arXiv subjects

Yun Shen

Publications and source records attributed to Yun Shen.

At least 37 records · Page 2Linked to original sources

arXiv2025

Multiple truly topological unidirectional surface magnetoplasmons at terahertz frequencies

Unidirectional propagation based on surface magnetoplasmons (SMPs) has recently been realized at the interface of magnetized semiconductors. However, usually SMPs lose their unidirectionality due to non-local effects, especially in the lower trivial bandgap of such structures. More recently, a truly unidirectional SMP (USMP) has been demonstrated in the upper topological non-trivial bandgap, but it supports only a single USMP, limiting its functionality. In this work, we present a fundamental physical model for multiple, robust, truly topological USMP modes at terahertz (THz) frequencies, realized in a semiconductor-dielectric-semiconductor (SDS) slab waveguide under opposing external magnetic fields. We analytically derive the dispersion properties of the SMPs and perform numerical analysis in both local and non-local models. Our results show that the SDS waveguide supports two truly (even and odd) USMP modes in the upper topological non-trivial bandgap. Exploiting these two modes, we demonstrate unidirectional SMP multimode interference (USMMI), being highly robust and immune to backscattering, overcoming the back-reflection issue in conventional bidirectional waveguides. To demonstrate the usefullness of this approach, we numerically realize a frequency- and magnetically-tunable arbitrary-ratio splitter based on this robust USMMI, enabling multimode conversion. We, further, identify a unique index-near-zero (INZ) odd USMP mode in the SDS waveguide, distinct from conventional semiconductor-dielectric-metal waveguides. Leveraging this INZ mode, we achieve phase modulation with a phase shift from -$π$ to $π$. Our work expands the manipulation of topological waves and enriches the field of truly non-reciprocal topological physics for practical device applications.

physics.optics↗

arXiv2025

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks

Recent research highlights concerns about the trustworthiness of third-party Pre-Trained Language Models (PTLMs) due to potential backdoor attacks. These backdoored PTLMs, however, are effective only for specific pre-defined downstream tasks. In reality, these PTLMs can be adapted to many other unrelated downstream tasks. Such adaptation may lead to unforeseen consequences in downstream model outputs, consequently raising user suspicion and compromising attack stealthiness. We refer to this phenomenon as backdoor complications. In this paper, we undertake the first comprehensive quantification of backdoor complications. Through extensive experiments using 4 prominent PTLMs and 16 text classification benchmark datasets, we demonstrate the widespread presence of backdoor complications in downstream models fine-tuned from backdoored PTLMs. The output distribution of triggered samples significantly deviates from that of clean samples. Consequently, we propose a backdoor complication reduction method leveraging multi-task learning to mitigate complications without prior knowledge of downstream tasks. The experimental results demonstrate that our proposed method can effectively reduce complications while maintaining the efficacy and consistency of backdoor attacks. Our code is available at https://github.com/zhangrui4041/Backdoor_Complications.

cs.CR↗

arXiv2025

Topological Anderson Phase Transitions in Y-shaped Plasmonic Valley Metal-slabs

Throughout history, all developmental trajectories of civilization - encompassing progress, creation, and innovation - have fundamentally pursued the paradigm shift 'from disorder to order'. In photonics, investigations into disordered systems have primarily focused on foundational principles governing signal diffusion and localization. This paper addresses terahertz device development by examining the dual role of disorder in photonic systems: while potentially compromising optical transmission stability, it simultaneously inspires innovative topological protection mechanisms. Building upon the symmetry-breaking induced valley-Hall topological Anderson phase transition in Y-shaped metallic structures, we achieve valley Chern number modulation through random rotation of constituent units, demonstrating progressive emergence of in-gap topological states with increasing disorder parameters and observing topological negative refraction phenomena. Furthermore, an effective Dirac two-band model is established to quantitatively characterize the evolution of bulk transport states under disorder variation. By strategically regulating disordered configurations to induce valley-Hall topological Anderson phase transitions, this research provides new pathways for overcoming critical technical challenges in terahertz devices, particularly transmission loss limitations.

physics.optics↗

arXiv2025

On the Proactive Generation of Unsafe Images From Text-To-Image Models Using Benign Prompts

