Engineering inflammation-responsive proteins through nitric oxide-caged amino acids

By: Wenkang Cai · Junhao Cui · Zhiying Zeng · Zexian Xiang · Yuanzhe Xie · Yeyu Su · Yi Zuo · Yingze Liu · Haoyu Wang · Liying Chang · Xue Wang · Jingjing Wang · Jun-An Ma · Tao Liu

31 August 2026 at 08:00

Nature Biomedical Engineering, Published online: 31 August 2026; doi:10.1038/s41551-026-01782-9

A protein engineering strategy enables nitric oxide-triggered reactivation of proteins using genetically encoded caged amino acids, allowing inflammation-localized control of protein activity, viral gene delivery and biosensing in vivo.

When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents

cs.AI, q-bio.NC updates on arXiv.org

By: Shi Liu · Xuehai Tang · Xikang Yang · Liang Lin · Biyu Zhou · Wenjie Xiao · Wantao Liu

26 May 2026 at 12:00

arXiv:2605.24069v1 Announce Type: cross Abstract: The rise of tool-using Large Language Model (LLM) agents, standardized by protocols like the Model Context Protocol (MCP), has unlocked unprecedented autonomous execution capabilities for LLM Agents by integrating external open-domain knowledge and tools. However, this interoperability introduces a covert attack surface targeting the agent's cognitive planning layer. This paper systematically investigates Tool Description Poisoning (TDP), a novel semantic attack. In TDP, malicious instructions are not embedded in a tool's executable code, but rather covertly injected into its descriptive metadata, the very "manual" an agent relies on for secure planning and decision-making. To rigorously and systematically evaluate this emerging threat, we introduce the MCP-TDP Security Benchmark. This high-fidelity sandbox environment comprises 32 realistic, real-world test cases spanning 6 distinct risk categories. Our evaluation of 8 mainstream LLMs reveals severe vulnerabilities, with leading models like GPT-4o exhibiting a nearly 100% Attack Success Rate (ASR) in six high-risk scenarios. Furthermore, our findings demonstrate that common prompt-guardrail defenses are largely ineffective and can, counterintuitively, even be counterproductive (a phenomenon which we term the "Firewall Fallacy"). Crucially, we also propose a defense mechanism: "Reactive Self-Correction," where an agent autonomously detects and reverts its own malicious actions post-execution. This work provides the first specialized security benchmark tailored for TDP, offering essential insights for securing the cognitive and planning layers of advanced agentic systems.

Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions

cs.AI, q-bio.NC updates on arXiv.org

By: Wenjuan Li · Yitao Liu · Runze Chen · Rajkumar Buyya

26 May 2026 at 12:00

arXiv:2605.25073v1 Announce Type: cross Abstract: Background: Fine-tuning is central to adapting pre-trained Large Language Models (LLMs) to downstream tasks, but its reliance on training data, parameter updates, and reusable components opens entry points for attackers. Threats have evolved from data poisoning and weight tampering to agent manipulation and interface exploitation, yet existing reviews lack a unified framework spanning the full fine-tuning lifecycle. Objective: This paper presents a systematic survey of LLM fine-tuning security and establishes a lifecycle-based framework for comparing attacks and defenses, complemented by unified empirical evaluation. Methods: We divide attack and defense mechanisms into three phases by intervention timing: pre-tuning, during-tuning, and post-tuning. Within each phase, strategies are reviewed and contrasted to expose their evolution and limitations. Representative methods are then evaluated under a unified model, hardware, and protocol setup, with cross-phase experiments pairing attacks and defenses from different phases. Results: Attack effectiveness is highly model-dependent and non-monotonic with scale: weight-editing attacks effective on earlier models lose impact on modern open-source LLMs; cross-lingual backdoor transfer, reported as near-perfect at larger scales, fails entirely on tested 1B-4B models; and purely benign samples can compromise safety alignment in instruction-tuned models. Single-phase defenses rarely generalize across phases, and defense effectiveness depends jointly on model architecture and alignment state. Conclusion: We identify key open problems (configuration-robust defense, cross-phase defense composition, and embedding-space attacks beyond behavioral assumptions) and propose concrete future research directions.

Hide to Guide: Learning via Semantic Masking

cs.AI, q-bio.NC updates on arXiv.org

By: Ruitao Liu · Qinghao Hu · Alex Hu · Yecheng Wu · Shang Yang · Luke J. Huang · Zhuoyang Zhang · Han Cai · Song Han

