arXiv subjects

Yun Shen

Publications and source records attributed to Yun Shen.

At least 55 records · Page 3Linked to original sources

arXiv2023

Test-Time Poisoning Attacks Against Test-Time Adaptation Models

Deploying machine learning (ML) models in the wild is challenging as it suffers from distribution shifts, where the model trained on an original domain cannot generalize well to unforeseen diverse transfer domains. To address this challenge, several test-time adaptation (TTA) methods have been proposed to improve the generalization ability of the target pre-trained models under test data to cope with the shifted distribution. The success of TTA can be credited to the continuous fine-tuning of the target model according to the distributional hint from the test samples during test time. Despite being powerful, it also opens a new attack surface, i.e., test-time poisoning attacks, which are substantially different from previous poisoning attacks that occur during the training time of ML models (i.e., adversaries cannot intervene in the training process). In this paper, we perform the first test-time poisoning attack against four mainstream TTA methods, including TTT, DUA, TENT, and RPL. Concretely, we generate poisoned samples based on the surrogate models and feed them to the target TTA models. Experimental results show that the TTA methods are generally vulnerable to test-time poisoning attacks. For instance, the adversary can feed as few as 10 poisoned samples to degrade the performance of the target model from 76.20% to 41.83%. Our results demonstrate that TTA algorithms lacking a rigorous security assessment are unsuitable for deployment in real-life scenarios. As such, we advocate for the integration of defenses against test-time poisoning attacks into the design of TTA methods.

cs.CR↗

arXiv2023

You Only Prompt Once: On the Capabilities of Prompt Learning on Large Language Models to Tackle Toxic Content

The spread of toxic content online is an important problem that has adverse effects on user experience online and in our society at large. Motivated by the importance and impact of the problem, research focuses on developing solutions to detect toxic content, usually leveraging machine learning (ML) models trained on human-annotated datasets. While these efforts are important, these models usually do not generalize well and they can not cope with new trends (e.g., the emergence of new toxic terms). Currently, we are witnessing a shift in the approach to tackling societal issues online, particularly leveraging large language models (LLMs) like GPT-3 or T5 that are trained on vast corpora and have strong generalizability. In this work, we investigate how we can use LLMs and prompt learning to tackle the problem of toxic content, particularly focusing on three tasks; 1) Toxicity Classification, 2) Toxic Span Detection, and 3) Detoxification. We perform an extensive evaluation over five model architectures and eight datasets demonstrating that LLMs with prompt learning can achieve similar or even better performance compared to models trained on these specific tasks. We find that prompt learning achieves around 10\% improvement in the toxicity classification task compared to the baselines, while for the toxic span detection task we find better performance to the best baseline (0.643 vs. 0.640 in terms of $F_1$-score). Finally, for the detoxification task, we find that prompt learning can successfully reduce the average toxicity score (from 0.775 to 0.213) while preserving semantic meaning.

cs.CL↗

arXiv2023

Generated Graph Detection

Graph generative models become increasingly effective for data distribution approximation and data augmentation. While they have aroused public concerns about their malicious misuses or misinformation broadcasts, just as what Deepfake visual and auditory media has been delivering to society. Hence it is essential to regulate the prevalence of generated graphs. To tackle this problem, we pioneer the formulation of the generated graph detection problem to distinguish generated graphs from real ones. We propose the first framework to systematically investigate a set of sophisticated models and their performance in four classification scenarios. Each scenario switches between seen and unseen datasets/generators during testing to get closer to real-world settings and progressively challenge the classifiers. Extensive experiments evidence that all the models are qualified for generated graph detection, with specific models having advantages in specific scenarios. Resulting from the validated generality and oblivion of the classifiers to unseen datasets/generators, we draw a safe conclusion that our solution can sustain for a decent while to curb generated graph misuses.

