arXiv subjects

Yang Lu

Publications and source records attributed to Yang Lu.

At least 37 records · Page 2Linked to original sources

arXiv2026

Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection

Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later privileged actions. Existing defenses mainly classify untrusted content or authorize proposed operations. They do not directly address how an agent's future authority should change once untrusted data enters its state. We present SkillGuard, a harness-level enforcement layer that treats this event as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states. Given sound skill summaries and policies, SkillGuard represents security-relevant transitions with a Skill Impact Graph, specifies admissible control over skill parameters via steerability signatures, and mediates invocations with an inline reference monitor. Following contamination, it computes weighted capability restrictions using binary, fractional, or fractional-flow strategies without auxiliary language-model inference. We evaluate SkillGuard on four AgentDojo suites with two backend LLMs, Gemini 2.5 Flash and Llama3.3-70B, against an LLM-only No Defense baseline and three defenses at different system layers: Spotlighting, CaMeL, and AttriGuard. We construct a compositional attack benchmark in which each attack combines observations individually insufficient to induce target violation and evaluate the same baselines on it. Under AgentDojo's Tool Knowledge attacks, SkillGuard eliminates attack success on three of four suites for both backends and reduces it to 4.8% and 14.3% on Slack. Against compositional attacks, it outperforms every baseline on Llama and matches the strongest baseline on Gemini at higher benign utility. Fractional-flow restriction preserves substantially more capabilities than binary restriction at the same attack success rate. Across both settings, SkillGuard adds no model calls or token overhead.

cs.CR↗

arXiv2026

PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance

Autonomous AI agents are emerging as interfaces for decentralized finance (DeFi) actions such as swaps, lending operations, and yield management. Because these agents rely on large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction ultimately submitted on-chain. We present PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution. PACE introduces typed transaction intents, a deterministic policy verifier, and signed Policy Decision Records (PDRs) that cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection. A Solidity smart account enforces PDR signatures on-chain with a measured overhead of 29,826-31,822 gas. We evaluate PACE against six baselines on 40 tasks spanning four attack categories plus benign utility (2,800 trials, 10 seeds). In our deterministic sandbox, PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline. Ablation studies identify permissive policy settings (+57.5 pp) and the touched-contract allowlist (+12.5 pp) as the dominant safety components. To test whether the same deterministic floor holds for real model outputs, the artifact additionally provides a three-model live-LLM evaluation over the full task suite with repeated runs. A mainnet-fork harness is included for archive-RPC deployments, but fork results are reported only when the corresponding artifacts are generated. These auxiliary studies are separate from, and never substitute for, the deterministic benchmark. We frame our claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.

cs.CR↗

arXiv2026

When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling

AI agents increasingly act rather than merely read: across the Model Context Protocol (MCP) ecosystem, the share of deployed tools that modify external state has risen from 27% to 65% of tool use. When agents exercise this authority on public blockchains through MCP, skills, and tool calling, the consequences of an attack are governed by the blockchain execution layer rather than by conventional software assumptions. This survey argues that four properties of that layer (irreversibility, signing authority, continuous autonomy, and sequence-level composition) qualitatively change the threat model, turning the recoverable failures of generic agent security into a standing, irreversible loss. We organize the fragmented MCP-security literature into an attack-surface taxonomy, then contribute a Web3 risk-mapping matrix that ties each attack class to its amplified impact, the responsible amplifiers, a representative mitigation, and the residual gap. We synthesize defenses, including emerging blockchain-based mechanisms, and find them improving but insufficient: measured protections stop fewer than 30% of attacks, and model-level safety refuses fewer than 3%. We close by positioning the work against adjacent surveys and deriving a research agenda from the matrix's open cells.

cs.CR↗

arXiv2026

Traceable Trust for action-ready artificial intelligence in bioscience

Artificial intelligence (AI) is becoming part of the working infrastructure of the biosciences. AI models can predict biomolecular structures, design proteins, rank variants, annotate images, recommend strains and optimise experimental conditions. We argue that the decision to use an AI output to guide laboratory action is a key juncture for trustworthy research and should follow a defined, reviewable process. We propose Traceable Trust as a proportionate assessment-and-design framework for this output-to-action boundary. It asks what evidence supports the output, what capability is being claimed, what agency has been delegated, what threshold authorises action, who can override it and how outcomes inform later decisions. We illustrate the framework through three case studies spanning ecosystem resources, project design and laboratory action. Together, the cases show how trust can be documented where AI outputs begin to shape scientific work.

