arXiv subjects

Minghui Li

Publications and source records attributed to Minghui Li.

69 records · Page 4Linked to original sources

arXiv2023

Integrated multi-color Raman microlasers with ultra-low pump levels in single high-Q lithium niobate microdisks

Photonic integrated Raman microlasers, particularly discrete multi-color lasers which are crucial for extending the emission wavelength range of chip-scale laser sources to much shorter wavelength, are highly in demand for various spectroscopy, microscopy analysis, and biological detection. However, integrated multi-color Raman microlasers have yet to be demonstrated because of the requirement of high-Q microresonators possessing large second-order nonlinearity and strong Raman phonon branches and the challenging in cavity-enhanced multi-photon hyper-Raman scattering parametric process. In this work, integrated multi-color Raman lasers have been demonstrated for the first time at weak pump levels, via the excitation of high-Q (>6 X 10^6) phase-matched modes in single thin-film lithium niobate (TFLN) microresonators by dispersion engineering. Raman lasing was observed at 1712 nm for a 1546-nm pump threshold power of only 620 uW. Furthermore, multi-color Raman lasers were realized at discrete wavelengths of 1712 nm, 813 nm, 533 nm and 406 nm with pump levels as low as 1.60 mW, which is more than two order of magnitude lower than the current records (i.e., 200 mW) in bulk resonators, allowed by the fulfillment of the requisite conditions consisting of broadband natural phase match, multiple-resonance and high Q-factors.

physics.optics↗

arXiv2023

Erbium-ytterbium co-doped lithium niobate single-mode microdisk laser with an ultralow threshold of 1 uW

We demonstrate single-mode microdisk lasers in the telecom band with ultra-low thresholds on erbium-ytterbium co-doped thin-film lithium niobate (TFLN). The active microdisk were fabricated with high-Q factors by photo-lithography assisted chemo-mechanical etching. Thanks to the erbium-ytterbium co-doping providing high optical gain, the ultra-low loss nanostructuring, and the excitation of high-Q coherent polygon modes which suppresses multi-mode lasing and allows high spatial mode overlap factor between pump and lasing modes, single-mode laser emission operating at 1530 nm wavelength was observed with an ultra-low threshold, under 980-nm-band optical pump. The threshold was measured as low as 1 uW, which is one order of magnitude smaller than the best results previously reported in single-mode active TFLN microlasers. And the conversion efficiency reaches 0.406%, which is also the highest value reported in single-mode active TFLN microlasers.

physics.optics↗

arXiv2023

AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learning

Multimodal contrastive learning aims to train a general-purpose feature extractor, such as CLIP, on vast amounts of raw, unlabeled paired image-text data. This can greatly benefit various complex downstream tasks, including cross-modal image-text retrieval and image classification. Despite its promising prospect, the security issue of cross-modal pre-trained encoder has not been fully explored yet, especially when the pre-trained encoder is publicly available for commercial use. In this work, we propose AdvCLIP, the first attack framework for generating downstream-agnostic adversarial examples based on cross-modal pre-trained encoders. AdvCLIP aims to construct a universal adversarial patch for a set of natural images that can fool all the downstream tasks inheriting the victim cross-modal pre-trained encoder. To address the challenges of heterogeneity between different modalities and unknown downstream tasks, we first build a topological graph structure to capture the relevant positions between target samples and their neighbors. Then, we design a topology-deviation based generative adversarial network to generate a universal adversarial patch. By adding the patch to images, we minimize their embeddings similarity to different modality and perturb the sample distribution in the feature space, achieving unviersal non-targeted attacks. Our results demonstrate the excellent attack performance of AdvCLIP on two types of downstream tasks across eight datasets. We also tailor three popular defenses to mitigate AdvCLIP, highlighting the need for new defense mechanisms to defend cross-modal pre-trained encoders.

