Search

We focus on the optimization of neutral atom transport and transfer between optical tweezers, both critical steps towards the implementation of quantum processors and simulators. We consider four different types of experimentally relevant pulses: piece-wise linear, piece-wise quadratic, minimum jerk, and a family of hybrid linear and minimum jerk ramps. We also develop a protocol using Shortcuts to Adiabaticity (STA) techniques that allows us to include the effects of static traps. By computing a measure of the error after transport and two measures of the heating for transient times, we provide a systematic characterization of the performance of all the considered pulses and show that our proposed STA protocol outperforms the experimentally inspired pulses. After pulse shape optimization we find a lower threshold for the total time of the protocol that is compatible with the limit below which the increase in the vibrational excitations exceeds half of the amount of states hosted by the moving tweezer. Since the obtained lower bound for the atom capturing or releasing stage is 9 times faster than the one reported in state-of-the-art experiments, we interpret our results as a wake-up call towards the importance of the inclusion and optimization of the transfer between tweezers, which may be the largest bottleneck to speed. For the two pulses having the best performance (minimum jerk and STA), we determine optimal regions in the experimentally accessible parameters to implement high fidelity transport pulses. Finally, our STA results prove that a modulation in the depth of the moving tweezer designed to counteract the effect of the static traps reduces errors and allows for shorter pulse duration. To motivate the use of our STA pulse in future experiments, we provide a simple analytical approximation for the tweezer position and depth controls., Comment: 21 pages, 8 figures

Protecting the intellectual property of machine learning models is a hot topic and many watermarking schemes for deep neural networks have been proposed in the literature. Unfortunately, prior work largely neglected the investigation of watermarking techniques for other types of models, including decision tree ensembles, which are a state-of-the-art model for classification tasks on non-perceptual data. In this paper, we present the first watermarking scheme designed for decision tree ensembles, focusing in particular on random forest models. We discuss watermark creation and verification, presenting a thorough security analysis with respect to possible attacks. We finally perform an experimental evaluation of the proposed scheme, showing excellent results in terms of accuracy and security against the most relevant threats., Comment: 7 pages, 5 figures, 2 tables

We present Timber, the first white-box poisoning attack targeting decision trees. Timber is based on a greedy attack strategy that leverages sub-tree retraining to efficiently estimate the damage caused by poisoning a given training instance. The attack relies on a tree annotation procedure, which enables the sorting of training instances so that they are processed in increasing order of the computational cost of sub-tree retraining. This sorting yields a variant of Timber that supports an early stopping criterion, designed to make poisoning attacks more efficient and feasible on larger datasets. We also discuss an extension of Timber to traditional random forest models, which is valuable since decision trees are typically combined into ensembles to improve their predictive power. Our experimental evaluation on public datasets demonstrates that our attacks outperform existing baselines in terms of effectiveness, efficiency, or both. Moreover, we show that two representative defenses can mitigate the effect of our attacks, but fail to effectively thwart them., Comment: This work has been accepted for publication in the 3rd IEEE Conference on Secure and Trustworthy Machine Learning (IEEE SaTML 2025). The final version will be available on IEEE Xplore. 17 pages, 7 figures, 5 tables

Image datasets serve as the foundation for machine learning models in computer vision, significantly influencing model capabilities, performance, and biases alongside architectural considerations. Therefore, understanding the composition and distribution of these datasets has become increasingly crucial. To address the need for intuitive exploration of these datasets, we propose AEye, an extensible and scalable visualization tool tailored to image datasets. AEye utilizes a contrastively trained model to embed images into semantically meaningful high-dimensional representations, facilitating data clustering and organization. To visualize the high-dimensional representations, we project them onto a two-dimensional plane and arrange images in layers so users can seamlessly navigate and explore them interactively. AEye facilitates semantic search functionalities for both text and image queries, enabling users to search for content. We open-source the codebase for AEye, and provide a simple configuration to add datasets., Comment: Accepted at IEEE VIS 2024