cs.CR↗

arXiv2023

Watermarking Diffusion Model

The availability and accessibility of diffusion models (DMs) have significantly increased in recent years, making them a popular tool for analyzing and predicting the spread of information, behaviors, or phenomena through a population. Particularly, text-to-image diffusion models (e.g., DALLE 2 and Latent Diffusion Models (LDMs) have gained significant attention in recent years for their ability to generate high-quality images and perform various image synthesis tasks. Despite their widespread adoption in many fields, DMs are often susceptible to various intellectual property violations. These can include not only copyright infringement but also more subtle forms of misappropriation, such as unauthorized use or modification of the model. Therefore, DM owners must be aware of these potential risks and take appropriate steps to protect their models. In this work, we are the first to protect the intellectual property of DMs. We propose a simple but effective watermarking scheme that injects the watermark into the DMs and can be verified by the pre-defined prompts. In particular, we propose two different watermarking methods, namely NAIVEWM and FIXEDWM. The NAIVEWM method injects the watermark into the LDMs and activates it using a prompt containing the watermark. On the other hand, the FIXEDWM is considered more advanced and stealthy compared to the NAIVEWM, as it can only activate the watermark when using a prompt containing a trigger in a fixed position. We conducted a rigorous evaluation of both approaches, demonstrating their effectiveness in watermark injection and verification with minimal impact on the LDM's functionality.

cs.CR↗

arXiv2023

A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plots

Building advanced machine learning (ML) models requires expert knowledge and many trials to discover the best architecture and hyperparameter settings. Previous work demonstrates that model information can be leveraged to assist other attacks, such as membership inference, generating adversarial examples. Therefore, such information, e.g., hyperparameters, should be kept confidential. It is well known that an adversary can leverage a target ML model's output to steal the model's information. In this paper, we discover a new side channel for model information stealing attacks, i.e., models' scientific plots which are extensively used to demonstrate model performance and are easily accessible. Our attack is simple and straightforward. We leverage the shadow model training techniques to generate training data for the attack model which is essentially an image classifier. Extensive evaluation on three benchmark datasets shows that our proposed attack can effectively infer the architecture/hyperparameters of image classifiers based on convolutional neural network (CNN) given the scientific plot generated from it. We also reveal that the attack's success is mainly caused by the shape of the scientific plots, and further demonstrate that the attacks are robust in various scenarios. Given the simplicity and effectiveness of the attack method, our study indicates scientific plots indeed constitute a valid side channel for model information stealing attacks. To mitigate the attacks, we propose several defense mechanisms that can reduce the original attacks' accuracy while maintaining the plot utility. However, such defenses can still be bypassed by adaptive attacks.

cs.CR↗

arXiv2023

One Size Does not Fit All: Quantifying the Risk of Malicious App Encounters for Different Android User Profiles

Previous work has investigated the particularities of security practices within specific user communities defined based on country of origin, age, prior tech abuse, and economic status. Their results highlight that current security solutions that adopt a one-size-fits-all-users approach ignore the differences and needs of particular user communities. However, those works focus on a single community or cluster users into hard-to-interpret sub-populations. In this work, we perform a large-scale quantitative analysis of the risk of encountering malware and other potentially unwanted applications (PUA) across user communities. At the core of our study is a dataset of app installation logs collected from 12M Android mobile devices. Leveraging user-installed apps, we define intuitive profiles based on users' interests (e.g., gamers and investors), and fit a subset of 5.4M devices to those profiles. Our analysis is structured in three parts. First, we perform risk analysis on the whole population to measure how the risk of malicious app encounters is affected by different factors. Next, we create different profiles to investigate whether risk differences across users may be due to their interests. Finally, we compare a per-profile approach for classifying clean and infected devices with the classical approach that considers the whole population. We observe that features such as the diversity of the app signers and the use of alternative markets highly correlate with the risk of malicious app encounters. We also discover that some profiles such as gamers and social-media users are exposed to more than twice the risks experienced by the average users. We also show that the classification outcome has a marked accuracy improvement when using a per-profile approach to train the prediction models. Overall, our results confirm the inadequacy of one-size-fits-all protection solutions.

