Search

The widespread adoption of facial recognition (FR) models raises serious concerns about their potential misuse, motivating the development of anti-facial recognition (AFR) to protect user facial privacy. In this paper, we argue that the static FR strategy, predominantly adopted in prior literature for evaluating AFR efficacy, cannot faithfully characterize the actual capabilities of determined trackers who aim to track a specific target identity. In particular, we introduce \emph{\ourAttack}, a dynamic FR strategy where the model's gallery database is iteratively updated with newly recognized target identity images. Surprisingly, such a simple approach renders all the existing AFR protections ineffective. To mitigate the privacy threats posed by DynTracker, we advocate for explicitly promoting diversity in the AFR-protected images. We hypothesize that the lack of diversity is the primary cause of the failure of existing AFR methods. Specifically, we develop \emph{DivTrackee}, a novel method for crafting diverse AFR protections that builds upon a text-guided image generation framework and diversity-promoting adversarial losses. Through comprehensive experiments on various facial image benchmarks and feature extractors, we demonstrate DynTracker's strength in breaking existing AFR methods and the superiority of DivTrackee in preventing user facial images from being identified by dynamic FR strategies. We believe our work can act as an important initial step towards developing more effective AFR methods for protecting user facial privacy against determined trackers.

As advancements in large language models (LLMs) continue and the demand for personalized models increases, parameter-efficient fine-tuning (PEFT) methods (e.g., LoRA) will become essential due to their efficiency in reducing computation costs. However, recent studies have raised alarming concerns that LoRA fine-tuning could potentially compromise the safety alignment in LLMs, posing significant risks for the model owner. In this paper, we first investigate the underlying mechanism by analyzing the changes in safety alignment related features before and after fine-tuning. Then, we propose a fixed safety module calculated by safety data and a task-specific initialization for trainable parameters in low-rank adaptations, termed Safety-alignment preserved Low-Rank Adaptation (SaLoRA). Unlike previous LoRA methods and their variants, SaLoRA enables targeted modifications to LLMs without disrupting their original alignments. Our experiments show that SaLoRA outperforms various adapters-based approaches across various evaluation metrics in different fine-tuning tasks.

Social media platforms are experiencing a growing presence of AI-Generated Texts (AIGTs). However, the misuse of AIGTs could have profound implications for public opinion, such as spreading misinformation and manipulating narratives. Despite its importance, a systematic study to assess the prevalence of AIGTs on social media is still lacking. To address this gap, this paper aims to quantify, monitor, and analyze the AIGTs on online social media platforms. We first collect a dataset (SM-D) with around 2.4M posts from 3 major social media platforms: Medium, Quora, and Reddit. Then, we construct a diverse dataset (AIGTBench) to train and evaluate AIGT detectors. AIGTBench combines popular open-source datasets and our AIGT datasets generated from social media texts by 12 LLMs, serving as a benchmark for evaluating mainstream detectors. With this setup, we identify the best-performing detector (OSM-Det). We then apply OSM-Det to SM-D to track AIGTs over time and observe different trends of AI Attribution Rate (AAR) across social media platforms from January 2022 to October 2024. Specifically, Medium and Quora exhibit marked increases in AAR, rising from 1.77% to 37.03% and 2.06% to 38.95%, respectively. In contrast, Reddit shows slower growth, with AAR increasing from 1.31% to 2.45% over the same period. Our further analysis indicates that AIGTs differ from human-written texts across several dimensions, including linguistic patterns, topic distributions, engagement levels, and the follower distribution of authors. We envision our analysis and findings on AIGTs in social media can shed light on future research in this domain., Comment: 24 pages,18 figures

Artificial Intelligence (AI) is pivotal in advancing mobile network systems by facilitating smart capabilities and automation. The transition from 4G to 5G has substantial implications for AI in consolidating a network predominantly geared towards business verticals. In this context, 3GPP has specified and introduced the Network Data Analytics Function (NWDAF) entity at the network's core to provide insights based on AI algorithms to benefit network orchestration. This paper proposes a framework for evolving NWDAF that presents the interfaces necessary to further empower the core network with AI capabilities B5G and 6G. In addition, we identify a set of research directions for realizing a distributed e-NWDAF., Comment: 8 pages

Streaming graphs are ubiquitous in daily life, such as evolving social networks and dynamic communication systems. Due to the sensitive information contained in the graph, directly sharing the streaming graphs poses significant privacy risks. Differential privacy, offering strict theoretical guarantees, has emerged as a standard approach for private graph data synthesis. However, existing methods predominantly focus on static graph publishing, neglecting the intrinsic relationship between adjacent graphs, thereby resulting in limited performance in streaming data publishing scenarios. To address this gap, we propose PSGraph, the first differentially private streaming graph synthesis framework that integrates temporal dynamics. PSGraph adaptively adjusts the privacy budget allocation mechanism by analyzing the variations in the current graph compared to the previous one for conserving the privacy budget. Moreover, PSGraph aggregates information across various timestamps and adopts crucial post-processing techniques to enhance the synthetic streaming graphs. We conduct extensive experiments on four real-world datasets under five commonly used metrics. The experimental results demonstrate the superiority of PSGraph.