Malicious or manipulated prompts are known to exploit text-to-image models to generate unsafe images. Existing studies, however, focus on the passive exploitation of such harmful capabilities. In this paper, we investigate the proactive generation of unsafe images from benign prompts (e.g., a photo of a cat) through maliciously modified text-to-image models. Our preliminary investigation demonstrates that poisoning attacks are a viable method to achieve this goal but uncovers significant side effects, where unintended spread to non-targeted prompts compromises attack stealthiness. Root cause analysis identifies conceptual similarity as an important contributing factor to these side effects. To address this, we propose a stealthy poisoning attack method that balances covertness and performance. Our findings highlight the potential risks of adopting text-to-image models in real-world scenarios, thereby calling for future research and safety measures in this space.

cs.CR↗

arXiv2025

Synthetic Artifact Auditing: Tracing LLM-Generated Synthetic Data Usage in Downstream Applications

Large language models (LLMs) have facilitated the generation of high-quality, cost-effective synthetic data for developing downstream models and conducting statistical analyses in various domains. However, the increased reliance on synthetic data may pose potential negative impacts. Numerous studies have demonstrated that LLM-generated synthetic data can perpetuate and even amplify societal biases and stereotypes, and produce erroneous outputs known as ``hallucinations'' that deviate from factual knowledge. In this paper, we aim to audit artifacts, such as classifiers, generators, or statistical plots, to identify those trained on or derived from synthetic data and raise user awareness, thereby reducing unexpected consequences and risks in downstream applications. To this end, we take the first step to introduce synthetic artifact auditing to assess whether a given artifact is derived from LLM-generated synthetic data. We then propose an auditing framework with three methods including metric-based auditing, tuning-based auditing, and classification-based auditing. These methods operate without requiring the artifact owner to disclose proprietary training details. We evaluate our auditing framework on three text classification tasks, two text summarization tasks, and two data visualization tasks across three training scenarios. Our evaluation demonstrates the effectiveness of all proposed auditing methods across all these tasks. For instance, black-box metric-based auditing can achieve an average accuracy of $0.868 \pm 0.071$ for auditing classifiers and $0.880 \pm 0.052$ for auditing generators using only 200 random queries across three scenarios. We hope our research will enhance model transparency and regulatory compliance, ensuring the ethical and responsible use of synthetic data.

cs.LG↗

arXiv2025

Polarization-controlled non-Hermitian metasurfaces for ultra-sensitive terahertz sensing

Non-Hermitian systems offer significant advantages in sensor design, especially at the exceptional points. However, the extreme sensitivity near these points poses great challenges due to fabrication errors and system noises, which degrade sensing performance. To address this, we introduce a novel approach leveraging the polarization degrees of freedom in non-Hermitian systems. In this work, we establish a direct relation between the incident polarization and the transmission phase of a coupled metasurface system and achieve the polarization-controlled phase singularity even post-fabrication. The incident polarization angle can be utilized as a sensing index, which enables indirect and accurate measurement. The theoretical approach is experimentally validated using a general design of THz non-Hermitian metasurface sensors. Our method enhances robustness and sensitivity, opening new avenues for practical applications in ultra-sensitive sensing.

physics.optics↗

arXiv2024

Terahertz Plasmonic Transport in Topological Valley Metal-slabs

Topological photonic devices have attracted great attentions in terahertz (THz) and optical regimes due to their robust protected transport properties. However, it remains challenging in miniaturization of the devices to get superior performance for photonic integrated circuits in optical networks. In this paper, Kagome photonic insulators constructed with ultrathin metal-slab on Polyimide substrate are proposed for THz waveguiding. Theoretical analysis and numerical simulation demonstrate that $C_{3v}$ symmetry can be broken by global rotation $θ$ of the air holes in metallic Kagome lattice, providing topological phase transitions. The propagation of THz waves through Z-shaped domain walls with multiple sharp corners verifies the robustness of plasmonic transport. The positive/negative refraction of topological valley edge state from Zigzag interface into background space is illustrated. These results present a novel approach to manipulate THz waves and facilitate development of photonic integrated circuits with high compactness and robustness.

physics.optics↗

arXiv2024

Image-Perfect Imperfections: Safety, Bias, and Authenticity in the Shadow of Text-To-Image Model Evolution

