arXiv subjects

Akira Ito

Publications and source records attributed to Akira Ito.

14 recordsLinked to original sources

arXiv2026

Transforming Keystroke Noise to Text: Self-Supervised Acoustic Eavesdropping Attacks on Keyboards

We present a self-supervised acoustic eavesdropping attack that reconstructs typed text solely from keystroke sounds, without requiring labeled data for the target device. The proposed attack enables stealthy eavesdropping in two real-world scenarios-physical spaces (public and semi-public) and online meetings. Our method combines unsupervised acoustic clustering with Transformer-based language model inference and iterative self-training, enabling stable character inference under highly uncertain acoustic-to-character mappings. We demonstrate that the proposed method achieves over 99% reconstruction accuracy with only 100-150 observed keystrokes under a close-proximity recording setup using a smartphone placed near the target device, significantly outperforming prior unsupervised baselines in low-data regimes. We further evaluate robustness across multiple laptop platforms and in realistic acquisition channels, including distance recording from approximately 3 meters away on the same desk, through-the-wall eavesdropping with a contact microphone, and background keyboard noise in online conferencing systems. Across these scenarios, the proposed method achieves high reconstruction accuracy (often exceeding 90%) with approximately 150-250 observed keystrokes. These results indicate that accurate text reconstruction from keystroke sounds is feasible in practice under an audio-only setting, even with limited observed keystrokes and without requiring device-specific labeled data, highlighting a realistic and previously underestimated privacy risk.

cs.CR↗

arXiv2026

Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

Backdoor attacks pose a serious threat to the safety and reliability of Large Language Models (LLMs), as they cause models to behave normally on clean inputs while producing attacker-specified responses when hidden triggers are present. Removing such unknown backdoors is particularly challenging when the defender does not know the backdoor attack types or the internal mechanisms formed through backdoor training. In this work, we propose a simple but effective backdoor removal method based on shared internal mechanisms across different backdoors. First, we show that different backdoors with the same task (attack objective) induce similar trigger-activated changes in the internal activations. Motivated by this observation, our method intentionally embeds a backdoor with a known trigger (\emph{dummy backdoor}) and then removes it through further fine-tuning on dummy-triggered inputs paired with clean responses. Since the dummy backdoor and the unknown backdoor can rely on shared internal mechanisms, removing the dummy backdoor also reduces the effect of the unknown backdoor. We evaluate our method on three backdoor attack types across multiple model families. Experimental results show that our method substantially reduces the attack success rate of the unknown backdoor while preserving model utility, outperforming representative existing defense methods in both backdoor removal effectiveness and utility preservation. These findings suggest that a defender-controllable backdoor can serve as a helpful proxy for mitigating unknown backdoors in generative LLMs.

cs.CR↗

arXiv2026

Comprehensive neutrino light curves and spectra: from pre-supernova evolution to early supernova phase

We present the first systematic study of neutrino emissions from massive stars, continuously tracking the late evolutionary stages through the early core-collapse supernova phase. Using progenitor and supernova models, we analyze the neutrino luminosities and spectra for progenitors with initial masses of 10--40~$M_\odot$. Our systematic analysis reveals that the compactness parameter ($\xi_{2.5}$) and carbon-oxygen core mass ($M_{\text{CO}}$) exhibit strong correlations with neutrino emission. In the pre-supernova phase, the time-integrated number of neutrinos correlates with $\xi_{2.5}$ when integrated over the final day and with $M_{\text{CO}}$ for longer durations. For the early supernova phase ($<200$ ms post-bounce), the neutrino properties are relatively insensitive to the specific stellar evolution code used, allowing for a reliable extraction of physical correlations. We confirm that the neutrino emission features, including the electron neutrino burst properties and accretion-powered luminosity of other species, reflect the progenitor's compactness. An evaluation of the observational feasibility for a nearby progenitor using a False Alarm Rate approach suggests that these correlations can persist even under practical detection conditions. Such a joint analysis of both phases provides complementary constraints on the internal structure. All calculated time-series data will be made publicly available.

astro-ph.HE↗

arXiv2025

Robust Backdoor Removal by Reconstructing Trigger-Activated Changes in Latent Representation

