arXiv subjects

Tianwei Zhang

Publications and source records attributed to Tianwei Zhang.

At least 289 records · Page 16Linked to original sources

arXiv2021

Privacy-preserving Collaborative Learning with Automatic Transformation Search

Collaborative learning has gained great popularity due to its benefit of data privacy protection: participants can jointly train a Deep Learning model without sharing their training sets. However, recent works discovered that an adversary can fully recover the sensitive training samples from the shared gradients. Such reconstruction attacks pose severe threats to collaborative learning. Hence, effective mitigation solutions are urgently desired. In this paper, we propose to leverage data augmentation to defeat reconstruction attacks: by preprocessing sensitive images with carefully-selected transformation policies, it becomes infeasible for the adversary to extract any useful information from the corresponding gradients. We design a novel search method to automatically discover qualified policies. We adopt two new metrics to quantify the impacts of transformations on data privacy and model usability, which can significantly accelerate the search speed. Comprehensive evaluations demonstrate that the policies discovered by our method can defeat existing reconstruction attacks in collaborative learning, with high efficiency and negligible impact on the model performance.

cs.CV↗

arXiv2021

A Survey of Microarchitectural Side-channel Vulnerabilities, Attacks and Defenses in Cryptography

Side-channel attacks have become a severe threat to the confidentiality of computer applications and systems. One popular type of such attacks is the microarchitectural attack, where the adversary exploits the hardware features to break the protection enforced by the operating system and steal the secrets from the program. In this paper, we systematize microarchitectural side channels with a focus on attacks and defenses in cryptographic applications. We make three contributions. (1) We survey past research literature to categorize microarchitectural side-channel attacks. Since these are hardware attacks targeting software, we summarize the vulnerable implementations in software, as well as flawed designs in hardware. (2) We identify common strategies to mitigate microarchitectural attacks, from the application, OS and hardware levels. (3) We conduct a large-scale evaluation on popular cryptographic applications in the real world, and analyze the severity, practicality and impact of side-channel vulnerabilities. This survey is expected to inspire side-channel research community to discover new attacks, and more importantly, propose new defense solutions against them.

cs.CR↗

arXiv2021

Risk Analysis and Policy Enforcement of Function Interactions in Robot Apps

Robot apps are becoming more automated, complex and diverse. An app usually consists of many functions, interacting with each other and the environment. This allows robots to conduct various tasks. However, it also opens a new door for cyber attacks: adversaries can leverage these interactions to threaten the safety of robot operations. Unfortunately, this issue is rarely explored in past works. We present the first systematic investigation about the function interactions in common robot apps. First, we disclose the potential risks and damages caused by malicious interactions. We introduce a comprehensive graph to model the function interactions in robot apps by analyzing 3,100 packages from the Robot Operating System (ROS) platform. From this graph, we identify and categorize three types of interaction risks. Second, we propose RTron, a novel system to detect and mitigate these risks and protect the operations of robot apps. We introduce security policies for each type of risks, and design coordination nodes to enforce the policies and regulate the interactions. We conduct extensive experiments on 110 robot apps from the ROS platform and two complex apps (Baidu Apollo and Autoware) widely adopted in industry. Evaluation results indicated RTron can correctly identify and mitigate all potential risks with negligible performance cost. To validate the practicality of the risks and solutions, we implement and evaluate RTron on a physical UGV (Turtlebot) with real-word apps and environments.

