Searcharxiv⌕ Search

arXiv subjects

Fu Wang

Publications and source records attributed to Fu Wang.

26 records · Page 2Linked to original sources
arXiv2023

Model-Agnostic Reachability Analysis on Deep Neural Networks

Verification plays an essential role in the formal analysis of safety-critical systems. Most current verification methods have specific requirements when working on Deep Neural Networks (DNNs). They either target one particular network category, e.g., Feedforward Neural Networks (FNNs), or networks with specific activation functions, e.g., RdLU. In this paper, we develop a model-agnostic verification framework, called DeepAgn, and show that it can be applied to FNNs, Recurrent Neural Networks (RNNs), or a mixture of both. Under the assumption of Lipschitz continuity, DeepAgn analyses the reachability of DNNs based on a novel optimisation scheme with a global convergence guarantee. It does not require access to the network's internal structures, such as layers and parameters. Through reachability analysis, DeepAgn can tackle several well-known robustness problems, including computing the maximum safe radius for a given input, and generating the ground-truth adversarial examples. We also empirically demonstrate DeepAgn's superior capability and efficiency in handling a broader class of deep neural networks, including both FNNs, and RNNs with very deep layers and millions of neurons, than other state-of-the-art verification approaches.

cs.LG↗
arXiv2023

Towards Verifying the Geometric Robustness of Large-scale Neural Networks

Deep neural networks (DNNs) are known to be vulnerable to adversarial geometric transformation. This paper aims to verify the robustness of large-scale DNNs against the combination of multiple geometric transformations with a provable guarantee. Given a set of transformations (e.g., rotation, scaling, etc.), we develop GeoRobust, a black-box robustness analyser built upon a novel global optimisation strategy, for locating the worst-case combination of transformations that affect and even alter a network's output. GeoRobust can provide provable guarantees on finding the worst-case combination based on recent advances in Lipschitzian theory. Due to its black-box nature, GeoRobust can be deployed on large-scale DNNs regardless of their architectures, activation functions, and the number of neurons. In practice, GeoRobust can locate the worst-case geometric transformation with high precision for the ResNet50 model on ImageNet in a few seconds on average. We examined 18 ImageNet classifiers, including the ResNet family and vision transformers, and found a positive correlation between the geometric robustness of the networks and the parameter numbers. We also observe that increasing the depth of DNN is more beneficial than increasing its width in terms of improving its geometric robustness. Our tool GeoRobust is available at https://github.com/TrustAI/GeoRobust.

cs.LG↗
arXiv2023

Dynamic Efficient Adversarial Training Guided by Gradient Magnitude

Adversarial training is an effective but time-consuming way to train robust deep neural networks that can withstand strong adversarial attacks. As a response to its inefficiency, we propose Dynamic Efficient Adversarial Training (DEAT), which gradually increases the adversarial iteration during training. We demonstrate that the gradient's magnitude correlates with the curvature of the trained model's loss landscape, allowing it to reflect the effect of adversarial training. Therefore, based on the magnitude of the gradient, we propose a general acceleration strategy, M+ acceleration, which enables an automatic and highly effective method of adjusting the training procedure. M+ acceleration is computationally efficient and easy to implement. It is suited for DEAT and compatible with the majority of existing adversarial training techniques. Extensive experiments have been done on CIFAR-10 and ImageNet datasets with various training environments. The results show that the proposed M+ acceleration significantly improves the training efficiency of existing adversarial training methods while achieving similar robustness performance. This demonstrates that the strategy is highly adaptive and offers a valuable solution for automatic adversarial training.

cs.LG↗
arXiv2021

Insight into the partitioning and clustering mechanism of rare-earth cations in alkali aluminoborosilicate glasses

