arXiv subjects

Xiaoyun Xu

Publications and source records attributed to Xiaoyun Xu.

16 recordsLinked to original sources

arXiv2026

Activating Latent Security Knowledge through LLM-Guided Risk Analysis for Secure Code Generation

Large language models are pretrained on extensive software and security corpora, yet they frequently generate functionally correct code containing well-known vulnerabilities. Existing defenses commonly treat this behavior as a knowledge deficit, addressing it through model-specific fine-tuning or retrieval from large collections of vulnerability code examples. We argue that insecure generation can arise from a failure to activate task-relevant security knowledge, rather than from knowledge absence alone. We present BRACE, an inference-time, training-free security harness for risk-conditioned activation of security knowledge in black-box code generation. Given only a coding task, BRACE first utilizes an LLM (as a security expert) to identify task-relevant security risks. The predicted risk identifiers are validated against a lightweight canonical catalog and converted into concise, task-specific risk cues. BRACE then supplies these cues to the target code model, prompting it to apply its own secure-coding knowledge while satisfying the original functional requirements. The framework requires no target-model fine-tuning, parameter access, hidden states, mutable logits, learned retriever, or coding-example knowledge base. We evaluate BRACE on six open-weight models and six frontier commercial models with four benchmarks (CyberNative, HumanEval, CWEval, BaxBench), measuring functional correctness, security, joint functionality-security, and project-level generation. BRACE raises the average Safe Code Rate from 33.9% under Secure Prompt to 91.2% on CyberNative. It also improves CWEval Func-Sec performance from 49.7% to 69.6%. Mechanism-oriented ablations further show that the gains depend on selecting task-relevant risks.

cs.CR↗

arXiv2026

From Verdict to Diagnosis: Attributable Security Review of Pull Requests

Automated code reviewers are increasingly used as gates on pull requests (PRs), yet evaluations measure whether they block a malicious change. A block may be triggered by an unrelated issue rather than the vulnerability that makes the PR unsafe; fixing the reported issue can leave the target defect exploitable. We call this discrepancy the Verdict-Diagnosis (VD) gap. We present MalPR-Bench, a mechanism-grounded benchmark of 89 malicious PRs and 50 paired benign controls across 44 repositories and eight language families. Each malicious case has a pre-committed rubric specifying the target vulnerability, accepted mechanism descriptions, required repository evidence, and off-target findings receiving no credit. Reviews are scored separately for verdict correctness, target-vulnerability identification, and evidence validation; an attributable block requires all three. We introduce PRGuard, an attributable PR security reviewer that constructs candidate vulnerabilities and validates their premises against repository evidence using deterministic, non-executing tools and bounded retrieval. Across 31 common-coverage held-out malicious PRs, PRGuard and CodeRabbit produce similar blocking totals (22/31 vs. 24/31), but PRGuard identifies 22 target vulnerabilities versus 16 for CodeRabbit, a 1.38x difference. On 14 absence-type cases, both block 9, while PRGuard identifies 9 targets versus 3. CodeRabbit identifies 16/24 targets when required evidence lies within touched files and 0/7 when validation requires evidence outside them. Finally, PRGuard uncovers twelve previously undisclosed, proof-of-concept-backed vulnerabilities across five projects. PRGuard/DeepSeek and CodeRabbit both block 10/12 discovery PRs, but produce 10/12 and 4/12 attributable blocks, respectively. Thus, verdict-only evaluation can substantially overstate the security value of automated review.

cs.CR↗

arXiv2025

MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustness

Vision Transformers (ViTs) have emerged as a fundamental architecture and serve as the backbone of modern vision-language models. Despite their impressive performance, ViTs exhibit notable vulnerability to evasion attacks, necessitating the development of specialized Adversarial Training (AT) strategies tailored to their unique architecture. While a direct solution might involve applying existing AT methods to ViTs, our analysis reveals significant incompatibilities, particularly with state-of-the-art (SOTA) approaches such as Generalist (CVPR 2023) and DBAT (USENIX Security 2024). This paper presents a systematic investigation of adversarial robustness in ViTs and provides a novel theoretical Mutual Information (MI) analysis in its autoencoder-based self-supervised pre-training. Specifically, we show that MI between the adversarial example and its latent representation in ViT-based autoencoders should be constrained via derived MI bounds. Building on this insight, we propose a self-supervised AT method, MIMIR, that employs an MI penalty to facilitate adversarial pre-training by masked image modeling with autoencoders. Extensive experiments on CIFAR-10, Tiny-ImageNet, and ImageNet-1K show that MIMIR can consistently provide improved natural and robust accuracy, where MIMIR outperforms SOTA AT results on ImageNet-1K. Notably, MIMIR demonstrates superior robustness against unforeseen attacks and common corruption data and can also withstand adaptive attacks where the adversary possesses full knowledge of the defense mechanism. Our code and trained models are publicly available at: https://github.com/xiaoyunxxy/MIMIR.