Verifiable learning advocates for training machine learning models amenable to efficient security verification. Prior research demonstrated that specific classes of decision tree ensembles -- called large-spread ensembles -- allow for robustness verification in polynomial time against any norm-based attacker. This study expands prior work on verifiable learning from basic ensemble methods (i.e., hard majority voting) to advanced boosted tree ensembles, such as those trained using XGBoost or LightGBM. Our formal results indicate that robustness verification is achievable in polynomial time when considering attackers based on the $L_\infty$-norm, but remains NP-hard for other norm-based attackers. Nevertheless, we present a pseudo-polynomial time algorithm to verify robustness against attackers based on the $L_p$-norm for any $p \in \mathbb{N} \cup \{0\}$, which in practice grants excellent performance. Our experimental evaluation shows that large-spread boosted ensembles are accurate enough for practical adoption, while being amenable to efficient security verification., Comment: 15 pages, 3 figures

Verifying the robustness of machine learning models against evasion attacks at test time is an important research problem. Unfortunately, prior work established that this problem is NP-hard for decision tree ensembles, hence bound to be intractable for specific inputs. In this paper, we identify a restricted class of decision tree ensembles, called large-spread ensembles, which admit a security verification algorithm running in polynomial time. We then propose a new approach called verifiable learning, which advocates the training of such restricted model classes which are amenable for efficient verification. We show the benefits of this idea by designing a new training algorithm that automatically learns a large-spread decision tree ensemble from labelled data, thus enabling its security verification in polynomial time. Experimental results on public datasets confirm that large-spread ensembles trained using our algorithm can be verified in a matter of seconds, using standard commercial hardware. Moreover, large-spread ensembles are more robust than traditional ensembles against evasion attacks, at the cost of an acceptable loss of accuracy in the non-adversarial setting., Comment: 19 pages, 5 figures; full version of the revised paper accepted at ACM CCS 2023 with corrected typo in footnote 1

We present our new experimental and theoretical framework which combines a broadband superluminescent diode (SLED/SLD) with fast learning algorithms to provide speed and accuracy improvements for the optimization of 1D optical dipole potentials, here generated with a Digital Micromirror Device (DMD). To characterize the setup and potential speckle patterns arising from coherence, we compare the superluminescent diode to a single-mode laser by investigating interference properties. We employ Machine Learning (ML) tools to train a physics-inspired model acting as a digital twin of the optical system predicting the behavior of the optical apparatus including all its imperfections. Implementing an iterative algorithm based on Iterative Learning Control (ILC) we optimize optical potentials an order of magnitude faster than heuristic optimization methods. We compare iterative model-based offline optimization and experimental feedback-based online optimization. Our methods provide a new route to fast optimization of optical potentials which is relevant for the dynamical manipulation of ultracold gases., Comment: 10 pages, 5 figures

We present a new approach to the global fairness verification of tree-based classifiers. Given a tree-based classifier and a set of sensitive features potentially leading to discrimination, our analysis synthesizes sufficient conditions for fairness, expressed as a set of traditional propositional logic formulas, which are readily understandable by human experts. The verified fairness guarantees are global, in that the formulas predicate over all the possible inputs of the classifier, rather than just a few specific test instances. Our analysis is formally proved both sound and complete. Experimental results on public datasets show that the analysis is precise, explainable to human experts and efficient enough for practical adoption., Comment: 15 pages with 7 figures

The ability to manipulate clouds of ultra-cold atoms is crucial for modern experiments on quantum manybody systems and quantum thermodynamics as well as future metrological applications of Bose-Einstein condensate. While optical manipulation offers almost arbitrary flexibility, the precise control of the resulting dipole potentials and the mitigation of unwanted disturbances is quite involved and only heuristic algorithms with rather slow convergence rates are available up to now. This paper thus suggests the application of iterative learning control (ILC) methods to generate fine-tuned effective potentials in the presence of uncertainties and external disturbances. Therefore, the given problem is reformulated to obtain a one-dimensional tracking problem by using a quasicontinuous input mapping which can be treated by established ILC methods. Finally, the performance of the proposed concept is illustrated in a simulation scenario., Comment: To appear in Proceedings of the 61st IEEE Conference on Decision and Control (CDC)

