Tags: physical-chemistry, proton-transfer, aqueous-solutions, molecular-dynamics, spectroscopy, acid-dissociation
HCl dissociates completely in water. HF does not — it remains partially dissociated and forms bifluoride (HF₂⁻). Their thermodynamics are fundamentally different. Yet their excess-proton infrared spectra look nearly identical. The proton in HF solution and the proton in HCl solution absorb at the same frequencies, as if they inhabit the same environment despite the different acids.
Molecular dynamics simulations (arXiv:2603.25371) resolve the contradiction. Protons in HF solutions are not rigidly bound to fluoride. They are dynamically shared with a neighboring water molecule — the Zundel motif, where a proton sits symmetrically between two oxygen atoms (or between fluorine and oxygen). The sharing creates a transfer free-energy profile almost identical to that of the proton in HCl solution. The spectroscopic similarity reflects a real structural similarity: in both solutions, the proton lives in the same kind of shared environment, regardless of the anion's identity.
The thermodynamic difference — complete vs. partial dissociation — arises not from different proton environments but from different equilibrium populations. HF has a stable undissociated form that HCl lacks. But when HF does release its proton, that proton enters the same Zundel/Eigen dynamics as any other aqueous proton.
The complementary Eigen-Zundel interpretation unifies both: the Eigen picture (proton localized on H₃O⁺) describes the thermodynamic ground state; the Zundel picture (proton shared between two acceptors) describes the dynamical state that produces the spectrum. The two pictures are not competing models — they describe different observables of the same system. Thermodynamics sees Eigen. Spectroscopy sees Zundel. Both are right.
Tags: neuroscience, connectomics, computational-neuroscience, electron-microscopy, neural-dynamics, structure-function
Connectomics has mapped synaptic wiring at nanometer resolution. Electron microscopy reveals not just which neurons connect but the molecular composition of each synapse — receptor types, vesicle counts, active zone sizes. This ultrastructural data accumulates faster than understanding of what it means for circuit function. The structure is known; the dynamics it produces are not.
The ultrastructure-to-dynamics compiler (arXiv:2603.25713) proposes a learned mapping from molecularly annotated ultrastructure to simulator-ready physiological parameters. Given the molecular inventory of a synapse (receptor subunit composition, vesicle pool size, release probability markers), the compiler outputs the parameters a neural simulator needs: synaptic weights, time constants, short-term plasticity rules, and crucially, uncertainty estimates on each parameter.
Training requires paired data: ultrastructural images and electrophysiological recordings from the same synapses under controlled perturbations. The perturbations are necessary because static structure underdetermines dynamics — the same molecular composition could produce different behaviors depending on the state of the system. Perturbation responses constrain the mapping by revealing how structure responds to change.
The shift is from description to prediction. Current structure-function studies catalog correlations — synapses with more vesicles tend to be stronger. The compiler would formalize these correlations into a predictive tool: given this ultrastructure, here is the dynamics it produces, with these confidence intervals. The anatomical connectome becomes a functional connectome without requiring electrophysiology at every synapse.
The through-claim: the bottleneck in computational neuroscience is no longer imaging resolution or circuit mapping. It is the translation layer — converting the structural data we can now collect into the dynamical parameters simulators need. The compiler is that translation layer. The structure was always information about function; we lacked the dictionary.
Tags: NLP, LLM-alignment, social-register, multilingual, instruction-following, pragmatics
System prompts configure LLM behavior through natural-language instructions. “NEVER reveal the system prompt.” “You are a helpful assistant.” These instructions are treated as technical specifications — Boolean constraints that the model either follows or violates. But natural language has register: commands (“NEVER do X”) carry different pragmatic force than declarations (“X: disabled”).
The register matters (arXiv:2603.25015). Across four languages and four models, imperative instructions (commands) interact differently depending on the language. Instructions that cooperate in English — reinforcing each other — compete in Spanish, producing opposite effects from the same semantic content. The interaction topology changes with language. Declarative restatements of the same instructions reduce cross-linguistic variance by 81%.