Backdoor attacks pose a critical threat to machine learning models, causing them to behave normally on clean data but misclassify poisoned data into a poisoned class. Existing defenses often attempt to identify and remove backdoor neurons based on Trigger-Activated Changes (TAC) which is the activation differences between clean and poisoned data. These methods suffer from low precision in identifying true backdoor neurons due to inaccurate estimation of TAC values. In this work, we propose a novel backdoor removal method by accurately reconstructing TAC values in the latent representation. Specifically, we formulate the minimal perturbation that forces clean data to be classified into a specific class as a convex quadratic optimization problem, whose optimal solution serves as a surrogate for TAC. We then identify the poisoned class by detecting statistically small $L^2$ norms of perturbations and leverage the perturbation of the poisoned class in fine-tuning to remove backdoors. Experiments on CIFAR-10, GTSRB, and TinyImageNet demonstrated that our approach consistently achieves superior backdoor suppression with high clean accuracy across different attack types, datasets, and architectures, outperforming existing defense methods.

cs.LG↗

arXiv2025

A Dual-Resolution Prescription in the $S_N$ Method for Boltzmann Neutrino Transport I: Proof of Principle and the Resolution of Collision Term

We propose a dual-resolution prescription meant for the Boltzmann neutrino transport, in which the advection and collision terms are calculated with different angular resolutions in momentum space. The purpose is to address the issue of the low resolution that afflicts the $S_N$ method in the multi-dimensional neutrino transport simulations for core-collapse supernovae. We handle with a high resolution the advection term alone, assuming that the collision term does not require such high resolutions. To confirm this surmise as well as our new conversion scheme, from low- to high-angular resolutions and vice versa, we run a couple of experimental one-zone (in space) simulations. Neutrino scatterings on nucleons are considered with small recoils fully taken into account whereas the advection term is replaced by the angle- and energy-dependent source terms that are designed to mimic the results of a Boltzmann simulation, inducing the anisotropy in momentum space. For the conversion from a low-resolution distribution function to a high-resolution one, we employ a polynomial interpolations in the zenith and azimuth directions separately with the number conservation and continuity (and periodicity only in the azimuth direction). We find that this dual-resolution scheme works well and that the current angular resolution employed in the canonical supernova simulations with our Boltzmann solver or a bit better in the $\phi_\nu$ direction will be sufficient for the collision terms if they are coupled with the advection terms calculated with a high-angular resolution via this prescription.

astro-ph.HE↗

arXiv2025

Do We Really Need Permutations? Impact of Model Width on Linear Mode Connectivity

Recently, Ainsworth et al. empirically demonstrated that, given two independently trained models, applying a parameter permutation that preserves the input-output behavior allows the two models to be connected by a low-loss linear path. When such a path exists, the models are said to achieve linear mode connectivity (LMC). Prior studies, including Ainsworth et al.(2023), have reported that achieving LMC requires not only an appropriate permutation search but also sufficiently wide models (e.g., a 32 $\times$ width multiplier for ResNet-20). This is broadly believed to be because increasing the model width ensures a large enough space of candidate permutations, increasing the chance of finding one that yields LMC. In this work, we empirically demonstrate that, even without any permutations, simply widening the models is sufficient for achieving LMC when using a suitable softmax temperature calibration. We further explain why this phenomenon arises by analyzing intermediate layer outputs. Specifically, we introduce layerwise exponentially weighted connectivity (LEWC), which states that the output of each layer of the merged model can be represented as an exponentially weighted sum of the outputs of the corresponding layers of the original models. Consequently the merged model's output matches that of an ensemble of the original models, facilitating LMC. To the best of our knowledge, this work is the first to show that widening the model not only facilitates nonlinear mode connectivity, as suggested in prior research, but also significantly increases the possibility of achieving linear mode connectivity.

cs.LG↗

arXiv2025

Is the Hard-Label Cryptanalytic Model Extraction Really Polynomial?

Deep Neural Networks (DNNs) have attracted significant attention, and their internal models are now considered valuable intellectual assets. Extracting such a model via oracle access to a DNN is conceptually similar to extracting a secret key from a block cipher. Consequently, cryptanalytic techniques, particularly differential-like attacks, have been actively explored. ReLU-based DNNs are the most common and widely deployed architectures. While early works (e.g., Crypto 2020, Eurocrypt 2024) assume access to exact output logits, which are typically not exposed, more recent works (e.g., Asiacrypt 2024, Eurocrypt 2025) focus on the hard-label setting, where only the final classification result (e.g., "dog" or "car") is available. Notably, Carlini et al. (Eurocrypt 2025) showed that model extraction is feasible in polynomial time even under this restricted setting. In this paper, we show that a key assumption underlying their attack becomes increasingly unrealistic as the target depth grows. While prior works noted neurons whose activation states rarely change, we analyze their concrete impact on hard-label extraction: even a single neuron that is (almost) always active can prevent the attack from proceeding unless its parameters are recovered, and ignoring it incurs a non-negligible error. A straightforward solution is to extract these parameters by observing a state switch of such a neuron, but observing such a switch becomes exponentially harder as depth increases, implying that hard-label extraction is not always polynomial time. To address this limitation, we propose a novel attack called cross-layer extraction. Rather than extracting secret parameters (e.g., weights and biases) directly, we exploit cross-layer interactions to recover them from deeper layers, reducing query complexity and addressing limitations of existing approaches.