In this paper we criticize the robustness measure traditionally employed to assess the performance of machine learning models deployed in adversarial settings. To mitigate the limitations of robustness, we introduce a new measure called resilience and we focus on its verification. In particular, we discuss how resilience can be verified by combining a traditional robustness verification technique with a data-independent stability analysis, which identifies a subset of the feature space where the model does not change its predictions despite adversarial manipulations. We then introduce a formally sound data-independent stability analysis for decision trees and decision tree ensembles, which we experimentally assess on public datasets and we leverage for resilience verification. Our results show that resilience verification is useful and feasible in practice, yielding a more reliable security assessment of both standard and robust decision tree models.

Modern web applications often rely on third-party services to provide their functionality to users. The secure integration of these services is a non-trivial task, as shown by the large number of attacks against Single Sign On and Cashier-as-a-Service protocols. In this paper we present Bulwark, a new automatic tool which generates formally verified security monitors from applied pi-calculus specifications of web protocols. The security monitors generated by Bulwark offer holistic protection, since they can be readily deployed both at the client side and at the server side, thus ensuring full visibility of the attack surface against web protocols. We evaluate the effectiveness of Bulwark by testing it against a pool of vulnerable web applications that use the OAuth 2.0 protocol or integrate the PayPal payment system., Comment: Full version of the paper presented at ESORICS2020 (14-18 September 2020)

Related-domain attackers control a sibling domain of their target web application, e.g., as the result of a subdomain takeover. Despite their additional power over traditional web attackers, related-domain attackers received only limited attention by the research community. In this paper we define and quantify for the first time the threats that related-domain attackers pose to web application security. In particular, we first clarify the capabilities that related-domain attackers can acquire through different attack vectors, showing that different instances of the related-domain attacker concept are worth attention. We then study how these capabilities can be abused to compromise web application security by focusing on different angles, including: cookies, CSP, CORS, postMessage and domain relaxation. By building on this framework, we report on a large-scale security measurement on the top 50k domains from the Tranco list that led to the discovery of vulnerabilities in 887 sites, where we quantified the threats posed by related-domain attackers to popular web applications., Comment: Submitted to USENIX Security '21 on 16 Oct 2020

Resistive-capacitive (RC) networks are used to model various processes in engineering, physics or biology. We consider the problem of recovering the network connection structure from measured input-output data. We address this problem as a structured identification one, that is, we assume to have a state-space model of the system (identified with standard techniques, such as subspace methods) and find a coordinate transformation that puts the identified system in a form that reveals the nodes connection structure. We characterize the solution set, that is, the set of all possible RC-networks that can be associated to the input-output data. We present a possible solution algorithm and show some computational experiments.

Machine learning has proved invaluable for a range of different tasks, yet it also proved vulnerable to evasion attacks, i.e., maliciously crafted perturbations of input data designed to force mispredictions. In this paper we propose a novel technique to verify the security of decision tree models against evasion attacks with respect to an expressive threat model, where the attacker can be represented by an arbitrary imperative program. Our approach exploits the interpretability property of decision trees to transform them into imperative programs, which are amenable for traditional program analysis techniques. By leveraging the abstract interpretation framework, we are able to soundly verify the security guarantees of decision tree models trained over publicly available datasets. Our experiments show that our technique is both precise and efficient, yielding only a minimal number of false positives and scaling up to cases which are intractable for a competitor approach.