cs.CV↗

arXiv2025

Towards Backdoor Stealthiness in Model Parameter Space

Recent research on backdoor stealthiness focuses mainly on indistinguishable triggers in input space and inseparable backdoor representations in feature space, aiming to circumvent backdoor defenses that examine these respective spaces. However, existing backdoor attacks are typically designed to resist a specific type of backdoor defense without considering the diverse range of defense mechanisms. Based on this observation, we pose a natural question: Are current backdoor attacks truly a real-world threat when facing diverse practical defenses? To answer this question, we examine 12 common backdoor attacks that focus on input-space or feature-space stealthiness and 17 diverse representative defenses. Surprisingly, we reveal a critical blind spot: Backdoor attacks designed to be stealthy in input and feature spaces can be mitigated by examining backdoored models in parameter space. To investigate the underlying causes behind this common vulnerability, we study the characteristics of backdoor attacks in the parameter space. Notably, we find that input- and feature-space attacks introduce prominent backdoor-related neurons in parameter space, which are not thoroughly considered by current backdoor attacks. Taking comprehensive stealthiness into account, we propose a novel supply-chain attack called Grond. Grond limits the parameter changes by a simple yet effective module, Adversarial Backdoor Injection (ABI), which adaptively increases the parameter-space stealthiness during the backdoor injection. Extensive experiments demonstrate that Grond outperforms all 12 backdoor attacks against state-of-the-art (including adaptive) defenses on CIFAR-10, GTSRB, and a subset of ImageNet. In addition, we show that ABI consistently improves the effectiveness of common backdoor attacks.

cs.CR↗

arXiv2025

SoK: The Last Line of Defense: On Backdoor Defense Evaluation

Backdoor attacks pose a significant threat to deep learning models by implanting hidden vulnerabilities that can be activated by malicious inputs. While numerous defenses have been proposed to mitigate these attacks, the heterogeneous landscape of evaluation methodologies hinders fair comparison between defenses. This work presents a systematic (meta-)analysis of backdoor defenses through a comprehensive literature review and empirical evaluation. We analyzed 183 backdoor defense papers published between 2018 and 2025 across major AI and security venues, examining the properties and evaluation methodologies of these defenses. Our analysis reveals significant inconsistencies in experimental setups, evaluation metrics, and threat model assumptions in the literature. Through extensive experiments involving three datasets (MNIST, CIFAR-100, ImageNet-1K), four model architectures (ResNet-18, VGG-19, ViT-B/16, DenseNet-121), 16 representative defenses, and five commonly used attacks, totaling over 3\,000 experiments, we demonstrate that defense effectiveness varies substantially across different evaluation setups. We identify critical gaps in current evaluation practices, including insufficient reporting of computational overhead and behavior under benign conditions, bias in hyperparameter selection, and incomplete experimentation. Based on our findings, we provide concrete challenges and well-motivated recommendations to standardize and improve future defense evaluations. Our work aims to equip researchers and industry practitioners with actionable insights for developing, assessing, and deploying defenses to different systems.

cs.CR↗

arXiv2025

Photometric analysis of asteroids in the Phocaea region

The Phocaea asteroid family, one of the large ancient families located in the inner main belt, may be the sources of near-Earth asteroids (NEAs) due to the nearby 3:1 mean motion resonance with Jupiter, the v6 secular resonance, and the Yarkovsky and YORP effects. Thus, understanding the influence of the Yarkovsky and YORP effects on the Phocaea family is one of the keys to figuring out the source of NEAs. However, the physical properties of most of the Phocaea family members are unknown at present. We perform a photometric analysis for 44 asteroids in the Phocaea region using photometric data obtained by ground-based and space-based telescopes (i.e., TESS and Gaia). Based on the derived physical properties, we find significant footprints of the Yarkovsky and YORP effects on the Phocaea family members. Selecting five asteroids nearby the inside boundary of the V-shape in the absolute-magnitude semimajor-axis (H, a) space, we estimate their densities considering their migration in semimajor-axis arises from the Yarkovsky effect. The bulk density of (852) Wladilena ({3.54 g/cm3) suggests a link to the H chondrite meteorites. Incorporating the grain density of the H chondrites, we estimate the macroporosities of the asteroids (290) Bruna, (1164) Kobolda, and (587) Hypsipyle, respectively 41%, 47%, and 65%, implying rubble pile structures. Considering the H chondrites link to asteroid (25) Phocaea, we suggest the parent body of the Phocaea family has been composed of H chondrite like material and the Phocaea family may be one of the sources of H chondrite meteorites.