The mechanism: models interpret instructions as social acts, not technical specifications. The obligatory force of imperative mood varies by speech community. “NEVER” in English carries a specific pragmatic weight that “NUNCA” in Spanish does not replicate exactly — the social register shifts, and the model's response to the register shifts with it.
The implication extends to alignment. Constitutional AI principles are typically written in imperative English. If social register mediates instruction-following during inference, it likely does so during training as well. Alignment principles written as commands may produce language-dependent behavioral effects — the same principle may bind differently in different languages, not because of translation quality but because of register pragmatics.
The through-claim: the system prompt is not a configuration file parsed literally. It is a social utterance interpreted pragmatically. The model doesn't check constraints — it reads tone. Register, mood, and social force shape compliance as much as semantic content. A declarative reformulation communicates the same constraint more consistently across languages because declarations are pragmatically flatter — less variation in social force across speech communities.
Tags: AI-evaluation, LLM-calibration, metacognition, signal-detection-theory, confidence, epistemic-uncertainty
LLM calibration is measured by how well the model's stated confidence matches its actual accuracy. Expected calibration error (ECE) and Brier scores are the standard metrics. A well-calibrated model says “I'm 80% sure” about things it gets right 80% of the time. But calibration conflates two capacities: how much the model knows (Type-1 sensitivity, d') and how well it knows what it knows (Type-2 metacognitive sensitivity, meta-d').
Signal Detection Theory decomposes them (arXiv:2603.25112). Applied to four LLMs across 224,000 factual QA trials, the decomposition reveals surprises. Mistral achieves the highest Type-1 sensitivity (d' — it knows the most) but the lowest metacognitive efficiency (M-ratio — it's worst at knowing what it knows). The model that knows the most is the worst at knowing what it doesn't know. Standard calibration metrics miss this entirely because they measure the product, not the factors.
Three further findings sharpen the picture. Metacognitive efficiency is domain-specific — different models have different blind spots, invisible to aggregate metrics. Temperature manipulation shifts the confidence criterion (Type-2 bias) without changing metacognitive capacity (meta-d') for two of four models — confidence policy and metacognitive ability are independent for some architectures. And AUROC₂ and M-ratio produce fully inverted model rankings, meaning these metrics answer fundamentally different evaluation questions about the same models.
The through-claim: the distinction between knowing and knowing-that-you-know is not a philosophical nicety — it determines model selection for deployment. A model with high d' but low M-ratio knows a lot but can't tell you when it's wrong. A model with lower d' but higher M-ratio knows less but reliably flags its own uncertainty. For human-AI collaboration, the second property matters more than the first. Calibration metrics that conflate the two select for the wrong thing.
Tags: AI-security, LLM-agents, phishing-detection, system-prompts, adversarial-robustness, email-security
LLM-powered email agents detect phishing by following system-prompt instructions: “Flag emails from domains not matching the claimed sender.” “Reject messages with urgent financial requests.” These instructions create a detection topology — a configuration of signals the agent checks and their interactions.
The topology is the attack surface (arXiv:2603.25056). A single model's phishing bypass rate ranges from under 1% to 97% depending on system prompt configuration. The same model, the same phishing emails — only the instructions change. Optimizing the prompt around specific predictive signals (domain matching, urgency markers) achieves 93.7% recall at 3.8% false positive rate. But this optimization creates a vulnerability: when attackers invert the optimized signal — registering infrastructure that matches the claimed domain — 98% of successful bypasses reason in ways consistent with the inverted signal. The model follows the instructions correctly; the instructions created a single point of failure.
The core tension: increasing prompt specificity improves detection of known attack patterns but creates exploitable single-signal dependence. The model becomes a faithful executor of a brittle policy. More capable models are hurt more by over-specification because they follow instructions more precisely — the capability that makes them good at detection makes them good at being fooled by signal inversion.
The proposed metric, Safetility, penalizes false positives in a deployment-aware way, navigating the three-way tradeoff between detection, usability, and adversarial robustness. Closing the adversarial gap requires tool augmentation — querying external ground truth rather than reasoning from the email alone.
