arXiv subjects

Yao Cheng

Publications and source records attributed to Yao Cheng.

At least 55 records · Page 3Linked to original sources

arXiv2023

Edge Deep Learning Model Protection via Neuron Authorization

With the development of deep learning processors and accelerators, deep learning models have been widely deployed on edge devices as part of the Internet of Things. Edge device models are generally considered as valuable intellectual properties that are worth for careful protection. Unfortunately, these models have a great risk of being stolen or illegally copied. The existing model protections using encryption algorithms are suffered from high computation overhead which is not practical due to the limited computing capacity on edge devices. In this work, we propose a light-weight, practical, and general Edge device model Pro tection method at neuron level, denoted as EdgePro. Specifically, we select several neurons as authorization neurons and set their activation values to locking values and scale the neuron outputs as the "asswords" during training. EdgePro protects the model by ensuring it can only work correctly when the "passwords" are met, at the cost of encrypting and storing the information of the "passwords" instead of the whole model. Extensive experimental results indicate that EdgePro can work well on the task of protecting on datasets with different modes. The inference time increase of EdgePro is only 60% of state-of-the-art methods, and the accuracy loss is less than 1%. Additionally, EdgePro is robust against adaptive attacks including fine-tuning and pruning, which makes it more practical in real-world applications. EdgePro is also open sourced to facilitate future research: https://github.com/Leon022/Edg

cs.CR↗

arXiv2023

Local newforms for generic representations of unramified ${\rm U}_{2n+1}$ and Rankin-Selberg integrals

Recently Atobe-Oi-Yasuda established the newform theory for irreducible tempered generic representations of unramified ${\rm U}_{2n+1}$ over non-archimedean local fields. In this paper we extend their result to every irreducible generic representations and compute the dimensions of the spaces of oldforms. We also compute the Rankin-Selberg integrals attached to newforms and oldforms under a natural assumption on the $γ$-factors defined by these integrals.

math.RT↗

arXiv2022

Excitement Surfeited Turns to Errors: Deep Learning Testing Framework Based on Excitable Neurons

Despite impressive capabilities and outstanding performance, deep neural networks (DNNs) have captured increasing public concern about their security problems, due to their frequently occurred erroneous behaviors. Therefore, it is necessary to conduct a systematical testing for DNNs before they are deployed to real-world applications. Existing testing methods have provided fine-grained metrics based on neuron coverage and proposed various approaches to improve such metrics. However, it has been gradually realized that a higher neuron coverage does \textit{not} necessarily represent better capabilities in identifying defects that lead to errors. Besides, coverage-guided methods cannot hunt errors due to faulty training procedure. So the robustness improvement of DNNs via retraining by these testing examples are unsatisfactory. To address this challenge, we introduce the concept of excitable neurons based on Shapley value and design a novel white-box testing framework for DNNs, namely DeepSensor. It is motivated by our observation that neurons with larger responsibility towards model loss changes due to small perturbations are more likely related to incorrect corner cases due to potential defects. By maximizing the number of excitable neurons concerning various wrong behaviors of models, DeepSensor can generate testing examples that effectively trigger more errors due to adversarial inputs, polluted data and incomplete training. Extensive experiments implemented on both image classification models and speaker recognition models have demonstrated the superiority of DeepSensor.

cs.LG↗

arXiv2022

Local discontinuous Galerkin method for a third order singularly perturbed problem of convection-diffusion type

The local discontinuous Galerkin (LDG) method is studied for a third-order singularly perturbed problem of the convection-diffusion type. Based on a regularity assumption for the exact solution, we prove almost $O(N^{-(k+1/2)})$ (up to a logarithmic factor) energy-norm convergence uniformly in the perturbation parameter. Here, $k\geq 0$ is the maximum degree of piecewise polynomials used in discrete space, and $N$ is the number of mesh elements. The results are valid for the three types of layer-adapted meshes: Shishkin-type, Bakhvalov-Shishkin type, and Bakhvalov-type. Numerical experiments are conducted to test the theoretical results.