cs.CV↗

arXiv2023

A Four-Pronged Defense Against Byzantine Attacks in Federated Learning

\textit{Federated learning} (FL) is a nascent distributed learning paradigm to train a shared global model without violating users' privacy. FL has been shown to be vulnerable to various Byzantine attacks, where malicious participants could independently or collusively upload well-crafted updates to deteriorate the performance of the global model. However, existing defenses could only mitigate part of Byzantine attacks, without providing an all-sided shield for FL. It is difficult to simply combine them as they rely on totally contradictory assumptions. In this paper, we propose FPD, a \underline{\textbf{f}}our-\underline{\textbf{p}}ronged \underline{\textbf{d}}efense against both non-colluding and colluding Byzantine attacks. Our main idea is to utilize absolute similarity to filter updates rather than relative similarity used in existingI works. To this end, we first propose a reliable client selection strategy to prevent the majority of threats in the bud. Then we design a simple but effective score-based detection method to mitigate colluding attacks. Third, we construct an enhanced spectral-based outlier detector to accurately discard abnormal updates when the training data is \textit{not independent and identically distributed} (non-IID). Finally, we design update denoising to rectify the direction of the slightly noisy but harmful updates. The four sequentially combined modules can effectively reconcile the contradiction in addressing non-colluding and colluding Byzantine attacks. Extensive experiments over three benchmark image classification datasets against four state-of-the-art Byzantine attacks demonstrate that FPD drastically outperforms existing defenses in IID and non-IID scenarios (with $30\%$ improvement on model accuracy).

cs.CR↗

arXiv2023

Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency

Deep neural networks are proven to be vulnerable to backdoor attacks. Detecting the trigger samples during the inference stage, i.e., the test-time trigger sample detection, can prevent the backdoor from being triggered. However, existing detection methods often require the defenders to have high accessibility to victim models, extra clean data, or knowledge about the appearance of backdoor triggers, limiting their practicality. In this paper, we propose the test-time corruption robustness consistency evaluation (TeCo), a novel test-time trigger sample detection method that only needs the hard-label outputs of the victim models without any extra information. Our journey begins with the intriguing observation that the backdoor-infected models have similar performance across different image corruptions for the clean images, but perform discrepantly for the trigger samples. Based on this phenomenon, we design TeCo to evaluate test-time robustness consistency by calculating the deviation of severity that leads to predictions' transition across different corruptions. Extensive experiments demonstrate that compared with state-of-the-art defenses, which even require either certain information about the trigger types or accessibility of clean data, TeCo outperforms them on different backdoor attacks, datasets, and model architectures, enjoying a higher AUROC by 10% and 5 times of stability.

cs.CR↗

arXiv2022

Monolithically integrated high-power narrow-bandwidth microdisk laser

Integrated on-chip microdisk lasers have attracted great attention as a light source of compact size, low lasing threshold and narrow bandwidth. However, challenges remain unresolved in terms of single mode operation at high output power while maintaining the ultra-narrow bandwidth. In this work, we demonstrate monolithically integrated on-chip single-frequency microdisk lasers coupled with bus-waveguides fabricated by photolithography assisted chemo-mechanical etching. Owing to the high-Q factor of a polygon whispering gallery mode formed in the microdisk and long cavity lengths (e.g., 409 um and 1 mm), a microdisk laser with a narrow linewidth of 0.11 MHz and a maximum output power of 62.1 uW has been achieved at room temperature.

physics.optics↗

arXiv2022

PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examples

Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example and the target point set to jointly explore the adversarial point clouds in the geometry space and the feature space. Furthermore, to launch a stealthier attack, we innovatively employ the neighbourhood density information to tailor the perturbation constraint, leading to geometry-aware and distribution-adaptive modifications for each point. Extensive experiments against different premier point cloud completion networks show that PointCA can cause a performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01. We conclude that existing completion models are severely vulnerable to adversarial examples, and state-of-the-art defenses for point cloud classification will be partially invalid when applied to incomplete and uneven point cloud data.

cs.CV↗

arXiv2022

A quantum algorithm for finding collision-inducing disturbance vectors in SHA-1

Modern cryptographic protocols rely on sophisticated hash functions to generate quasi-unique numbers that serve as signatures for user authentication and other security verifications. The security could be compromised by finding texts hash-mappable to identical numbers, forming so-called collision attack. Seeding a disturbance vector in the hash mapping to obtain a successful collision is that a major focus of cryptography study in the past two decades to improve hash protocols. We propose an algorithm that takes advantage of entangled quantum states for concurrent seeding of candidate disturbance vectors, out of which the one entailing collision is selected through a combination of quantum search, phase gating, diffusion gating, and information feedbacks from classical computing machinery. The complexity reduction is shown to be on the order of $\mathcal{O}(2^{n/2+1})$ where $n$ is the number of qubits encoding addresses. We demonstrate the practicality of the proposed by an implementation scheme based on degenerate optical parametric oscillators.