This study investigates the radial oscillations of hybrid neutron stars, characterized by a composition of hadronic external layers and a quark matter core. Utilizing a density-dependent relativistic mean-field model that incorporates hyperons and baryons for describing hadronic matter, and a density-dependent quark model for quark matter, we analyze the ten lowest eigenfrequencies and their corresponding oscillation functions. Our focus lies on neutron stars with equations-of-state involving N, N + $\Delta$, N + H, and N + H + $\Delta$, featuring a phase transition to quark matter. Emphasizing the effects of a slow phase transition at the hadron-quark interface, we observe that the maximum mass is attained before the fundamental mode's frequency decreases for slow phase transitions. This observation implies the stability of stellar configurations with higher central densities than the maximum mass, called Slow Stable Hybrid Stars (SSHSs), even under small radial perturbations. The length of these SSHS branch depends upon the energy density jump between two phases and the stiffness of the quark EoS., Comment: Contribution for the conference proceedings of the "10th International Conference on Quarks and Nuclear Physics (QNP 2024)"

Owing to their rapid cooling rate and hence loss-limited propagation distance, cosmic-ray electrons and positrons (CRe) at very high energies probe local cosmic-ray accelerators and provide constraints on exotic production mechanisms such as annihilation of dark matter particles. We present a high-statistics measurement of the spectrum of CRe candidate events from 0.3 to 40 TeV with the High Energy Stereoscopic System (H.E.S.S.), covering two orders of magnitude in energy and reaching a proton rejection power of better than $10^{4}$. The measured spectrum is well described by a broken power law, with a break around 1 TeV, where the spectral index increases from $\Gamma_1 = 3.25$ $\pm$ 0.02 (stat) $\pm$ 0.2 (sys) to $\Gamma_2 = 4.49$ $\pm$ 0.04 (stat) $\pm$ 0.2 (sys). Apart from the break, the spectrum is featureless. The absence of distinct signatures at multi-TeV energies imposes constraints on the presence of nearby CRe accelerators and the local CRe propagation mechanisms., Comment: main paper: 8 pages, 4 figures, supplemental material: 12 pages, 14 figures, accepted for publication in Physical Review Letters https://journals.aps.org/prl/

While open Large Language Models (LLMs) have made significant progress, they still fall short of matching the performance of their closed, proprietary counterparts, making the latter attractive even for the use on highly private data. Recently, various new methods have been proposed to adapt closed LLMs to private data without leaking private information to third parties and/or the LLM provider. In this work, we analyze the privacy protection and performance of the four most recent methods for private adaptation of closed LLMs. By examining their threat models and thoroughly comparing their performance under different privacy levels according to differential privacy (DP), various LLM architectures, and multiple datasets for classification and generation tasks, we find that: (1) all the methods leak query data, i.e., the (potentially sensitive) user data that is queried at inference time, to the LLM provider, (2) three out of four methods also leak large fractions of private training data to the LLM provider while the method that protects private data requires a local open LLM, (3) all the methods exhibit lower performance compared to three private gradient-based adaptation methods for local open LLMs, and (4) the private adaptation methods for closed LLMs incur higher monetary training and query costs than running the alternative methods on local open LLMs. This yields the conclusion that, to achieve truly privacy-preserving LLM adaptations that yield high performance and more privacy at lower costs, taking into account current methods and models, one should use open LLMs., Comment: Accepted at NeurIPS 2024

Most states responded to the onset of the pandemic by temporarily granting teachers Emergency licenses. These licenses allowed teachers to work in classrooms without passing the typical licensure exams. Since then, several states have extended their use of Emergency licenses, raising questions about how these policies impact the composition of the teacher workforce and student outcomes. In this paper, we examine the result of these policies using data on multiple cohorts of Emergency licensed teachers (ELTs) who taught in Massachusetts between 2021 and 2023. We find that ELTs were slightly more likely to remain in the same school and in the teaching workforce than teachers from other entry routes. However, ELTs' students scored significantly lower on standardized tests in math and science than other students in the same school and same year. Our findings are at odds with earlier, more positive assessments of Emergency licensure in Massachusetts. Our updated results appear to be driven by more recent cohorts of ELTs, rather than the teachers who received Emergency licenses at the start of the pandemic. Overall, this study suggests policymakers should be cautious when drawing sweeping conclusions about the impacts of teacher licensure based solely on the earliest cohort of teachers who obtained pandemic-era Emergency licenses.

Departmentalized instruction, in which teachers specialize in one or more core subjects and instruct multiple groups of students in a day, has become increasingly prominent in elementary schools. Using 8 years of data from Massachusetts and a difference-in-differences design, we estimate the effects of departmentalization on student achievement. We find that departmentalization has positive effects in English language arts (ELA) and science and mixed evidence of positive effects in math. These positive effects are not driven by teacher productivity improvements: Consistent with prior findings on teacher specialization, teachers are less effective when specializing in math and no more effective in ELA than when teaching self-contained classrooms. Rather, consistent with the theoretical underpinnings for specialization, departmentalized schools tend to assign teachers to their stronger subjects.

Graduates of special education teacher education programs can teach in a range of special education settings, raising the potential that their training can occur in very different settings than where they find their first jobs. We follow 263 completers of Moderate Disabilities programs in Massachusetts from their field placements to their early-career teaching positions and study the characteristics of their field placements and the degree to which these are aligned with their early-career teaching positions. We also assess the degree to which alignment is associated with early-career teacher turnover. We found that many of these teachers student-taught in an inclusive setting but were hired into a self-contained special education setting and vice versa, and teachers who experienced this misalignment were more likely to leave the workforce early in their careers. Teachers who student taught with a supervising practitioner without a special education license were also more likely to leave early. Findings suggest that teachers training to educate students with learning disabilities should student teach in a setting that is aligned with where they are likely to be hired, and with a supervising practitioner who is trained in special education.

