arXiv subjects

Yuan Xiao

Publications and source records attributed to Yuan Xiao.

26 records · Page 2Linked to original sources

arXiv2022

Pitfalls in gpr data interpretation: false reflectors detected in lunar radar cross sections by Chang'e-3

Chang'e-3(CE-3) has been the first spacecraft to soft-land on the Moon since the Soviet Union's Luna 24 in 1976. The spacecraft arrived at Mare Imbrium on December 14, 2013 and the same day, Yutu lunar rover separated from lander to start its exploration of the surface and the subsurface around the landing site. The rover was equipped, among other instruments, with two Lunar Penetrating Radar systems (LPR) having a working frequency of 60 and 500 MHz. The radars acquired data for about two weeks while the rover was slowly moving along a path of about 114 m. At Navigation point N0209 the rover got stacked into the lunar soil and after that only data at fixed position could be collected. The low frequency radar data have been analyzed by different authors and published in two different papers, which reported totally controversial interpretations of the radar cross sections. The present study is devoted to resolve such controversy carefully analyzing and comparing the data collected on the Moon by Yutu rover and on Earth by a prototype of LRP mounted onboard a model of the CE-3 lunar rover. Such analysis demonstrates that the deep radar features previously ascribed to the lunar shallow stratigraphy are not real reflectors, rather they are signal artefacts probably generated by the system and its electromagnetic interaction with the metallic rover.

physics.geo-ph↗

arXiv2020

Partly Supervised Multitask Learning

Semi-supervised learning has recently been attracting attention as an alternative to fully supervised models that require large pools of labeled data. Moreover, optimizing a model for multiple tasks can provide better generalizability than single-task learning. Leveraging self-supervision and adversarial training, we propose a novel general purpose semi-supervised, multiple-task model---namely, self-supervised, semi-supervised, multitask learning (S$^4$MTL)---for accomplishing two important tasks in medical imaging, segmentation and diagnostic classification. Experimental results on chest and spine X-ray datasets suggest that our S$^4$MTL model significantly outperforms semi-supervised single task, semi/fully-supervised multitask, and fully-supervised single task models, even with a 50\% reduction of class and segmentation labels. We hypothesize that our proposed model can be effective in tackling limited annotation problems for joint training, not only in medical imaging domains, but also for general-purpose vision tasks.

cs.CV↗

arXiv2020

Preparation and Characterization of High-Entropy Alloy (TaNb)$_{1-x}$(ZrHfTi)$_x$ Superconducting Films

We report on the preparation and the physical properties of superconducting (TaNb)_1-x(ZrHfTi)_x high-entropy alloy films. The films were prepared by means of magnetron sputtering at room temperature, with x ranging from 0 to 1 with an average thickness of 600 - 950 nm. All films crystallize in a pseudo body-centered cubic (BCC) structure. For samples with x < 0.65, the normal-state properties are metallic, while for x > 0.65 the films are weakly insulating. The transition from metallic to weakly insulating occurs right at the near-equimolar stoichiometry. We find all films, except for x = 0 or 1, to become superconducting at low temperatures, and we interpret their superconducting properties within the Bardeen-Cooper-Schrieffer (BCS) framework. The highest transition temperature T_c = 6.9 K of the solid solution is observed for x = 0.43. The highest upper-critical field B_c2(0) = 11.05 T is found for the near-equimolar ratio x = 0.65, where the mixing entropy is the largest. The superconducting parameters derived for all the films from transport measurements are found to be close to those that are reported for amorphous superconductors. Our results indicate that these films of high-entropy alloys are promising candidates for superconducting device fabrication.

cond-mat.supr-con↗

arXiv2019

SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities

SPEculative Execution side Channel Hardware (SPEECH) Vulnerabilities have enabled the notorious Meltdown, Spectre, and L1 terminal fault (L1TF) attacks. While a number of studies have reported different variants of SPEECH vulnerabilities, they are still not well understood. This is primarily due to the lack of information about microprocessor implementation details that impact the timing and order of various micro-architectural events. Moreover, to date, there is no systematic approach to quantitatively measure SPEECH vulnerabilities on commodity processors. This paper introduces SPEECHMINER, a software framework for exploring and measuring SPEECH vulnerabilities in an automated manner. SPEECHMINER empirically establishes the link between a novel two-phase fault handling model and the exploitability and speculation windows of SPEECH vulnerabilities. It enables testing of a comprehensive list of exception-triggering instructions under the same software framework, which leverages covert-channel techniques and differential tests to gain visibility into the micro-architectural state changes. We evaluated SPEECHMINER on 9 different processor types, examined 21 potential vulnerability variants, confirmed various known attacks, and identified several new variants.

