arXiv subjects

Zhixing Ye

Publications and source records attributed to Zhixing Ye.

5 recordsLinked to original sources

arXiv2026

Giant Magnetocaloric Effect in a High-Spin Shastry-Sutherland Dipolar Magnet

The Shastry-Sutherland lattice is a prototypical frustrated quantum magnet. It is notable for its exactly solvable dimer-singlet ground state and hosts a wealth of magnetic phenomena under external fields. Here, this work investigates the high-spin (S = 7/2) Eu-based magnet Eu2MgSi2O7 (EMSO) using low-temperature magnetothermal measurements and Monte Carlo simulations, revealing a giant magnetocaloric effect (MCE) in this Shastry-Sutherland compound. The entropy change peak value is found to be 55.0 J kg-1 K-1 under a field change of B = 0-4 T, approximately 1.5 times larger than the commercial Gd3Ga5O12 (GGG). Adiabatic demagnetization refrigeration achieves a lowest temperature of 151 mK, deeply into the sub-Kelvin regime. Furthermore, a distinctive cooling effect persists below about 1 T, a characteristic absent for conventional magnetic coolants. A dipolar Shastry-Sutherland model is introduced as a minimal model to describe this system; in particular, the experimentally revealed 1/3 magnetization pseudo-plateau can be ascribed to the presence of dipolar couplings between Eu2+ ions, further stabilized by the thermal fluctuations, explaining the persistent cooling effect. This work establishes EMSO as a novel platform for exploring the dipolar Shastry-Sutherland system and for sub-Kelvin adiabatic demagnetization refrigeration.

cond-mat.mtrl-sci↗

arXiv2023

Measuring the Transferability of $\ell_\infty$ Attacks by the $\ell_2$ Norm

Deep neural networks could be fooled by adversarial examples with trivial differences to original samples. To keep the difference imperceptible in human eyes, researchers bound the adversarial perturbations by the $\ell_\infty$ norm, which is now commonly served as the standard to align the strength of different attacks for a fair comparison. However, we propose that using the $\ell_\infty$ norm alone is not sufficient in measuring the attack strength, because even with a fixed $\ell_\infty$ distance, the $\ell_2$ distance also greatly affects the attack transferability between models. Through the discovery, we reach more in-depth understandings towards the attack mechanism, i.e., several existing methods attack black-box models better partly because they craft perturbations with 70% to 130% larger $\ell_2$ distances. Since larger perturbations naturally lead to better transferability, we thereby advocate that the strength of attacks should be simultaneously measured by both the $\ell_\infty$ and $\ell_2$ norm. Our proposal is firmly supported by extensive experiments on ImageNet dataset from 7 attacks, 4 white-box models, and 9 black-box models.

cs.LG↗

arXiv2022

FG-UAP: Feature-Gathering Universal Adversarial Perturbation

Deep Neural Networks (DNNs) are susceptible to elaborately designed perturbations, whether such perturbations are dependent or independent of images. The latter one, called Universal Adversarial Perturbation (UAP), is very attractive for model robustness analysis, since its independence of input reveals the intrinsic characteristics of the model. Relatively, another interesting observation is Neural Collapse (NC), which means the feature variability may collapse during the terminal phase of training. Motivated by this, we propose to generate UAP by attacking the layer where NC phenomenon happens. Because of NC, the proposed attack could gather all the natural images' features to its surrounding, which is hence called Feature-Gathering UAP (FG-UAP). We evaluate the effectiveness our proposed algorithm on abundant experiments, including untargeted and targeted universal attacks, attacks under limited dataset, and transfer-based black-box attacks among different architectures including Vision Transformers, which are believed to be more robust. Furthermore, we investigate FG-UAP in the view of NC by analyzing the labels and extracted features of adversarial examples, finding that collapse phenomenon becomes stronger after the model is corrupted. The code will be released when the paper is accepted.

cs.CV↗

arXiv2021

Dominant Patterns: Critical Features Hidden in Deep Neural Networks

In this paper, we find the existence of critical features hidden in Deep NeuralNetworks (DNNs), which are imperceptible but can actually dominate the outputof DNNs. We call these features dominant patterns. As the name suggests, for a natural image, if we add the dominant pattern of a DNN to it, the output of this DNN is determined by the dominant pattern instead of the original image, i.e., DNN's prediction is the same with the dominant pattern's. We design an algorithm to find such patterns by pursuing the insensitivity in the feature space. A direct application of the dominant patterns is the Universal Adversarial Perturbations(UAPs). Numerical experiments show that the found dominant patterns defeat state-of-the-art UAP methods, especially in label-free settings. In addition, dominant patterns are proved to have the potential to attack downstream tasks in which DNNs share the same backbone. We claim that DNN-specific dominant patterns reveal some essential properties of a DNN and are of great importance for its feature analysis and robustness enhancement.

cs.LG↗

arXiv2020

HRFA: High-Resolution Feature-based Attack

Adversarial attacks have long been developed for revealing the vulnerability of Deep Neural Networks (DNNs) by adding imperceptible perturbations to the input. Most methods generate perturbations like normal noise, which is not interpretable and without semantic meaning. In this paper, we propose High-Resolution Feature-based Attack (HRFA), yielding authentic adversarial examples with up to $1024 \times 1024$ resolution. HRFA exerts attack by modifying the latent feature representation of the image, i.e., the gradients back propagate not only through the victim DNN, but also through the generative model that maps the feature space to the image space. In this way, HRFA generates adversarial examples that are in high-resolution, realistic, noise-free, and hence is able to evade several denoising-based defenses. In the experiment, the effectiveness of HRFA is validated by attacking the object classification and face verification tasks with BigGAN and StyleGAN, respectively. The advantages of HRFA are verified from the high quality, high authenticity, and high attack success rate faced with defenses.

cs.LG↗