The attractive interaction in conventional BCS superconductors is provided by a bosonic mode. However, the pairing glue of most unconventional superconductors is unknown. The effect of electron-boson coupling is therefore extensively studied in these materials. A key signature are dispersion kinks that can be observed in the spectral function as abrupt changes in velocity and lifetime of quasiparticles. Here, we show the existence of two kinks in the unconventional iron-based superconductor RbFe$_2$As$_2$ using angle-resolved photoemission spectroscopy (ARPES) and dynamical mean field theory (DMFT). In addition, we observe the formation of a Hubbard band multiplet due to the combination of Coulomb interaction and Hund's rule coupling in this multiorbital systems. We demonstrate that the two dispersion kinks are a consequence of these strong many-body interactions. This interpretation is in line with a growing number of theoretical predictions for kinks in various general models of correlated materials. Our results provide a unifying link between iron-based superconductors and different classes of correlated, unconventional superconductors such as cuprates and heavy-fermion materials.

Neutrinoless double beta decay ($0 \nu \beta \beta$) provides a way to probe physics beyond the Standard Model of particle physics. The upcoming nEXO experiment will search for $0\nu\beta\beta$ decay in $^{136}$Xe with a projected half-life sensitivity exceeding $10^{28}$ years at the 90\% confidence level using a liquid xenon (LXe) Time Projection Chamber (TPC) filled with 5 tonnes of Xe enriched to $\sim$90\% in the $\beta \beta$-decaying isotope $^{136}$Xe. In parallel, a potential future upgrade to nEXO is being investigated with the aim to further suppress radioactive backgrounds, and to confirm $\beta \beta$-decay events. This technique, known as Ba-tagging, comprises of extracting and identifying the $\beta \beta$-decay daughter $^{136}$Ba ion. One tagging approach being pursued involves extracting a small volume of LXe in the vicinity of a potential $\beta \beta$-decay using a capillary tube and facilitating a liquid to gas phase transition by heating the capillary exit. The Ba ion is then separated from the accompanying Xe gas using a radio-frequency (RF) carpet and RF funnel, conclusively identifying the ion as $^{136}$Ba via laser-fluorescence spectroscopy and mass spectrometry. Simultaneously, an accelerator-driven Ba ion source is being developed to validate and optimize this technique. The motivation for the project, the development of the different aspects along with current status and results are discussed here.

LiV$_2$O$_4$ is a member of the so-called $3d$ heavy fermion compounds, with effective electron mass exceeding 60 times the free electron mass, comparable to $4f$ heavy fermion compounds. The origin of the strong electron correlation in combination with its metallic character have been a subject of intense theoretical and experimental discussion, with Kondo-like physics and Mott-physics being suggested as its physical origin. Here we report state-of-the art \textit{ab initio} Density Functional Theory + dynamical mean-field theory calculations for LiV$_2$O$_4$ for the full three orbital V $t_\mathrm{2g}$ manifold, and present temperature-dependent spectral properties. We map out the phase diagram for a representative 3-orbital model system as a function of doping and interaction strength, which indicates that LiV$_2$O$_4$ is located between two orbital-selective Mott phases, giving rise to a robust strongly correlated Hund's metal behavior. At low temperature we find the emergence of a strongly renormalized sharp quasi-particle peak a few meV above the Fermi level of V $a_\mathrm{1g}$ character, in agreement with experimental reports., Comment: 6 pages with 4 figures, supplemental 2 pages with 3 figures

Human Pose Estimation (HPE) has been widely applied in autonomous systems such as self-driving cars. However, the potential risks of HPE to adversarial attacks have not received comparable attention with image classification or segmentation tasks. Existing works on HPE robustness focus on misleading an HPE system to provide wrong predictions that still indicate some human poses. In this paper, we study the vulnerability of HPE systems to disappearance attacks, where the attacker aims to subtly alter the HPE training process via backdoor techniques so that any input image with some specific trigger will not be recognized as involving any human pose. As humans are typically at the center of HPE systems, such attacks can induce severe security hazards, e.g., pedestrians' lives will be threatened if a self-driving car incorrectly understands the front scene due to disappearance attacks. To achieve the adversarial goal of disappearance, we propose IntC, a general framework to craft Invisibility Cloak in the HPE domain. The core of our work lies in the design of target HPE labels that do not represent any human pose. In particular, we propose three specific backdoor attacks based on our IntC framework with different label designs. IntC-S and IntC-E, respectively designed for regression- and heatmap-based HPE techniques, concentrate the keypoints of triggered images in a tiny, imperceptible region. Further, to improve the attack's stealthiness, IntC-L designs the target poisons to capture the label outputs of typical landscape images without a human involved, achieving disappearance and reducing detectability simultaneously. Extensive experiments demonstrate the effectiveness and generalizability of our IntC methods in achieving the disappearance goal. By revealing the vulnerability of HPE to disappearance and backdoor attacks, we hope our work can raise awareness of the potential risks ...