astro-ph.EP↗

arXiv2025

Cooling process of the high-mass young stellar object G24.33+0.14 following an accretion burst

The HMYSO G24.33+0.14 (G24), has recently been observed to undergo an accretion burst since September 2019, lasting approximately two years. By utilizing 1.3 mm observational data from the NOrthern Extended Millimeter Array (NOEMA) in March 2020 and the Atacama Large Millimeter/submillimeter Array (ALMA) in September 2019, we have examined the physical environment changes in gas and dust within G24 region during the decay phase of the accretion burst. Following the burst, the continuum emission in the inner core region of G24 diminished by approximately 20%, while the emission in the outer region exhibited an increase by a factor of ~30%. This pattern indicates that the heat wave, triggered by the accretion burst, radiated outward from the core's interior to its periphery over the half-year period, with a calculated propagation speed of 0.08-0.38 times the speed of light. Moreover, the methanol emission intensity in this area has experienced a notable decline, with the rate of flux reduction correlating positively with the energy of the upper energy states. This, in conjunction with the analysis of methanol molecular line rotation temperature diagrams for different emitting regions, further substantiates that the core region of G24 cooled down, contrasted with the persistent heating in the outer region following the burst.

astro-ph.GA↗

arXiv2025

Real-world Edge Neural Network Implementations Leak Private Interactions Through Physical Side Channel

Neural networks have become a fundamental component of numerous practical applications, and their implementations, which are often accelerated by hardware, are integrated into all types of real-world physical devices. User interactions with neural networks on hardware accelerators are commonly considered privacy-sensitive. Substantial efforts have been made to uncover vulnerabilities and enhance privacy protection at the level of machine learning algorithms, including membership inference attacks, differential privacy, and federated learning. However, neural networks are ultimately implemented and deployed on physical devices, and current research pays comparatively less attention to privacy protection at the implementation level. In this paper, we introduce a generic physical side-channel attack, ScaAR, that extracts user interactions with neural networks by leveraging electromagnetic (EM) emissions of physical devices. Our proposed attack is implementation-agnostic, meaning it does not require the adversary to possess detailed knowledge of the hardware or software implementations, thanks to the capabilities of deep learning-based side-channel analysis (DLSCA). Experimental results demonstrate that, through the EM side channel, ScaAR can effectively extract the class label of user interactions with neural classifiers, including inputs and outputs, on the AMD-Xilinx MPSoC ZCU104 FPGA and Raspberry Pi 3 B. In addition, for the first time, we provide side-channel analysis on edge Large Language Model (LLM) implementations on the Raspberry Pi 5, showing that EM side channel leaks interaction data, and different LLM tokens can be distinguishable from the EM traces.

cs.CR↗

arXiv2024

BAN: Detecting Backdoors Activated by Adversarial Neuron Noise

Backdoor attacks on deep learning represent a recent threat that has gained significant attention in the research community. Backdoor defenses are mainly based on backdoor inversion, which has been shown to be generic, model-agnostic, and applicable to practical threat scenarios. State-of-the-art backdoor inversion recovers a mask in the feature space to locate prominent backdoor features, where benign and backdoor features can be disentangled. However, it suffers from high computational overhead, and we also find that it overly relies on prominent backdoor features that are highly distinguishable from benign features. To tackle these shortcomings, this paper improves backdoor feature inversion for backdoor detection by incorporating extra neuron activation information. In particular, we adversarially increase the loss of backdoored models with respect to weights to activate the backdoor effect, based on which we can easily differentiate backdoored and clean models. Experimental results demonstrate our defense, BAN, is 1.37$\times$ (on CIFAR-10) and 5.11$\times$ (on ImageNet200) more efficient with an average 9.99\% higher detect success rate than the state-of-the-art defense BTI-DBF. Our code and trained models are publicly available at~\url{https://github.com/xiaoyunxxy/ban}.