cs.CR↗

arXiv2021

A search for cloud cores affected by shocked carbon chain chemistry in L1251

We searched for shocked carbon chain chemistry (SCCC) sources with C$_3$S abundances surpassing those of HC$_5$N towards the dark cloud L1251, using the Effelsberg telescope at K-band (18 -- 26\,GHz). L1251-1 and L1251-3 are identified as the most promising SCCC sources. The two sources harbor young stellar objects. We conducted mapping observations towards L1251-A, the western tail of L1251, at $λ$ $\sim$3\,mm with the PMO 13.7 m and the NRO 45 m telescopes in lines of C$_2$H, N$_2$H$^+$, CS, HCO$^+$, SO, HC$_3$N and C$^{18}$O as well as in CO 3--2 using the JCMT. The spectral data were combined with archival data including Spitzer and Herschel continuum maps for further analysis. Filamentary sub-structures labeled as F1 to F6 were extracted in L1251, with F1 being associated with L1251-A hosting L1251-1. The peak positions of dense gas traced by HCO$^+$ are misaligned relative to those of the dust clumps. Episodic outflows are common in this region. The twisted morphology of F1 and velocity distribution along L1251-A may originate from stellar feedback. SCCC in L1251-1 may have been caused by outflow activities originated from the infrared source IRS1. The signposts of ongoing SCCC and the broadened line widths of C$_3$S and C$_4$H in L1251-1 as well as the distribution of HC$_3$N are also related to outflow activities in this region. L1251-1 (IRS1) together with the previously identified SCCC source IRS3 demonstrate that L1251-A is an excellent region to study shocked carbon chain chemistry.

astro-ph.GA↗

arXiv2021

RigidFusion: Robot Localisation and Mapping in Environments with Large Dynamic Rigid Objects

This work presents a novel RGB-D SLAM approach to simultaneously segment, track and reconstruct the static background and large dynamic rigid objects that can occlude major portions of the camera view. Previous approaches treat dynamic parts of a scene as outliers and are thus limited to a small amount of changes in the scene, or rely on prior information for all objects in the scene to enable robust camera tracking. Here, we propose to treat all dynamic parts as one rigid body and simultaneously segment and track both static and dynamic components. We, therefore, enable simultaneous localisation and reconstruction of both the static background and rigid dynamic components in environments where dynamic objects cause large occlusion. We evaluate our approach on multiple challenging scenes with large dynamic occlusion. The evaluation demonstrates that our approach achieves better motion segmentation, localisation and mapping without requiring prior knowledge of the dynamic object's shape and appearance.

cs.RO↗

arXiv2021

Local Black-box Adversarial Attacks: A Query Efficient Approach

Adversarial attacks have threatened the application of deep neural networks in security-sensitive scenarios. Most existing black-box attacks fool the target model by interacting with it many times and producing global perturbations. However, global perturbations change the smooth and insignificant background, which not only makes the perturbation more easily be perceived but also increases the query overhead. In this paper, we propose a novel framework to perturb the discriminative areas of clean examples only within limited queries in black-box attacks. Our framework is constructed based on two types of transferability. The first one is the transferability of model interpretations. Based on this property, we identify the discriminative areas of a given clean example easily for local perturbations. The second is the transferability of adversarial examples. It helps us to produce a local pre-perturbation for improving query efficiency. After identifying the discriminative areas and pre-perturbing, we generate the final adversarial examples from the pre-perturbed example by querying the targeted model with two kinds of black-box attack techniques, i.e., gradient estimation and random search. We conduct extensive experiments to show that our framework can significantly improve the query efficiency during black-box perturbing with a high attack success rate. Experimental results show that our attacks outperform state-of-the-art black-box attacks under various system settings.

cs.CV↗

arXiv2020

Stealing Deep Reinforcement Learning Models for Fun and Profit

This paper presents the first model extraction attack against Deep Reinforcement Learning (DRL), which enables an external adversary to precisely recover a black-box DRL model only from its interaction with the environment. Model extraction attacks against supervised Deep Learning models have been widely studied. However, those techniques cannot be applied to the reinforcement learning scenario due to DRL models' high complexity, stochasticity and limited observable information. We propose a novel methodology to overcome the above challenges. The key insight of our approach is that the process of DRL model extraction is equivalent to imitation learning, a well-established solution to learn sequential decision-making policies. Based on this observation, our methodology first builds a classifier to reveal the training algorithm family of the targeted black-box DRL model only based on its predicted actions, and then leverages state-of-the-art imitation learning techniques to replicate the model from the identified algorithm family. Experimental results indicate that our methodology can effectively recover the DRL models with high fidelity and accuracy. We also demonstrate two use cases to show that our model extraction attack can (1) significantly improve the success rate of adversarial attacks, and (2) steal DRL models stealthily even they are protected by DNN watermarks. These pose a severe threat to the intellectual property and privacy protection of DRL applications.