Text-to-image models, such as Stable Diffusion (SD), undergo iterative updates to improve image quality and address concerns such as safety. Improvements in image quality are straightforward to assess. However, how model updates resolve existing concerns and whether they raise new questions remain unexplored. This study takes an initial step in investigating the evolution of text-to-image models from the perspectives of safety, bias, and authenticity. Our findings, centered on Stable Diffusion, indicate that model updates paint a mixed picture. While updates progressively reduce the generation of unsafe images, the bias issue, particularly in gender, intensifies. We also find that negative stereotypes either persist within the same Non-White race group or shift towards other Non-White race groups through SD updates, yet with minimal association of these traits with the White race group. Additionally, our evaluation reveals a new concern stemming from SD updates: State-of-the-art fake image detectors, initially trained for earlier SD versions, struggle to identify fake images generated by updated versions. We show that fine-tuning these detectors on fake images generated by updated versions achieves at least 96.6\% accuracy across various SD versions, addressing this issue. Our insights highlight the importance of continued efforts to mitigate biases and vulnerabilities in evolving text-to-image models.

cs.CR↗

arXiv2024

Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification

Recently, autonomous agents built on large language models (LLMs) have experienced significant development and are being deployed in real-world applications. These agents can extend the base LLM's capabilities in multiple ways. For example, a well-built agent using GPT-3.5-Turbo as its core can outperform the more advanced GPT-4 model by leveraging external components. More importantly, the usage of tools enables these systems to perform actions in the real world, moving from merely generating text to actively interacting with their environment. Given the agents' practical applications and their ability to execute consequential actions, it is crucial to assess potential vulnerabilities. Such autonomous systems can cause more severe damage than a standalone language model if compromised. While some existing research has explored harmful actions by LLM agents, our study approaches the vulnerability from a different perspective. We introduce a new type of attack that causes malfunctions by misleading the agent into executing repetitive or irrelevant actions. We conduct comprehensive evaluations using various attack methods, surfaces, and properties to pinpoint areas of susceptibility. Our experiments reveal that these attacks can induce failure rates exceeding 80\% in multiple scenarios. Through attacks on implemented and deployable agents in multi-agent scenarios, we accentuate the realistic risks associated with these vulnerabilities. To mitigate such attacks, we propose self-examination detection methods. However, our findings indicate these attacks are difficult to detect effectively using LLMs alone, highlighting the substantial risks associated with this vulnerability.

cs.CR↗

arXiv2024

Instruction Backdoor Attacks Against Customized LLMs

The increasing demand for customized Large Language Models (LLMs) has led to the development of solutions like GPTs. These solutions facilitate tailored LLM creation via natural language prompts without coding. However, the trustworthiness of third-party custom versions of LLMs remains an essential concern. In this paper, we propose the first instruction backdoor attacks against applications integrated with untrusted customized LLMs (e.g., GPTs). Specifically, these attacks embed the backdoor into the custom version of LLMs by designing prompts with backdoor instructions, outputting the attacker's desired result when inputs contain the pre-defined triggers. Our attack includes 3 levels of attacks: word-level, syntax-level, and semantic-level, which adopt different types of triggers with progressive stealthiness. We stress that our attacks do not require fine-tuning or any modification to the backend LLMs, adhering strictly to GPTs development guidelines. We conduct extensive experiments on 6 prominent LLMs and 5 benchmark text classification datasets. The results show that our instruction backdoor attacks achieve the desired attack performance without compromising utility. Additionally, we propose two defense strategies and demonstrate their effectiveness in reducing such attacks. Our findings highlight the vulnerability and the potential risks of LLM customization such as GPTs.