Context: PKS 0903-57 is a little-studied gamma-ray blazar which has recently attracted considerable interest due to the strong flaring episodes observed since 2020 in HE (100 MeV < E < 100 GeV) and VHE (100 GeV < E < 10 TeV) gamma-rays. Its nature and properties are still not well determined. In particular, it is unclear whether PKS 0903-57 is a BL Lac or a Flat Spectrum Radio Quasar (FSRQ), while its redshift estimation relies on a possibly misassociated low signal-to-noise spectrum. Aim: We aim to reliably measure the redshift of the blazar and to determine its spectral type and luminosity in the optical range. Methods: We performed spectroscopy of the optical counterpart of the blazar using the South African Large Telescope (SALT) and the Very Large Telescope (VLT) and monitored it photometrically with the Rapid Eye Mount (REM) telescope. Results: We firmly measured the redshift of the blazar as z= 0.2621 +/- 0.0006 thanks to the detection of five narrow optical lines. The detection of a symmetric broad Halpha line with Full Width at Half Maximum (FWHM) of 4020 +/- 30 km/s together with a jet-dominated continuum leads us to classify it as a FSRQ. Finally, we detected with high significance a redshift offset (about 1500 km/s) between the broad line and the host. This is the first time that such an offset is unequivocally detected in a VHE blazar, possibly pointing to a very peculiar accretion configuration, a merging system, or a recoiling Black Hole., Comment: Astronomy and Astrophysics Letters, Accepted

Large vision-language models (LVLMs) have been rapidly developed and widely used in various fields, but the (potential) stereotypical bias in the model is largely unexplored. In this study, we present a pioneering measurement framework, $\texttt{ModSCAN}$, to $\underline{SCAN}$ the stereotypical bias within LVLMs from both vision and language $\underline{Mod}$alities. $\texttt{ModSCAN}$ examines stereotypical biases with respect to two typical stereotypical attributes (gender and race) across three kinds of scenarios: occupations, descriptors, and persona traits. Our findings suggest that 1) the currently popular LVLMs show significant stereotype biases, with CogVLM emerging as the most biased model; 2) these stereotypical biases may stem from the inherent biases in the training dataset and pre-trained models; 3) the utilization of specific prompt prefixes (from both vision and language modalities) performs well in reducing stereotypical biases. We believe our work can serve as the foundation for understanding and addressing stereotypical bias in LVLMs., Comment: Accepted in EMNLP 2024. 29 pages, 22 figures

Recent work on studying memorization in self-supervised learning (SSL) suggests that even though SSL encoders are trained on millions of images, they still memorize individual data points. While effort has been put into characterizing the memorized data and linking encoder memorization to downstream utility, little is known about where the memorization happens inside SSL encoders. To close this gap, we propose two metrics for localizing memorization in SSL encoders on a per-layer (layermem) and per-unit basis (unitmem). Our localization methods are independent of the downstream task, do not require any label information, and can be performed in a forward pass. By localizing memorization in various encoder architectures (convolutional and transformer-based) trained on diverse datasets with contrastive and non-contrastive SSL frameworks, we find that (1) while SSL memorization increases with layer depth, highly memorizing units are distributed across the entire encoder, (2) a significant fraction of units in SSL encoders experiences surprisingly high memorization of individual data points, which is in contrast to models trained under supervision, (3) atypical (or outlier) data points cause much higher layer and unit memorization than standard data points, and (4) in vision transformers, most memorization happens in the fully-connected layers. Finally, we show that localizing memorization in SSL has the potential to improve fine-tuning and to inform pruning strategies., Comment: Accepted at NeurIPS 2024

Large language models (LLMs) have shown considerable success in a range of domain-specific tasks, especially after fine-tuning. However, fine-tuning with real-world data usually leads to privacy risks, particularly when the fine-tuning samples exist in the pre-training data. To avoid the shortcomings of real data, developers often employ methods to automatically generate synthetic data for fine-tuning, as data generated by traditional models are often far away from the real-world pertaining data. However, given the advanced capabilities of LLMs, the distinction between real data and LLM-generated data has become negligible, which may also lead to privacy risks like real data. In this paper, we present an empirical analysis of this underexplored issue by investigating a key question: "Does fine-tuning with LLM-generated data enhance privacy, or does it pose additional privacy risks?" Based on the structure of LLM's generated data, our research focuses on two primary approaches to fine-tuning with generated data: supervised fine-tuning with unstructured generated data and self-instruct tuning. The number of successful Personal Information Identifier (PII) extractions for Pythia after fine-tuning our generated data raised over $20\%$. Furthermore, the ROC-AUC score of membership inference attacks for Pythia-6.9b after self-instruct methods also achieves more than $40\%$ improvements on ROC-AUC score than base models. The results indicate the potential privacy risks in LLMs when fine-tuning with the generated data.