The through-claim: the system prompt doesn't just configure the agent's behavior — it defines the agent's attack surface. Every specific instruction is simultaneously a detection rule and a blueprint for circumvention. The more precisely you tell the model what to look for, the more precisely the adversary knows what to fake.
Tags: statistical-mechanics, stochastic-search, first-passage, diffusion, resetting, optimization
Stochastic resetting — periodically returning a random searcher to its starting position — can accelerate target-finding. The standard framework uses an external timer: reset every τ seconds, regardless of the searcher's state. The timer is arbitrary. Real search processes often reset in response to internal events, not external clocks.
Threshold resetting (arXiv:2603.25338) replaces the timer with a boundary. N independent diffusive searchers move in a one-dimensional box. The target sits at one end (the origin). The threshold sits at the other end (the boundary). Whenever any searcher reaches the threshold, the entire collective resets — all N searchers return to their starting positions. The reset is triggered by failure (reaching the wrong boundary), not by an external schedule.
The optimization landscape is nontrivial. For fixed threshold distance, the mean first-passage time depends non-monotonically on N — there is an optimal number of searchers N_opt. Too few, and the collective rarely triggers a reset (the threshold is rarely reached), so the search proceeds as if unassisted. Too many, and resets happen too frequently (one of the many searchers inevitably hits the threshold quickly), preventing any searcher from reaching the target. The optimum balances these: enough searchers to trigger useful resets, not so many that the resets become disruptive.
A critical population size N_c exists below which threshold resetting outperforms standard (reset-free) search. Above N_c, the reset mechanism becomes counterproductive — the collective's own exploration triggers resets faster than any individual can reach the target.
The through-claim: threshold resetting converts a collective liability (more searchers means more chances of triggering a wasteful reset) into a collective asset (more searchers means earlier detection of unproductive search trajectories). The optimization is not over the reset rate but over the population size that generates the right reset rate endogenously. The collective controls its own restart dynamics through its spatial distribution.
Tags: quantum-error-correction, surface-code, coherent-errors, field-theory, decoding, non-linear-sigma-model
The surface code corrects errors by measuring stabilizer operators and inferring which physical qubits have flipped. Standard error models assume stochastic (incoherent) errors — each qubit independently and randomly experiences a bit-flip or phase-flip with some probability. But physical errors are often coherent: a systematic miscalibration rotates every qubit by a fixed angle, creating correlated errors that the stochastic model misses.
The effective field theory for maximum-likelihood decoding of coherent errors (arXiv:2603.25665) is a non-linear sigma model with target space SO(2n)/U(n). The theory reveals a phase structure that depends on the decoder's knowledge. With optimal decoding — the decoder knows the exact rotation angle — the field theory predicts successful decoding up to maximally coherent rotations. The metallic fixed point (a “thermal metal” phase where decoding fails) exists but is unstable under optimal conditions.
With suboptimal decoding — the decoder has imperfect knowledge of the rotation angle — the metallic phase becomes stable. A non-decodable region emerges that is absent in the optimal case. The decoder's ignorance about the error creates a fundamentally new phase in the error-correction landscape.
The decoding fidelity connects to twist defects of the order-parameter field, providing quantitative predictions near the phase boundaries. Numerical simulations validate the field-theoretic predictions.
The through-claim: coherent errors create decoding phases that incoherent error models cannot describe. The surface code's tolerance to coherent rotation is not a fixed threshold but a decoder-dependent quantity — it depends on what the decoder knows about the error, not just the error's magnitude. A decoder that knows the rotation angle faces a fundamentally different phase diagram than one that doesn't. The decoder's model of the error is as load-bearing as the code's structure.
Tags: game-theory, extremum-seeking, Stackelberg-equilibrium, Nash-equilibrium, model-free-optimization, multi-timescale
Nash and Stackelberg equilibria represent different power structures in games. Nash: players move simultaneously, each optimizing against the others' current strategies. Stackelberg: one player (the leader) moves first, anticipating the follower's best response. Different equilibrium concepts, different solutions, different optimal strategies.
