Nanjing University of Aeronautics and Astronautics

Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.

Tool-using LLM agents turn model output into real actions, making indirect prompt injection an execution-security problem. SecureGARD inserts an executable ontology between planning and tool execution, grounding heterogeneous tool calls into shared semantic actions and judging each as ready, waiting, or forbidden against the current task state. Under benign and indirect-injection settings on AgentDojo, ASB, and AgentDyn, the observed attack success rate is 0% on both backbones, with higher task utility under attack than the compared baselines.

Large language models refuse the same harmful request in one language but may comply when it is rephrased in another. Researchers first identified safety-related neurons independently within each language, then took the intersection of the candidate sets from six languages to obtain a cross-lingually shared "safety kernel," and tested its functional role with activation suppression and activation-state transfer. Building on it, SK-Masked LoRA restricts fine-tuning updates to the feed-forward network output dimensions corresponding to the safety kernel, lowering attack success rates across several models and multilingual safety benchmarks, with some effect on languages excluded from kernel discovery.

Large language models refuse the same harmful request in one language but may comply when it is rephrased in another. Researchers first identified safety-related neurons independently within each language, then took the intersection of the candidate sets from six languages to obtain a cross-lingually shared "safety kernel," and tested its functional role with activation suppression and activation-state transfer. Building on it, SK-Masked LoRA restricts fine-tuning updates to the feed-forward network output dimensions corresponding to the safety kernel, lowering attack success rates across several models and multilingual safety benchmarks, with some effect on languages excluded from kernel discovery.

Instead of a fixed intervention chosen in advance, Q-NeuS reads each query's own internal activations to decide which feed-forward neurons to amplify, improving every one of seven models from 3B to 32B parameters across three benchmarks.

Instead of a fixed intervention chosen in advance, Q-NeuS reads each query's own internal activations to decide which feed-forward neurons to amplify, improving every one of seven models from 3B to 32B parameters across three benchmarks.

A Peking University-led team aligned routine single-lead ECG with physician-authored echocardiography reports to train AnyECG-Echo, a screening framework that resolves 13 fine-grained structural heart disease subtypes at once. Earlier AI-ECG models mostly required 12-lead input, were validated within a single health system, or needed per-condition manual labels. Across internal, temporal and geographically independent external cohorts totaling 25,222 patients, the framework reached high AUROC for high-impact subtypes such as reduced left ventricular systolic function, global heart enlargement and mitral stenosis, and retained usable discrimination in the external cohort.

A Peking University-led team aligned routine single-lead ECG with physician-authored echocardiography reports to train AnyECG-Echo, a screening framework that resolves 13 fine-grained structural heart disease subtypes at once. Earlier AI-ECG models mostly required 12-lead input, were validated within a single health system, or needed per-condition manual labels. Across internal, temporal and geographically independent external cohorts totaling 25,222 patients, the framework reached high AUROC for high-impact subtypes such as reduced left ventricular systolic function, global heart enlargement and mitral stenosis, and retained usable discrimination in the external cohort.

The work proposes GeoScaffold, a geometric supervision framework that first learns a compact depth tokenizer on depth maps from training trajectories and freezes it, then fine-tunes the policy with a handful of learnable geometry query tokens whose hidden states reconstruct navigation-critical geometry such as depth, connectivity, and traversability, thereby internalizing geometry into the policy itself; after training the tokenizer, target generators, and reconstruction heads are discarded, leaving the backbone and action interface unchanged, and experiments show it consistently outperforms leading vision-only navigators on continuous VLN benchmarks, offering a practical paradigm for lightweight edge deployment of spatially aware embodied navigation models.

The work proposes GeoScaffold, a geometric supervision framework that first learns a compact depth tokenizer on depth maps from training trajectories and freezes it, then fine-tunes the policy with a handful of learnable geometry query tokens whose hidden states reconstruct navigation-critical geometry such as depth, connectivity, and traversability, thereby internalizing geometry into the policy itself; after training the tokenizer, target generators, and reconstruction heads are discarded, leaving the backbone and action interface unchanged, and experiments show it consistently outperforms leading vision-only navigators on continuous VLN benchmarks, offering a practical paradigm for lightweight edge deployment of spatially aware embodied navigation models.