quant-ph↗

arXiv2022

Shielding Federated Learning: Mitigating Byzantine Attacks with Less Constraints

Federated learning is a newly emerging distributed learning framework that facilitates the collaborative training of a shared global model among distributed participants with their privacy preserved. However, federated learning systems are vulnerable to Byzantine attacks from malicious participants, who can upload carefully crafted local model updates to degrade the quality of the global model and even leave a backdoor. While this problem has received significant attention recently, current defensive schemes heavily rely on various assumptions, such as a fixed Byzantine model, availability of participants' local data, minority attackers, IID data distribution, etc. To relax those constraints, this paper presents Robust-FL, the first prediction-based Byzantine-robust federated learning scheme where none of the assumptions is leveraged. The core idea of the Robust-FL is exploiting historical global model to construct an estimator based on which the local models will be filtered through similarity detection. We then cluster local models to adaptively adjust the acceptable differences between the local models and the estimator such that Byzantine users can be identified. Extensive experiments over different datasets show that our approach achieves the following advantages simultaneously: (i) independence of participants' local data, (ii) tolerance of majority attackers, (iii) generalization to variable Byzantine model.

cs.DC↗

arXiv2022

Scalable semi-classical implementation of Shor factoring using time-multiplexed degenerate optical parametric oscillators

A scheme to encode arbitrarily long integer pairs on degenerate optical parametric oscillations multiplexed in time is proposed. The classical entanglement between the polarization directions and the phases of the oscillating pulses, regarded as two computational registers, furnishes the integer correlations within each pair. We show the major algorithmic steps, modular exponentiation and discrete Fourier transform, of Shor's quantum factoring algorithm can be executed in the registers as pulse interferences under the assistance of external logics. The factoring algorithm is thus rendered equivalent to a semi-classical optical-path implementation that is scalable and decoherence-free. The sought-after multiplicative order, from which the prime factors are deduced, is identified from a two-dimensional fringe image generated by four-hole interference measured at the end of the path.

quant-ph↗

arXiv2022

Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfer

While deep face recognition (FR) systems have shown amazing performance in identification and verification, they also arouse privacy concerns for their excessive surveillance on users, especially for public face images widely spread on social networks. Recently, some studies adopt adversarial examples to protect photos from being identified by unauthorized face recognition systems. However, existing methods of generating adversarial face images suffer from many limitations, such as awkward visual, white-box setting, weak transferability, making them difficult to be applied to protect face privacy in reality. In this paper, we propose adversarial makeup transfer GAN (AMT-GAN), a novel face protection method aiming at constructing adversarial face images that preserve stronger black-box transferability and better visual quality simultaneously. AMT-GAN leverages generative adversarial networks (GAN) to synthesize adversarial face images with makeup transferred from reference images. In particular, we introduce a new regularization module along with a joint training strategy to reconcile the conflicts between the adversarial noises and the cycle consistence loss in makeup transfer, achieving a desirable balance between the attack strength and visual changes. Extensive experiments verify that compared with state of the arts, AMT-GAN can not only preserve a comfortable visual quality, but also achieve a higher attack success rate over commercial FR APIs, including Face++, Aliyun, and Microsoft.

cs.CV↗

arXiv2021

New efficient time-stepping schemes for the anisotropic phase-field dendritic crystal growth model

In this paper, we propose and analyze a first-order and a second-order time-stepping schemes for the anisotropic phase-field dendritic crystal growth model. The proposed schemes are based on an auxiliary variable approach for the Allen-Cahn equation and delicate treatment of the terms coupling the Allen-Cahn equation and temperature equation. The idea of the former is to introduce suitable auxiliary variables to facilitate construction of high order stable schemes for a large class of gradient flows. We propose a new technique to treat the coupling terms involved in the crystal growth model and introduce suitable stabilization terms to result in totally decoupled schemes, which satisfy a discrete energy law without affecting the convergence order. A delicate implementation demonstrates that the proposed schemes can be realized in a very efficient way. That is, it only requires solving four linear elliptic equations and a simple algebraic equation at each time step. A detailed comparison with existing schemes is given, and the advantage of the new schemes are emphasized. As far as we know this is the first second-order scheme that is totally decoupled, linear, unconditionally stable for the dendritic crystal growth model with variable mobility parameter.