cs.LG↗

arXiv2020

FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation Techniques

It is extensively studied that Deep Neural Networks (DNNs) are vulnerable to Adversarial Examples (AEs). With more and more advanced adversarial attack methods have been developed, a quantity of corresponding defense solutions were designed to enhance the robustness of DNN models. It has become a popularity to leverage data augmentation techniques to preprocess input samples before inference to remove adversarial perturbations. By obfuscating the gradients of DNN models, these approaches can defeat a considerable number of conventional attacks. Unfortunately, advanced gradient-based attack techniques (e.g., BPDA and EOT) were introduced to invalidate these preprocessing effects. In this paper, we present FenceBox, a comprehensive framework to defeat various kinds of adversarial attacks. FenceBox is equipped with 15 data augmentation methods from three different categories. We comprehensively evaluated that these methods can effectively mitigate various adversarial attacks. FenceBox also provides APIs for users to easily deploy the defense over their models in different modes: they can either select an arbitrary preprocessing method, or a combination of functions for a better robustness guarantee, even under advanced adversarial attacks. We open-source FenceBox, and expect it can be used as a standard toolkit to facilitate the research of adversarial attacks and defenses.

cs.LG↗

arXiv2020

Planck Galactic Cold Clumps in Two Regions: the First Quadrant and the Anti-Center Direction Region

Sixty five Planck Galactic cold clumps (PGCCs) from the first quadrant (IQuad) and thirty nine of PGCCs from the Anti-Center direction region (ACent) were observed in $^{12}$CO, $^{13}$CO and C$^{18}$O J=1-0 lines using the PMO 13.7-m telescope. All the targets were detected with all the three lines, except for 12 IQuad and 8 ACent PGCCs without C$^{18}$O detection. Seventy six and 49 velocity components were obtained in IQuad and ACent respectively. One-hundred and forty-six cores were extracted from 76 IQuad clumps and 100 cores from 49 ACent clumps. The average T$_{\mathrm{ex}}$ of IQuad cores and ACent cores are 12.4 K and 12.1 K, respectively. The average line width of $^{13}$CO of IQuad cores and ACent cores are 1.55 km s$^{-1}$ and 1.77 km s$^{-1}$, respectively. Among the detected cores, 24 in IQuad and 13 in ACent have asymmetric line profiles. The small blue excesses, $\sim$0.03 in IQuad and 0.01 in ACent, indicate that the star formation is not active in these PGCC cores. Power-law fittings of core mass function to the high mass end give indexes of -0.57 in IQuad and -1.02 in ACent which are flatter than the slope of initial mass function given by \citeauthor{1955ApJ...121..161S}. The large turnover masses with value of 28 M$_{\odot}$ for IQuad cores and 77 M$_{\odot}$ for ACent cores suggest low star formation efficiencies in PGCCs. The correlation between virial mass and gas mass indicates that most of PGCC cores in both regions are not likely pressure-confined.

astro-ph.GA↗

arXiv2020

Generating Adversarial Examples with Controllable Non-transferability

Adversarial attacks against Deep Neural Networks have been widely studied. One significant feature that makes such attacks particularly powerful is transferability, where the adversarial examples generated from one model can be effective against other similar models as well. A large number of works have been done to increase the transferability. However, how to decrease the transferability and craft malicious samples only for specific target models are not explored yet. In this paper, we design novel attack methodologies to generate adversarial examples with controllable non-transferability. With these methods, an adversary can efficiently produce precise adversarial examples to attack a set of target models he desires, while keeping benign to other models. The first method is Reversed Loss Function Ensemble, where the adversary can craft qualified examples from the gradients of a reversed loss function. This approach is effective for the white-box and gray-box settings. The second method is Transferability Classification: the adversary trains a transferability-aware classifier from the perturbations of adversarial examples. This classifier further provides the guidance for the generation of non-transferable adversarial examples. This approach can be applied to the black-box scenario. Evaluation results demonstrate the effectiveness and efficiency of our proposed methods. This work opens up a new route for generating adversarial examples with new features and applications.