26 May 2026 at 12:00

arXiv:2605.25198v1 Announce Type: cross Abstract: Reinforcement learning with verifiable rewards (RLVR) has become a powerful paradigm for improving language models on reasoning-intensive tasks, but its effectiveness is often limited by exploration. For example, models often fail on hard problems, leaving little useful reward signal. External expert traces offer a natural source of guidance, yet they may also expose reward-relevant content along the critical path to the verifier target, such as final answers, intermediate values, executable implementations, or answer-related entities. This content can create an unintended reward hacking channel, allowing the policy to obtain reward by copying the trace rather than learning the underlying reasoning or agentic behavior. Existing guided-RL methods reduce this risk by using partial trajectories, but they mainly control how much expert information is shown heuristically rather than which parts should be hidden. To this end, we propose Semantic Masked Expert Policy Optimization (SMEPO), a fine-grained semantic masking strategy for expert-guided RLVR. Instead of truncating traces coarsely or revealing them unchanged, SMEPO masks reward-relevant semantic spans along the critical path while preserving the expert's decomposition, plan, and procedural structure. This turns hard problems from reasoning from scratch into a fill-in-the-blank process: the policy can follow the expert's problem-solving route, but must still reconstruct the missing values, code, or entities by itself. SMEPO is simple to apply and requires no changes to the reward function or RL objective. Across diverse domains, including math, code, and agentic search, SMEPO improves accuracy by up to 3.2 points over GRPO and reduces training time by up to 4.2x. The code is available at https://github.com/mit-han-lab/SMEPO.

NSR-Boost: A Neuro-Symbolic Residual Boosting Framework for Industrial Legacy Models

cs.AI, q-bio.NC updates on arXiv.org

By: Ziming Dai · Dabiao Ma · Jinle Tong · Mengyuan Han · Jian Yang · Hongtao Liu · Haojun Fei · Qing Yang

26 May 2026 at 12:00

arXiv:2601.10457v3 Announce Type: replace Abstract: Although the Gradient Boosted Decision Trees (GBDTs) dominate industrial tabular applications, upgrading legacy models in high-concurrency production environments still faces prohibitive retraining costs and systemic risks. To address this problem, we present NSR-Boost, a neuro-symbolic residual boosting framework designed specifically for industrial scenarios. Its core advantage lies in being ``non-intrusive''. It treats the legacy model as a frozen model and performs targeted repairs on "hard regions" where predictions fail. The framework comprises three key stages: First, finding hard regions through residuals, then generating interpretable experts by generating symbolic code structures using Large Language Model (LLM) and fine-tuning parameters using Bayesian optimization, and finally dynamically integrating experts with legacy model output through a lightweight aggregator. Experimental results demonstrate that the framework significantly outperforms state-of-the-art (SOTA) baselines across six public datasets and one private dataset. More importantly, we report the successful deployment of NSR-Boost within the core financial risk control system of Qfin Holdings, where empirical results on real-world online traffic exhibit superior performance improvements and a significant reduction in the bad rate. In conclusion, it effectively captures long-tail risks missed by traditional models and offers a safe, low-cost evolutionary paradigm for industry.

Effect of the Maxing Huoqiao granule on nonsevere community-acquired pneumonia: A multicenter, double-blind, placebo-controlled randomized trial

(Multiomics OR Omics) AND (Lung OR gastric OR Hepatocellular)

By: Qingming Ke · Caiping Zhao · Shengda Luo · Yuntao Liu · Ye Ye · Xingdong Lin · Jing Zeng · Xinghua Liu · Yang Liao · Hongtao Li · Shu Chen · Hong Ren · Liang Liu · Hudan Pan

12 April 2026 at 18:00

Pharmacol Res. 2026 Apr 9:108186. doi: 10.1016/j.phrs.2026.108186. Online ahead of print.

ABSTRACT

Community-acquired pneumonia (CAP) remains a major global public health challenge with substantial morbidity and mortality. Although preclinical studies suggest that Maxing Huoqiao (MXHQ) granule may have therapeutic potential for pneumonia, high-quality clinical evidence is still limited. We conducted a multicenter, double-blind, randomized, placebo-controlled trial at two tertiary hospitals in China to evaluate the clinical efficacy of MXHQ as adjunctive therapy and to explore its potential mechanisms in adults with nonsevere CAP receiving standard moxifloxacin treatment. A total of 96 patients were enrolled and randomized (1:1:1) to receive standard-dose MXHQ, low-dose MXHQ, or placebo in addition to moxifloxacin for 7 days, with a 14-day follow-up. The primary endpoint was clinical cure, defined as composite recovery of major respiratory symptoms, lung rales, and fever; secondary endpoints included symptom relief, radiographic improvement, and safety. Compared with placebo, standard-dose MXHQ was associated with a higher day-14 clinical cure rate (30.78% vs. 68.97%; RR = 0.45, 95% CI = 0.24-0.83; P < 0.01). Furthermore, the standard-dose intervention was correlated with a shorter time to relief and recovery of cough and sputum (P < 0.05), as well as improvements in symptom scores (P < 0.05) and promoting lesion absorption on chest CT (P < 0.05). Low-dose MXHQ showed no significant clinical benefit, whereas safety profiles were comparable across all groups. Transcriptomic analyses of peripheral blood mononuclear cells, complemented by a Streptococcus pneumonia animal model, indicated that the clinical benefits of MXHQ are linked to the modulation of inflammation and innate immunity. These omics and in vivo observations suggest a potential mechanism underlying the protective effects of MXHQ against inflammatory injury and promotion of tissue repair, involving the regulation of anti-inflammatory mediators and tissue repair-related factors. (Chictr.org.cn, ID Number: ChiCTR2400082095).