math.NA↗

arXiv2022

Understanding Real-world Threats to Deep Learning Models in Android Apps

Famous for its superior performance, deep learning (DL) has been popularly used within many applications, which also at the same time attracts various threats to the models. One primary threat is from adversarial attacks. Researchers have intensively studied this threat for several years and proposed dozens of approaches to create adversarial examples (AEs). But most of the approaches are only evaluated on limited models and datasets (e.g., MNIST, CIFAR-10). Thus, the effectiveness of attacking real-world DL models is not quite clear. In this paper, we perform the first systematic study of adversarial attacks on real-world DNN models and provide a real-world model dataset named RWM. Particularly, we design a suite of approaches to adapt current AE generation algorithms to the diverse real-world DL models, including automatically extracting DL models from Android apps, capturing the inputs and outputs of the DL models in apps, generating AEs and validating them by observing the apps' execution. For black-box DL models, we design a semantic-based approach to build suitable datasets and use them for training substitute models when performing transfer-based attacks. After analyzing 245 DL models collected from 62,583 real-world apps, we have a unique opportunity to understand the gap between real-world DL models and contemporary AE generation algorithms. To our surprise, the current AE generation algorithms can only directly attack 6.53% of the models. Benefiting from our approach, the success rate upgrades to 47.35%.

cs.CR↗

arXiv2022

The local discontinuous Galerkin method for a singularly perturbed convection-diffusion problem with characteristic and exponential layers

A singularly perturbed convection-diffusion problem,posed on the unit square in $\mathbb{R}^2$, is studied; its solution has both exponential and characteristic boundary layers. The problem is solved numerically using the local discontinuous Galerkin (LDG) method on Shishkin meshes. Using tensor-product piecewise polynomials of degree at most $k>0$ in each variable, the error between the LDG solution and the true solution is proved to converge, uniformly in the singular perturbation parameter, at a rate of $O((N^{-1}\ln N)^{k+1/2})$ in an associated energy norm, where $N$ is the number of mesh intervals in each coordinate direction.(This is the first uniform convergence result proved for the LDG method applied to a problem with characteristic boundary layers.) Furthermore, we prove that this order of convergence increases to $O((N^{-1}\ln N)^{k+1})$ when one measures the energy-norm difference between the LDG solution and a local Gauss-Radau projection of the true solution into the finite element space.This uniform supercloseness property implies an optimal $L^2$ error estimate of order $(N^{-1}\ln N)^{k+1}$ for our LDG method. Numerical experiments show the sharpness of our theoretical results.

math.NA↗

arXiv2022

Supercloseness of the local discontinuous Galerkin method for a singularly perturbed convection-diffusion problem

A singularly perturbed convection-diffusion problem posed on the unit square in $\mathbb{R}^2$, whose solution has exponential boundary layers, is solved numerically using the local discontinuous Galerkin (LDG) method with piecewise polynomials of degree at most $k>0$ on three families of layer-adapted meshes: Shishkin-type, Bakhvalov-Shishkin-type and Bakhvalov-type.On Shishkin-type meshes this method is known to be no greater than $O(N^{-(k+1/2)})$ accurate in the energy norm induced by the bilinear form of the weak formulation, where $N$ mesh intervals are used in each coordinate direction. (Note: all bounds in this abstract are uniform in the singular perturbation parameter and neglect logarithmic factors that will appear in our detailed analysis.) A delicate argument is used in this paper to establish $O(N^{-(k+1)})$ energy-norm superconvergence on all three types of mesh for the difference between the LDG solution and a local Gauss-Radau projection of the exact solution into the finite element space. This supercloseness property implies a new $N^{-(k+1)}$ bound for the $L^2$ error between the LDG solution on each type of mesh and the exact solution of the problem; this bound is optimal (up to logarithmic factors). Numerical experiments confirm our theoretical results.

math.NA↗

arXiv2022

Rethinking the Defense Against Free-rider Attack From the Perspective of Model Weight Evolving Frequency

Federated learning (FL) is a distributed machine learning approach where multiple clients collaboratively train a joint model without exchanging their data. Despite FL's unprecedented success in data privacy-preserving, its vulnerability to free-rider attacks has attracted increasing attention. Existing defenses may be ineffective against highly camouflaged or high percentages of free riders. To address these challenges, we reconsider the defense from a novel perspective, i.e., model weight evolving frequency.Empirically, we gain a novel insight that during the FL's training, the model weight evolving frequency of free-riders and that of benign clients are significantly different. Inspired by this insight, we propose a novel defense method based on the model Weight Evolving Frequency, referred to as WEF-Defense.Specifically, we first collect the weight evolving frequency (defined as WEF-Matrix) during local training. For each client, it uploads the local model's WEF-Matrix to the server together with its model weight for each iteration. The server then separates free-riders from benign clients based on the difference in the WEF-Matrix. Finally, the server uses a personalized approach to provide different global models for corresponding clients. Comprehensive experiments conducted on five datasets and five models demonstrate that WEF-Defense achieves better defense effectiveness than the state-of-the-art baselines.