cs.CR↗

arXiv2023

Backdoor Attacks Against Dataset Distillation

Dataset distillation has emerged as a prominent technique to improve data efficiency when training machine learning models. It encapsulates the knowledge from a large dataset into a smaller synthetic dataset. A model trained on this smaller distilled dataset can attain comparable performance to a model trained on the original training dataset. However, the existing dataset distillation techniques mainly aim at achieving the best trade-off between resource usage efficiency and model utility. The security risks stemming from them have not been explored. This study performs the first backdoor attack against the models trained on the data distilled by dataset distillation models in the image domain. Concretely, we inject triggers into the synthetic data during the distillation procedure rather than during the model training stage, where all previous attacks are performed. We propose two types of backdoor attacks, namely NAIVEATTACK and DOORPING. NAIVEATTACK simply adds triggers to the raw data at the initial distillation phase, while DOORPING iteratively updates the triggers during the entire distillation procedure. We conduct extensive evaluations on multiple datasets, architectures, and dataset distillation techniques. Empirical evaluation shows that NAIVEATTACK achieves decent attack success rate (ASR) scores in some cases, while DOORPING reaches higher ASR scores (close to 1.0) in all cases. Furthermore, we conduct a comprehensive ablation study to analyze the factors that may affect the attack performance. Finally, we evaluate multiple defense mechanisms against our backdoor attacks and show that our attacks can practically circumvent these defense mechanisms.

cs.CR↗

arXiv2022

Topological Robust Corner States of a Two-Dimensional Square Lattice with $\mathbf C_{\mathbf 4}$ Symmetry in Fully Coupled Dipolar Arrays

Higher-order topological insulators(HOTIs) is an exciting topic. We constructed a square lattice dipole arrays, it supports out-of-plane and in-plane modes by going beyond conventional scalar coupling. In-plane modes naturally break $\mathrm C_{4}$ symmetry, we only studied the out-of-plane modes that maintain $\mathrm C_{4}$ symmetry. Due to the slowly decaying long-range coupling, we consider its fully coupled interactions by using the lattice sums technique and combined with the coupled dipole method (CDM) to study its topological properties in detail. Interestingly, even when the full coupling is considered, the topological properties of the system remain similar to those of the 2D Su-Schrieffer-Heeger(SSH) model, but very differently, it supports robust zero-energy corner states (ZECSs) with $\mathrm C_{4}$ symmetry, we calculate the bulk polarization and discuss in detail the topological origin of the ZECSs. The lattice sums technique in the article can be applied to arbitrary fully coupled 2D dipole arrays. The materials we used can be able to confine light into the deep subwavelength scale, it has a great potential in enhancing light-matter interactions in the terahertz (THz) range.

physics.optics↗

arXiv2022

Amplifying Membership Exposure via Data Poisoning

As in-the-wild data are increasingly involved in the training stage, machine learning applications become more susceptible to data poisoning attacks. Such attacks typically lead to test-time accuracy degradation or controlled misprediction. In this paper, we investigate the third type of exploitation of data poisoning - increasing the risks of privacy leakage of benign training samples. To this end, we demonstrate a set of data poisoning attacks to amplify the membership exposure of the targeted class. We first propose a generic dirty-label attack for supervised classification algorithms. We then propose an optimization-based clean-label attack in the transfer learning scenario, whereby the poisoning samples are correctly labeled and look "natural" to evade human moderation. We extensively evaluate our attacks on computer vision benchmarks. Our results show that the proposed attacks can substantially increase the membership inference precision with minimum overall test-time model performance degradation. To mitigate the potential negative impacts of our attacks, we also investigate feasible countermeasures.

cs.CR↗

arXiv2022

Backdoor Attacks in the Supply Chain of Masked Image Modeling

Masked image modeling (MIM) revolutionizes self-supervised learning (SSL) for image pre-training. In contrast to previous dominating self-supervised methods, i.e., contrastive learning, MIM attains state-of-the-art performance by masking and reconstructing random patches of the input image. However, the associated security and privacy risks of this novel generative method are unexplored. In this paper, we perform the first security risk quantification of MIM through the lens of backdoor attacks. Different from previous work, we are the first to systematically threat modeling on SSL in every phase of the model supply chain, i.e., pre-training, release, and downstream phases. Our evaluation shows that models built with MIM are vulnerable to existing backdoor attacks in release and downstream phases and are compromised by our proposed method in pre-training phase. For instance, on CIFAR10, the attack success rate can reach 99.62%, 96.48%, and 98.89% in the downstream phase, release phase, and pre-training phase, respectively. We also take the first step to investigate the success factors of backdoor attacks in the pre-training phase and find the trigger number and trigger pattern play key roles in the success of backdoor attacks while trigger location has only tiny effects. In the end, our empirical study of the defense mechanisms across three detection-level on model supply chain phases indicates that different defenses are suitable for backdoor attacks in different phases. However, backdoor attacks in the release phase cannot be detected by all three detection-level methods, calling for more effective defenses in future research.