cs.CY↗

arXiv2026

Stitch the Fragments: One-Shot Hierarchical Federated Clustering

Federated Clustering (FC) faces a critical bottleneck in real-world scenarios, i.e., global clusters are rarely intact, often fragmenting into incomplete, multi-granular unlabeled ``clusterlets'' distributed across Non-IID clients. Although hierarchical clustering is theoretically well-suited to model such nested distributions, its recursive nature strictly relies on multi-round communication, introducing prohibitive computational overhead and severe privacy vulnerabilities. This paper, therefore, proposes a novel one-shot hierarchical federated clustering framework designed to seamlessly ``stitch'' the fragmented local clusterlets into a holistic global distribution. Our approach enables clients to perform autonomous fine-grained distribution exploration, uploading prototype-level knowledge via a dynamic parameter-interleaving mechanism to scramble transmission trajectories, which effectively prevents the server from tracing individual client data distributions. Subsequently, a multi-granular learning mechanism at the server fuses these granularly inconsistent local clusterlets, reconstructing a coherent global hierarchy for ultimate clustering. Extensive experiments on real benchmark datasets illustrate the superiority of the proposed approach, which effectively bridges the granularity gap among heterogeneous clients while minimizing privacy exposure risks via anonymized informative one-shot communication.

cs.LG↗

arXiv2026

GRACE: LLM-Grounded Semantic Metric Spaces for Scalable Mixed-Data Clustering

Clustering mixed tabular data requires a unified metric space to bridge the inherent heterogeneity between continuous numerical measurements and discrete categorical symbols. Traditionally, algorithms rely entirely on dataset-internal statistics to estimate categorical relationships, which confines the learned metric to empirical co-occurrences and ignores conceptually obvious yet statistically unobserved affinities. Although LLMs offer external world knowledge, applying their text-centric reasoning to highly abstract tabular concepts presents significant challenges. Bridging this modality gap to construct a semantically complete metric typically requires embedding LLMs into iterative metric learning loops to dynamically optimize cross-modality representations. This incurs intractable computational overhead, forcing a compromise between semantic enrichment and scalability. Therefore, we propose GRACE, an LLM-grounded framework for scalable mixed-data clustering. GRACE shifts semantic acquisition to the attribute-value level via a multi-perspective LLM querying strategy, mapping heterogeneous values into knowledge-informed descriptions. Crucially, this one-shot grounding extracts general-purpose semantic representations that embed heterogeneous attributes into a unified space, decoupling expensive LLM invocation from iterative optimization. Furthermore, GRACE cross-validates these external semantics against dataset-internal statistical evidence to ensure alignment with the dataset-specific cluster structure. Ultimately, GRACE matches the scalability of conventional statistics-driven baselines while achieving superior clustering accuracy and conceptual interpretability over 11 competing methods. The source code is available at https://github.com/develop-yang/GRACE-GRACE-A

cs.AI↗

arXiv2026

Spatially resolved thermal dust emission in the L1157 outflow reveals grain-driven molecular enrichment

Protostellar outflow shocks reshape local dust properties and molecular chemistry. The L1157 outflow is an archetypal chemically rich shocked region, but the thermal dust associated with its successive shocks has remained unresolved because molecular-line contamination obscures the broadband continuum. We obtained new James Clerk Maxwell Telescope (825--906 $μ$m) spectral-line observations and Submillimeter Array (1.1--1.4 mm) continuum observations toward L1157 B0-B1-B2, probing spatial scales from 0.4 pc to 1200 au. After removing molecular-line contamination on a pixel-by-pixel basis, we derived the dust temperature, column density, and dust opacity index from continuum data spanning 70 $μ$m to 1.3 mm. The line-corrected continuum maps reveal the dust distribution across successive shocks. The dust opacity index ($β\approx1.8$--2.3) indicates that grains have not grown to millimeter sizes throughout the shocked regions. Combined with previous $\rm NH_3$ observations, we find that the dust emission resolves into compact clumps along the precessing jet, whereas gaseous $\rm NH_3$ peaks at the shock fronts, reaching abundances of $\sim10^{-5}$ relative to $\rm H_2$, even where the 0.85 and 1.3 mm dust emission is detected at only 3--5$σ$. Our newly developed physicochemical shock model shows that $\rm NH_3$ forms predominantly on grain surfaces and is released by shock-induced sputtering, with the highest abundances occurring where post-shock re-adsorption remains inefficient. These results establish spatially resolved dust continuum imaging as a direct observational probe of grain evolution and provide new observational constraints on dust-gas interactions in protostellar shocks.

