Source author record

Ying Lin

Ying Lin appears in the imported research catalog. Authorship, coauthor and topic links are available while profile ownership is still unclaimed.

ResearcherUnclaimed source record

Artificial Intelligence Cryptography and Security Machine Learning

Catalog footprint

What is connected

3works

3topics

4close collaborators

Actions

Connect this record

Open graph Browse works

Inspect adjacent papers, topics, institutions and collaborators without losing the researcher page.

Building this map preview

BZPEER is loading the nearby papers, people, topics and institutions for this page.

preprint2026arXiv

Are Tools All We Need? Unveiling the Tool-Use Tax in LLM Agents

Tool-augmented reasoning has become a popular direction for LLM-based agents, and it is widely assumed to improve reasoning and reliability. However, we demonstrate that this consensus does not always hold: in the presence of semantic distractors, tool-augmented reasoning does not necessarily outperform native CoT. To explain this performance gap, we propose a Factorized Intervention Framework that isolates the cost of prompt formatting, the overhead of the tool-calling protocol, and the actual gain from executing tools. Our analysis reveals a critical tradeoff: under semantic noise, the gains from tools often fail to offset the "tool-use tax", which is the performance degradation introduced by the tool-calling protocol itself. To address this, we introduce G-STEP, a lightweight inference-time gate to mitigate protocol-induced errors. While this yields partial recovery, our findings suggest that more substantial improvements still require strengthening the model's intrinsic reasoning and tool-interaction capabilities.

preprint2022arXiv

A Generative Adversarial Network-based Selective Ensemble Characteristic-to-Expression Synthesis (SE-CTES) Approach and Its Applications in Healthcare

Investigating the causal relationships between characteristics and expressions plays a critical role in healthcare analytics. Effective synthesis for expressions using given characteristics can make great contributions to health risk management and medical decision-making. For example, predicting the resulting physiological symptoms on patients from given treatment characteristics is helpful for the disease prevention and personalized treatment strategy design. Therefore, the objective of this study is to effectively synthesize the expressions based on given characteristics. However, the mapping from characteristics to expressions is usually from a relatively low dimension space to a high dimension space, but most of the existing methods such as regression models could not effectively handle such mapping. Besides, the relationship between characteristics and expressions may contain not only deterministic patterns, but also stochastic patterns. To address these challenges, this paper proposed a novel selective ensemble characteristic-to-expression synthesis (SE-CTES) approach inspired by generative adversarial network (GAN). The novelty of the proposed method can be summarized into three aspects: (1) GAN-based architecture for deep neural networks are incorporated to learn the relatively low dimensional mapping to high dimensional mapping containing both deterministic and stochastic patterns; (2) the weights of the two mismatching errors in the GAN-based architecture are proposed to be different to reduce the learning bias in the training process; and (3) a selective ensemble learning framework is proposed to reduce the prediction bias and improve the synthesis stability. To validate the effectiveness of the proposed approach, extensive numerical simulation studies and a real-world healthcare case study were applied and the results demonstrated that the proposed method is very promising.

preprint2016arXiv

GID: Graph-based Intrusion Detection on Massive Process Traces for Enterprise Security Systems

Intrusion detection system (IDS) is an important part of enterprise security system architecture. In particular, anomaly-based IDS has been widely applied to detect abnormal process behaviors that deviate from the majority. However, such abnormal behavior usually consists of a series of low-level heterogeneous events. The gap between the low-level events and the high-level abnormal behaviors makes it hard to infer which single events are related to the real abnormal activities, especially considering that there are massive "noisy" low-level events happening in between. Hence, the existing work that focus on detecting single entities/events can hardly achieve high detection accuracy. Different from previous work, we design and implement GID, an efficient graph-based intrusion detection technique that can identify abnormal event sequences from a massive heterogeneous process traces with high accuracy. GID first builds a compact graph structure to capture the interactions between different system entities. The suspiciousness or anomaly score of process paths is then measured by leveraging random walk technique to the constructed acyclic directed graph. To eliminate the score bias from the path length, the Box-Cox power transformation based approach is introduced to normalize the anomaly scores so that the scores of paths of different lengths have the same distribution. The efficiency of suspicious path discovery is further improved by the proposed optimization scheme. We fully implement our GID algorithm and deploy it into a real enterprise security system, and it greatly helps detect the advanced threats, and optimize the incident response. Executing GID on system monitoring datasets showing that GID is efficient (about 2 million records per minute) and accurate (higher than 80% in terms of detection rate).