, enabling LLMs to effectively identify and reject malicious instructions regardless of their source or position in the context. We evaluate InstruCoT across three critical dimensions: Behavior Deviation, Privacy Leakage, and Harmful Output. Experimental results across four LLMs demonstrate that InstruCoT significantly outperforms baselines in all dimensions while maintaining utility performance without degradation

cs.AI↗
arXiv2026

Impact of Nuclear Reaction Rate Uncertainties on Type I X-ray Burst Nucleosynthesis: A Monte Carlo Study

Type I X-ray bursts are thermonuclear flashes on the surface of accreting neutron stars, involving hundreds of nuclei and thousands of reactions with larger uncertainties in reaction rate. To investigate the impact of nuclear reaction rate uncertainties on type I X-ray burst nucleosynthesis, comprehensive Monte Carlo simulations were performed with temperature-independent and -dependent variations in reaction rates using the REACLIB and STARLIB libraries, respectively. A total of 1,711 $(p, γ)$, $(p, α)$, $(α, p)$, and $(α, γ)$ reaction rates are varied simultaneously along with their inverse reactions via detailed balance. For the first time, it has been found that Monte Carlo sampling with larger perturbations to these reaction rates may lead to multi-peak abundance distributions for certain isotopes, such as $^{64}$Zn and $^{55}$Co. These multi-peak structures arise not only from coupled reactions but also from single reactions in some cases. Our studies also confirm previously identified key reactions and provide more robust lists that deserve priority consideration in future studies.

astro-ph.HE↗
arXiv2026

Multi-Domain Audio Question Answering Benchmark Toward Acoustic Content Reasoning

We present Task 5 of the DCASE 2025 Challenge: an Audio Question Answering (AQA) benchmark spanning multiple domains of sound understanding. This task defines three QA subsets (Bioacoustics, Temporal Soundscapes, and Complex QA) to test audio-language models on interactive question-answering over diverse acoustic scenes. We describe the dataset composition (from marine mammal calls to soundscapes and complex real-world clips), the evaluation protocol (top-1 accuracy with answer-shuffling robustness), and baseline systems (Qwen2-Audio-7B, AudioFlamingo 2, Gemini-2-Flash). Preliminary results on the development set are compared, showing strong variation across models and subsets. This challenge aims to advance the audio understanding and reasoning capabilities of audio-language models toward human-level acuity, which are crucial for enabling AI agents to perceive and interact about the world effectively.

cs.SD↗
arXiv2026

InstMeter: An Instruction-Level Method to Predict Energy and Latency of DL Model Inference on MCUs

Deep learning (DL) models can now run on microcontrollers (MCUs). Through neural architecture search (NAS), we can search DL models that meet the constraints of MCUs. Among various constraints, energy and latency costs of the model inference are critical metrics. To predict them, existing research relies on coarse proxies such as multiply-accumulations (MACs) and model's input parameters, often resulting in inaccurate predictions or requiring extensive data collection. In this paper, we propose InstMeter, a predictor leveraging MCUs' clock cycles to accurately estimate the energy and latency of DL models. Clock cycles are fundamental metrics reflecting MCU operations, directly determining energy and latency costs. Furthermore, a unique property of our predictor is its strong linearity, allowing it to be simple and accurate. We thoroughly evaluate InstMeter under different scenarios, MCUs, and software settings. Compared with state-of-the-art studies, InstMeter can reduce the energy and latency prediction errors by $3\times$ and $6.5\times$, respectively, while requiring $100\times$ and $10\times$ less training data. In the NAS scenario, InstMeter can fully exploit the energy budget, identifying optimal DL models with higher inference accuracy. We also evaluate InstMeter's generalization performance through various experiments on three ARM MCUs (Cortex-M4, M7, M33) and one RISC-V-based MCU (ESP32-C3), different compilation options (-Os, -O2), GCC versions (v7.3, v10.3), application scenarios (keyword spotting, image recognition), dynamic voltage and frequency scaling, temperatures (21°C, 43°C), and software settings (TFLMv2.4, TFLMvCI). We will open our source codes and the MCU-specific benchmark datasets.

cs.LG↗
arXiv2026

Demystifying the Lifecycle of Failures in Platform-Orchestrated Agentic Workflows

Agentic workflows built on low-code orchestration platforms enable rapid development of multi-agent systems, but they also introduce new and poorly understood failure modes that hinder reliability and maintainability. Unlike traditional software systems, failures in agentic workflows often propagate across heterogeneous nodes through natural-language interactions, tool invocations, and dynamic control logic, making failure attribution and repair particularly challenging. In this paper, we present an empirical study of platform-orchestrated agentic workflows from a failure lifecycle perspective, with the goal of characterizing failure manifestations, identifying underlying root causes, and examining corresponding repair strategies. We present AgentFail, a dataset of 307 real-world failure cases collected from two representative agentic workflow platforms. Based on this dataset, we analyze failure patterns, root causes, and repair difficulty for various failure root causes and nodes in the workflow. Our findings reveal key failure mechanisms in agentic workflows and provide actionable guidelines for reliable failure repair, and real-world agentic workflow design.

cs.AI↗
arXiv2026

From Flat Logs to Causal Graphs: Hierarchical Failure Attribution for LLM-based Multi-Agent Systems

LLM-powered Multi-Agent Systems (MAS) have demonstrated remarkable capabilities in complex domains but suffer from inherent fragility and opaque failure mechanisms. Existing failure attribution methods, whether relying on direct prompting, costly replays, or supervised fine-tuning, typically treat execution logs as flat sequences. This linear perspective fails to disentangle the intricate causal links inherent to MAS, leading to weak observability and ambiguous responsibility boundaries. To address these challenges, we propose CHIEF, a novel framework that transforms chaotic trajectories into a structured hierarchical causal graph. It then employs hierarchical oracle-guided backtracking to efficiently prune the search space via sybthesized virtual oracles. Finally, it implements counterfactual attribution via a progressive causal screening strategy to rigorously distinguish true root causes from propagated symptoms. Experiments on Who&When benchmark show that CHIEF outperforms eight strong and state-of-the-art baselines on both agent- and step-level accuracy. Ablation studies further confirm the critical role of each proposed module.

cs.AI↗
arXiv2026

Learning Partial Graph Matching via Optimal Partial Transport

Partial graph matching extends traditional graph matching by allowing some nodes to remain unmatched, enabling applications in more complex scenarios. However, this flexibility introduces additional complexity, as both the subset of nodes to match and the optimal mapping must be determined. While recent studies have explored deep learning techniques for partial graph matching, a significant limitation remains: the absence of an optimization objective that fully captures the problem's intrinsic nature while enabling efficient solutions. In this paper, we propose a novel optimization framework for partial graph matching, inspired by optimal partial transport. Our approach formulates an objective that enables partial assignments while incorporating matching biases, using weighted total variation as the divergence function to guarantee optimal partial assignments. Our method can achieve efficient, exact solutions within cubic worst case time complexity. Our contributions are threefold: (i) we introduce a novel optimization objective that balances matched and unmatched nodes; (ii) we establish a connection between partial graph matching and linear sum assignment problem, enabling efficient solutions; (iii) we propose a deep graph matching architecture with a novel partial matching loss, providing an end-to-end solution. The empirical evaluations on standard graph matching benchmarks demonstrate the efficacy of the proposed approach.

cs.LG↗