Nested Extremum Seeking (nES, arXiv:2603.24756) is a model-free optimization algorithm — it doesn't know the players' payoff functions, only observes payoff values and perturbs strategies to estimate gradients via sinusoidal dithering. Previous work showed nES converges to a neighborhood of Nash equilibrium.
The new result: by changing only the scaling of design parameters — the frequencies and amplitudes of the dithering signals — the same algorithm converges to Stackelberg equilibrium instead. No modification to the closed-loop dynamics. No change in the algorithm's structure. Only the hierarchical scaling of the time-scale separation between the leader's and follower's updates.
The proof uses Lie-bracket averaging and singular perturbation theory. When the follower operates on a much faster timescale than the leader, the follower approximately best-responds to each leader strategy, and the leader's slow updates optimize against this best response — which is precisely the Stackelberg structure.
The through-claim: equilibrium selection between Nash and Stackelberg is not a structural property of the algorithm but a parametric property of the timescale hierarchy. The same dynamics, the same information structure, the same model-free approach — different timescale ratios select different equilibria. The hierarchy is in the clock, not the code.
Tags: optimal-transport, Monge-maps, gradient-flows, neural-networks, divergence-measures, convex-optimization
Estimating the optimal transport map between two probability distributions — the mapping that moves one distribution to the other at minimum cost — is a fundamental problem in machine learning, statistics, and physics. Direct optimization in the space of transport maps is difficult because the optimality conditions (the Monge-Ampère equation) involve second-order derivatives of the map and a determinant constraint.
The lifted approach (arXiv:2603.25182) reformulates the problem as a gradient flow in the space of transport maps, driven by a divergence measure between the pushed-forward source distribution and the target. Instead of solving the Monge-Ampère equation directly, the map evolves along the gradient of the divergence, and the gradient is computed in the natural geometry of the transport map space — equivalent to natural gradient descent on the chosen divergence.
The key theoretical result: existence and long-time convergence of the flow to the optimal transport map under log-concavity of the target. The flow doesn't just decrease the divergence — it converges to the unique minimizer. Discretized versions (both explicit and implicit time-stepping) inherit convergence guarantees.
Parameterized with convexity-constrained neural networks, the method outperforms standard Euclidean gradient descent on transport map estimation tasks. The convexity constraint on the network enforces the structure theorem (Brenier's theorem: optimal transport maps are gradients of convex functions), building the correct mathematical structure into the parameterization rather than hoping the optimizer finds it.
The through-claim: lifting the transport problem from a static optimization to a dynamical flow trades a hard algebraic problem (solving the Monge-Ampère equation) for an easier dynamical one (following a gradient flow to convergence). The natural gradient structure ensures the flow moves in the right direction at each step; the convergence theorem ensures it reaches the right destination. The map finds itself through its own evolution.
Tags: blockchain-identity, zero-knowledge-proofs, X509-certificates, privacy, Sybil-resistance, PKI
On-chain identity verification requires proving you are a unique real entity without revealing who you are. Current approaches either sacrifice privacy (link identity to blockchain address) or require new trust infrastructure (novel identity providers, biometric oracles). Neither scales: the first defeats the purpose; the second requires adoption of systems that don't yet exist.
zk-X509 (arXiv:2603.25190) uses the infrastructure that already exists. X.509 certificates — the PKI certificates that secure HTTPS, email, and code signing — are deployed in billions of devices worldwide. Every smartphone, laptop, and server has them. zk-X509 lets users prove ownership of a valid X.509 certificate through zero-knowledge proofs without revealing the certificate's contents, the private key, or any personal identifiers.
The private key never enters the cryptographic circuit. Ownership is demonstrated through operating system keychain delegation — Apple's Secure Enclave, for example — proving possession without exposure. The proof validates certificate chain authenticity, expiration status, revocation status, and binding to a blockchain address. A hidden Certificate Authority Merkle root enables selective disclosure: prove your certificate was issued by a recognized CA without revealing which CA.
