arXiv subjects

Liang Tong

Publications and source records attributed to Liang Tong.

14 recordsLinked to original sources

arXiv2026

Measuring Spin-Charge Separation by an Off-diagonal Dissipative Response

Fractionalization of symmetry - exemplified by spin-charge separation in the 1D Hubbard model and fractional charges in the fractional quantum Hall effect - is a typical strongly correlated phenomena in quantum many-body systems. Despite the success in measuring velocity differences, however, it is still quite challenging in probing emergent excitations' anomalous dimensions experimentally. We propose a off-diagonal dissipative response protocol, leveraging dissipative response theory (DRT), to directly detect spin-charge separation. By selectively dissipating spin-$\downarrow$ particles and measuring the spin-$\uparrow$ response, we uncover a universal temporal signature: the off-diagonal response exhibits a crossover from cubic-in-time ($t^3$) growth at short times to linear-in-time ($t$) decay at long times. Crucially, the coefficients $\varkappa^s$ (short-time) and $\varkappa^l$ (long-time) encode the distinct anomalous dimensions and velocities of spinons and holons, providing unambiguous evidence of fractionalization. This signal vanishes trivially without spin-charge separation. Our predictions, verified numerically via tDMRG, with microscopic parameters linking with Luttinger parameters by Bethe ansatz, establish off-diagonal dissipative response as a probe of quantum fractionalization in synthetic quantum matter.

cond-mat.quant-gas↗

arXiv2023

FocusedCleaner: Sanitizing Poisoned Graphs for Robust GNN-based Node Classification

Graph Neural Networks (GNNs) are vulnerable to data poisoning attacks, which will generate a poisoned graph as the input to the GNN models. We present FocusedCleaner as a poisoned graph sanitizer to effectively identify the poison injected by attackers. Specifically, FocusedCleaner provides a sanitation framework consisting of two modules: bi-level structural learning and victim node detection. In particular, the structural learning module will reverse the attack process to steadily sanitize the graph while the detection module provides ``the focus" -- a narrowed and more accurate search region -- to structural learning. These two modules will operate in iterations and reinforce each other to sanitize a poisoned graph step by step. As an important application, we show that the adversarial robustness of GNNs trained over the sanitized graph for the node classification task is significantly improved. Extensive experiments demonstrate that FocusedCleaner outperforms the state-of-the-art baselines both on poisoned graph sanitation and improving robustness.

cs.LG↗

arXiv2023

Hierarchical Graph Neural Networks for Causal Discovery and Root Cause Localization

In this paper, we propose REASON, a novel framework that enables the automatic discovery of both intra-level (i.e., within-network) and inter-level (i.e., across-network) causal relationships for root cause localization. REASON consists of Topological Causal Discovery and Individual Causal Discovery. The Topological Causal Discovery component aims to model the fault propagation in order to trace back to the root causes. To achieve this, we propose novel hierarchical graph neural networks to construct interdependent causal networks by modeling both intra-level and inter-level non-linear causal relations. Based on the learned interdependent causal networks, we then leverage random walks with restarts to model the network propagation of a system fault. The Individual Causal Discovery component focuses on capturing abrupt change patterns of a single system entity. This component examines the temporal patterns of each entity's metric data (i.e., time series), and estimates its likelihood of being a root cause based on the Extreme Value theory. Combining the topological and individual causal scores, the top K system entities are identified as root causes. Extensive experiments on three real-world datasets with case studies demonstrate the effectiveness and superiority of the proposed framework.

cs.LG↗

arXiv2022

Personalized Federated Learning via Heterogeneous Modular Networks

Personalized Federated Learning (PFL) which collaboratively trains a federated model while considering local clients under privacy constraints has attracted much attention. Despite its popularity, it has been observed that existing PFL approaches result in sub-optimal solutions when the joint distribution among local clients diverges. To address this issue, we present Federated Modular Network (FedMN), a novel PFL approach that adaptively selects sub-modules from a module pool to assemble heterogeneous neural architectures for different clients. FedMN adopts a light-weighted routing hypernetwork to model the joint distribution on each client and produce the personalized selection of the module blocks for each client. To reduce the communication burden in existing FL, we develop an efficient way to interact between the clients and the server. We conduct extensive experiments on the real-world test beds and the results show both the effectiveness and efficiency of the proposed FedMN over the baselines.

cs.LG↗

arXiv2021

FACESEC: A Fine-grained Robustness Evaluation Framework for Face Recognition Systems