cs.LG↗

arXiv2024

Distribution and Properties of Molecular Gas Toward the Monoceros OB1 Region

We perform a comprehensive CO study toward the Monoceros OB1 (Mon OB1) region based on the MWISP survey at an angular resolution of about $50''$. The high-sensitivity data, together with the high dynamic range, shows that molecular gas in the $\rm 8^{\circ}\times4^{\circ}$ region displays complicated hierarchical structures and various morphology (e.g., filamentary, cavity-like, shell-like, and other irregular structures). Based on Gaussian decomposition and clustering for $\mathrm{^{13}CO}$ data, a total of 263 $\mathrm{^{13}CO}$ structures are identified in the whole region, and 88% of raw data flux is recovered. The dense gas with relatively high column density from the integrated CO emission is mainly concentrated in the region where multiple $\rm ^{13}CO$ structures are overlapped. Combining the results of 32 large $\mathrm{^{13}CO}$ structures with distances from Gaia DR3, we estimate an average distance of $\rm 729^{+45}_{-45}~pc$ for the GMC complex. The total mass of the GMC Complex traced by $\mathrm{^{12}CO}$, $\mathrm{^{13}CO}$, and $\mathrm{C^{18}O}$ are $1.1\times10^5~M_\odot$, $4.3\times10^4~M_\odot$, and $8.4\times10^3~M_\odot$, respectively. The dense gas fraction shows a clear difference between Mon OB1 GMC East (12.4%) and Mon OB1 GMC West (3.3%). Our results show that the dense gas environment is closely linked to the nearby star-forming regions. On the other hand, star-forming activities have a great influence on the physical properties of the surrounding molecular gas (e.g., greater velocity dispersion, higher temperatures, and more complex velocity structures, etc.). We also discuss the distribution/kinematics of molecular gas associated with nearby star-forming activities.

astro-ph.GA↗

arXiv2024

A method of photometric data extraction for asteroids from time-domain surveys

The lightcurves of asteroids are essential for determining their physical characteristics, including shape, spin, size, and surface composition. However, most asteroids are missing some of these basic physical parameters due to lack of photometric data. Although a few telescopes or surveys are specially designed for photometric lightcurve observations of asteroids, many ground-based and space-based sky surveys for hunting new exoplanets, transient events, etc., should capture numerous small Solar System objects. This will benefit the physical studies of these objects. In order to extract data of these moving objects from time-domain photometric surveys, we have developed a new method using the model tree algorithm in the field of machine learning. A dedicated module is built to automatically identify moving objects in dataset, and extract their photometric and astrometric data. As the first application of this novel method, we have analyzed data in five fields of the Yunnan-Hong Kong wide field photometric (YNHK) survey, from which 538 lightcurves of 211 asteroids are successfully extracted. Meanwhile, we also tested the method based on the data from NASA's Transiting Exoplanet Survey Satellite, and the result proves the reliability of our method. With derived lightcurves of 13 asteroids from the YNHK survey, we have determined their synodic spin periods, among which the periods of 4 asteroids are estimated for the first time. In future, we are going to apply this method to search for small objects in the outer part of the Solar System from the Chinese Space Station Telescope survey.

astro-ph.EP↗

arXiv2023

Universal Soldier: Using Universal Adversarial Perturbations for Detecting Backdoor Attacks

Deep learning models achieve excellent performance in numerous machine learning tasks. Yet, they suffer from security-related issues such as adversarial examples and poisoning (backdoor) attacks. A deep learning model may be poisoned by training with backdoored data or by modifying inner network parameters. Then, a backdoored model performs as expected when receiving a clean input, but it misclassifies when receiving a backdoored input stamped with a pre-designed pattern called "trigger". Unfortunately, it is difficult to distinguish between clean and backdoored models without prior knowledge of the trigger. This paper proposes a backdoor detection method by utilizing a special type of adversarial attack, universal adversarial perturbation (UAP), and its similarities with a backdoor trigger. We observe an intuitive phenomenon: UAPs generated from backdoored models need fewer perturbations to mislead the model than UAPs from clean models. UAPs of backdoored models tend to exploit the shortcut from all classes to the target class, built by the backdoor trigger. We propose a novel method called Universal Soldier for Backdoor detection (USB) and reverse engineering potential backdoor triggers via UAPs. Experiments on 345 models trained on several datasets show that USB effectively detects the injected backdoor and provides comparable or better results than state-of-the-art methods.

