Forskningsradar

Science Journals

Peer-reviewade publikationer — 54780 artiklar

Unveiling TCP BBR Dominance in Starlink Internet: Experimental Insights and Analysis
arXiv:2607.07133v1 Announce Type: new Abstract: This experimental study delivers a global assessment of Google's Bottleneck Bandwidth and Round-trip propagation time-version 3 (BBR-v3) Congestion Control Algorithm (CCA) over SpaceX's Starlink network. Leveraging a strategically deployed six-city testbed across five continents, we systematically benchmark BBR-v3 against eight CCAs: Cubic, Hybla, Vegas, LeoCC, Copa, PCC, BBR-v1, and BBR-v2 under both dedicated and concurrent conditions. Our results demonstrate that BBR-v3's advantage is not aggressive bandwidth capture, but a more balanced fairness, loss, and delay trade-off over the Starlink Internet. We develop pragmatic mathematical models that capture Starlink's complex network dynamics and characterize BBR-v3 behavior to better explain the experimental observations. Our extensive evaluation of queue buildup and fairness further demonstrates BBR-v3's capability to maximize throughput in high-latency, variable satellite environments, while maintaining a balance between aggressiveness and fairness. The findings establish BBR-v3 as a compelling CCA for Low Earth Orbit (LEO) satellite networks and provide a principled analytical foundation for next generation satellite Internet transport design.
HumAIN: Human-Aware Implicit Social Robot Navigation
arXiv:2607.07357v1 Announce Type: new Abstract: Effective social robot navigation requires sensitivity to human behavior, often revealed through subtle skeletal cues like gait and orientation. We present Human-Aware Implicit Social Robot Navigation (HumAIN), a novel framework that fuses implicit social cues directly into the planning loop via knowledge distillation. We first employ a transformer-based teacher model that fuses rich multi-modal inputs, including historic images, skeletal keypoints, robot state, and a robot's target goal, to learn robust, human-aware representations for the robot's future trajectory planning. To enable real-time deployment, we then distill this knowledge into a lightweight student model. By optimizing for both trajectory reconstruction and latent feature alignment with the teacher, the student learns to infer complex social dynamics from minimal inputs. Bridging the prediction-planning gap with an efficient distilled architecture, our method enables robots to reason about human behavior in a manner that is adaptive, robust, and socially compliant. We validate HumAIN through extensive experiments, where it improves trajectory prediction metrics by an average of 29.8% across all metrics compared to state-of-the-art baselines. These results highlight the benefit of using implicit, whole-body cues to achieve human-like navigation awareness on resource-constrained platforms.
Non-contact, Real-time, Heart-rate Measurement using Image Processing with Commodity Cameras and AI Agents
arXiv:2607.06598v1 Announce Type: cross Abstract: Heart rate measurement is one of the key requirements for real-time health monitoring, in particular for health caring of elderly people. Traditional heart rate measurement relies on contact sensing mechanisms such as some heart rate measurement devices at medical hospitals or some wearable devices with embedded sensors such as Apple Watch, etc. In this paper, we develop a system for non-contact, real-time, heart rate measurement using image processing with commodity cameras such as an embedded camera on a laptop, where we use an innovative algorithm to capture the relevant signals for the computation of heart rate in a time series in real life environments. The presented heart rate computation (HRC) process is composed with four major steps: (a) identify frames per second of the camera in use, i.e., 30 frames per second for a given camera, (b) face detection (FD) with shape predictor of 68 face landmarks using deep learning (DL) method, (c) time sliding window (TSW) algorithm to de-noise the signal by smoothing out the noise, and (d) compute heart rate based on identified signal periodicity. We test and analyze the developed prototypes against heart rate results by Apple Watch and check the difference range in multiple rounds and compute the mean of the difference for the measurement values of the heart rate of the same person at the same time. We will do further tuning and optimization of the present methods and deploy the system as a personal AI agent [6] for health monitoring as our future directions.
