Search

Deep neural networks (DNNs) have long been recognized as vulnerable to backdoor attacks. By providing poisoned training data in the fine-tuning process, the attacker can implant a backdoor into the victim model. This enables input samples meeting specific textual trigger patterns to be classified as target labels of the attacker's choice. While such black-box attacks have been well explored in both computer vision and natural language processing (NLP), backdoor attacks relying on white-box attack philosophy have hardly been thoroughly investigated. In this paper, we take the first step to introduce a new type of backdoor attack that conceals itself within the underlying model architecture. Specifically, we propose to design separate backdoor modules consisting of two functions: trigger detection and noise injection. The add-on modules of model architecture layers can detect the presence of input trigger tokens and modify layer weights using Gaussian noise to disturb the feature distribution of the baseline model. We conduct extensive experiments to evaluate our attack methods using two model architecture settings on five different large language datasets. We demonstrate that the training-free architectural backdoor on a large language model poses a genuine threat. Unlike the-state-of-art work, it can survive the rigorous fine-tuning and retraining process, as well as evade output probability-based defense methods (i.e. BDDR). All the code and data is available https://github.com/SiSL-URI/Arch_Backdoor_LLM.

Backdoor attacks pose a significant threat when using third-party data for deep learning development. In these attacks, data can be manipulated to cause a trained model to behave improperly when a specific trigger pattern is applied, providing the adversary with unauthorized advantages. While most existing works focus on designing trigger patterns in both visible and invisible to poison the victim class, they typically result in a single targeted class upon the success of the backdoor attack, meaning that the victim class can only be converted to another class based on the adversary predefined value. In this paper, we address this issue by introducing a novel sample-specific multi-targeted backdoor attack, namely NoiseAttack. Specifically, we adopt White Gaussian Noise (WGN) with various Power Spectral Densities (PSD) as our underlying triggers, coupled with a unique training strategy to execute the backdoor attack. This work is the first of its kind to launch a vision backdoor attack with the intent to generate multiple targeted classes with minimal input configuration. Furthermore, our extensive experimental results demonstrate that NoiseAttack can achieve a high attack success rate against popular network architectures and datasets, as well as bypass state-of-the-art backdoor detection methods. Our source code and experiments are available at https://github.com/SiSL-URI/NoiseAttack/tree/main.

Emerging in recent years, open edge computing platforms (OECPs) claim large-scale edge nodes, the extensive usage and adoption, as well as the openness to any third parties to join as edge nodes. For instance, OneThingCloud, a major OECP operated in China, advertises 5 million edge nodes, 70TB bandwidth, and 1,500PB storage. However, little information is publicly available for such OECPs with regards to their technical mechanisms and involvement in edge computing activities. Furthermore, different from known edge computing paradigms, OECPs feature an open ecosystem wherein any third party can participate as edge nodes and earn revenue for the contribution of computing and bandwidth resources, which, however, can introduce byzantine or even malicious edge nodes and thus break the traditional threat model for edge computing. In this study, we conduct the first empirical study on two representative OECPs, which is made possible through the deployment of edge nodes across locations, the efficient and semi-automatic analysis of edge traffic as well as the carefully designed security experiments. As the results, a set of novel findings and insights have been distilled with regards to their technical mechanisms, the landscape of edge nodes, the usage and adoption, and the practical security/privacy risks. Particularly, millions of daily active edge nodes have been observed, which feature a wide distribution in the network space and the extensive adoption in content delivery towards end users of 16 popular Internet services. Also, multiple practical and concerning security risks have been identified along with acknowledgements received from relevant parties, e.g., the exposure of long-term and cross-edge-node credentials, the co-location with malicious activities of diverse categories, the failures of TLS certificate verification, the extensive information leakage against end users, etc.

Despite achieving good performance and wide adoption, machine learning based security detection models (e.g., malware classifiers) are subject to concept drift and evasive evolution of attackers, which renders up-to-date threat data as a necessity. However, due to enforcement of various privacy protection regulations (e.g., GDPR), it is becoming increasingly challenging or even prohibitive for security vendors to collect individual-relevant and privacy-sensitive threat datasets, e.g., SMS spam/non-spam messages from mobile devices. To address such obstacles, this study systematically profiles the (in)feasibility of federated learning for privacy-preserving cyber threat detection in terms of effectiveness, byzantine resilience, and efficiency. This is made possible by the build-up of multiple threat datasets and threat detection models, and more importantly, the design of realistic and security-specific experiments. We evaluate FL on two representative threat detection tasks, namely SMS spam detection and Android malware detection. It shows that FL-trained detection models can achieve a performance that is comparable to centrally trained counterparts. Also, most non-IID data distributions have either minor or negligible impact on the model performance, while a label-based non-IID distribution of a high extent can incur non-negligible fluctuation and delay in FL training. Then, under a realistic threat model, FL turns out to be adversary-resistant to attacks of both data poisoning and model poisoning. Particularly, the attacking impact of a practical data poisoning attack is no more than 0.14\% loss in model accuracy. Regarding FL efficiency, a bootstrapping strategy turns out to be effective to mitigate the training delay as observed in label-based non-IID scenarios.