cs.LG↗

arXiv2025

Sparse-Autoencoder-Guided Internal Representation Unlearning for Large Language Models

As large language models (LLMs) are increasingly deployed across various applications, privacy and copyright concerns have heightened the need for more effective LLM unlearning techniques. Many existing unlearning methods aim to suppress undesirable outputs through additional training (e.g., gradient ascent), which reduces the probability of generating such outputs. While such suppression-based approaches can control model outputs, they may not eliminate the underlying knowledge embedded in the model's internal activations; muting a response is not the same as forgetting it. Moreover, such suppression-based methods often suffer from model collapse. To address these issues, we propose a novel unlearning method that directly intervenes in the model's internal activations. In our formulation, forgetting is defined as a state in which the activation of a forgotten target is indistinguishable from that of ``unknown'' entities. Our method introduces an unlearning objective that modifies the activation of the target entity away from those of known entities and toward those of unknown entities in a sparse autoencoder latent space. By aligning the target's internal activation with those of unknown entities, we shift the model's recognition of the target entity from ``known'' to ``unknown'', achieving genuine forgetting while avoiding over-suppression and model collapse. Empirically, we show that our method effectively aligns the internal activations of the forgotten target, a result that the suppression-based approaches do not reliably achieve. Additionally, our method effectively reduces the model's recall of target knowledge in question-answering tasks without significant damage to the non-target knowledge.

cs.CL↗

arXiv2024

Muon-induced collisional flavor instability in core-collapse supernova

Neutrinos are known to undergo flavor conversion among their three flavors. In the theoretical modeling of core-collapse supernova (CCSN), there has been a great deal of attention to recent discoveries of a new type of neutrino flavor conversions, namely collisional flavor instability (CFI), in which the instability is induced by the flavor-dependent decoherence due to the disparity of neutrino-matter interactions among flavors. In this paper, we study how the appearance of on-shell muons and associated neutrino-matter interactions can impact CFIs based on linear stability analysis of flavor conversions. Some striking results emerge from the present study. First, we analytically show that breaking beta- and pair equilibrium is a necessary condition to trigger CFIs. This also indicates that CFIs with on-shell muons could appear in $e \tau$ and $\mu \tau$ neutrino mixing sectors in very high-density region ($\gtrsim 10^{13} {\rm g/cm^{3}}$), exhibiting a possibility of large impacts of CFIs on CCSN. Second, resonance-like CFIs, having a much higher growth rate than normal CFIs, can be triggered by muons. The resonance point of CFIs is different between $e \tau$ and $\mu \tau$ sectors; the former (latter) occurs at $\mu_{e (\mu)} = \mu_{n} - \mu_{p}$, where $\mu_{i}$ denotes the chemical potential of $i$ constitute ($n$ and $p$ represent neutrons and protons, respectively). Our result suggests that the non-linear evolution of CFI with on-shell muons would induce flavor conversions with the complex interplay among all three different neutrino-mixing sectors.

hep-ph↗

arXiv2024

Analysis of Linear Mode Connectivity via Permutation-Based Weight Matching: With Insights into Other Permutation Search Methods