Optimized Instance Alteration for Explaining and Assessing Robustness of Classifiers
arXiv:2607.06637v1 Announce Type: new Abstract: In this work, we propose a unified approach for diagnosing misclassification and assessing the robustness of black-box classifiers. Central to our method is an optimization framework that modifies an instance so that the classifier predicts a specified target label, while ensuring that the modification remains easily explainable. The objective function contains two components: an explainability-aware $L_0$ (XA-$L_0$) penalty that promotes sparse and interpretable modifications, and a classifier loss objective that steers the perturbed instance toward the desired output. This integrated optimization formulation is used both to identify the underlying causes of misclassification and to evaluate robustness by determining how an instance can change within a tolerance region before being reassigned to another class. To quantify robustness, we introduce the Tolerance Region Confusion Matrix (TOR-Confusion Matrix), which measures a classifier's susceptibility by modeling the class-to-class transition probabilities induced by tolerance-bounded perturbations. We validate the proposed method on both image and tabular datasets, demonstrating its ability to jointly deliver interpretability and robustness assessment.
The Approximation Ratio for the Risk of Myopic Bayesian Active Learning for Linear Regression
arXiv:2607.06642v1 Announce Type: new Abstract: Active learning studies the fundamental question: what data should we choose to observe? The greedy algorithm in optimal experiment design is a common heuristic and also equivalent to myopic Bayesian active learning for linear regression, the common framework where long-term planning is replaced with the one-step optimal choice. In this work, we prove a first-of-its-kind approximation ratio for the greedy algorithm's risk that is tight up to an absolute constant. The approximation ratio is linear in the maximum initial leverage score (MILS), a newly identified quantity fundamental to the greedy algorithm's performance. Finally, we illustrate the results with simple numerical simulations.
A Large Language Model-Driven Agent-Based Modeling Framework with Multi-Round Communication for Simulating Vaccine Opinion Dynamics
arXiv:2607.07387v1 Announce Type: new Abstract: Recently, Large Language Models (LLMs) have been utilized in various applications of computational social science and provide the possibility to integrate such models into agent-based modeling to explore the cognitive processes. However, how specific cognitive modules drive individual decisions and macro-level opinion dynamics remains unclear. Therefore, this study introduces a framework that integrates an LLM (Qwen3-8B) into agent-based modeling to investigate this problem, using vaccination opinion dynamics as a case study. We utilize this framework to simulate opinion dynamics among agents with heterogeneous profiles and social networks, evaluating scenarios by enabling different cognitive modules: a memory module and a prompt diversity module. The simulation results reveal that different cognitive modules have opposite impacts on our emergent opinion. Furthermore, the framework reproduces the non-linear behavior patterns of social influence observed in existing research, demonstrating our framework's validity and potential to reach the level 3 validation of agent-based models.
Hydrogen-Bond Donor-Acceptor Imbalance in Low-Frequency Terahertz Water Spectra
arXiv:2607.06780v1 Announce Type: new Abstract: The low-frequency dielectric response of liquid water is commonly described by a dominant Debye relaxation together with additional faster contributions whose microscopic origin remains debated. Here we show that the dielectric function of water between 0.14 and 1.21 THz can be represented by a collective Debye relaxation plus a Drude-Smith term constrained to the zero-dc-conductivity limit. The Drude-Smith spectral weight increases upon heating pure H2O from 20 C to 50 C and decreases upon isotopic substitution (D2O at 20 C vs. H2O at 20 C). Molecular dynamics simulations including nuclear quantum effects show correlated changes in the population of water molecules with unequal numbers of donated and accepted hydrogen-bonds. Ab-initio-based spectra calculations further indicate that the ~0.1-1 THz response contains both nuclear-motion and explicit electronic-polarisation/charge-redistribution contributions. We therefore interpret the excess low-frequency THz response as a localised, mixed nuclear-electronic dielectric response correlated with transient donor-acceptor imbalance in the hydrogen-bond network.
