arXiv subjects

Ting Wang

Publications and source records attributed to Ting Wang.

At least 235 records · Page 13Linked to original sources

arXiv2020

Self-controlled growth of highly uniform Ge/Si hut wires for scalable qubit devices

Semiconductor nanowires have been playing a crucial role in the development of nanoscale devices for the realization of spin qubits, Majorana fermions, single photon emitters, nanoprocessors, etc. The monolithic growth of site-controlled nanowires is a prerequisite towards the next generation of devices that will require addressability and scalability. Here, combining top-down nanofabrication and bottom-up self-assembly, we report on the growth of Ge wires on pre-patterned Si (001) substrates with controllable position, distance, length and structure. This is achieved by a novel growth process which uses a SiGe strain-relaxation template and can be generalized to other material combinations. Transport measurements show an electrically tunable spin-orbit coupling, with a spin-orbit length similar to that of III-V materials. Also, capacitive coupling between closely spaced wires is observed, which underlines their potential as a host for implementing two qubit gates. The reported results open a path towards scalable qubit devices with Si compatibility.

cond-mat.mes-hall↗

arXiv2019

Convergence of the likelihood ratio method for linear response of non-equilibrium stationary states

We consider numerical schemes for computing the linear response of steady-state averages of stochastic dynamics with respect to a perturbation of the drift part of the stochastic differential equation. The schemes are based on Girsanov's change-of-measure theory to reweight trajectories with factors derived from a linearization of the Girsanov weights. We investigate both the discretization error and the finite time approximation error. The designed numerical schemes are shown to be of bounded variance with respect to the integration time, which is a desirable feature for long time simulation. We also show how the discretization error can be improved to second order accuracy in the time step by modifying the weight process in an appropriate way.

math.NA↗

arXiv2019

Interpretable Deep Learning under Fire

Providing explanations for deep neural network (DNN) models is crucial for their use in security-sensitive domains. A plethora of interpretation models have been proposed to help users understand the inner workings of DNNs: how does a DNN arrive at a specific decision for a given input? The improved interpretability is believed to offer a sense of security by involving human in the decision-making process. Yet, due to its data-driven nature, the interpretability itself is potentially susceptible to malicious manipulations, about which little is known thus far. Here we bridge this gap by conducting the first systematic study on the security of interpretable deep learning systems (IDLSes). We show that existing \imlses are highly vulnerable to adversarial manipulations. Specifically, we present ADV^2, a new class of attacks that generate adversarial inputs not only misleading target DNNs but also deceiving their coupled interpretation models. Through empirical evaluation against four major types of IDLSes on benchmark datasets and in security-critical applications (e.g., skin cancer diagnosis), we demonstrate that with ADV^2 the adversary is able to arbitrarily designate an input's prediction and interpretation. Further, with both analytical and empirical evidence, we identify the prediction-interpretation gap as one root cause of this vulnerability -- a DNN and its interpretation model are often misaligned, resulting in the possibility of exploiting both models simultaneously. Finally, we explore potential countermeasures against ADV^2, including leveraging its low transferability and incorporating it in an adversarial training framework. Our findings shed light on designing and operating IDLSes in a more secure and informative fashion, leading to several promising research directions.

cs.CR↗

arXiv2019

SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

Despite their immense popularity, deep learning-based acoustic systems are inherently vulnerable to adversarial attacks, wherein maliciously crafted audios trigger target systems to misbehave. In this paper, we present SirenAttack, a new class of attacks to generate adversarial audios. Compared with existing attacks, SirenAttack highlights with a set of significant features: (i) versatile -- it is able to deceive a range of end-to-end acoustic systems under both white-box and black-box settings; (ii) effective -- it is able to generate adversarial audios that can be recognized as specific phrases by target acoustic systems; and (iii) stealthy -- it is able to generate adversarial audios indistinguishable from their benign counterparts to human perception. We empirically evaluate SirenAttack on a set of state-of-the-art deep learning-based acoustic systems (including speech command recognition, speaker recognition and sound event classification), with results showing the versatility, effectiveness, and stealthiness of SirenAttack. For instance, it achieves 99.45% attack success rate on the IEMOCAP dataset against the ResNet18 model, while the generated adversarial audios are also misinterpreted by multiple popular ASR platforms, including Google Cloud Speech, Microsoft Bing Voice, and IBM Speech-to-Text. We further evaluate three potential defense methods to mitigate such attacks, including adversarial training, audio downsampling, and moving average filtering, which leads to promising directions for further research.