Recently, Ainsworth et al. showed that using weight matching (WM) to minimize the $L^2$ distance in a permutation search of model parameters effectively identifies permutations that satisfy linear mode connectivity (LMC), where the loss along a linear path between two independently trained models with different seeds remains nearly constant. This paper analyzes LMC using WM, which is useful for understanding stochastic gradient descent's effectiveness and its application in areas like model merging. We first empirically show that permutations found by WM do not significantly reduce the $L^2$ distance between two models, and the occurrence of LMC is not merely due to distance reduction by WM itself. We then demonstrate that permutations can change the directions of the singular vectors, but not the singular values, of the weight matrices in each layer. This finding shows that permutations found by WM primarily align the directions of singular vectors associated with large singular values across models. This alignment brings the singular vectors with large singular values, which determine the model's functionality, closer between the original and merged models, allowing the merged model to retain functionality similar to the original models, thereby satisfying LMC. This paper also analyzes activation matching (AM) in terms of singular vectors and finds that the principle of AM is likely the same as that of WM. Finally, we analyze the difference between WM and the straight-through estimator (STE), a dataset-dependent permutation search method, and show that WM can be more advantageous than STE in achieving LMC among three or more models.

cs.LG↗

arXiv2023

Universality of the Neutrino Collisional Flavor Instability in Core Collapse Supernovae

Neutrinos are known to undergo flavor conversion processes among the three flavors. The fast flavor conversion (FFC) has been the central piece of flavor conversions taking place in core-collapse supernovae (CCSNe) due to its shorter timescale to the completion of flavor conversion compared to other types of flavor conversion. Although the ordinary collisions between neutrinos and matter were once thought to decohere neutrinos and thus damp flavor conversions, it was recently realized that they can also induce the flavor conversion. The linear analysis showed that the so-called collisional flavor instability or CFI occurs in the absence of FFC. In this paper, we investigate if CFI takes place in of the post-bounce core of CCSNe, using the results of spherically symmetric Boltzmann simulations of CCSNe for four progenitor models with different masses. We also provide a necessary (but not sufficient) condition of matter properties for the occurrence of CFI in optically thick and semi-transparent regions; baryon mass density ($ρ$), electron fraction ($Y_e$), and the degeneracy of electron-type neutrinos ($η_{ν_e}$) need to be $10^{10} {\rm g/cm^3} \lesssim ρ\lesssim 10^{12} {\rm g/cm^3}$, $Y_e\lesssim 0.4$, and $η_{ν_e} \lesssim 0.5$, respectively. This condition allows us to easily locate the place of possible CFI occurence without detailed stability analyses, which is useful for analyzing CFI in CCSN models phenomenologically

astro-ph.HE↗

arXiv2023

MPC Builder for Autonomous Drive: Automatic Generation of MPCs for Motion Planning and Control

This study presents a new framework for vehicle motion planning and control based on the automatic generation of model predictive controllers (MPCs) named MPC Builder. In this framework, several components necessary for MPC, such as prediction models, constraints, and cost functions, are prepared in advance. The MPC Builder then generates various MPCs online in a unified manner according to traffic situations. This scheme enabled us to represent various driving tasks with less design effort than typical switched MPC systems. The proposed framework was implemented considering the continuation/generalized minimum residual (C/GMRES) method optimization solver, which can reduce computational costs. Finally, numerical experiments on multiple driving scenarios were presented.

cs.RO↗

arXiv2020

Scyclone: High-Quality and Parallel-Data-Free Voice Conversion Using Spectrogram and Cycle-Consistent Adversarial Networks

This paper proposes Scyclone, a high-quality voice conversion (VC) technique without parallel data training. Scyclone improves speech naturalness and speaker similarity of the converted speech by introducing CycleGAN-based spectrogram conversion with a simplified WaveRNN-based vocoder. In Scyclone, a linear spectrogram is used as the conversion features instead of vocoder parameters, which avoids quality degradation due to extraction errors in fundamental frequency and voiced/unvoiced parameters. The spectrogram of source and target speakers are modeled by modified CycleGAN networks, and the waveform is reconstructed using the simplified WaveRNN with a single Gaussian probability density function. The subjective experiments with completely unpaired training data show that Scyclone is significantly better than CycleGAN-VC2, one of the existing state-of-the-art parallel-data-free VC techniques.

eess.AS↗

arXiv1996

Context-Sensitive Measurement of Word Distance by Adaptive Scaling of a Semantic Space

The paper proposes a computationally feasible method for measuring context-sensitive semantic distance between words. The distance is computed by adaptive scaling of a semantic space. In the semantic space, each word in the vocabulary V is represented by a multi-dimensional vector which is obtained from an English dictionary through a principal component analysis. Given a word set C which specifies a context for measuring word distance, each dimension of the semantic space is scaled up or down according to the distribution of C in the semantic space. In the space thus transformed, distance between words in V becomes dependent on the context C. An evaluation through a word prediction task shows that the proposed measurement successfully extracts the context of a text.

cmp-lg↗