On Explicit Super-Expressive Approximation for Neural Networks
arXiv:2607.06781v1 Announce Type: new Abstract: In this work, we investigate the fixed-architecture neural network approximation with explicit parameter bounds and elementary activations. While prior work demonstrated super-expressive approximation using fixed-size networks, they lack quantitative and non-asymptotic characterizations of parameter magnitude with respect to the approximation error. We resolve this issue by introducing the Chinese Remainder Theorem as a constructive encoding mechanism. For Lipschitz continuous functions on $[0,1]^D$, we construct a width-$\max\{D,4\}$, depth-$5$ network with explicit parameter-error trade-offs. For H\"older-smooth functions in $C^{r,\gamma}_A\left([0,1]^D\right)$, our fixed network of width $\max\{2D,\ D+5N+1\}$ and depth $r + 9$ achieves the parameter magnitude $\mathcal{P}$ bounded by $\log_2 \mathcal{P}=\mathcal{O}\bigl(\varepsilon^{-2D/(r+\gamma)}\log(1/\varepsilon)\bigr)$. This is the dual result compared to those in the parameter-bounded and architecture-unbounded paradigm.
Will AstroForge Collapse the PGM Market?
arXiv:2607.06806v1 Announce Type: new Abstract: AstroForge seeks to mine platinum group metals (PGM) from asteroids. Asteroid reserves appear to be unlimited, and at current market price the gross margin of asteroid mining would be very high. It is natural to ask: when AstroForge successfully demonstrates economic space mining of PGM, will they cause the PGM market to collapse? We answer the question with a non-steady system dynamics model of the PGM market. We find that the market price for PGM will eventually drop towards the much lower cost of asteroid mining, but only after the entire supply has shifted off-world. In the meanwhile, huge fortunes will be made. And everybody on Earth will benefit from new applications of lower-price PGM.
Radiation Damage Cascades in Fullerite Using Molecular Dynamics
arXiv:2607.06962v1 Announce Type: new Abstract: Molecular dynamics is used to study radiation cascades in solid C60 under ambient conditions. Simulations are performed for Primary Knock-On Atom (PKA) energies from 0.1 to 1 keV, and cascades are sampled over many PKA directions to collect statistics. Energies and forces are described using the Environment Dependent Interaction Potential for carbon paired with the Ziegler-Biersack-Littmark potential for short-range interactions, and cascade behaviour is characterized by tracking kinetic energy, hybridization and bond connectivity as a function of time. Compared to most materials, fullerite exhibits an unusual radiation response due to weak thermal transfer between C60 molecules leading to a thermalization phase lasting hundreds of picoseconds. The cascades damage the C60 molecules and link them together, and a linear relation is found between the number of cross-linked molecules and the number of new sp3 atoms. The threshold displacement energy computed is 18 eV, in agreement with experiments
Reliable and Developer-Aligned Evaluation of Agents for Software Engineering
arXiv:2607.06713v1 Announce Type: new Abstract: Large language models are rapidly moving towards closing the development cycle, transitioning from simple assistive companions to autonomous contributors deeply embedded into collaborative development environments. Despite their accelerated adoption, existing evaluation techniques are limited due to their fragmented nature and distorted projection of true model capabilities, often obtained from hypothetical syntactic scenarios. This research aims to bridge this gap by providing a comprehensive evaluation methodology for LLM-powered agents that is grounded in real-world software development practice. Our evaluation approach focuses on contamination-awareness, in-the-wild agentic behavior assessment, and trajectory-aware benchmarks and metrics capturing realistic coding contexts, human-aligned behavior, and model failure modes.