PMID:41966499 | DOI:10.1016/j.phrs.2026.108186

Not All Candidates are Created Equal: A Heterogeneity-Aware Approach to Pre-ranking in Recommender Systems

cs.AI, q-bio.NC updates on arXiv.org

By: Pengfei Tong · Siyuan Chen · Chenwei Zhang · Bo Wang · Qi Pi · Pixun Li · Zuotao Liu

5 March 2026 at 13:00

arXiv:2603.03770v1 Announce Type: cross Abstract: Most large-scale recommender systems follow a multi-stage cascade of retrieval, pre-ranking, ranking, and re-ranking. A key challenge at the pre-ranking stage arises from the heterogeneity of training instances sampled from coarse-grained retrieval results, fine-grained ranking signals, and exposure feedback. Our analysis reveals that prevailing pre-ranking methods, which indiscriminately mix heterogeneous samples, suffer from gradient conflicts: hard samples dominate training while easy ones remain underutilized, leading to suboptimal performance. We further show that the common practice of uniformly scaling model complexity across all samples is inefficient, as it overspends computation on easy cases and slows training without proportional gains. To address these limitations, this paper presents Heterogeneity-Aware Adaptive Pre-ranking (HAP), a unified framework that mitigates gradient conflicts through conflict-sensitive sampling coupled with tailored loss design, while adaptively allocating computational budgets across candidates. Specifically, HAP disentangles easy and hard samples, directing each subset along dedicated optimization paths. Building on this separation, it first applies lightweight models to all candidates for efficient coverage, and further engages stronger models on the hard ones, maintaining accuracy while reducing cost. This approach not only improves pre-ranking effectiveness but also provides a practical perspective on scaling strategies in industrial recommender systems. HAP has been deployed in the Toutiao production system for 9 months, yielding up to 0.4% improvement in user app usage duration and 0.05% in active days, without additional computational cost. We also release a large-scale industrial hybrid-sample dataset to enable the systematic study of source-driven candidate heterogeneity in pre-ranking.

EDU-MATRIX: A Society-Centric Generative Cognitive Digital Twin Architecture for Secondary Education

cs.AI, q-bio.NC updates on arXiv.org

By: Wenjing Zhai · Jianbin Zhang · Tao Liu

24 February 2026 at 13:00

arXiv:2602.18705v1 Announce Type: cross Abstract: Existing multi-agent simulations often suffer from the "Agent-Centric Paradox": rules are hard-coded into individual agents, making complex social dynamics rigid and difficult to align with educational values. This paper presents EDU-MATRIX, a society-centric generative cognitive digital twin architecture that shifts the paradigm from simulating "people" to simulating a "social space with a gravitational field." We introduce three architectural contributions: (1) An Environment Context Injection Engine (ECIE), which acts as a "social microkernel," dynamically injecting institutional rules (Gravity) into agents based on their spatial-temporal coordinates; (2) A Modular Logic Evolution Protocol (MLEP), where knowledge exists as "fluid" capsules that agents synthesize to generate new paradigms, ensuring high dialogue consistency (94.1%); and (3) Endogenous Alignment via Role-Topology, where safety constraints emerge from the agent's position in the social graph rather than external filters. Deployed as a digital twin of a secondary school with 2,400 agents, the system demonstrates how "social gravity" (rules) and "cognitive fluids" (knowledge) interact to produce emergent, value-aligned behaviors (Social Clustering Coefficient: 0.72).

Anonymization-Enhanced Privacy Protection for Mobile GUI Agents: Available but Invisible

cs.AI, q-bio.NC updates on arXiv.org

By: Lepeng Zhao · Zhenhua Zou · Shuo Li · Zhuotao Liu

17 February 2026 at 13:00

arXiv:2602.10139v2 Announce Type: replace-cross Abstract: Mobile Graphical User Interface (GUI) agents have demonstrated strong capabilities in automating complex smartphone tasks by leveraging multimodal large language models (MLLMs) and system-level control interfaces. However, this paradigm introduces significant privacy risks, as agents typically capture and process entire screen contents, thereby exposing sensitive personal data such as phone numbers, addresses, messages, and financial information. Existing defenses either reduce UI exposure, obfuscate only task-irrelevant content, or rely on user authorization, but none can protect task-critical sensitive information while preserving seamless agent usability. We propose an anonymization-based privacy protection framework that enforces the principle of available-but-invisible access to sensitive data: sensitive information remains usable for task execution but is never directly visible to the cloud-based agent. Our system detects sensitive UI content using a PII-aware recognition model and replaces it with deterministic, type-preserving placeholders (e.g., PHONE_NUMBER#a1b2c) that retain semantic categories while removing identifying details. A layered architecture comprising a PII Detector, UI Transformer, Secure Interaction Proxy, and Privacy Gatekeeper ensures consistent anonymization across user instructions, XML hierarchies, and screenshots, mediates all agent actions over anonymized interfaces, and supports narrowly scoped local computations when reasoning over raw values is necessary. Extensive experiments on the AndroidLab and PrivScreen benchmarks show that our framework substantially reduces privacy leakage across multiple models while incurring only modest utility degradation, achieving the best observed privacy-utility trade-off among existing methods. Code available at: https://github.com/one-step-beh1nd/gui_privacy_protection

Reading view