Machine learning algorithms, however effective, are known to be vulnerable in adversarial scenarios where a malicious user may inject manipulated instances. In this work we focus on evasion attacks, where a model is trained in a safe environment and exposed to attacks at test time. The attacker aims at finding a minimal perturbation of a test instance that changes the model outcome. We propose a model-agnostic strategy that builds a robust ensemble by training its basic models on feature-based partitions of the given dataset. Our algorithm guarantees that the majority of the models in the ensemble cannot be affected by the attacker. We experimented the proposed strategy on decision tree ensembles, and we also propose an approximate certification method for tree ensembles that efficiently assess the minimal accuracy of a forest on a given dataset avoiding the costly computation of evasion attacks. Experimental evaluation on publicly available datasets shows that proposed strategy outperforms state-of-the-art adversarial learning algorithms against evasion attacks.

We study the dilute and ultracold unitary Bose gas, which is characterized by a universal equation of state due to the diverging s-wave scattering length, under a transverse harmonic confinement. From the hydrodynamic equations of superfluids we derive an effective one-dimensional nonpolynomial Schr\"odinger equation (1D NPSE) for the axial dynamics which, however, takes also into account the transverse dynamics. Finally, by solving the 1D NPSE we obtain meaningful analytical formulas for the dark (gray and black) solitons of the bosonic system., Comment: 13 pages, 4 figures, improved version

Session management is a fundamental component of web applications: despite the apparent simplicity, correctly implementing web sessions is extremely tricky, as witnessed by the large number of existing attacks. This motivated the design of formal methods to rigorously reason about web session security which, however, are not supported at present by suitable automated verification techniques. In this paper we introduce the first security type system that enforces session security on a core model of web applications, focusing in particular on server-side code. We showcase the expressiveness of our type system by analyzing the session management logic of HotCRP, Moodle, and phpMyAdmin, unveiling novel security flaws that have been acknowledged by software developers.

Despite its success and popularity, machine learning is now recognized as vulnerable to evasion attacks, i.e., carefully crafted perturbations of test inputs designed to force prediction errors. In this paper we focus on evasion attacks against decision tree ensembles, which are among the most successful predictive models for dealing with non-perceptual problems. Even though they are powerful and interpretable, decision tree ensembles have received only limited attention by the security and machine learning communities so far, leading to a sub-optimal state of the art for adversarial learning techniques. We thus propose Treant, a novel decision tree learning algorithm that, on the basis of a formal threat model, minimizes an evasion-aware loss function at each step of the tree construction. Treant is based on two key technical ingredients: robust splitting and attack invariance, which jointly guarantee the soundness of the learning process. Experimental results on three publicly available datasets show that Treant is able to generate decision tree ensembles that are at the same time accurate and nearly insensitive to evasion attacks, outperforming state-of-the-art adversarial learning techniques.

We present WPSE, a browser-side security monitor for web protocols designed to ensure compliance with the intended protocol flow, as well as confidentiality and integrity properties of messages. We formally prove that WPSE is expressive enough to protect web applications from a wide range of protocol implementation bugs and web attacks. We discuss concrete examples of attacks which can be prevented by WPSE on OAuth 2.0 and SAML 2.0, including a novel attack on the Google implementation of SAML 2.0 which we discovered by formalizing the protocol specification in WPSE. Moreover, we use WPSE to carry out an extensive experimental evaluation of OAuth 2.0 in the wild. Out of 90 tested websites, we identify security flaws in 55 websites (61.1%), including new critical vulnerabilities introduced by tracking libraries such as Facebook Pixel, all of which fixable by WPSE. Finally, we show that WPSE works flawlessly on 83 websites (92.2%), with the 7 compatibility issues being caused by custom implementations deviating from the OAuth 2.0 specification, one of which introducing a critical vulnerability.