The Power of Backdoor Absorption in Community Training
arXiv:2607.06643v1 Announce Type: new Abstract: Backdoor attacks severely threaten large-scale AI models. When model owners delegate training to external compute providers within a decentralized training paradigm, adversaries can craft stealthy, low-frequency triggers to inject malicious behavior while evading standard audits. Traditionally, detecting these attacks requires a full re-computation of the training steps--a prohibitive overhead that directly contradicts the owner's resource constraints. To address this, we investigate the resilience of continuous optimization dynamics under Byzantine perturbations, where adversaries are forced to compete against a continuous influx of honest updates. Under a threat model where an adversary compromises f out of n total trainers, we quantify the minimum auditing overhead required by the model owner to probabilistically bound the attack success rate. We formalize this injection-absorption dynamic as a Discrete-Time Markov Chain (DTMC). Using this framework, we prove that the success probability of any bounded adversary asymptotically collapses to zero under a defense strategy combining natural absorption, a randomized scheduler, and lazy verification oracle. Empirical results demonstrate significant backdoor suppression with zero utility degradation even when invoking the verification oracle on merely 10% of the total training steps. This approach yields a provably sound and computationally efficient defense for safety-critical AI.
General Incomplete Multimodal Learning via Dynamic Quality Perception
arXiv:2607.06943v1 Announce Type: new Abstract: Multimodal learning robust to missing modalities is essential for real-world applications. Existing methods mainly focus on inter-modality missing, where entire modalities are absent, while overlooking intra-modality degradation, where modalities are present but severely corrupted. In practice, these two types of missing often coexist, making existing approaches ineffective. To address this limitation, we propose General Incomplete Multimodal Learning (GIML), a unified framework that simultaneously handles both inter-modality missing and intra-modality degradation through dynamic quality perception. Specifically, GIML models heterogeneous missing patterns as continuous modality information degradation, enabling degradation-aware adaptive fusion. To achieve reliable quality perception, we introduce a Noise-aware Quality Estimator that learns the mapping from corrupted features to noise intensity through controlled noise injection. Furthermore, we propose a Noise-Semantic Decoupled module that separates semantic information from noise interference. This improves robustness and generalization to unseen corruption patterns. Extensive experiments across datasets with diverse modality types demonstrate the effectiveness and generality of GIML. Code is available at: https://github.com/Yu-Five/GIML.
Converge to Surprise: Evolutionary Self-supervised Image Clustering
arXiv:2607.06887v1 Announce Type: new Abstract: Most self-supervised image clustering models, actually almost all deep learning approaches, are based on gradient descent: In order to calculate the loss, every optimization step requires a clearly defined target, whether a contrastive split, a masked patch or entity, an EMA-teacher output, a pseudo-label, or a differentiable information-theoretic functional. We propose a self-supervised framework that drops this requirement for image clustering. Without any prior knowledge, we have to assume that each pixel is i.i.d. according to the Principle of Maximum Entropy. Taking this as our null hypothesis H0, we define a "surprise score" that measures how unlikely the model's output representation would be under H0. Maximizing the surprise score forces the deep learning model to reject H0 - equivalently, to discover non-random feature from data. Also, here is our fundamental assumption: a surprise score cannot, in general, be reduced to a per-step loss. Hence, we propose the "converge-to-surprise" scheme to optimize our model: an evolution-strategy (ES) outer loop, which directly maximizes the surprise score without needing its gradient, paired with a periodic gradient-descent inner loop, which uses the surprising clusters already discovered by ES as surrogate targets. On standard image benchmarks, our framework achieves new state-of-the-art results in non-parametric self-supervised image clustering - the strictest deep-clustering setting, in which the number of ground-truth classes is not given to the model.