cs.LG↗

arXiv2022

Rankin-Selberg integrals for ${\rm SO}_{2n+1}\times{\rm GL}_r$ attached to Newforms and Oldforms

The conjectural newform theory for generic representations of $p$-adic ${\rm SO}_{2n+1}$ was formulated by P.-Y. Tsai in her thesis in which Tsai also verified the conjecture when the representations are supercuspidal. The main purpose of this work is to compute the Rankin-Selberg integrals for ${\rm SO}_{2n+1}\times{\rm GL}_r$ with $1\le r\le n$ attached to newforms and also oldforms under the validity of the conjecture.

math.NT↗

arXiv2022

Finding Global Homophily in Graph Neural Networks When Meeting Heterophily

We investigate graph neural networks on graphs with heterophily. Some existing methods amplify a node's neighborhood with multi-hop neighbors to include more nodes with homophily. However, it is a significant challenge to set personalized neighborhood sizes for different nodes. Further, for other homophilous nodes excluded in the neighborhood, they are ignored for information aggregation. To address these problems, we propose two models GloGNN and GloGNN++, which generate a node's embedding by aggregating information from global nodes in the graph. In each layer, both models learn a coefficient matrix to capture the correlations between nodes, based on which neighborhood aggregation is performed. The coefficient matrix allows signed values and is derived from an optimization problem that has a closed-form solution. We further accelerate neighborhood aggregation and derive a linear time complexity. We theoretically explain the models' effectiveness by proving that both the coefficient matrix and the generated node embedding matrix have the desired grouping effect. We conduct extensive experiments to compare our models against 11 other competitors on 15 benchmark datasets in a wide range of domains, scales and graph heterophilies. Experimental results show that our methods achieve superior performance and are also very efficient.

cs.LG↗

arXiv2022

On the Rankin-Selberg $L$-factors for ${\rm SO}_{5}\times{\rm GL}_2$

Let $π$ and $τ$ be a smooth generic representation of ${\rm SO}_5$ and ${\rm GL}_2$ respectively over a non-archimedean local field. Assume that $π$ is irreducible and $τ$ is irreducible or induced of Langlands' type. We show that the $L$- and $ε$-factors attached to $π\timesτ$ defined by the Rankin-Selberg integrals and the associated Weil-Deligne representation coincide. Similar compatibility results are also obtained for the local factors defined by the Novodvorsky's local zeta integrals attached to generic representations of ${\rm GSp}_4\times{\rm GL}_2$.

math.NT↗

arXiv2021

NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identification

Deep neural networks (DNNs) have demonstrated their outperformance in various domains. However, it raises a social concern whether DNNs can produce reliable and fair decisions especially when they are applied to sensitive domains involving valuable resource allocation, such as education, loan, and employment. It is crucial to conduct fairness testing before DNNs are reliably deployed to such sensitive domains, i.e., generating as many instances as possible to uncover fairness violations. However, the existing testing methods are still limited from three aspects: interpretability, performance, and generalizability. To overcome the challenges, we propose NeuronFair, a new DNN fairness testing framework that differs from previous work in several key aspects: (1) interpretable - it quantitatively interprets DNNs' fairness violations for the biased decision; (2) effective - it uses the interpretation results to guide the generation of more diverse instances in less time; (3) generic - it can handle both structured and unstructured data. Extensive evaluations across 7 datasets and the corresponding DNNs demonstrate NeuronFair's superior performance. For instance, on structured datasets, it generates much more instances (~x5.84) and saves more time (with an average speedup of 534.56%) compared with the state-of-the-art methods. Besides, the instances of NeuronFair can also be leveraged to improve the fairness of the biased DNNs, which helps build more fair and trustworthy deep learning systems.

cs.LG↗

arXiv2021

Local discontinuous Galerkin method on layer-adapted meshes for singularly perturbed reaction-diffusion problems in two dimensions

We analyse the local discontinuous Galerkin (LDG) method for two-dimensional singularly perturbed reaction-diffusion problems. A class of layer-adapted meshes, including Shishkin- and Bakhvalov-type meshes, is discussed within a general framework. Local projections and their approximation properties on anisotropic meshes are used to derive error estimates for energy and "balanced" norms. Here, the energy norm is naturally derived from the bilinear form of LDG formulation and the "balanced" norm is artifically introduced to capture the boundary layer contribution. We establish a uniform convergence of order $k$ for the LDG method using the balanced norm with the local weighted $L^2$ projection as well as an optimal convergence of order $k+1$ for the energy norm using the local Gauss-Radau projections. Numerical experiments are presented.