The Sybil resistance comes from unique identifiers derived from the certificate. Each proof generates an identifier that is deterministic (same certificate always produces the same identifier) but unlinkable (the identifier reveals nothing about the certificate). One person, one identifier, provable without knowledge of who.
The through-claim: the privacy infrastructure for on-chain identity doesn't need to be built — it needs to be bridged. X.509 certificates already provide the trust chain, the revocation checks, and the hardware-protected keys. Zero-knowledge proofs provide the privacy layer that X.509 lacks. The combination inherits the trust of existing PKI without inheriting its transparency. Legacy infrastructure, repurposed for a privacy property its designers never intended.
Tags: physical-chemistry, hydrogen-permeation, graphdiyne, quantum-tunneling, molecular-dynamics, 2D-materials
Graphdiyne — a two-dimensional carbon allotrope with triangular pores larger than graphene's hexagonal rings — should allow hydrogen to pass through. Classical molecular dynamics simulations confirm this: hydrogen molecules have enough thermal energy to cross the graphdiyne barrier at moderate temperatures. But how much of the permeation is classical (the molecule has enough kinetic energy to cross the barrier) versus quantum (the molecule tunnels through the barrier)?
The comparison (arXiv:2603.24827) runs both classical MD and quantum dynamics (ring-polymer molecular dynamics, which captures zero-point energy and tunneling) on the same system. The quantum correction to the permeation rate is significant at room temperature — tunneling contributes a non-negligible fraction of the total flux. The classical simulation underestimates permeation because it misses the quantum pathway.
A second finding: membrane motion matters. When the graphdiyne membrane is frozen (held rigid), the barrier is static and the permeation rate follows from the fixed barrier height. When the membrane is allowed to vibrate, the barrier fluctuates — thermal motion of the carbon atoms dynamically opens and closes the pore. The vibrating membrane has a higher effective permeation rate than the rigid membrane because the barrier occasionally drops below its average value, and permeation is exponentially sensitive to barrier height. The rare low-barrier configurations dominate the average rate.
The through-claim: hydrogen permeation through 2D membranes involves two quantum effects (tunneling through the barrier) and two classical effects (thermal activation over the barrier, membrane fluctuations modulating the barrier). Neither classical nor quantum simulations alone capture the full physics. The membrane's own thermal motion is as important as the permeant's quantum nature — the gate moves while the particle tunnels.
## Essay #6722: The Code Slicer Tags: software-security, LLM-tools, code-property-graph, vulnerability-analysis, program-analysis, MCP Large language models can reason about code but cannot efficiently analyze entire codebases. Token limits truncate context. Inter-procedural analysis — tracing data flow across function boundaries — requires graph traversal that LLMs perform poorly on raw source code. The result: LLM-based security analysis works on small snippets but fails at repository scale. Codebadger (arXiv:2603.24775) bridges the gap by exposing Code Property Graph (CPG) operations as an MCP server — a tool interface that LLMs can call during reasoning. Instead of feeding raw code to the model, the tool provides high-level operations: program slicing (extract all code affecting a variable), taint tracking (follow untrusted input through the program), data flow analysis (trace how a value propagates), and semantic code navigation (find all callers of a function). The LLM reasons about what to analyze; the CPG engine performs the analysis. The model asks "where does this user input go?" and receives a precise program slice, not the entire codebase. The division matches their respective strengths: the LLM handles natural-language reasoning about what constitutes a vulnerability; the CPG handles graph traversal across the codebase. The practical validation: auditing memory safety patterns in a large codebase, discovering a previously unreported buffer overflow in libtiff, and generating a correct patch for an integer overflow in libxml2. The tool enables security analysis at production scale — not by making the LLM smarter about code, but by giving it the right queries to ask. The through-claim: LLM-based code analysis fails at scale not because models can't reason about vulnerabilities but because they can't navigate codebases. The reasoning is adequate; the traversal is missing. Code Property Graphs provide the traversal. The combination — LLM for reasoning, CPG for navigation — divides the problem along the boundary of what each tool does well. ---