Evaluating LLM Robustness Under Domain-Specific Prompt Perturbations in Public Health Applications
arXiv:2607.06913v1 Announce Type: new Abstract: Large language models (LLMs) are increasingly applied in public health applications, yet their robustness to non-clinical user inputs remains underexplored. We propose a domain specific robustness benchmark that evaluates LLMs under two perturbation types that commonly arise when non-clinical users interact with health AI systems: misinformation framing (MF), where prompt might be injected by false health claims, and layperson rewriting (LR), where patients describe symptoms in everyday language rather than medical terminology. Our goal is to evaluate the stability of LLMs under these perturbation. Experiments show that MF degrades accuracy by 7.2 pp on average with prediction flip rates of 9-38 percent, even when claims are explicitly labelled as unsupported; LR causes only 1.4 pp degradation. These findings highlight two distinct deployment risks in public health settings: models may produce incorrect outputs when users unintentionally carry misinformation into their queries, and may misinterpret clinically relevant details when patients use informal language. Both risks call for perturbation-aware robustness evaluation beyond clean baseline benchmark
Reliable mechanistic operator recovery with biologically-informed neural networks: principles for architecture and optimisation design
arXiv:2607.07425v1 Announce Type: cross Abstract: Many biological processes are governed by complex dynamical mechanisms that remain incompletely understood despite increasing volumes of experimental data. Biologically-informed neural networks (BINNs) seek to address this challenge by embedding mechanistic differential equations into neural network training, enabling interpretable constitutive operators to be recovered directly from sparse and noisy observations. However, reliable operator recovery depends sensitively on network architecture, optimisation strategy, and data informativeness. Here, we present a systematic empirical study of how these factors influence mechanistic inference using BINNs applied to canonical one-dimensional advection-diffusion-reaction partial differential equation models. Across a suite of benchmark problems, we investigate how network expressivity, learning rate, loss weighting, and batch size influence optimisation behaviour and operator recovery. We show that successful mechanistic inference depends on balancing competing objectives rather than maximising any single aspect of the model or optimisation. Moderately expressive architectures outperform overly complex networks, intermediate learning rates improve optimisation stability, balanced data and PDE losses are essential for accurate operator recovery, and intermediate batch sizes provide the best compromise between computational efficiency and reproducibility. We further identify practical diagnostics for recognising common failure modes, including over-fitting, unstable optimisation, and poor mechanistic recovery when the ground truth is unavailable. Together, these findings provide evidence-based guidelines for deploying BINNs as credible tools for biological model discovery.
Causal evidence of racial and institutional biases in accessing paywalled articles and scientific data
arXiv:2509.08299v2 Announce Type: replace Abstract: Scientific progress depends on researchers' ability to access and build upon the work of others. Yet, much published work remains behind expensive paywalls, and even accessible articles often rest on datasets shared only "upon reasonable request" to the authors. Researchers can try to overcome these barriers through informal channels, such as emailing authors directly, but whether such channels are hindered by racial or institutional biases remains unknown. Here we combine survey data, semi-structured interviews, large-scale observational analysis, and two randomized audit experiments to examine disparities in access to scientific knowledge. Surveyed researchers in the Global South report markedly lower institutional access to the literature and depend more heavily on informal channels to obtain papers and data; interviews elaborate the workarounds and racialized frictions they encounter. Our analysis of 250 million articles reveals that Global South researchers cite paywalled papers at significantly lower rates than Global North counterparts--a gap associated with reduced knowledge breadth and scholarly impact. Using citation-context classification, we further find that papers whose data is available only upon request are less likely to be cited for reusing their data, a penalty falling disproportionately on the Global South. To probe mechanisms, we conduct two email audit studies in which fictional PhD students differing in racial background and institutional affiliation request paywalled articles (N = 18,000) and datasets (N = 16,000). Racial identity influences response rates to both requests, whereas institutional affiliation influences access to datasets. These findings reveal how informal gatekeeping can perpetuate structural inequities in science, highlighting the need for stronger data-sharing mandates and more equitable open-access policies.