cs.CR↗

arXiv2022

Cerberus: Exploring Federated Prediction of Security Events

Modern defenses against cyberattacks increasingly rely on proactive approaches, e.g., to predict the adversary's next actions based on past events. Building accurate prediction models requires knowledge from many organizations; alas, this entails disclosing sensitive information, such as network structures, security postures, and policies, which might often be undesirable or outright impossible. In this paper, we explore the feasibility of using Federated Learning (FL) to predict future security events. To this end, we introduce Cerberus, a system enabling collaborative training of Recurrent Neural Network (RNN) models for participating organizations. The intuition is that FL could potentially offer a middle-ground between the non-private approach where the training data is pooled at a central server and the low-utility alternative of only training local models. We instantiate Cerberus on a dataset obtained from a major security company's intrusion prevention product and evaluate it vis-a-vis utility, robustness, and privacy, as well as how participants contribute to and benefit from the system. Overall, our work sheds light on both the positive aspects and the challenges of using FL for this task and paves the way for deploying federated approaches to predictive security.

cs.CR↗

arXiv2022

On the Privacy Risks of Cell-Based NAS Architectures

Existing studies on neural architecture search (NAS) mainly focus on efficiently and effectively searching for network architectures with better performance. Little progress has been made to systematically understand if the NAS-searched architectures are robust to privacy attacks while abundant work has already shown that human-designed architectures are prone to privacy attacks. In this paper, we fill this gap and systematically measure the privacy risks of NAS architectures. Leveraging the insights from our measurement study, we further explore the cell patterns of cell-based NAS architectures and evaluate how the cell patterns affect the privacy risks of NAS-searched architectures. Through extensive experiments, we shed light on how to design robust NAS architectures against privacy attacks, and also offer a general methodology to understand the hidden correlation between the NAS-searched architectures and other privacy risks.

cs.CR↗

arXiv2022

Finding MNEMON: Reviving Memories of Node Embeddings

Previous security research efforts orbiting around graphs have been exclusively focusing on either (de-)anonymizing the graphs or understanding the security and privacy issues of graph neural networks. Little attention has been paid to understand the privacy risks of integrating the output from graph embedding models (e.g., node embeddings) with complex downstream machine learning pipelines. In this paper, we fill this gap and propose a novel model-agnostic graph recovery attack that exploits the implicit graph structural information preserved in the embeddings of graph nodes. We show that an adversary can recover edges with decent accuracy by only gaining access to the node embedding matrix of the original graph without interactions with the node embedding models. We demonstrate the effectiveness and applicability of our graph recovery attack through extensive experiments.

cs.LG↗

arXiv2022

Realization of broadband index-near-zero modes in nonreciprocal magneto-optical heterostructures

Epsilon-near-zero (ENZ) metamaterial with the relative permittivity approaching zero has been a hot research subject in the past decades. The wave in the ENZ region has infinite phase velocity ($v=1/\sqrt{\varepsilonμ}$), whereas it cannot efficiently travel into the other devices or air due to the impedance mismatch or near-zero group velocity. In this paper, we demonstrate that the tunable index-near-zero (INZ) modes with vanishing wavenumbers ($k=0$) and nonzero group velocities ($v_\mathrm{g} \neq 0$) can be achieved in nonreciprocal magneto-optical systems. This kind of INZ modes has been experimentally demonstrated in the photonic crystals at Dirac point frequencies and that impedance-matching effect has been observed as well. Our theoretical analysis reveals that the INZ modes exhibit tunability when changing the parameter of the one-way (nonreciprocal) waveguides. Moreover, owing to the zero-phase-shift characteristic and decreasing $v_\mathrm{g}$ of the INZ modes, several perfect optical buffers (POBs) are proposed in the microwave and terahertz regimes. The theoretical results are further verified by the numerical simulations performed by the finite element method. Our findings may open the new avenues for research in the areas of ultra -strong or -fast nonlinearity, perfect cloaking, high-resolution holographic imaging and wireless communications.

physics.optics↗

arXiv2022

Realization of a photonic topological insulator in Kagome crystals at terahertz wavelengths