Machine learning has revolutionized numerous domains, playing a crucial role in driving advancements and enabling data-centric processes. The significance of data in training models and shaping their performance cannot be overstated. Recent research has highlighted the heterogeneous impact of individual data samples, particularly the presence of valuable data that significantly contributes to the utility and effectiveness of machine learning models. However, a critical question remains unanswered: are these valuable data samples more vulnerable to machine learning attacks? In this work, we investigate the relationship between data importance and machine learning attacks by analyzing five distinct attack types. Our findings reveal notable insights. For example, we observe that high importance data samples exhibit increased vulnerability in certain attacks, such as membership inference and model stealing. By analyzing the linkage between membership inference vulnerability and data importance, we demonstrate that sample characteristics can be integrated into membership metrics by introducing sample-specific criteria, therefore enhancing the membership inference performance. These findings emphasize the urgent need for innovative defense mechanisms that strike a balance between maximizing utility and safeguarding valuable data against potential exploitation., Comment: To Appear in Network and Distributed System Security (NDSS) Symposium 2025

Adapting Large Language Models (LLMs) to specific tasks introduces concerns about computational efficiency, prompting an exploration of efficient methods such as In-Context Learning (ICL). However, the vulnerability of ICL to privacy attacks under realistic assumptions remains largely unexplored. In this work, we present the first membership inference attack tailored for ICL, relying solely on generated texts without their associated probabilities. We propose four attack strategies tailored to various constrained scenarios and conduct extensive experiments on four popular large language models. Empirical results show that our attacks can accurately determine membership status in most cases, e.g., 95\% accuracy advantage against LLaMA, indicating that the associated risks are much higher than those shown by existing probability-based attacks. Additionally, we propose a hybrid attack that synthesizes the strengths of the aforementioned strategies, achieving an accuracy advantage of over 95\% in most cases. Furthermore, we investigate three potential defenses targeting data, instruction, and output. Results demonstrate combining defenses from orthogonal dimensions significantly reduces privacy leakage and offers enhanced privacy assurances., Comment: To Appear in the ACM Conference on Computer and Communications Security, October 14-18, 2024

Text-to-image models, such as Stable Diffusion (SD), undergo iterative updates to improve image quality and address concerns such as safety. Improvements in image quality are straightforward to assess. However, how model updates resolve existing concerns and whether they raise new questions remain unexplored. This study takes an initial step in investigating the evolution of text-to-image models from the perspectives of safety, bias, and authenticity. Our findings, centered on Stable Diffusion, indicate that model updates paint a mixed picture. While updates progressively reduce the generation of unsafe images, the bias issue, particularly in gender, intensifies. We also find that negative stereotypes either persist within the same Non-White race group or shift towards other Non-White race groups through SD updates, yet with minimal association of these traits with the White race group. Additionally, our evaluation reveals a new concern stemming from SD updates: State-of-the-art fake image detectors, initially trained for earlier SD versions, struggle to identify fake images generated by updated versions. We show that fine-tuning these detectors on fake images generated by updated versions achieves at least 96.6\% accuracy across various SD versions, addressing this issue. Our insights highlight the importance of continued efforts to mitigate biases and vulnerabilities in evolving text-to-image models., Comment: To Appear in the ACM Conference on Computer and Communications Security, October 14-18, 2024

Direct redshift determination of BL Lac objects is highly challenging as the emission in the optical and near-infrared (NIR) bands is largely dominated by the non-thermal emission from the relativistic jet that points very close to our line of sight. Therefore, their optical spectra often show no emission lines from the host galaxy. In this work, we aim to overcome this difficulty by attempting to detect the host galaxy and derive redshift constraints based on assumptions on the galaxy magnitude ("imaging redshifts"). Imaging redshifts are derived by obtaining deep optical images under good seeing conditions, so that it is possible to detect the host galaxy as weak extension of the point-like source. We then derive the imaging redshift by using the host galaxy as a standard candle using two different methods. We determine imaging redshift for 9 out of 17 blazars that we observed as part of this program. The redshift range of these targets is 0.28-0.60 and the two methods used to derive the redshift give very consistent results within the uncertainties. We also performed a detailed comparison of the imaging redshifts with those obtained by other methods, like direct spectroscopic constraints or looking for groups of galaxies close to the blazar. We show that the constraints from different methods are consistent and that for example in the case of J2156.0+1818, which is the most distant source for which we detect the host galaxy, combining the three constraints narrows down the redshift to $0.63

Rydberg atom electric field sensors are tunable quantum sensors that can perform sensitive radio frequency (RF) measurements. Their qualities have piqued interest at longer wavelengths where their small size compares favorably to impedance-matched antennas. Here, we compare the signal detection sensitivity of cm-scale Rydberg sensors to similarly sized room-temperature electrically small antennas with active and passive receiver backends. We present and analyze effective circuit models for each sensor type, facilitating a fair sensitivity comparison for cm-scale sensors. We calculate that contemporary Rydberg sensor implementations are less sensitive than unmatched antennas with active amplification. However, we find that idealized Rydberg sensors operating with a maximized atom number and at the standard quantum limit may perform well beyond the capabilities of antenna-based sensors at room temperature, the sensitivities of both lying below typical atmospheric background noise., Comment: 6 pages, 3 figures

Despite being prevalent in the general field of Natural Language Processing (NLP), pre-trained language models inherently carry privacy and copyright concerns due to their nature of training on large-scale web-scraped data. In this paper, we pioneer a systematic exploration of such risks associated with pre-trained language encoders, specifically focusing on the membership leakage of pre-training data exposed through downstream models adapted from pre-trained language encoders-an aspect largely overlooked in existing literature. Our study encompasses comprehensive experiments across four types of pre-trained encoder architectures, three representative downstream tasks, and five benchmark datasets. Intriguingly, our evaluations reveal, for the first time, the existence of membership leakage even when only the black-box output of the downstream model is exposed, highlighting a privacy risk far greater than previously assumed. Alongside, we present in-depth analysis and insights toward guiding future researchers and practitioners in addressing the privacy considerations in developing pre-trained language models., Comment: ECAI24