Photodetectors that are sensitive in shortwave infrared (SWIR) range (1 um - 2 um) are of significant interest for applications in 3D, night and adverse weather imaging, machine vision and autonomous driving, among others. Currently available technologies in the SWIR rely on costly epitaxial semiconductors that are not monolithically integrated with CMOS electronics. Solution-processed quantum dots can address this challenge by enabling low-cost manufacturing and simple monolithic integration on silicon in a back-end-of-line (BEOL) process. To date, colloidal quantum dot (CQD) materials to access the SWIR are mostly based on lead sulfide (PbS) and mercury telluride (HgTe) compounds, imposing major regulatory concerns and impeding their deployment in consumer electronics due to toxicity concerns. Here we report a new synthesis method for environmentally-friendly silver telluride (Ag2Te) quantum dots and their application in high-performance SWIR photodetectors. The CQD photodetector stack employs materials compliant with the Restriction of Hazardous Substance (RoHS) directives and is sensitive in the spectral range from 350 nm - 1600 nm. The room-temperature detectivity is of the order 1012 Jones, the 3dB bandwidth is in excess of 0.1 MHz and the linear dynamic range is over 118 dB. We also realize a monolithically integrated SWIR imager based on solution processed, heavy-metal-free materials, thus paving the way of this technology to consumer electronics market.

We present the vector, scalar and tensor renormalization constants (RCs) using overlap fermions with either regularization independent momentum subtraction (RI/MOM) or symmetric momentum subtraction (RI/SMOM) as the intermediate scheme on the lattice with lattice spacings $a$ from 0.04 fm to 0.12 fm. Our gauge field configurations from the MILC and RBC/UKQCD collaborations include sea quarks using either the domain wall or the HISQ action, respectively. The results show that RI/MOM and RI/SMOM can provide consistent renormalization constants to the $\overline{\textrm{MS}}$ scheme, after proper $a^2p^2$ extrapolations. But at $p\sim 2$\,GeV, both RI/MOM and RI/SMOM suffer from nonperturbative effects which cannot be removed by the perturbative matching. The comparison between the results with different sea actions also suggests that the renormalization constant is discernibly sensitive to the lattice spacing but not to the bare gauge coupling in the gauge action., Comment: 25 pages, 20 figures; Version accepted for publication in PRD

We compute the overlap Dirac spectrum on three ensembles generated using 2+1 flavor domain wall fermions. The spectral density is determined up to $\lambda\sim$100 MeV with sub-percentage statistical uncertainty. The three ensembles have different lattice spacings and two of them have quark masses tuned to the physical point. We show that we can resolve the flavor content of the sea quarks and constrain their masses using the Dirac spectral density. We find that the density is close to a constant below $\lambda\le$ 20 MeV (but 10\% higher than that in the 2-flavor chiral limit) as predicted by chiral perturbative theory ($\chi$PT), and then increases linearly due to the strange quark mass. Using the next to leading order $\chi$PT, one can extract the light and strange quark masses with $\sim$20\% uncertainties. Using the non-perturbative RI/MOM renormalization, we obtain the chiral condensates at $\overline{\textrm{MS}}$ 2 GeV as $\Sigma=(260.3(0.7)(1.3)(0.7)(0.8)\ \textrm{MeV})^3$ in the $N_f=2$ (keeping the strange quark mass at the physical point) chiral limit and $\Sigma_0=(232.6(0.9)(1.2)(0.7)(0.8)\ \textrm{MeV})^3$ in the $N_f=3$ chiral limit, where the four uncertainties come from the statistical fluctuation, renormalization constant, continuum extrapolation and lattice spacing determination. Note that {$\Sigma/\Sigma_0=1.40(2)(2)$ is much larger than 1} due to the strange quark mass effect., Comment: 10 pages, 6 figures