astro-ph.GA↗

arXiv2026

OneShot: Index-in-Ranking with Neural Scoring for Large-Scale Retrieval

In modern recommendation systems, retrieval serves as a primary stage responsible for filtering billions of candidate items down to thousands prior to refined ranking. To make this massive search effective and efficient, the system relies on ranking accuracy and indexing efficiency. However, these two objectives are traditionally misaligned: while the former optimizes for the alignment between ranking predictions and user behavior, the latter optimizes for a structural grouping of item representations which enables fast search among billions of candidates. Thus, despite extensive efforts to scale up interaction modeling for retrieval, they remain fundamentally limited by the structural misalignment between the ranking objectives and the proximity-learned index. In this work, we address this long-standing dichotomy by proposing a new holistic retrieval framework, OneShot. It is an end-to-end, in-model index learning framework that natively aligns index learning with ranking objectives. Using this joint learning as a structural foundation, OneShot pushes the boundaries of retrieval expressiveness by scaling interaction modeling with neural scoring beyond the persistent dot-product bottleneck. OneShot is fully deployed in Instagram's industrial short-video recommendation system, driving significant wins in user daily sessions, engagement, and time-spent. Additionally, OneShot achieves a $20\%$ recall gain at the operational ranking volume and a 10x efficiency improvement at an equivalent recall level.

cs.IR↗

arXiv2026

Robust 4D Driving Scene Reconstruction from Imperfect Visual Priors

Reconstructing 4D driving scenes in the wild (e.g., internet and AI-generated videos) is critical for diverse autonomous driving simulation. While recent Gaussian Scene Graph (GSG) methods achieve impressive visual quality, they heavily rely on precise priors, such as accurate camera poses and LiDAR depth, or manual annotations. When initialized with noisy priors estimated from in-the-wild videos, existing GSG methods suffer from optimization ambiguity (e.g., entangling camera and agent poses) and topological failures (e.g., missing objects), causing severe rendering artifacts. To enable robust in-the-wild reconstruction, we introduce Adaptive Gaussian Graph (AGG), a self-correcting 4D framework. Our Semantically-Guided Tick-Tock Strategy leverages 2D foundation features to explicitly decouple static background and camera pose updates from dynamic agent learning. Concurrently, our Adaptive Topology Evolution module actively rectifies graph structures by spawning missing agents, reassigning misclassified Gaussians, and pruning false positives. To rigorously evaluate this in-the-wild setting, we introduce Wild-30, a challenging benchmark of internet and generative videos. Extensive experiments on KITTI and Wild-30 validate that AGG consistently outperforms state-of-the-art approaches in visual fidelity and robustness under noisy priors.

cs.CV↗

arXiv2026

Outage-Constrained Environment Division Multiple Access (EDMA) for Pinching-Antenna Systems

Environment division multiple access (EDMA) has emerged as a promising multiple access paradigm, which mitigates inter-user interference by dynamically adjusting pinching antenna (PA) positions to the underlying propagation environment. This paper investigates a multi-user PA-enabled EDMA framework that accounts for probabilistic line-of-sight (LoS) blockages, random non-LoS (NLoS) scattering, and practical inwaveguide attenuation. With the aim of maximizing the total information rate, we formulate a joint PA deployment and power allocation problem subject to statistical rate outage constraints, the transmit power budget, and the feasible deployment region of PAs. We first consider a canonical two-user two-PA scenario and derive closed-form expressions for the outage probabilities, followed by a low-complexity projected gradient descent (PGD)-based algorithm to address the reformulated problem. Then, we extend our design to the general multi-user multi-PA scenario and derive tractable approximations for the outage probabilities by assuming interfering links to be NLoS and applying the Chernoff bounding technique, where a successive convex approximation (SCA)-based algorithm is proposed to handle the resulting nonconvex problem. Simulations validate the superiority of the proposed PA-enabled EDMA design and the effectiveness of the proposed algorithms. Specifically, both the PGD-based algorithm and the SCA-based algorithm achieve near-optimal performance in comparison with the exhaustive search. Furthermore, the PA-enabled EDMA design yields significant performance gains over both PA-enabled and conventional time division multiple access designs.

eess.SP↗

arXiv2026

PI-H2T: Enhancing Long-Tailed Visual Recognition with Permutation-Invariant and Head-to-Tail Feature Fusion