cs.CR↗

arXiv2024

"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models

The misuse of large language models (LLMs) has drawn significant attention from the general public and LLM vendors. One particular type of adversarial prompt, known as jailbreak prompt, has emerged as the main attack vector to bypass the safeguards and elicit harmful content from LLMs. In this paper, employing our new framework JailbreakHub, we conduct a comprehensive analysis of 1,405 jailbreak prompts spanning from December 2022 to December 2023. We identify 131 jailbreak communities and discover unique characteristics of jailbreak prompts and their major attack strategies, such as prompt injection and privilege escalation. We also observe that jailbreak prompts increasingly shift from online Web communities to prompt-aggregation websites and 28 user accounts have consistently optimized jailbreak prompts over 100 days. To assess the potential harm caused by jailbreak prompts, we create a question set comprising 107,250 samples across 13 forbidden scenarios. Leveraging this dataset, our experiments on six popular LLMs show that their safeguards cannot adequately defend jailbreak prompts in all scenarios. Particularly, we identify five highly effective jailbreak prompts that achieve 0.95 attack success rates on ChatGPT (GPT-3.5) and GPT-4, and the earliest one has persisted online for over 240 days. We hope that our study can facilitate the research community and LLM vendors in promoting safer and regulated LLMs.

cs.CR↗

arXiv2024

Rotating-modulated Higher-Order Topological States in a Split-ring Photonic Insulator

The emerging field of topology has brought device effects to a new level. Higher-order topological insulators (HOTIs) go beyond traditional descriptions of bulk-edge correspondence, broadening the understanding of topologically insulating phases. In this paper, a second-order split-ring photonic crystal (SSPC) with zero-dimensional (0D) corner states and one-dimensional (1D) edge states is proposed. Based on the coupling strength determined by the opening direction between the split-rings, the electronic transition strength of the electronic system is imitated, and the topological trivial and non-trivial transformation of the topological two-dimensional (2D) SSH model are realized by using the rotating split-ring lattice. Theory and simulation find that SSPC has non-trivial topological edge states that can be quantified by bulk polarization. As the opening direction of the split-rings gradually changes within one period, there will be transitions between four different topological polarizations of the lowest energy bands, which can be conveniently used to achieve transitions between different topological phases. Our research can be extended to higher dimensions and broaden research paths for higher-order photonic topological insulators and semimetals.

physics.optics↗

arXiv2024

Composite Backdoor Attacks Against Large Language Models

Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same multiple trigger keys in only a single component. CBA ensures that the backdoor is activated only when all trigger keys appear. Our experiments demonstrate that CBA is effective in both natural language processing (NLP) and multimodal tasks. For instance, with $3\%$ poisoning samples against the LLaMA-7B model on the Emotion dataset, our attack achieves a $100\%$ Attack Success Rate (ASR) with a False Triggered Rate (FTR) below $2.06\%$ and negligible model accuracy degradation. Our work highlights the necessity of increased security research on the trustworthiness of foundation LLMs.

cs.CR↗

arXiv2023

FAKEPCD: Fake Point Cloud Detection via Source Attribution

To prevent the mischievous use of synthetic (fake) point clouds produced by generative models, we pioneer the study of detecting point cloud authenticity and attributing them to their sources. We propose an attribution framework, FAKEPCD, to attribute (fake) point clouds to their respective generative models (or real-world collections). The main idea of FAKEPCD is to train an attribution model that learns the point cloud features from different sources and further differentiates these sources using an attribution signal. Depending on the characteristics of the training point clouds, namely, sources and shapes, we formulate four attribution scenarios: close-world, open-world, single-shape, and multiple-shape, and evaluate FAKEPCD's performance in each scenario. Extensive experimental results demonstrate the effectiveness of FAKEPCD on source attribution across different scenarios. Take the open-world attribution as an example, FAKEPCD attributes point clouds to known sources with an accuracy of 0.82-0.98 and to unknown sources with an accuracy of 0.73-1.00. Additionally, we introduce an approach to visualize unique patterns (fingerprints) in point clouds associated with each source. This explains how FAKEPCD recognizes point clouds from various sources by focusing on distinct areas within them. Overall, we hope our study establishes a baseline for the source attribution of (fake) point clouds.

cs.CR↗

arXiv2023

Comprehensive Assessment of Toxicity in ChatGPT

Moderating offensive, hateful, and toxic language has always been an important but challenging topic in the domain of safe use in NLP. The emerging large language models (LLMs), such as ChatGPT, can potentially further accentuate this threat. Previous works have discovered that ChatGPT can generate toxic responses using carefully crafted inputs. However, limited research has been done to systematically examine when ChatGPT generates toxic responses. In this paper, we comprehensively evaluate the toxicity in ChatGPT by utilizing instruction-tuning datasets that closely align with real-world scenarios. Our results show that ChatGPT's toxicity varies based on different properties and settings of the prompts, including tasks, domains, length, and languages. Notably, prompts in creative writing tasks can be 2x more likely than others to elicit toxic responses. Prompting in German and Portuguese can also double the response toxicity. Additionally, we discover that certain deliberately toxic prompts, designed in earlier studies, no longer yield harmful responses. We hope our discoveries can guide model developers to better regulate these AI systems and the users to avoid undesirable outputs.