cs.CR↗

arXiv2020

SplitFusion: Simultaneous Tracking and Mapping for Non-Rigid Scenes

We present SplitFusion, a novel dense RGB-D SLAM framework that simultaneously performs tracking and dense reconstruction for both rigid and non-rigid components of the scene. SplitFusion first adopts deep learning based semantic instant segmentation technique to split the scene into rigid or non-rigid surfaces. The split surfaces are independently tracked via rigid or non-rigid ICP and reconstructed through incremental depth map fusion. Experimental results show that the proposed approach can provide not only accurate environment maps but also well-reconstructed non-rigid targets, e.g. the moving humans.

cs.CV↗

arXiv2020

Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques

Deep Neural Networks (DNNs) are well-known to be vulnerable to Adversarial Examples (AEs). A large amount of efforts have been spent to launch and heat the arms race between the attackers and defenders. Recently, advanced gradient-based attack techniques were proposed (e.g., BPDA and EOT), which have defeated a considerable number of existing defense methods. Up to today, there are still no satisfactory solutions that can effectively and efficiently defend against those attacks. In this paper, we make a steady step towards mitigating those advanced gradient-based attacks with two major contributions. First, we perform an in-depth analysis about the root causes of those attacks, and propose four properties that can break the fundamental assumptions of those attacks. Second, we identify a set of operations that can meet those properties. By integrating these operations, we design two preprocessing functions that can invalidate these powerful attacks. Extensive evaluations indicate that our solutions can effectively mitigate all existing standard and advanced attack techniques, and beat 11 state-of-the-art defense solutions published in top-tier conferences over the past 2 years. The defender can employ our solutions to constrain the attack success rate below 7% for the strongest attacks even the adversary has spent dozens of GPU hours.

cs.CR↗

arXiv2020

Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learning

Adversarial attacks against conventional Deep Learning (DL) systems and algorithms have been widely studied, and various defenses were proposed. However, the possibility and feasibility of such attacks against Deep Reinforcement Learning (DRL) are less explored. As DRL has achieved great success in various complex tasks, designing effective adversarial attacks is an indispensable prerequisite towards building robust DRL algorithms. In this paper, we introduce two novel adversarial attack techniques to \emph{stealthily} and \emph{efficiently} attack the DRL agents. These two techniques enable an adversary to inject adversarial samples in a minimal set of critical moments while causing the most severe damage to the agent. The first technique is the \emph{critical point attack}: the adversary builds a model to predict the future environmental states and agent's actions, assesses the damage of each possible attack strategy, and selects the optimal one. The second technique is the \emph{antagonist attack}: the adversary automatically learns a domain-agnostic model to discover the critical moments of attacking the agent in an episode. Experimental results demonstrate the effectiveness of our techniques. Specifically, to successfully attack the DRL agent, our critical point technique only requires 1 (TORCS) or 2 (Atari Pong and Breakout) steps, and the antagonist technique needs fewer than 5 steps (4 Mujoco tasks), which are significant improvements over state-of-the-art methods.

cs.CR↗

arXiv2020

Learning to Optimize Non-Rigid Tracking

One of the widespread solutions for non-rigid tracking has a nested-loop structure: with Gauss-Newton to minimize a tracking objective in the outer loop, and Preconditioned Conjugate Gradient (PCG) to solve a sparse linear system in the inner loop. In this paper, we employ learnable optimizations to improve tracking robustness and speed up solver convergence. First, we upgrade the tracking objective by integrating an alignment data term on deep features which are learned end-to-end through CNN. The new tracking objective can capture the global deformation which helps Gauss-Newton to jump over local minimum, leading to robust tracking on large non-rigid motions. Second, we bridge the gap between the preconditioning technique and learning method by introducing a ConditionNet which is trained to generate a preconditioner such that PCG can converge within a small number of steps. Experimental results indicate that the proposed learning method converges faster than the original PCG by a large margin.

cs.CV↗

arXiv2020

FlowFusion: Dynamic Dense RGB-D SLAM Based on Optical Flow

Dynamic environments are challenging for visual SLAM since the moving objects occlude the static environment features and lead to wrong camera motion estimation. In this paper, we present a novel dense RGB-D SLAM solution that simultaneously accomplishes the dynamic/static segmentation and camera ego-motion estimation as well as the static background reconstructions. Our novelty is using optical flow residuals to highlight the dynamic semantics in the RGB-D point clouds and provide more accurate and efficient dynamic/static segmentation for camera tracking and background reconstruction. The dense reconstruction results on public datasets and real dynamic scenes indicate that the proposed approach achieved accurate and efficient performances in both dynamic and static environments compared to state-of-the-art approaches.