The imbalanced distribution of long-tailed data presents a significant challenge for deep learning models, causing them to prioritize head classes while neglecting tail classes. Two key factors contributing to low recognition accuracy are the deformed representation space and a biased classifier, stemming from insufficient semantic information in tail classes. To address these issues, we propose permutation-invariant and head-to-tail feature fusion (PI-H2T), a highly adaptable method. PI-H2T enhances the representation space through permutation-invariant representation fusion (PIF), yielding more clustered features and automatic class margins. Additionally, it adjusts the biased classifier by transferring semantic information from head to tail classes via head-to-tail fusion (H2TF), improving tail class diversity. Theoretical analysis and experiments show that PI-H2T optimizes both the representation space and decision boundaries. Its plug-and-play design ensures seamless integration into existing methods, providing a straightforward path to further performance improvements. Extensive experiments on long-tailed benchmarks confirm the effectiveness of PI-H2T.

cs.CV↗

arXiv2026

Molecule-dependent Abundance Behavior of Oxygen-bearing Complex Organics in High-Mass Star-Forming Regions: A Uniform 50-source Survey

We present a uniform IRAM-30\,m survey analysis of four oxygen-bearing complex organic molecules (COMs), methanol (CH$_3$OH), acetaldehyde (CH$_3$CHO), methyl formate (CH$_3$OCHO), and dimethyl ether (CH$_3$OCH$_3$), toward 50 high-mass star-forming regions (HMSFRs) associated with 6.7\,GHz methanol masers. Column densities were derived through a homogeneous rotation-diagram approach, with CH$_3$CN used as a proxy excitation-temperature reference when needed. In CH$_3$OH-normalized abundance-ratio space, CH$_3$OCHO/CH$_3$OH and CH$_3$OCH$_3$/CH$_3$OH show the strongest pairwise correlation, whereas the correlations involving CH$_3$CHO are weaker. No clear monotonic trends are found with Galactocentric distance or beam-averaged H$_2$ column density. Comparison with previous observations places the CH$_3$OCHO--CH$_3$OCH$_3$ behavior within the range of earlier abundance-ratio measurements, while CH$_3$CHO shows larger inter-study variation. A representative warm-up chemical model is used only for qualitative comparison with the observed abundance ranges, which are most closely matched during the decline from the post-desorption abundance peaks in the model. These results provide homogeneous beam-averaged abundance-ratio constraints for common O-bearing COMs in high-mass star-forming regions and show that their source-to-source behavior is molecule-dependent rather than fully described by a single common abundance pattern.

astro-ph.GA↗

arXiv2026

Interactive Training 2: Auditable Control Plane for Live Model Training

Experiment trackers show how training is progressing, but changing a live run still usually requires trainer-specific code. We present Interactive Training 2, an open-source control plane for steering training through a shared protocol. Training applications declare which settings and actions they expose, humans and automated controllers submit requests through the same interface, and the training loop validates and applies them at safe control points. A customized Aim workspace combines live metrics and controls with a chronological record of requests and outcomes. We demonstrate the system across five NLP and reinforcement-learning workflows. The released code and traces provide a reusable foundation for auditable human- and agent-guided training.

cs.LG↗

arXiv2026

Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation

Large Language Models are increasingly deployed in Security Operations Centers for log analysis tasks including summarization, alert triage, and threat investigation. These systems ingest logs from external-facing services and process network logs as natural language contexts to generate security insights. We demonstrate that this architectural pattern introduces a critical vulnerability: adversaries can embed prompt injection payloads in log-generating fields that persist in storage and are executed when analysts query the LLM, achieving what we term passive prompt injection. We present LogInject, a systematic framework for evaluating these threats. Using LogInject-1.0, a benchmark of 12,847 log entries including 2,569 adversarial samples, we evaluate three production LLMs across four attack objectives: activity concealment, false positive generation, information exfiltration, and output hijacking. Our findings reveal an up to 88.2% attack success rate (83.4% average across models) under the baseline conditions. We introduce Context Stitching, a novel technique that fragments payloads across multiple log entries to evade stateless filters while exploiting LLM long-context reasoning, achieving a 76.4% success rate. As mitigation, we evaluate layered defenses by combining input filtering, prompt hardening, and output validation, demonstrating a 90.4% attack reduction, although 8.4% residual vulnerability persists. Our results establish that LLM-based log analysis creates an inherent confused deputy vulnerability where untrusted data and trusted instructions compete indistinguishably for model attention, requiring defense in-depth architectures and continued human oversight for security-critical decisions.

cs.CR↗

arXiv2026

RIS-Assisted Downlink Pinching-Antenna Systems: GNN-Enabled Optimization Approaches