cs.CR↗

arXiv2019

FDI: Quantifying Feature-based Data Inferability

Motivated by many existing security and privacy applications, e.g., network traffic attribution, linkage attacks, private web search, and feature-based data de-anonymization, in this paper, we study the Feature-based Data Inferability (FDI) quantification problem. First, we conduct the FDI quantification under both naive and general data models from both a feature distance perspective and a feature distribution perspective. Our quantification explicitly shows the conditions to have a desired fraction of the target users to be Top-K inferable (K is an integer parameter). Then, based on our quantification, we evaluate the user inferability in two cases: network traffic attribution in network forensics and feature-based data de-anonymization. Finally, based on the quantification and evaluation, we discuss the implications of this research for existing feature-based inference systems.

cs.CR↗

arXiv2019

De-Health: All Your Online Health Information Are Belong to Us

In this paper, we study the privacy of online health data. We present a novel online health data De-Anonymization (DA) framework, named De-Health. De-Health consists of two phases: Top-K DA, which identifies a candidate set for each anonymized user, and refined DA, which de-anonymizes an anonymized user to a user in its candidate set. By employing both candidate selection and DA verification schemes, De-Health significantly reduces the DA space by several orders of magnitude while achieving promising DA accuracy. Leveraging two real world online health datasets WebMD (89,393 users, 506K posts) and HealthBoards (388,398 users, 4.7M posts), we validate the efficacy of De-Health. Further, when the training data are insufficient, De-Health can still successfully de-anonymize a large portion of anonymized users. We develop the first analytical framework on the soundness and effectiveness of online health data DA. By analyzing the impact of various data features on the anonymity, we derive the conditions and probabilities for successfully de-anonymizing one user or a group of users in exact DA and Top-K DA. Our analysis is meaningful to both researchers and policy makers in facilitating the development of more effective anonymization techniques and proper privacy polices. We present a linkage attack framework which can link online health/medical information to real world people. Through a proof-of-concept attack, we link 347 out of 2805 WebMD users to real world people, and find the full names, medical/health information, birthdates, phone numbers, and other sensitive information for most of the re-identified users. This clearly illustrates the fragility of the notion of privacy of those who use online health forums.

cs.CR↗

arXiv2019

Steady State Sensitivity Analysis of Continuous Time Markov Chains

In this paper we study Monte Carlo estimators based on the likelihood ratio approach for steady-state sensitivity. We first extend the result of Glynn and Olvera-Cravioto [doi:doi: 10.1287/stsy.2018.002] to the setting of continuous time Markov chains with a countable state space which include models such as stochastic reaction kinetics and kinetic Monte Carlo lattice system. We show that the variance of the centered likelihood ratio estimators does not grow in time. This result suggests that the centered likelihood ratio estimators should be favored for sensitivity analysis when the mixing time of the underlying continuous time Markov chain is large, which is typically the case when systems exhibit multi-scale behavior. We demonstrate a practical implication of this analysis on a numerical benchmark of two examples for the biochemical reaction networks.