cs.LG↗

arXiv2023

IB-RAR: Information Bottleneck as Regularizer for Adversarial Robustness

In this paper, we propose a novel method, IB-RAR, which uses Information Bottleneck (IB) to strengthen adversarial robustness for both adversarial training and non-adversarial-trained methods. We first use the IB theory to build regularizers as learning objectives in the loss function. Then, we filter out unnecessary features of intermediate representation according to their mutual information (MI) with labels, as the network trained with IB provides easily distinguishable MI for its features. Experimental results show that our method can be naturally combined with adversarial training and provides consistently better accuracy on new adversarial examples. Our method improves the accuracy by an average of 3.07% against five adversarial attacks for the VGG16 network, trained with three adversarial training benchmarks and the CIFAR-10 dataset. In addition, our method also provides good robustness for undefended methods, such as training with cross-entropy loss only. Finally, in the absence of adversarial training, the VGG16 network trained using our method and the CIFAR-10 dataset reaches an accuracy of 35.86% against PGD examples, while using all layers reaches 25.61% accuracy.

cs.LG↗

arXiv2022

The Cassiopeia Filament: A Blown Spur of the Local Arm

We present wide-field and high-sensitivity CO(1-0) molecular line observations toward the Cassiopeia region, using the 13.7m millimeter telescope of the Purple Mountain Observatory (PMO). The CO observations reveal a large-scale highly filamentary molecular cloud within the Galactic region of 132\fdg0\,$\geq$\,$l$\,$\geq$\,122\fdg0 and -1\fdg0\,$\leq$\,$b$\,$\leq$\,3\fdg0 and the velocity range from approximately +1 to +4 km/s. The measured length of the large-scale filament, referred to as the Cassiopeia Filament, is about 390 pc. The observed properties of the Cassiopeia Filament, such as length, column density, and velocity gradient, are consistent with those synthetic large-scale filaments in the inter-arm regions. Based on its observed properties and location on the Galactic plane, we suggest that the Cassiopeia Filament is a spur of the Local arm, which is formed due to the galactic shear. The western end of the Cassiopeia Filament shows a giant arc-like molecular gas shell, which is extending in the velocity range from roughly -1 to +7 km/s. Finger-like structures, with systematic velocity gradients, are detected in the shell. The CO kinematics suggest that the large shell is expanding at a velocity of ~6.5 km/s. Both the shell and finger-like structures outline a giant bubble with a radius of ~16 pc, which is likely produced by stellar wind from the progenitor star of a supernova remnant. The observed spectral linewidths suggest that the whole Cassiopeia Filament was quiescent initially until its west part was blown by stellar wind and became supersonically turbulent.

astro-ph.GA↗

arXiv2019

Efficient Sampling for Selecting Important Nodes in Random Network

We consider the problem of selecting important nodes in a random network, where the nodes connect to each other randomly with certain transition probabilities. The node importance is characterized by the stationary probabilities of the corresponding nodes in a Markov chain defined over the network, as in Google's PageRank. Unlike deterministic network, the transition probabilities in random network are unknown but can be estimated by sampling. Under a Bayesian learning framework, we apply the first-order Taylor expansion and normal approximation to provide a computationally efficient posterior approximation of the stationary probabilities. In order to maximize the probability of correct selection, we propose a dynamic sampling procedure which uses not only posterior means and variances of certain interaction parameters between different nodes, but also the sensitivities of the stationary probabilities with respect to each interaction parameter. Numerical experiment results demonstrate the superiority of the proposed sampling procedure.

stat.ME↗

arXiv2015

Percolation properties in a traffic model

As a dynamical complex system, traffic is characterized by a transition from free flow to congestions, which is mostly studied in highways. However, despite its importance in developing congestion mitigation strategies, the understanding of this common traffic phenomenon in a city-scale is still missing. An open question is how the traffic in the network collapses from a global efficient traffic to isolated local flows in small clusters, i.e. the question of traffic percolation. Here we study the traffic percolation properties on a lattice by simulation of an agent-based model for traffic. A critical traffic volume in this model distinguishes the free-state from congested state of traffic. Our results show that the threshold of traffic percolation decreases with increasing traffic volume and reaches a minimum value at the critical traffic volume. We show that this minimal threshold is the result of longest spatial correlation between traffic flows at the critical traffic volume. These findings may help to develop congestion mitigation strategies in a network view.

physics.soc-ph↗