We present FACESEC, a framework for fine-grained robustness evaluation of face recognition systems. FACESEC evaluation is performed along four dimensions of adversarial modeling: the nature of perturbation (e.g., pixel-level or face accessories), the attacker's system knowledge (about training data and learning architecture), goals (dodging or impersonation), and capability (tailored to individual inputs or across sets of these). We use FACESEC to study five face recognition systems in both closed-set and open-set settings, and to evaluate the state-of-the-art approach for defending against physically realizable attacks on these. We find that accurate knowledge of neural architecture is significantly more important than knowledge of the training data in black-box attacks. Moreover, we observe that open-set face recognition systems are more vulnerable than closed-set systems under different types of attacks. The efficacy of attacks for other threat model variations, however, appears highly dependent on both the nature of perturbation and the neural network architecture. For example, attacks that involve adversarial face masks are usually more potent, even against adversarially trained models, and the ArcFace architecture tends to be more robust than the others.

cs.CV↗

arXiv2021

Topological defect states in elastic phononic plates

Topological defects (including disclinations and dislocations) which commonly exist in various materials have shown an amazing ability to produce excellent mechanical and physical properties of matters. In this paper, disclinations and dislocations are firstly introduced into the valley-polarized elastic phononic plate. Deformation of the lattice yields the interface expressing as the topologically protected wave guiding, due to the valley-polarized phase transition of phononic crystals (PnCs) across the interface. Then, disclinations are introduced into the Wannier-type elastic phononic plate. The deformation of the lattice yielded by disclinations produces a pentagonal core with the local five-fold symmetry. The topological bound states are well localized around the boundaries of the pentagonal cores with and without the hollow regions. The topological interface state and the topological bound state immunize against the finite sizes and the moderate disturbances of plates, essentially differing from the trivial defect states. The discovery of topological defect states unveils a new horizon in topological mechanics and physics, and it provides a novel platform to implement large-scale elastic devices with robust topological waveguides and resonators.

cond-mat.mtrl-sci↗

arXiv2020

Towards Robustness against Unsuspicious Adversarial Examples

Despite the remarkable success of deep neural networks, significant concerns have emerged about their robustness to adversarial perturbations to inputs. While most attacks aim to ensure that these are imperceptible, physical perturbation attacks typically aim for being unsuspicious, even if perceptible. However, there is no universal notion of what it means for adversarial examples to be unsuspicious. We propose an approach for modeling suspiciousness by leveraging cognitive salience. Specifically, we split an image into foreground (salient region) and background (the rest), and allow significantly larger adversarial perturbations in the background, while ensuring that cognitive salience of background remains low. We describe how to compute the resulting non-salience-preserving dual-perturbation attacks on classifiers. We then experimentally demonstrate that our attacks indeed do not significantly change perceptual salience of the background, but are highly effective against classifiers robust to conventional attacks. Furthermore, we show that adversarial training with dual-perturbation attacks yields classifiers that are more robust to these than state-of-the-art robust learning approaches, and comparable in terms of robustness to conventional attacks.

cs.LG↗

arXiv2020

Defending Against Physically Realizable Attacks on Image Classification

We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiveness against three of the highest profile physical attacks. Next, we propose a new abstract adversarial model, rectangular occlusion attacks, in which an adversary places a small adversarially crafted rectangle in an image, and develop two approaches for efficiently computing the resulting adversarial examples. Finally, we demonstrate that adversarial training using our new attack yields image classification models that exhibit high robustness against the physically realizable attacks we study, offering the first effective generic defense against such attacks.

cs.LG↗

arXiv2019

Three-dimensional higher-order topological acoustic system with multidimensional topological states

Topologically protected gapless edge/surface states are phases of quantum matter which behave as massless Dirac fermions, immunizing against disorders and continuous perturbations. Recently, a new class of topological insulators (TIs) with gapped edge states and in-gap corner states have been theoretically predicted in electric systems 1,2, and experimentally realized in two-dimensional (2D) mechanical and electromagnetic systems 3,4, electrical circuits 5, optical and sonic crystals 6-11, and elastic phononic plates 12. Here, we elaborately design a strong three-dimensional (3D) topological acoustic system, by arranging acoustic meta-atoms in a simple cubic lattice. Under the direct field measurements, besides of the 2D surface propagations on all of the six surfaces, the 1D hinge propagations behaving as robust acoustic fibers along the twelve hinges and the 0D corner modes working as robust localized resonances at the eight corners are experimentally confirmed. As these multidimensional topological states are activated in different frequencies and independent spaces, our works pave feasible ways for applications in the topological acoustic cavities, communications and signal-processing.

cond-mat.mtrl-sci↗

arXiv2019

Pseudospin-valley-coupled phononic topological insulator with edge and corner states