math.PR↗

arXiv2019

Accelerated scale bridging with sparsely approximated Gaussian learning

Multiscale modeling is a systematic approach to describe the behavior of complex systems by coupling models from different scales. The approach has been demonstrated to be very effective in areas of science as diverse as materials science, climate modeling and chemistry. However, routine use of multiscale simulations is often hindered by the very high cost of individual at-scale models. Approaches aiming to alleviate that cost by means of Gaussian process regression based surrogate models have been proposed. Yet, many of these surrogate models are expensive to construct, especially when the number of data needed is large. In this article, we employ a hierarchical sparse Cholesky decomposition to develop a sparse Gaussian process regression method and apply the method to approximate the equation of state of an energetic material in a multiscale model of dynamic deformation. We demonstrate that the method provides a substantial reduction both in computational cost and solution error as compared with previous methods.

physics.comp-ph↗

arXiv2019

Adversarial CAPTCHAs

Following the principle of to set one's own spear against one's own shield, we study how to design adversarial CAPTCHAs in this paper. We first identify the similarity and difference between adversarial CAPTCHA generation and existing hot adversarial example (image) generation research. Then, we propose a framework for text-based and image-based adversarial CAPTCHA generation on top of state-of-the-art adversarial image generation techniques. Finally, we design and implement an adversarial CAPTCHA generation and evaluation system, named aCAPTCHA, which integrates 10 image preprocessing techniques, 9 CAPTCHA attacks, 4 baseline adversarial CAPTCHA generation methods, and 8 new adversarial CAPTCHA generation methods. To examine the performance of aCAPTCHA, extensive security and usability evaluations are conducted. The results demonstrate that the generated adversarial CAPTCHAs can significantly improve the security of normal CAPTCHAs while maintaining similar usability. To facilitate the CAPTCHA security research, we also open source the aCAPTCHA system, including the source code, trained models, datasets, and the usability evaluation interfaces.

cs.CR↗

arXiv2018

TextBugger: Generating Adversarial Text Against Real-world Applications

Deep Learning-based Text Understanding (DLTU) is the backbone technique behind various applications, including question answering, machine translation, and text classification. Despite its tremendous popularity, the security vulnerabilities of DLTU are still largely unknown, which is highly concerning given its increasing use in security-sensitive applications such as sentiment analysis and toxic content detection. In this paper, we show that DLTU is inherently vulnerable to adversarial text attacks, in which maliciously crafted texts trigger target DLTU systems and services to misbehave. Specifically, we present TextBugger, a general attack framework for generating adversarial texts. In contrast to prior works, TextBugger differs in significant ways: (i) effective -- it outperforms state-of-the-art attacks in terms of attack success rate; (ii) evasive -- it preserves the utility of benign text, with 94.9\% of the adversarial text correctly recognized by human readers; and (iii) efficient -- it generates adversarial text with computational complexity sub-linear to the text length. We empirically evaluate TextBugger on a set of real-world DLTU systems and services used for sentiment analysis and toxic content detection, demonstrating its effectiveness, evasiveness, and efficiency. For instance, TextBugger achieves 100\% success rate on the IMDB dataset based on Amazon AWS Comprehend within 4.61 seconds and preserves 97\% semantic similarity. We further discuss possible defense mechanisms to mitigate such attack and the adversary's potential countermeasures, which leads to promising directions for further research.

cs.CR↗

arXiv2018

Model-Reuse Attacks on Deep Learning Systems

Many of today's machine learning (ML) systems are built by reusing an array of, often pre-trained, primitive models, each fulfilling distinct functionality (e.g., feature extraction). The increasing use of primitive models significantly simplifies and expedites the development cycles of ML systems. Yet, because most of such models are contributed and maintained by untrusted sources, their lack of standardization or regulation entails profound security implications, about which little is known thus far. In this paper, we demonstrate that malicious primitive models pose immense threats to the security of ML systems. We present a broad class of {\em model-reuse} attacks wherein maliciously crafted models trigger host ML systems to misbehave on targeted inputs in a highly predictable manner. By empirically studying four deep learning systems (including both individual and ensemble systems) used in skin cancer screening, speech recognition, face verification, and autonomous steering, we show that such attacks are (i) effective - the host systems misbehave on the targeted inputs as desired by the adversary with high probability, (ii) evasive - the malicious models function indistinguishably from their benign counterparts on non-targeted inputs, (iii) elastic - the malicious models remain effective regardless of various system design choices and tuning strategies, and (iv) easy - the adversary needs little prior knowledge about the data used for system tuning or inference. We provide analytical justification for the effectiveness of model-reuse attacks, which points to the unprecedented complexity of today's primitive models. This issue thus seems fundamental to many ML systems. We further discuss potential countermeasures and their challenges, which lead to several promising research directions.