math.NA↗

arXiv2021

Giga fine-structure constant in photonic solitons

We report on the flavour physics of mesoscopic instantons found primarily in a pure Nb metal, doped magnetically by long-lived Mossbauer 93mNb gamas. A giga fine-structure constant NI*alpha characterizes various properties of the soliton, in which NI ~ 3 * 10^10 is the instanton number. A hierarchy of photonic solitons is classified into six flavours, i.e., three generations in each of two homotopy classes. The underdoped metallic heterostructure contains two topologically distinct sectors. When the gama-dopant filling factor > 0.88, the nontrivial sector becomes a chiral superfluid at T >> 300 K to provide a gama-clock Q-factor > 10^27 for some decades, while the trivial sector becomes a superconductor below 9.3 K. Distinct soliton flavours carrying Kopnin masses > 14 PeV, Majorana mass < 36 aeV, and nuclear B > 35000 T imply a range of possible applications, e.g., topological quantum computation and the detection of invisible particles.

physics.gen-ph↗

arXiv2020

The local discontinuous Galerkin method on layer-adapted meshes for time-dependent singularly perturbed convection-diffusion problems

In this paper we analyze the error as well for the semi-discretization as the full discretization of a time-dependent convection-diffusion problem. We use for the discretization in space the local discontinuous Galerkin (LDG) method on a class of layer-adapted meshes including Shishkin-type and Bakhvalov-type meshes and the implicit $θ$-scheme in time. For piecewise tensor-product polynomials of degree $k$ we obtain uniform or almost uniform error estimates with respect to space of order $k+1/2$ in some energy norm and optimal error estimates with respect to time. Our analysis is based on careful approximation error estimates for the Ritz projection related to the stationary problem on the anisotropic meshes used. We discuss also improved estimates in the one-dimensional case and the use of a discontinuous Galekin discretization in time. Numerical experiments are given to support our theoretical results.

math.NA↗

arXiv2020

Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence

This paper aims to provide a thorough study on the effectiveness of the transformation-based ensemble defence for image classification and its reasons. It has been empirically shown that they can enhance the robustness against evasion attacks, while there is little analysis on the reasons. In particular, it is not clear whether the robustness improvement is a result of transformation or ensemble. In this paper, we design two adaptive attacks to better evaluate the transformation-based ensemble defence. We conduct experiments to show that 1) the transferability of adversarial examples exists among the models trained on data records after different reversible transformations; 2) the robustness gained through transformation-based ensemble is limited; 3) this limited robustness is mainly from the irreversible transformations rather than the ensemble of a number of models; and 4) blindly increasing the number of sub-models in a transformation-based ensemble does not bring extra robustness gain.

cs.LG↗

arXiv2020

Special value formula for the twisted triple product $L$-function and an application to the restricted $L^2$-norm problem

We establish explicit Ichino's formulae for the central values of the triple product $L$-functions with emphasis on the calculations for the real place. The key ingredient for our computations is Proposition 6.8 which generalizes a result of Michel-Venkatesh. As an application we prove the optimal upper bound of a sum of restricted $L^2$-norms of the $L^2$-normalized newforms on certain quadratic extensions with prime level and bounded spectral parameter following the methods of Blomer.

math.NT↗

arXiv2020

DeepMnemonic: Password Mnemonic Generation via Deep Attentive Encoder-Decoder Model

Strong passwords are fundamental to the security of password-based user authentication systems. In recent years, much effort has been made to evaluate password strength or to generate strong passwords. Unfortunately, the usability or memorability of the strong passwords has been largely neglected. In this paper, we aim to bridge the gap between strong password generation and the usability of strong passwords. We propose to automatically generate textual password mnemonics, i.e., natural language sentences, which are intended to help users better memorize passwords. We introduce \textit{DeepMnemonic}, a deep attentive encoder-decoder framework which takes a password as input and then automatically generates a mnemonic sentence for the password. We conduct extensive experiments to evaluate DeepMnemonic on the real-world data sets. The experimental results demonstrate that DeepMnemonic outperforms a well-known baseline for generating semantically meaningful mnemonic sentences. Moreover, the user study further validates that the generated mnemonic sentences by DeepMnemonic are useful in helping users memorize strong passwords.

cs.CR↗