Topologically protected gapless edge states are phases of quantum matter which behave as massless Dirac fermions, immunizing against disorders and continuous perturbations. Recently, a new class of topological insulators (TIs) with topological corner states have been theoretically predicted in electric systems, and experimentally realized in two-dimensional (2D) mechanical and electromagnetic systems, electrical circuits, optical and sonic crystals, and elastic phononic plates. Here, we demonstrate a pseudospin-valley-coupled phononic TI, which simultaneously exhibits gapped edge states and topological corner states. Pseudospin-orbit coupling edge states and valley-polarized edge state are respectively induced by the lattice deformation and the symmetry breaking. When both of them coexist, these topological edge states will be greatly gapped and the topological corner state emerges. Under direct field measurements, the robust edge propagation behaving as an elastic waveguide and the topological corner mode working as a robust localized resonance are experimentally confirmed. The pseudospin-valley coupling in our phononic TIs can be well-controlled which provides a reconfigurable platform for the multiple edge and corner states, and exhibits well applications in the topological elastic energy recovery and the highly sensitive sensing.

cond-mat.mes-hall↗

arXiv2019

Finding Needles in a Moving Haystack: Prioritizing Alerts with Adversarial Reinforcement Learning

Detection of malicious behavior is a fundamental problem in security. One of the major challenges in using detection systems in practice is in dealing with an overwhelming number of alerts that are triggered by normal behavior (the so-called false positives), obscuring alerts resulting from actual malicious activity. While numerous methods for reducing the scope of this issue have been proposed, ultimately one must still decide how to prioritize which alerts to investigate, and most existing prioritization methods are heuristic, for example, based on suspiciousness or priority scores. We introduce a novel approach for computing a policy for prioritizing alerts using adversarial reinforcement learning. Our approach assumes that the attackers know the full state of the detection system and dynamically choose an optimal attack as a function of this state, as well as of the alert prioritization policy. The first step of our approach is to capture the interaction between the defender and attacker in a game theoretic model. To tackle the computational complexity of solving this game to obtain a dynamic stochastic alert prioritization policy, we propose an adversarial reinforcement learning framework. In this framework, we use neural reinforcement learning to compute best response policies for both the defender and the adversary to an arbitrary stochastic policy of the other. We then use these in a double-oracle framework to obtain an approximate equilibrium of the game, which in turn yields a robust stochastic policy for the defender. Extensive experiments using case studies in fraud and intrusion detection demonstrate that our approach is effective in creating robust alert prioritization policies.

cs.CR↗

arXiv2019

Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features

Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, ML models are often susceptible to evasion attacks, in which an adversary makes changes to the input (such as malware) in order to avoid being detected. A conventional approach to evaluate ML robustness to such attacks, as well as to design robust ML, is by considering simplified feature-space models of attacks, where the attacker changes ML features directly to effect evasion, while minimizing or constraining the magnitude of this change. We investigate the effectiveness of this approach to designing robust ML in the face of attacks that can be realized in actual malware (realizable attacks). We demonstrate that in the context of structure-based PDF malware detection, such techniques appear to have limited effectiveness, but they are effective with content-based detectors. In either case, we show that augmenting the feature space models with conserved features (those that cannot be unilaterally modified without compromising malicious functionality) significantly improves performance. Finally, we show that feature space models enable generalized robustness when faced with a variety of realizable attacks, as compared to classifiers which are tuned to be robust to a specific realizable attack.

cs.CR↗

arXiv2018

Elastic higher-order topological insulator with topologically protected corner states

Topologically gapless edge states, characterized by topological invariants and Berry's phases of bulk energy bands, provide amazing techniques to robustly control the reflectionless propagation of electrons, photons and phonons. Recently, a new family of topological phases, dictated by the bulk polarization, has been observed, leading to the discovery of the higher-order topological insulators (HOTIs). So far, the HOTIs are only demonstrated in discrete mechanical and electromagnetic systems and electrical circuits with the quantized quadrupole polarization. Here, we realize the higher-order topological states in a two-dimensional (2D) continuous elastic system whose energy bands can be well described. We experimentally observe the gapped one-dimensional (1D) edge states, the trivially gapped zero-dimensional (0D) corner states and the topologically protected 0D corner states. Compared with the trivial corner modes, the topological ones, immunizing against defects, are robustly localized at the obtuse-angled but not the acute-angled corners. The topological shape-dependent corner states open a new route for the design of the topologically-protected but reconfigurable 0D local eigenmodes and provide an excellent platform for the topological transformation of elastic energy among 2D bulk, 1D edge and 0D corner modes.

cond-mat.mes-hall↗

arXiv2018

Adversarial Regression with Multiple Learners

Despite the considerable success enjoyed by machine learning techniques in practice, numerous studies demonstrated that many approaches are vulnerable to attacks. An important class of such attacks involves adversaries changing features at test time to cause incorrect predictions. Previous investigations of this problem pit a single learner against an adversary. However, in many situations an adversary's decision is aimed at a collection of learners, rather than specifically targeted at each independently. We study the problem of adversarial linear regression with multiple learners. We approximate the resulting game by exhibiting an upper bound on learner loss functions, and show that the resulting game has a unique symmetric equilibrium. We present an algorithm for computing this equilibrium, and show through extensive experiments that equilibrium models are significantly more robust than conventional regularized linear regression.

cs.LG↗