cs.CR↗

arXiv2018

Global sensitivity analysis based on DIRECT-KG-HDMR and thermal optimization of pin-fin heat sink for the platform inertial navigation system

In this study, in order to reduce the local high temperature of the platform in inertial navigation system (PINS), a pin-fin heat sink with staggered arrangement is designed. To reduce the dimension of the inputs and improve the efficiency of optimization, a feasible global sensitivity analysis (GSA) based on Kriging-High Dimensional Model Representation with DIviding RECTangles sampling strategy (DIRECT-KG-HDMR) is proposed. Compared with other GSA methods, the proposed method can indicate the effects of the structural and the material parameters on the maximum temperature at the bottom of the heat sink by using both sensitivity and coupling coefficients. From the results of GSA, it can be found that the structural parameters have greater effects on thermal performance than the material ones. Moreover, the coupling intensities between the structural and material parameters are weak. Therefore, the structural parameters are selected to optimize the thermal performance of the heat sink, and several popular optimization algorithms such as GA, DE, TLBO, PSO and EGO are used for the optimization. Moreover, steady thermal response of the PINS with the optimized heat sink is also studied, and its result shows that the maximum temperature of high temperature region of the platform is reduced by 1.09 degree Celsius compared with the PINS without the heat sink.

cs.CE↗

arXiv2018

Enhanced optical Kerr nonlinearity of graphene/Si hybrid waveguide

In this work, we experimentally study the optical kerr nonlinearities of graphene/Si hybrid waveguides with enhanced self-phase modulation. In the case of CMOS compatible materials for nonlinear optical signal processing, Si and silicon nitride waveguides have been extensively investigated over the past decade. However, Si waveguides exhibit strong two-photon absorption (TPA) at telecommunication wavelengths, which lead to a significant reduction of nonlinear figure of merit. In contrast, silicon nitride based material system usually suppress the TPA, but simultaneously leads to the reduction of the Kerr nonlinearity by two orders of magnitude. Here, we introduce a graphene/Si hybrid waveguide, which remain the optical properties and CMOS compatibility of Si waveguides, while enhance the Kerr nonlinearity by transferring patterned graphene over the top of the waveguides. The graphene/Si waveguides are measured with a nonlinear parameter of 510 W-1m-1. Enhanced nonlinear figure-of-merit (FOM) of 2.48 has been achieved, which is three times higher than that of the Si waveguide. This work reveals the potential application of graphene/Si hybrid photonic waveguides with high Kerr nonlinearity and FOM for nonlinear all-optical signal processing.

physics.app-ph↗

arXiv2018

EagleEye: Attack-Agnostic Defense against Adversarial Inputs (Technical Report)

Deep neural networks (DNNs) are inherently vulnerable to adversarial inputs: such maliciously crafted samples trigger DNNs to misbehave, leading to detrimental consequences for DNN-powered systems. The fundamental challenges of mitigating adversarial inputs stem from their adaptive and variable nature. Existing solutions attempt to improve DNN resilience against specific attacks; yet, such static defenses can often be circumvented by adaptively engineered inputs or by new attack variants. Here, we present EagleEye, an attack-agnostic adversarial tampering analysis engine for DNN-powered systems. Our design exploits the {\em minimality principle} underlying many attacks: to maximize the attack's evasiveness, the adversary often seeks the minimum possible distortion to convert genuine inputs to adversarial ones. We show that this practice entails the distinct distributional properties of adversarial inputs in the input space. By leveraging such properties in a principled manner, EagleEye effectively discriminates adversarial inputs and even uncovers their correct classification outputs. Through extensive empirical evaluation using a range of benchmark datasets and DNN models, we validate EagleEye's efficacy. We further investigate the adversary's possible countermeasures, which implies a difficult dilemma for her: to evade EagleEye's detection, excessive distortion is necessary, thereby significantly reducing the attack's evasiveness regarding other detection mechanisms.