Dynamic Grammar-Compressed Self-Index in $\delta$-Optimal Space
arXiv:2604.24080v3 Announce Type: replace Abstract: A compressed self-index stores a string in compressed form while supporting locate queries without decompression. For highly repetitive strings, such as those arising in web crawls, versioned documents, and genomic collections, static self-indexes can match the $\delta$-optimal lower bound of $\Omega(\delta \log(n \log \sigma / (\delta \log n)) \log n)$ bits up to constant factors, where $n$ is the string length, $\sigma$ is the alphabet size, and $\delta$ is the substring complexity. Their dynamic counterparts, however, remain scarce: every existing dynamic self-index either fails to attain $\delta$-optimal space, pays $\Omega(\log n)$ time per reported occurrence for locate queries, or has an update time that grows with the maximum value in the longest common prefix (LCP) array of the text. We present the dynamic RR-index, a dynamic grammar-compressed self-index built on the restricted recompression run-length straight-line program (RLSLP). To our knowledge, it is the first dynamic self-index to attain $\delta$-optimal space. The index uses $O(\delta \log(n \log \sigma / (\delta \log n)) \log n)$ bits in expectation, answers locate queries in expected $O(m + \log m \log^{2} n + \mathit{occ} (\log n / \log \log n))$ time, where $m$ is the pattern length and $\mathit{occ}$ is the number of occurrences, and supports insertion of a length-$m'$ string and deletion of a length-$m'$ substring in expected amortized $O(m' \log^{2} n + \log^{3} n)$ time, with no dependence on the maximum LCP value. On eleven highly repetitive corpora, including a $37$ GB Wikipedia dump and a $59$ GB human-chromosome collection, the dynamic RR-index is up to $77\times$ faster than the dynamic r-index for updates and up to $11\times$ faster than other dynamic indexes for locate queries.
Extending Xenakis: From Architectural Geometry to Sonification of the Philips Pavilion
arXiv:2607.06589v1 Announce Type: new Abstract: Architecture and music have been linked through proportion and temporal structure, yet architectural geometry is rarely viewed as a source of generative music. Revisiting Xenakis' one-directional transformation from string glissandi in Metastaseis to the ruled surfaces of the Philips Pavilion, we invert this workflow and sonify the completed Pavilion as a temporal composition. We reconstruct the Pavilion as nine ruled surfaces, extract their governing ruling lines, and subdivide each surface into structural lines and spatial sampling points. Four evenly spaced ruling lines per surface generate continuous string glissandi, while 3357 sampled points develop five density-based energy blocks and a sparse brass and woodwind subsequence. Implemented in Python, the system produces MIDI rendered in Ableton Live, accompanied by a real-time 3D visualization that reveals architectural motion, stasis, and structural contrast through sound and image. In general, this work paves the way for the transfer of architectural geometry as a performable musical structure, extending Xenakis's architectural and musical thinking to sonification and interactive music practice.
Unconditional Lower Bounds for Degree Fault Tolerant Spanners
arXiv:2607.07576v1 Announce Type: new Abstract: We study multiplicative graph spanners in the $f$-degree fault tolerant ($f$-DFT) model, in which the spanner must approximately preserve distances even after any subset of edges of maximum degree $f$ temporarily "fails" and is removed from the graph. We prove that there are $n$-node lower bound graphs for which any $f$-DFT $(2k-1)$-stretch spanner $H$ must have size $$|E(H)| \ge \Omega\left( f^{1-1/k} n^{1+1/k}\right).$$ This matches a lower bound that was previously only known to hold conditionally, under the 1963 girth conjecture of Erd\H{o}s. It also matches the current upper bounds, up to a factor of $\texttt{exp}(k)$. Our proof is an analysis of the so-called Wenger graphs (J. Comb. Theory 1991), via their recent reinterpretation by Szab\'o and by Conlon (Am. Math. Monthly 2021).