cs.CR↗

arXiv2019

Enhanced Seismic Imaging with Predictive Neural Networks for Geophysics

We propose a predictive neural network architecture that can be utilized to update reference velocity models as inputs to the full waveform inversion. Deep learning models are explored to augment velocity model building workflows during processing the 3D seismic volume in salt-prone environments. Specifically, a neural network architecture, with 3D convolutional, de-convolutional layers, and 3D max-pooling, is designed to take standard amplitude 3D seismic volumes as an input. Enhanced data augmentations through generative adversarial networks and a weighted loss function enable the network to train with few sparsely annotated slices. Batch normalization is also applied for faster convergence. A 3D probability cube for salt bodies and inclusions is generated through ensembles of predictions from multiple models in order to reduce variance. Velocity models inferred from the proposed networks provide opportunities for FWI forward models to converge faster with an initial condition closer to the true model. In addition, in each iteration step, the probability cubes of salt bodies and inclusions inferred from the proposed networks can be used as a regularization term within the FWI forward modelling, which may result in an improved velocity model estimation while the output of seismic migration can be utilized as an input of the 3D neural network for subsequent iterations.

eess.IV↗

arXiv2019

Unsupervised Learning Framework of Interest Point Via Properties Optimization

This paper presents an entirely unsupervised interest point training framework by jointly learning detector and descriptor, which takes an image as input and outputs a probability and a description for every image point. The objective of the training framework is formulated as joint probability distribution of the properties of the extracted points. The essential properties are selected as sparsity, repeatability and discriminability which are formulated by the probabilities. To maximize the objective efficiently, latent variable is introduced to represent the probability of that a point satisfies the required properties. Therefore, original maximization can be optimized with Expectation Maximization algorithm (EM). Considering high computation cost of EM on large scale image set, we implement the optimization process with an efficient strategy as Mini-Batch approximation of EM (MBEM). In the experiments both detector and descriptor are instantiated with fully convolutional network which is named as Property Network (PN). The experiments demonstrate that PN outperforms state-of-the-art methods on a number of image matching benchmarks without need of retraining. PN also reveals that the proposed training framework has high flexibility to adapt to diverse types of scenes.

cs.CV↗

arXiv2018

SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution

This paper presents SgxPectre Attacks that exploit the recently disclosed CPU bugs to subvert the confidentiality and integrity of SGX enclaves. Particularly, we show that when branch prediction of the enclave code can be influenced by programs outside the enclave, the control flow of the enclave program can be temporarily altered to execute instructions that lead to observable cache-state changes. An adversary observing such changes can learn secrets inside the enclave memory or its internal registers, thus completely defeating the confidentiality guarantee offered by SGX. To demonstrate the practicality of our SgxPectre Attacks, we have systematically explored the possible attack vectors of branch target injection, approaches to win the race condition during enclave's speculative execution, and techniques to automatically search for code patterns required for launching the attacks. Our study suggests that any enclave program could be vulnerable to SgxPectre Attacks since the desired code patterns are available in most SGX runtimes (e.g., Intel SGX SDK, Rust-SGX, and Graphene-SGX). Most importantly, we have applied SgxPectre Attacks to steal seal keys and attestation keys from Intel signed quoting enclaves. The seal key can be used to decrypt sealed storage outside the enclaves and forge valid sealed data; the attestation key can be used to forge attestation signatures. For these reasons, SgxPectre Attacks practically defeat SGX's security protection. This paper also systematically evaluates Intel's existing countermeasures against SgxPectre Attacks and discusses the security implications.

cs.CR↗

arXiv2017

Stacco: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves

Intel Software Guard Extension (SGX) offers software applications enclave to protect their confidentiality and integrity from malicious operating systems. The SSL/TLS protocol, which is the de facto standard for protecting transport-layer network communications, has been broadly deployed for a secure communication channel. However, in this paper, we show that the marriage between SGX and SSL may not be smooth sailing. Particularly, we consider a category of side-channel attacks against SSL/TLS implementations in secure enclaves, which we call the control-flow inference attacks. In these attacks, the malicious operating system kernel may perform a powerful man-in-the-kernel attack to collect execution traces of the enclave programs at page, cacheline, or branch level, while positioning itself in the middle of the two communicating parties. At the center of our work is a differential analysis framework, dubbed Stacco, to dynamically analyze the SSL/TLS implementations and detect vulnerabilities that can be exploited as decryption oracles. Surprisingly, we found exploitable vulnerabilities in the latest versions of all the SSL/TLS libraries we have examined. To validate the detected vulnerabilities, we developed a man-in-the-kernel adversary to demonstrate Bleichenbacher attacks against the latest OpenSSL library running in the SGX enclave (with the help of Graphene) and completely broke the PreMasterSecret encrypted by a 4096-bit RSA public key with only 57286 queries. We also conducted CBC padding oracle attacks against the latest GnuTLS running in Graphene-SGX and an open-source SGX-implementation of mbedTLS (i.e., mbedTLS-SGX) that runs directly inside the enclave, and showed that it only needs 48388 and 25717 queries, respectively, to break one block of AES ciphertext. Empirical evaluation suggests these man-in-the-kernel attacks can be completed within 1 or 2 hours.

cs.CR↗