Rare-earth (RE) containing alkali aluminoborosilicate glasses find increasingly broad technological applications, with their further development only impeded by yet-poor understanding of coordination environment and structural role of RE ions in glasses. In this work we combine free induction decay (FID)-detected electron paramagnetic resonance (EPR), electron spin echo envelope modulation (ESEEM), and MAS NMR spectroscopies, to examine the coordination environment and the clustering tendencies of RE3+ in a series of peralkaline aluminoborosilicate glasses co-doped with Nd2O3 (0.001-0.1 mol%) and 5 mol% La2O3. Quantitative EPR spectral analysis reveals three different Nd3+ forms coexisting in the glasses: isolated Nd3+ centers, dipole-coupled Nd clusters (Nd-O-X-O-Nd, where X = Si/B/Al), and spin-exchange-coupled Nd clusters, (Nd-O-Nd) and (Nd-O-La-O-Nd). Extensive RE clustering is observed at high RE2O3 concentrations, with more than 90% REs converting to dipole- and exchange-coupled Nd clusters already at [RE2O3] = 0.01 mol%. ESEEM analysis of the EPR-detectable Nd centers indicates a Na/Si-rich environment (four Na+ per Nd3+) for the isolated Nd3+ centers and the Na/Si/B-rich environment (2-3 Na+ and 1-2 boron per each Nd3+) for the dipole-coupled Nd clusters, while the EPR-undetectable exchanged-coupled RE clusters are predicted to exist in a Na/B-rich environment. The RE clustering induces nano-scale glass phase separation, while the Na/B-rich environment of the RE clusters implies a depletion of the same elements from the remaining host glass. Based on our results, we develop a mechanistic model that explains the high tendency of RE3+ to form clusters in alkali aluminoborosilicate glasses.

cond-mat.mtrl-sci↗
arXiv2021

Fooling Object Detectors: Adversarial Attacks by Half-Neighbor Masks

Although there are a great number of adversarial attacks on deep learning based classifiers, how to attack object detection systems has been rarely studied. In this paper, we propose a Half-Neighbor Masked Projected Gradient Descent (HNM-PGD) based attack, which can generate strong perturbation to fool different kinds of detectors under strict constraints. We also applied the proposed HNM-PGD attack in the CIKM 2020 AnalytiCup Competition, which was ranked within the top 1% on the leaderboard. We release the code at https://github.com/YanghaoZYH/HNM-PGD.

cs.CV↗
arXiv2020

Generalizing Universal Adversarial Attacks Beyond Additive Perturbations

The previous study has shown that universal adversarial attacks can fool deep neural networks over a large set of input images with a single human-invisible perturbation. However, current methods for universal adversarial attacks are based on additive perturbation, which cause misclassification when the perturbation is directly added to the input images. In this paper, for the first time, we show that a universal adversarial attack can also be achieved via non-additive perturbation (e.g., spatial transformation). More importantly, to unify both additive and non-additive perturbations, we propose a novel unified yet flexible framework for universal adversarial attacks, called GUAP, which is able to initiate attacks by additive perturbation, non-additive perturbation, or the combination of both. Extensive experiments are conducted on CIFAR-10 and ImageNet datasets with six deep neural network models including GoogleLeNet, VGG16/19, ResNet101/152, and DenseNet121. The empirical experiments demonstrate that GUAP can obtain up to 90.9% and 99.24% successful attack rates on CIFAR-10 and ImageNet datasets, leading to over 15% and 19% improvements respectively than current state-of-the-art universal adversarial attacks. The code for reproducing the experiments in this paper is available at https://github.com/TrustAI/GUAP.

cs.CV↗
arXiv2020

SDN-controlled and Orchestrated OPSquare DCN Enabling Automatic Network Slicing with Differentiated QoS Provisioning

In this work, we propose and experimentally assess the automatic and flexible NSs configurations of optical OPSquare DCN controlled and orchestrated by an extended SDN control plane for multi-tenant applications with differentiated QoS provisioning. Optical Flow Control (OFC) protocol has been developed to prevent packet losses at switch sides caused by packet contentions.Based on the collected resource topology of data plane, the optical network slices can be dynamically provisioned and automatically reconfigured by the SDN control plane. Meanwhile, experimental results validate that the priority assignment of application flows supplies dynamic QoS performance to various slices running applications with specific requirements in terms of packet loss and transmission latency. In addition, the capability of exposing traffic statistics information of data plane to SDN control plane enables the implementation of load balancing algorithms further improving the network performance with high QoS. No packet loss and less than 4.8 us server-to-server latency can be guaranteed for the sliced network with highest priority at a load of 0.5.

cs.NI↗