math.NA↗

arXiv2020

Optimizing Privacy-Preserving Outsourced Convolutional Neural Network Predictions

Convolutional neural network is a machine-learning model widely applied in various prediction tasks, such as computer vision and medical image analysis. Their great predictive power requires extensive computation, which encourages model owners to host the prediction service in a cloud platform. Recent researches focus on the privacy of the query and results, but they do not provide model privacy against the model-hosting server and may leak partial information about the results. Some of them further require frequent interactions with the querier or heavy computation overheads, which discourages querier from using the prediction service. This paper proposes a new scheme for privacy-preserving neural network prediction in the outsourced setting, i.e., the server cannot learn the query, (intermediate) results, and the model. Similar to SecureML (S&P'17), a representative work that provides model privacy, we leverage two non-colluding servers with secret sharing and triplet generation to minimize the usage of heavyweight cryptography. Further, we adopt asynchronous computation to improve the throughput, and design garbled circuits for the non-polynomial activation function to keep the same accuracy as the underlying network (instead of approximating it). Our experiments on MNIST dataset show that our scheme achieves an average of 122x, 14.63x, and 36.69x reduction in latency compared to SecureML, MiniONN (CCS'17), and EzPC (EuroS&P'19), respectively. For the communication costs, our scheme outperforms SecureML by 1.09x, MiniONN by 36.69x, and EzPC by 31.32x on average. On the CIFAR dataset, our scheme achieves a lower latency by a factor of 7.14x and 3.48x compared to MiniONN and EzPC, respectively. Our scheme also provides 13.88x and 77.46x lower communication costs than MiniONN and EzPC on the CIFAR dataset.

cs.CR↗

arXiv2019

Augmenting Encrypted Search: A Decentralized Service Realization with Enforced Execution

Searchable symmetric encryption (SSE) allows the data owner to outsource an encrypted database to a remote server in a private manner while maintaining the ability for selectively search. So far, most existing solutions focus on an honest-but-curious server, while security designs against a malicious server have not drawn enough attention. A few recent works have attempted to construct verifiable SSE that enables the data owner to verify the integrity of search results. Nevertheless, these verification mechanisms are highly dependent on specific SSE schemes, and fail to support complex queries. A general verification mechanism is desired that can be applied to all SSE schemes. In this work, instead of concentrating on a central server, we explore the potential of the smart contract, an emerging blockchain-based decentralized technology, and construct decentralized SSE schemes where the data owner can receive correct search results with assurance without worrying about potential wrongdoings of a malicious server. We study both public and private blockchain environments and propose two designs with a trade-off between security and efficiency. To better support practical applications, the multi-user setting of SSE is further investigated where the data owner allows authenticated users to search keywords in shared documents. We implement prototypes of our two designs and present experiments and evaluations to demonstrate the practicability of our decentralized SSE schemes.

cs.CR↗

arXiv2014

LARSEN-ELM: Selective Ensemble of Extreme Learning Machines using LARS for Blended Data

Extreme learning machine (ELM) as a neural network algorithm has shown its good performance, such as fast speed, simple structure etc, but also, weak robustness is an unavoidable defect in original ELM for blended data. We present a new machine learning framework called LARSEN-ELM for overcoming this problem. In our paper, we would like to show two key steps in LARSEN-ELM. In the first step, preprocessing, we select the input variables highly related to the output using least angle regression (LARS). In the second step, training, we employ Genetic Algorithm (GA) based selective ensemble and original ELM. In the experiments, we apply a sum of two sines and four datasets from UCI repository to verify the robustness of our approach. The experimental results show that compared with original ELM and other methods such as OP-ELM, GASEN-ELM and LSBoost, LARSEN-ELM significantly improve robustness performance while keeping a relatively high speed.

cs.LG↗