cs.CR↗

arXiv2018

Complete long-term corrosion protection with chemical vapor deposited graphene

Despite the numerous reports on the topic, examples of chemical vapor deposited (CVD) graphene-based anticorrosive coatings able to provide long-term protection (i.e., several months) of metals are still unavailable. Here, we finally present a polymer-graphene hybrid coating, comprising two single layers of CVD graphene sandwiched by three layers of polyvinyl butyral, that provides complete corrosion protection to commercial aluminum alloys even after 120 days of exposure to simulated seawater. The essential role played by graphene in the hybrid coating is evident when we compare the results from a polymer-only coating of the same thickness, which fails in protecting the metal after barely 30 days. With the emergence of commercially available large-area CVD graphene, our work demonstrates a straightforward approach towards high-performance anticorrosive coatings, which can be extended to other two-dimensional materials and polymers, for long-term protection of various relevant metals and alloys.

cond-mat.mtrl-sci↗

arXiv2018

Ge hole spin qubit

Holes confined in quantum dots have gained considerable interest in the past few years due to their potential as spin qubits. Here we demonstrate double quantum dot devices in Ge hut wires. Low temperature transport measurements reveal Pauli spin blockade. We demonstrate electric-dipole spin resonance by applying a radio frequency electric field to one of the electrodes defining the double quantum dot. Next, we induce coherent hole spin oscillations by varying the duration of the microwave burst. Rabi oscillations with frequencies reaching 140MHz are observed. Finally, Ramsey experiments reveal dephasing times of 130ns. The reported results emphasize the potential of Ge as a platform for fast and scalable hole spin qubit devices.

cond-mat.mes-hall↗

arXiv2018

Differentially Private Releasing via Deep Generative Model (Technical Report)

Privacy-preserving releasing of complex data (e.g., image, text, audio) represents a long-standing challenge for the data mining research community. Due to rich semantics of the data and lack of a priori knowledge about the analysis task, excessive sanitization is often necessary to ensure privacy, leading to significant loss of the data utility. In this paper, we present dp-GAN, a general private releasing framework for semantic-rich data. Instead of sanitizing and then releasing the data, the data curator publishes a deep generative model which is trained using the original data in a differentially private manner; with the generative model, the analyst is able to produce an unlimited amount of synthetic data for arbitrary analysis tasks. In contrast of alternative solutions, dp-GAN highlights a set of key features: (i) it provides theoretical privacy guarantee via enforcing the differential privacy principle; (ii) it retains desirable utility in the released model, enabling a variety of otherwise impossible analyses; and (iii) most importantly, it achieves practical training scalability and stability by employing multi-fold optimization strategies. Through extensive empirical evaluation on benchmark datasets and analyses, we validate the efficacy of dp-GAN.

cs.CR↗

arXiv2017

Stationary averaging for multi-scale continuous time Markov chains using parallel replica dynamics

We propose two algorithms for simulating continuous time Markov chains in the presence of metastability. We show that the algorithms correctly estimate, under the ergodicity assumption, stationary averages of the process. Both algorithms, based on the idea of the parallel replica method, use parallel computing in order to explore metastable sets more efficiently. The algorithms require no assumptions on the Markov chains beyond ergodicity and the presence of identifiable metastability. In particular, there is no assumption on reversibility. For simpler illustration of the algorithms, we assume that a synchronous architecture is used throughout of the paper. We present error analyses, as well as numerical simulations on multi-scale stochastic reaction network models in order to demonstrate consistency of the method and its efficiency.

math.NA↗