Topological systems are inherently robust to disorder and continuous perturbations, resulting in dissipation-free edge transport of electrons in quantum solids, or reflectionless guiding of photons and phonons in classical wave systems characterized by topological invariants. Despite considerable efforts, direct experimental demonstration of theoretically predicted robust, lossless energy transport in topological insulators operating at terahertz frequencies is needed further investigations to shed affirmative light on the unique properties enabled by topological protection. Here, we introduce Kagome lattice that exhibits a new class of symmetry-protected topological phases with very low Berry curvature but nontrivial bulk polarization, and fabricate an optical topological insulator that provide the valley hall effect. Theoretical analysis show that four type edge states can be obtained. Measurements of THz-TDs with high time-resolution demonstrate that terahertz wave propagating along the straight topological edge and Z-shape edge with sharp turns have almost same high transmission in 0.440 THz to 0.457 THz domain range. Those results quantitatively illustrate the suppression of backscattering due to the non-trivial topology of the structure. The THz-TDs measurement yields amplitude and phase information, showing significant advantage compared to general broadband infrared, single wavelength continuous-wave THz measurements and visible spectroscopy. It allows further exploration of the effective refractive index, group velocity and dispersion relations of edge states. Our work offers possibilities for advanced control of the propagation and manipulation of THz waves, and facilitates the applications including sixth-generation (6G) wireless communication, terahertz integrated circuits, and interconnects for intrachip and interchip communication.

physics.optics↗

arXiv2021

Model Stealing Attacks Against Inductive Graph Neural Networks

Many real-world data come in the form of graphs. Graph neural networks (GNNs), a new family of machine learning (ML) models, have been proposed to fully leverage graph data to build powerful applications. In particular, the inductive GNNs, which can generalize to unseen data, become mainstream in this direction. Machine learning models have shown great potential in various tasks and have been deployed in many real-world scenarios. To train a good model, a large amount of data as well as computational resources are needed, leading to valuable intellectual property. Previous research has shown that ML models are prone to model stealing attacks, which aim to steal the functionality of the target models. However, most of them focus on the models trained with images and texts. On the other hand, little attention has been paid to models trained with graph data, i.e., GNNs. In this paper, we fill the gap by proposing the first model stealing attacks against inductive GNNs. We systematically define the threat model and propose six attacks based on the adversary's background knowledge and the responses of the target models. Our evaluation on six benchmark datasets shows that the proposed model stealing attacks against GNNs achieve promising performance.

cs.CR↗

arXiv2021

Non-Hermitian total-loss high-order topological insulator based on 1D Su-Schrieffer-Heeger (SSH)

Non-Hermiticity alters topology with the presence of non-Hermitian factors in topological systems. Most existing non-Hermitian topological systems derive their topological phases from Hermitian components, that is, the gain and loss of the system are considered simultaneously. In this work, we reveal two-dimensional non-Hermitian high-order topological insulator based on one-dimensional SSH chain, the nontrivial topology of which induced by total-loss. By introducing the loss of a specific configuration, we get a band gap with corner and edge states whose topology is characterized by the gapped wannier band. In addition, we demonstrate the existence of 'real-energy' edge states in pseudo-PT symmetric domain wall system. These results can be easily implemented in experiments, and promote the research of topological transmission of lossy systems in the real world.

physics.optics↗

arXiv2021

Valley and Valley-like Split-ring Topological Photonic Crystal

In the research of topological phases of matter, valley pseudospins have been introduced into photonic systems. Here, we construct a split-ring photonic crystal (SPC) in which the spilt rings are distributed according to the Kagome model. By rotating three split rings as a whole under the condition of ensuring the existence of C3v symmetry, we obtain a traditional two-band-inversion valley topology (2IVT) driven by opening twofold Dirac degeneracy point. When three split rings are rotated as a whole without ensuring the existence of C3v symmetry, a valley-like topology driven by opening twofold degeneracy point will exist. In particular, when three split rings are rotated separately, three-band-inversion valley-like topology (3IVT) will exist which is also driven by opening twofold degeneracy point. Valley topology and valley-like topology can be described by non-trivial Wannier band (WB) and bulk polarization (BP), and they both have the positive and negative refraction along the Zigzag domain-wall. Our research can be extended to other models, using controllable geometry to construct a variety of topological structures, so as to provide ideas for the research of new topological states.

physics.optics↗