Compensator-based inference for signal detection under unknown background: the binned data case
arXiv:2607.06939v1 Announce Type: cross Abstract: The problem of signal detection under an unknown background can be framed as one of inferring the weight of a mixture model with one misspecified component. Banerjee and Algeri (2026) show that, for this problem, the conservativeness of the inference is entirely determined by one single parameter, called the compensator. They demonstrate that, when the data are independent and identically distributed, an inferential approach based on the compensator circumvents the need to estimate the density of the misspecified component and the associated challenges. The main purpose of this manuscript is to broaden the scope of such an approach and extend it to the case in which, as is often encountered in modern experiments in physics and astronomy, the data consist of Poisson counts observed over a large number of bins.
Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey
arXiv:2607.06593v1 Announce Type: new Abstract: Blockchains have evolved from simple distributed ledgers into programmable platforms that process complex application logic and carry significant financial value. All modern Web3 systems share a common goal: providing secure, decentralized, and trustworthy execution in an increasingly interconnected environment. However, this evolution has shifted the attack surface from isolated infrastructure disruptions to programmable economic abuse and cross-domain exploits. In this article, we focus on the research of blockchain attacks and defenses. In particular, we categorize the threat landscape and corresponding mitigation strategies according to both a four-tier layered architecture (network, cryptographic, consensus, and application) and cross-domain trust boundaries. We seek to answer these important questions: How has the research in blockchain security evolved over the past decade, especially with the rise of decentralized finance (DeFi) and cross-chain interoperability? How do local security assumptions fail when protocols are composed, and what are the driving needs for Web3 security research in the future?
Magnetic field generation by the Rayleigh-Taylor instability in laser-driven planar plastic targets
arXiv:2607.06965v1 Announce Type: new Abstract: Magnetic fields generated by the Rayleigh-Taylor instability were measured in laser-accelerated planar foils using ultrafast proton radiography. Thin plastic foils were irradiated with $\sim$4-kJ, 2.5-ns laser pulses focused to an intensity of $\sim$10$^{14}$ W$/$cm$^{2}$ on the OMEGA EP Laser System. Target modulations were seeded by laser nonuniformities and amplified during target acceleration by the Rayleigh-Taylor instability. The experimental data show the hydrodynamic evolution of the target and MG-level magnetic fields generated in the broken foil. The experimental data are in good agreement with predictions from 2-D magnetohydrodynamic simulations.
Interpreting Lambda Calculus in Domain-Valued Random Variables
arXiv:2112.06339v3 Announce Type: replace Abstract: We develop Boolean-valued domain theory and show how the lambda-calculus can be interpreted in using domain-valued random variables. We focus on the reflexive domain construction rather than the language and its semantics. The notion of equality has to be interpreted in the Boolean algebra and when we say that an equation is valid in the model we mean that its interpretation is the top element of the Boolean algebra.
NonTextual Target Attack
arXiv:2510.02999v5 Announce Type: replace Abstract: Existing gradient-based jailbreak attacks on Large Language Models (LLMs) typically optimize adversarial suffixes to align the LLM output with predefined target responses. However, restricting the objective as inducing fixed targets inherently constrains the adversarial search space, limiting the overall attack efficacy. Furthermore, existing methods typically require numerous optimization iterations to fulfill the large gap between the fixed target and the original LLM output, resulting in low attack efficiency. To overcome these limitations, we propose NonTextual Target Attack (NTA), the first gradient-based attack that relies on a non-textual constrained objective to maximize the unsafety probability of the LLM output, without enforcing any response patterns. For tractable optimization, we further decompose this objective into two constrained sub-objectives, which can be approximated by two differentiable unconstrained losses, to iteratively optimize the response and the adversarial prompt in the neighborhood of the original prompt, with a theoretical analysis to validate the decomposition. In contrast to existing attacks, NTA first realizes gradient-based prompt optimization on a non-textual target and significantly expands the attack space, enabling more flexible and efficient exploration of LLM vulnerabilities. Extensive evaluations show that \textsc{NTA} achieves an average attack success rate of 96.8\% against recent safety-aligned LLMs with only 100 optimization iterations on AdvBench, outperforming state-of-the-art gradient-based attacks by over 40\%.