The increasing cost of training machine learning (ML) models has led to the inclusion of new parties to the training pipeline, such as users who contribute training data and companies that provide computing resources. This involvement of such new parties in the ML training process has introduced new attack surfaces for an adversary to exploit. A recent attack in this domain is the model hijacking attack, whereby an adversary hijacks a victim model to implement their own -- possibly malicious -- hijacking tasks. However, the scope of the model hijacking attack is so far limited to the homogeneous-modality tasks. In this paper, we transform the model hijacking attack into a more general multimodal setting, where the hijacking and original tasks are performed on data of different modalities. Specifically, we focus on the setting where an adversary implements a natural language processing (NLP) hijacking task into an image classification model. To mount the attack, we propose a novel encoder-decoder based framework, namely the Blender, which relies on advanced image and language models. Experimental results show that our modal hijacking attack achieves strong performances in different settings. For instance, our attack achieves 94%, 94%, and 95% attack success rate when using the Sogou news dataset to hijack STL10, CIFAR-10, and MNIST classifiers.

Recently, autonomous agents built on large language models (LLMs) have experienced significant development and are being deployed in real-world applications. These agents can extend the base LLM's capabilities in multiple ways. For example, a well-built agent using GPT-3.5-Turbo as its core can outperform the more advanced GPT-4 model by leveraging external components. More importantly, the usage of tools enables these systems to perform actions in the real world, moving from merely generating text to actively interacting with their environment. Given the agents' practical applications and their ability to execute consequential actions, it is crucial to assess potential vulnerabilities. Such autonomous systems can cause more severe damage than a standalone language model if compromised. While some existing research has explored harmful actions by LLM agents, our study approaches the vulnerability from a different perspective. We introduce a new type of attack that causes malfunctions by misleading the agent into executing repetitive or irrelevant actions. We conduct comprehensive evaluations using various attack methods, surfaces, and properties to pinpoint areas of susceptibility. Our experiments reveal that these attacks can induce failure rates exceeding 80\% in multiple scenarios. Through attacks on implemented and deployable agents in multi-agent scenarios, we accentuate the realistic risks associated with these vulnerabilities. To mitigate such attacks, we propose self-examination detection methods. However, our findings indicate these attacks are difficult to detect effectively using LLMs alone, highlighting the substantial risks associated with this vulnerability.

We establish three variational principles for the upper metric mean dimension with potential of level sets of continuous maps in terms of the entropy of partitions and Katok's entropy of the underlying system. Our results hold for dynamical systems exhibiting the specification property. Moreover, we apply our results to study the metric mean dimension of suspension flows.

The Tarantula Nebula in the Large Magellanic Cloud is known for its high star formation activity. At its center lies the young massive star cluster R136, providing a significant amount of the energy that makes the nebula shine so brightly at many wavelengths. Recently, young massive star clusters have been suggested to also efficiently produce high-energy cosmic rays, potentially beyond PeV energies. Here, we report the detection of very-high-energy $\gamma$-ray emission from the direction of R136 with the High Energy Stereoscopic System, achieved through a multicomponent, likelihood-based modeling of the data. This supports the hypothesis that R136 is indeed a very powerful cosmic-ray accelerator. Moreover, from the same analysis, we provide an updated measurement of the $\gamma$-ray emission from 30 Dor C, the only superbubble detected at TeV energies presently. The $\gamma$-ray luminosity above $0.5\,\mathrm{TeV}$ of both sources is $(2-3)\times 10^{35}\,\mathrm{erg}\,\mathrm{s}^{-1}$. This exceeds by more than a factor of 2 the luminosity of HESS J1646$-$458, which is associated with the most massive young star cluster in the Milky Way, Westerlund 1. Furthermore, the $\gamma$-ray emission from each source is extended with a significance of $>3\sigma$ and a Gaussian width of about $30\,\mathrm{pc}$. For 30 Dor C, a connection between the $\gamma$-ray emission and the nonthermal X-ray emission appears likely. Different interpretations of the $\gamma$-ray signal from R136 are discussed., Comment: 10+11 pages, 4+6 figures. Corresponding authors: L. Mohrmann, N. Komin

The effect of thermal surface cleaning on the Gilbert damping, $\alpha$, of yttrium iron garnet (YIG), before capping with a metallic layer, has been investigated. Our results show that $\alpha$ is strongly effected by relatively mild annealing conditions (T = 300 C) when performed in a vacuum. This increase needs to be taken into account when obtaining the spin mixing conductance from spin pumping measurements. We measure an increase in $\alpha$ by a factor of 8 when the YIG is vacuum annealed at 300 C. No such changes in $\alpha$ are observed when annealed at the same temperature in 0.1 mbar of oxygen., Comment: 5 page, 4 figures

Productivity in Research (PQ) is a scholarship granted by CNPq (Brazilian National Council for Scientific and Technological Development). This scholarship aims to recognize a few selected faculty researchers for their scientific production, outstanding technology and innovation in their respective areas of knowledge. In the present study, we evaluated the scientific production of the 185 researchers in the Computer Science area granted with PQ scholarship in the last PQ selection notice. To evaluate the productivity of each professor, we considered papers published in scientific journals and conferences (complete works) in a five years period (from 2017 to 2021). We analyzed the productivity in terms of both quantity and quality. We also evaluated its distribution over the country, universities and research facilities, as well as, the co-authorship network produced., Comment: 15 pages, 14 figures