cs.RO↗

arXiv2019

Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications

We systematize software side-channel attacks with a focus on vulnerabilities and countermeasures in the cryptographic implementations. Particularly, we survey past research literature to categorize vulnerable implementations, and identify common strategies to eliminate them. We then evaluate popular libraries and applications, quantitatively measuring and comparing the vulnerability severity, response time and coverage. Based on these characterizations and evaluations, we offer some insights for side-channel researchers, cryptographic software developers and users. We hope our study can inspire the side-channel research community to discover new vulnerabilities, and more importantly, to fortify applications against them.

cs.CR↗

arXiv2019

Carbon-Chain Molecules in Molecular Outflows and Lupus I Region--New Producing Region and New Forming Mechanism

Using the new equipment of the Shanghai Tian Ma Radio Telescope, we have searched for carbon-chain molecules (CCMs) towards five outflow sources and six Lupus I starless dust cores, including one region known to be characterized by warm carbon-chain chemistry (WCCC), Lupus I-1 (IRAS 15398-3359), and one TMC-1 like cloud, Lupus I-6 (Lupus-1A). Lines of HC3N J=2-1, HC5N J=6-5, HC7N J=14-13, 15-14, 16-15 and C3S J=3-2 were detected in all the targets except in the outflow source L1660 and the starless dust core Lupus I-3/4. The column densities of nitrogen-bearing species range from 10$^{12}$ to 10$^{14}$ cm$^{-2}$ and those of C$_3$S are about 10$^{12}$ cm$^{-2}$. Two outflow sources, I20582+7724 and L1221, could be identified as new carbon-chain--producing regions. Four of the Lupus I dust cores are newly identified as early quiescent and dark carbon-chain--producing regions similar to Lup I-6, which together with the WCCC source, Lup I-1, indicate that carbon-chain-producing regions are popular in Lupus I which can be regard as a Taurus like molecular cloud complex in our Galaxy. The column densities of C3S are larger than those of HC7N in the three outflow sources I20582, L1221 and L1251A. Shocked carbon-chain chemistry (SCCC) is proposed to explain the abnormal high abundances of C3S compared with those of nitrogen-bearing CCMs. Gas-grain chemical models support the idea that shocks can fuel the environment of those sources with enough $S^+$ thus driving the generation of S-bearing CCMs.

astro-ph.SR↗

arXiv2019

A particular carbon-chain-producing region: L1489 starless core

We detected carbon-chain molecules (CCMs) HC2n+1N (n=1-3) and C3S in Ku band as well as {high-energy excitation lines including C4H N=9-8, J=17/2-15/2, 19/2-17/2, and CH3CCH J=5-4, K=2 in the 3 mm band toward a starless core called the eastern molecular core (EMC) of L1489 IRS. Maps of all the observed lines were also obtained. Comparisons with a number of early starless cores and WCCC source L1527 show that the column densities of C4H and CH3CCH are close to those of L1527, and the CH3CCH column densities of the EMC and L1527 are slightly higher than those of TMC-1. The EMC and L1527 have similar C3S column densities, but they are much lower than those of all the starless cores, with only 6.5% and 10% of the TMC-1 value, respectively. The emissions of the N-bearing species of the EMC and L1527 are at the medium level of the starless cores. These comparisons show that the CCM emissions in the EMC are similar to those of L1527, though L1527 contains a protostar. Although dark and quiescent, the EMC is warmer and at a later evolutionary stage than classical carbon-chain--producing regions in the cold, dark, quiescent early phase. The PACS, SPIRE, and SCUBA maps evidently show that the L1489 IRS seems to be the heating source of the EMC. Although it is located at the margins of the EMC, its bolometric luminosity and bolometric temperature are relatively high. Above all, the EMC is a rather particular carbon-chain-producing region and is quite significant for CCM science.

astro-ph.SR↗