cs.CY↗

arXiv2023

Quantifying Privacy Risks of Prompts in Visual Prompt Learning

Large-scale pre-trained models are increasingly adapted to downstream tasks through a new paradigm called prompt learning. In contrast to fine-tuning, prompt learning does not update the pre-trained model's parameters. Instead, it only learns an input perturbation, namely prompt, to be added to the downstream task data for predictions. Given the fast development of prompt learning, a well-generalized prompt inevitably becomes a valuable asset as significant effort and proprietary data are used to create it. This naturally raises the question of whether a prompt may leak the proprietary information of its training data. In this paper, we perform the first comprehensive privacy assessment of prompts learned by visual prompt learning through the lens of property inference and membership inference attacks. Our empirical evaluation shows that the prompts are vulnerable to both attacks. We also demonstrate that the adversary can mount a successful property inference attack with limited cost. Moreover, we show that membership inference attacks against prompts can be successful with relaxed adversarial assumptions. We further make some initial investigations on the defenses and observe that our method can mitigate the membership inference attacks with a decent utility-defense trade-off but fails to defend against property inference attacks. We hope our results can shed light on the privacy risks of the popular prompt learning paradigm. To facilitate the research in this direction, we will share our code and models with the community.

cs.CR↗

arXiv2023

Prompt Backdoors in Visual Prompt Learning

Fine-tuning large pre-trained computer vision models is infeasible for resource-limited users. Visual prompt learning (VPL) has thus emerged to provide an efficient and flexible alternative to model fine-tuning through Visual Prompt as a Service (VPPTaaS). Specifically, the VPPTaaS provider optimizes a visual prompt given downstream data, and downstream users can use this prompt together with the large pre-trained model for prediction. However, this new learning paradigm may also pose security risks when the VPPTaaS provider instead provides a malicious visual prompt. In this paper, we take the first step to explore such risks through the lens of backdoor attacks. Specifically, we propose BadVisualPrompt, a simple yet effective backdoor attack against VPL. For example, poisoning $5\%$ CIFAR10 training data leads to above $99\%$ attack success rates with only negligible model accuracy drop by $1.5\%$. In particular, we identify and then address a new technical challenge related to interactions between the backdoor trigger and visual prompt, which does not exist in conventional, model-level backdoors. Moreover, we provide in-depth analyses of seven backdoor defenses from model, prompt, and input levels. Overall, all these defenses are either ineffective or impractical to mitigate our BadVisualPrompt, implying the critical vulnerability of VPL.

cs.CR↗

arXiv2023

Realization of the all-optical phase modulator, filter, splitter, and self-consistent logic gates based on assembled magneto-optical heterostructures

All-optical computing has recently emerged as a vibrant research field in response to the energy crisis and the growing demand for information processing. However, the efficiency of subwavelength-scale all-optical devices remains relatively low due to challenges such as back-scattering reflections and strict surface roughness. Furthermore, achieving multifunctionality through the reassembly of all-optical structures has thus far been rarely accomplished. One promising approach to address these issues is the utilization of one-way edge modes. In this study, we propose four types of deep-subwavelength ($\sim 10^{-2} λ_0$, where $λ_0$ is the wavelength in vacuum) all-optical functional devices: a phase modulator, a filter, a splitter, and logic gates. These devices are based on robust one-way modes but do not require an external magnetic field, which can allow for flexible assembly. In particular, we investigate a phase modulation range spanning from $-π$ to $π$, a perfect filter that divides the input port's one-way region into two output one-way regions with equal bandwidth, a multi-frequency splitter with an equal splitting ratio (e.g., 50/50), and self-consistent logic gates. We validate these theoretical findings through comprehensive full-wave numerical simulations. Our findings may find applications in minimal optical calculations and integrated optical circuits.

physics.app-ph↗