In-context learning (ICL) is a recent advancement in the capabilities of large language models (LLMs). This feature allows users to perform a new task without updating the model. Concretely, users can address tasks during the inference time by conditioning on a few input-label pair demonstrations along with the test input. It is different than the conventional fine-tuning paradigm and offers more flexibility. However, this capability also introduces potential issues. For example, users may use the model on any data without restriction, such as performing tasks with improper or sensitive content, which might violate the model policy or conflict with the model owner's interests. As a model owner, it is crucial to establish a mechanism to control the model's behavior under ICL, depending on the model owner's requirements for various content. To this end, we introduce the concept of "applicability authorization" tailored for LLMs, particularly for ICL behavior, and propose a simple approach, ICLGuard. It is a fine-tuning framework designed to allow the model owner to regulate ICL behavior on different data. ICLGuard preserves the original LLM and fine-tunes only a minimal set of additional trainable parameters to "guard" the LLM. Empirical results show that the guarded LLM can deactivate its ICL ability on target data without affecting its ICL ability on other data and its general functionality across all data.

Open-source large language models (LLMs) have become increasingly popular among both the general public and industry, as they can be customized, fine-tuned, and freely used. However, some open-source LLMs require approval before usage, which has led to third parties publishing their own easily accessible versions. Similarly, third parties have been publishing fine-tuned or quantized variants of these LLMs. These versions are particularly appealing to users because of their ease of access and reduced computational resource demands. This trend has increased the risk of training time attacks, compromising the integrity and security of LLMs. In this work, we present a new training time attack, SOS, which is designed to be low in computational demand and does not require clean data or modification of the model weights, thereby maintaining the model's utility intact. The attack addresses security issues in various scenarios, including the backdoor attack, jailbreak attack, and prompt stealing attack. Our experimental findings demonstrate that the proposed attack is effective across all evaluated targets. Furthermore, we present the other side of our SOS technique, namely the copyright token -- a novel technique that enables users to mark their copyrighted content and prevent models from using it.

PSR B1259-63 is a gamma-ray binary system that hosts a pulsar in an eccentric orbit, with a 3.4 year period, around an O9.5Ve star. At orbital phases close to periastron passages, the system radiates bright and variable non-thermal emission. We report on an extensive VHE observation campaign conducted with the High Energy Stereoscopic System, comprised of ~100 hours of data taken from $t_p-24$ days to $t_p+127$ days around the system's 2021 periastron passage. We also present the timing and spectral analyses of the source. The VHE light curve in 2021 is consistent with the stacked light curve of all previous observations. Within the light curve, we report a VHE maximum at times coincident with the third X-ray peak first detected in the 2021 X-ray light curve. In the light curve -- although sparsely sampled in this time period -- we see no VHE enhancement during the second disc crossing. In addition, we see no correspondence to the 2021 GeV flare in the VHE light curve. The VHE spectrum obtained from the analysis of the 2021 dataset is best described by a power law of spectral index $\Gamma = 2.65 \pm 0.04_{\text{stat}}$ $\pm 0.04_{\text{sys}}$, a value consistent with the previous H.E.S.S. observations of the source. We report spectral variability with a difference of $\Delta \Gamma = 0.56 ~\pm~ 0.18_{\text{stat}}$ $~\pm~0.10_{\text{sys}}$ at 95% c.l., between sub-periods of the 2021 dataset. We also find a linear correlation between contemporaneous flux values of X-ray and TeV datasets, detected mainly after $t_p+25$ days, suggesting a change in the available energy for non-thermal radiation processes. We detect no significant correlation between GeV and TeV flux points, within the uncertainties of the measurements, from $\sim t_p-23$ days to $\sim t_p+126$ days. This suggests that the GeV and TeV emission originate from different electron populations., Comment: accepted to A&A

We present a characterization of $(\mu,\nu)$-dichotomies in terms of the admissibility of certain pairs of weighted spaces for nonautonomous discrete time dynamics acting on Banach spaces. Our general framework enables us to treat various settings in which no similar result has been previously obtained as well as to recover and refine several known results. We emphasize that our results hold without any bounded growth assumption and the statements make no use of Lyapunov norms. Moreover, as a consequence of our characterization, we study the robustness of $(\mu, \nu)$-dichotomies, i.e. we show that this notion persists under small but very general linear perturbations.

Recently, the concept of artificial assistants has evolved from science fiction into real-world applications. GPT-4o, the newest multimodal large language model (MLLM) across audio, vision, and text, has further blurred the line between fiction and reality by enabling more natural human-computer interactions. However, the advent of GPT-4o's voice mode may also introduce a new attack surface. In this paper, we present the first systematic measurement of jailbreak attacks against the voice mode of GPT-4o. We show that GPT-4o demonstrates good resistance to forbidden questions and text jailbreak prompts when directly transferring them to voice mode. This resistance is primarily due to GPT-4o's internal safeguards and the difficulty of adapting text jailbreak prompts to voice mode. Inspired by GPT-4o's human-like behaviors, we propose VoiceJailbreak, a novel voice jailbreak attack that humanizes GPT-4o and attempts to persuade it through fictional storytelling (setting, character, and plot). VoiceJailbreak is capable of generating simple, audible, yet effective jailbreak prompts, which significantly increases the average attack success rate (ASR) from 0.033 to 0.778 in six forbidden scenarios. We also conduct extensive experiments to explore the impacts of interaction steps, key elements of fictional writing, and different languages on VoiceJailbreak's effectiveness and further enhance the attack performance with advanced fictional writing techniques. We hope our study can assist the research community in building more secure and well-regulated MLLMs.