This paper investigates a reconfigurable intelligent surface (RIS)-assisted multi-waveguide pinching-antenna (PA) system (PASS) for multi-user downlink information transmission, motivated by the unknown impact of the integration of emerging PASS and RIS on wireless communications. First, we formulate sum rate (SR) and energy efficiency (EE) maximization problems in a unified framework, subject to constraints on the movable region of PAs, total power budget, and tunable phase of RIS elements. Then, by leveraging a graph-structured topology of the RIS-assisted PASS, a novel three-stage graph neural network (GNN) is proposed, which learns PA positions based on user locations, and RIS phase shifts according to composite channel conditions at the first two stages, respectively, and finally determines beamforming vectors. Specifically, the proposed GNN is achieved through unsupervised training, together with three implementation strategies for its integration with convex optimization, thus offering trade-offs between inference time and solution optimality. Extensive numerical results are provided to validate the effectiveness of the proposed GNN, and to support its unique attributes of viable generalization capability, good performance reliability, and real-time applicability. Moreover, the impact of key parameters on RIS-assisted PASS is illustrated and analyzed.

cs.NI↗

arXiv2026

AnchorMoE: Interpretable Time Series Classification via Anchor-Routed MoE

Multivariate time series classification (MTSC) is pivotal in high-stakes domains, such as clinical diagnosis and industrial fault detection, where safe deployment necessitates transparent decision-making. However, isolating the temporal segments that drive model predictions is challenging because discriminative signals in real-world time series are typically sparse, heterogeneous, and heavily obscured by background noise. This paper, therefore, proposes AnchorMoE, an interpretable-by-construction classification framework. Built upon a Mixture-of-Experts (MoE) architecture, AnchorMoE encodes multi-view representations of local patches and routes them to specialized experts, ensuring that the final prediction is formulated as an exact additive decomposition over the input segments, facilitating ante-hoc transparency rather than relying on post-hoc estimations. To maintain the reliability of this decomposition under sparse signal distributions, we introduce a geometric orthogonality constraint that penalizes representational redundancy, compelling distinct experts to specialize in heterogeneous predictive patterns. Furthermore, an uncertainty-aware reliability gate is designed to dynamically calibrate the contribution of each segment, effectively suppressing residual background noise. Extensive experiments on real-world and synthetic benchmarks demonstrate that AnchorMoE achieves highly competitive classification performance while faithfully grounding its decisions in the raw time series.

cs.LG↗

arXiv2026

Spatially Adaptive SWIPT with Pinching Antenna under Probabilistic LoS Blockage

This paper considers a power-splitting (PS)-based simultaneous wireless information and power transfer (SWIPT) system employing a reconfigurable pinching antenna (PA) under probabilistic line-of-sight (LoS) blockage. We formulate a joint optimization of the PA position and PS ratio to maximize the average signal-to-noise ratio (SNR) at the user, subject to its average energy harvesting (EH) and PA placement range. We derive the closed-form solution. Results show that the EH requirement has a deterministic impact on the optimal PA position and its feasible region, requiring the PA close to the user for large channel gain. Moreover, stronger waveguide attenuation lowers the overall SNR and shifts the optimal PA toward the feed point, while heavier LoS blockage degrades the SNR uniformly with little change in the optimal PA position. Spatial PA adaptation combined with dynamic PS ensures robust SWIPT performance, and mechanical reconfigurability enhances sustainability by guaranteeing energy feasibility in dynamic environments.

eess.SP↗

arXiv2026

OmniSCS: Omni Safety-Critical Scenario Synthesis for Autonomous Driving via a Fully Editable Driving World

The synthesis of safety-critical scenarios (SCS) and their evaluation through closed-loop simulations are crucial for developing robust autonomous driving systems. A key aspect of this process involves editing agent states in both appearance and trajectory levels within existing scenes. However, current methods struggle to preserve data fidelity after scene editing and fail to efficiently generate high-quality SCS through such modifications. To overcome these limitations, we propose OmniSCS, an innovative system that generates photorealistic SCS with high physical fidelity while enabling closed-loop testing in synthetic environments. OmniSCS comprises two key modules: 1) A Fully Editable Driving World Construction module that maintains high-fidelity agent appearance and background during scene editing via dual-strategy agent reconstruction and depth-refinement background reconstruction methods. 2) A SCS Synthesis module that facilitates object insertion and agent trajectory editing to synthesize diverse SCS while preserving data fidelity. Experiments on nuScenes, Waymo, and KITTI datasets show that OmniSCS outperforms state-of-the-art methods in edited scene fidelity. We further validate its ability to enhance autonomous driving algorithms and support real-time (13Hz) closed-loop testing. Overall, OmniSCS provides a safer, more effective, and cost-efficient solution for SCS optimization and testing in autonomous driving.

cs.RO↗