We present HornDroid, a new tool for the static analysis of information flow properties in Android applications. The core idea underlying HornDroid is to use Horn clauses for soundly abstracting the semantics of Android applications and to express security properties as a set of proof obligations that are automatically discharged by an off-the-shelf SMT solver. This approach makes it possible to fine-tune the analysis in order to achieve a high degree of precision while still using off-the-shelf verification tools, thereby leveraging the recent advances in this field. As a matter of fact, HornDroid outperforms state-of-the-art Android static analysis tools on benchmarks proposed by the community. Moreover, HornDroid is the first static analysis tool for Android to come with a formal proof of soundness, which covers the core of the analysis technique: besides yielding correctness assurances, this proof allowed us to identify some critical corner-cases that affect the soundness guarantees provided by some of the previous static analysis tools for Android., Comment: In Proceedings of 1st IEEE European Symposium on Security and Privacy (IEEE EuroS&P 2016)

The present paper proposes the first static analysis for Android applications which is both flow-sensitive on the heap abstraction and provably sound with respect to a rich formal model of the Android platform. We formulate the analysis as a set of Horn clauses defining a sound over-approximation of the semantics of the Android application to analyse, borrowing ideas from recency abstraction and extending them to our concurrent setting. Moreover, we implement the analysis in HornDroid, a state-of-the-art information flow analyser for Android applications. Our extension allows HornDroid to perform strong updates on heap-allocated data structures, thus significantly increasing its precision, without sacrificing its soundness guarantees. We test our implementation on DroidBench, a popular benchmark of Android applications developed by the research community, and we show that our changes to HornDroid lead to an improvement in the precision of the tool, while having only a moderate cost in terms of efficiency. Finally, we assess the scalability of our tool to the analysis of real applications.

Accurate knowledge of the single-molecule (self) translational dynamics of liquid para-H2 is an essential requirement for the calculation of the neutron scattering properties of this important quantum liquid. We show that, by using Centroid Molecular Dynamics (CMD) quantum simulations of the velocity autocorrelation function, calculations of the total neutron cross section (TCS) remarkably agree with experimental data at the thermal and epithermal incident neutron energies where para-H2 dynamics is actually dominated by the self contributions. This result shows that a proper account of the quantum nature of the fluid, as provided by CMD, is a necessary and very effective condition to obtain the correct absolute-scale cross section values directly from first-principle computations of the double differential cross section, and without the need of introducing any empirically adjusted quantity. At subthermal incident energies, appropriate modeling of the para-H2 intermolecular (distinct) dynamics also becomes crucial, but quantum simulations are not yet able to cope with it. Existing simple models which account for the distinct part provide an appropriate correction of self-only calculations and bring the computed results in reasonable accord with TCS experimental data available until very recently. However, if just published cross section measurements in the cold range are considered, the agreement turns out to be by far superior and very satisfactory. The possible origin of slight residual differences will be commented and suggest further computational and experimental efforts. Nonetheless, the ability to reproduce the total cross section in the wide range between 1 and 900 meV represents an encouraging and important validation step of the CMD method and of the present simple algorithm.

We investigate the potential of the upcoming LOBSTER space observatory (due circa 2009) to detect soft X-ray flashes from shock breakout in supernovae, primarily from Type II events. LOBSTER should discover many SN breakout flashes, although the number is sensitive to the uncertain distribution of extragalactic gas columns. X-ray data will constrain the radii of their progenitor stars far more tightly than can be accomplished with optical observations of the SN light curve. We anticipate the appearance of blue supergiant explosions (SN 1987A analogs), which will uncover a population of these underluminous events. We consider also how the mass, explosion energy, and absorbing column can be constrained from X-ray observables alone and with the assistance of optically-determined distances. These conclusions are drawn using known scaling relations to extrapolate, from previous numerical calculations, the LOBSTER response to explosions with a broad range of parameters. We comment on a small population of flashes with 0.2 < z < 0.8 that should exist as transient background events in XMM, Chandra, and ROSAT integrations., Comment: 14 pages, 9 figures, accepted by MNRAS, presented at AAS 203rd meeting