Mainstream compilers implement different countermeasures to prevent specific classes of speculative execution attacks. Unfortunately, these countermeasures either lack formal guarantees or come with proofs restricted to speculative semantics capturing only a subset of the speculation mechanisms supported by modern CPUs, thereby limiting their practical applicability. Ideally, these security proofs should target a speculative semantics capturing the effects of all speculation mechanisms implemented in modern CPUs. However, this is impractical and requires new secure compilation proofs to support additional speculation mechanisms. In this paper, we address this problem by proposing a novel secure compilation framework that allows lifting the security guarantees provided by Spectre countermeasures from weaker speculative semantics (ignoring some speculation mechanisms) to stronger ones (accounting for the omitted mechanisms) without requiring new secure compilation proofs. Using our lifting framework, we performed the most comprehensive security analysis of Spectre countermeasures implemented in mainstream compilers to date. Our analysis spans 9 different countermeasures against 5 classes of Spectre attacks, which we proved secure against a speculative semantics accounting for five different speculation mechanisms.

A graph neural network (GNN) is a type of neural network that is specifically designed to process graph-structured data. Typically, GNNs can be implemented in two settings, including the transductive setting and the inductive setting. In the transductive setting, the trained model can only predict the labels of nodes that were observed at the training time. In the inductive setting, the trained model can be generalized to new nodes/graphs. Due to its flexibility, the inductive setting is the most popular GNN setting at the moment. Previous work has shown that transductive GNNs are vulnerable to a series of privacy attacks. However, a comprehensive privacy analysis of inductive GNN models is still missing. This paper fills the gap by conducting a systematic privacy analysis of inductive GNNs through the lens of link stealing attacks, one of the most popular attacks that are specifically designed for GNNs. We propose two types of link stealing attacks, i.e., posterior-only attacks and combined attacks. We define threat models of the posterior-only attacks with respect to node topology and the combined attacks by considering combinations of posteriors, node attributes, and graph features. Extensive evaluation on six real-world datasets demonstrates that inductive GNNs leak rich information that enables link stealing attacks with advantageous properties. Even attacks with no knowledge about graph structures can be effective. We also show that our attacks are robust to different node similarities and different graph features. As a counterpart, we investigate two possible defenses and discover they are ineffective against our attacks, which calls for more effective defenses., Comment: To appear in the 24th Privacy Enhancing Technologies Symposium (PETS 2024), July 15-20, 2024

With the advent of text-to-image models and concerns about their misuse, developers are increasingly relying on image safety classifiers to moderate their generated unsafe images. Yet, the performance of current image safety classifiers remains unknown for both real-world and AI-generated images. In this work, we propose UnsafeBench, a benchmarking framework that evaluates the effectiveness and robustness of image safety classifiers, with a particular focus on the impact of AI-generated images on their performance. First, we curate a large dataset of 10K real-world and AI-generated images that are annotated as safe or unsafe based on a set of 11 unsafe categories of images (sexual, violent, hateful, etc.). Then, we evaluate the effectiveness and robustness of five popular image safety classifiers, as well as three classifiers that are powered by general-purpose visual language models. Our assessment indicates that existing image safety classifiers are not comprehensive and effective enough to mitigate the multifaceted problem of unsafe images. Also, there exists a distribution shift between real-world and AI-generated images in image qualities, styles, and layouts, leading to degraded effectiveness and robustness. Motivated by these findings, we build a comprehensive image moderation tool called PerspectiveVision, which addresses the main drawbacks of existing classifiers with improved effectiveness and robustness, especially on AI-generated images. UnsafeBench and PerspectiveVision can aid the research community in better understanding the landscape of image safety classification in the era of generative AI.

The onset of the pandemic in spring 2020 substantially disrupted routes into teaching and offered a unique opportunity to study this process with different requirements for initial entry into the classroom. We examine the impacts of the Temporary Certificate of Eligibility (Temporary CE), which allowed teacher candidates in New Jersey to enter the workforce before completing assessment and performance requirements. Relative to the novice teacher workforce before the pandemic, Temporary CE teachers were substantially more diverse without any significant effects on teacher performance or student test scores. However, Temporary CE holders were less likely to remain in the same school or in the New Jersey teaching workforce between 2020-21 and 2021-22. Although Temporary CE holders disproportionately entered through alternate routes into teaching, these patterns hold for both traditional- and alternate-route entrants.

Given math's importance, states are adopting a range of K12 policies to improve math outcomes. As these and other policies unfold, policymakers need to monitor intended outcomes and ultimately gauge impact. They need answers to basic questions: Are more students taking and passing algebra and advanced math? Are performance gaps changing between student groups or schools? What are the characteristics of our math teachers? Are they changing? How are math teachers with different characteristics distributed across schools and students? Policymakers also need answers to more complex questions: Did a given policy have an effect? If so, why, under what conditions, and for whom? Were there any unintended consequences? With these kinds of questions in mind, this CALDER brief singles out the value of longitudinal, individual-level state administrative data by reviewing questions that can--and can't--be answered by the more limited data made publicly available by states. To illustrate, we focus on three states that are attempting to improve math outcomes and that enroll large numbers of students from historically marginalized student groups: California, Florida, and Texas.