Search

Epitaxially grown InAs NWs are relevant for electrical sensing applications due to Fermi level pinning at NW surface, thus very sensitive to surrounding environment. While a single NW growth batch consists of millions virtually identical replicas of the same NW, real samples display subtle differences in NW size, shape, structure which may affect the detection performance. Here, electrical gas detection is investigated the in two NW-based nominally identical or twin devices fabricated starting from the same NW growth batch. Two individual wurtzite InAs NWs are placed onto a fabrication substrate at 2 micrometers distance with 90 degrees relative orientation, each NW is electrically contacted, and the nanodevices are exposed to humidity and NO$_2$ flux diluted in synthetic air. Electrical signal versus time is measured simultaneously in each nanodevice, upon different gases and concentrations. Observed detection limit is 2 ppm for NO$_2$, 20% for relative humidity. Correlation analysis method is exploited by calculating auto- and cross-correlation functions for the experimental signal pairs, indicating lack of cross-correlation in the signal noise of the two nanodevices, suggesting that signal differences could be ascribed mainly to nonidealities of fabrication protocol and nanoscopic differences in the two nanostructures, rather than different environmental conditions., Comment: 25 pages

Recent work has proposed neural network pruning techniques to reduce the size of a network while preserving robustness against adversarial examples, i.e., well-crafted inputs inducing a misclassification. These methods, which we refer to as adversarial pruning methods, involve complex and articulated designs, making it difficult to analyze the differences and establish a fair and accurate comparison. In this work, we overcome these issues by surveying current adversarial pruning methods and proposing a novel taxonomy to categorize them based on two main dimensions: the pipeline, defining when to prune; and the specifics, defining how to prune. We then highlight the limitations of current empirical analyses and propose a novel, fair evaluation benchmark to address them. We finally conduct an empirical re-evaluation of current adversarial pruning methods and discuss the results, highlighting the shared traits of top-performing adversarial pruning methods, as well as common issues. We welcome contributions in our publicly-available benchmark at https://github.com/pralab/AdversarialPruningBenchmark

Gradient-based attacks are a primary tool to evaluate robustness of machine-learning models. However, many attacks tend to provide overly-optimistic evaluations as they use fixed loss functions, optimizers, step-size schedulers, and default hyperparameters. In this work, we tackle these limitations by proposing a parametric variation of the well-known fast minimum-norm attack algorithm, whose loss, optimizer, step-size scheduler, and hyperparameters can be dynamically adjusted. We re-evaluate 12 robust models, showing that our attack finds smaller adversarial perturbations without requiring any additional tuning. This also enables reporting adversarial robustness as a function of the perturbation budget, providing a more complete evaluation than that offered by fixed-budget attacks, while remaining efficient. We release our open-source code at https://github.com/pralab/HO-FMN.

Motivated by the superior performance of deep learning in many applications including computer vision and natural language processing, several recent studies have focused on applying deep neural network for devising future generations of wireless networks. However, several recent works have pointed out that imperceptible and carefully designed adversarial examples (attacks) can significantly deteriorate the classification accuracy. In this paper, we investigate a defense mechanism based on both training-time and run-time defense techniques for protecting machine learning-based radio signal (modulation) classification against adversarial attacks. The training-time defense consists of adversarial training and label smoothing, while the run-time defense employs a support vector machine-based neural rejection (NR). Considering a white-box scenario and real datasets, we demonstrate that our proposed techniques outperform existing state-of-the-art technologies., Comment: Published in IEEE Wireless Communications Letters, vol. 11, no. 6, pp. 1161-1165, June 2022

Achieving stable, high-quality quantum dots has proven challenging within device architectures rooted in conventional solid-state device fabrication paradigms. In fact, these are grappled with complex protocols in order to balance ease of realization, scalability, and quantum transport properties. Here, we demonstrate a novel paradigm of semiconductor quantum dot engineering by exploiting ion gating. Our approach is found to enable the realization and control of a novel quantum dot system: the iontronic quantum dot. Clear Coulomb blockade peaks and their dependence on an externally applied magnetic field are reported, together with the impact of device architecture and confinement potential on quantum dot quality. Devices incorporating two identical quantum dots in series are realized, addressing the reproducibility of the developed approach. The iontronic quantum dot represents a novel class of zero-dimensional quantum devices engineered to overcome the need for thin dielectric layers, facilitating single-step device fabrication. Overall, the reported approach holds the potential to revolutionize the development of functional quantum materials and devices, driving rapid progress in solid state quantum technologies

Thanks to their extensive capacity, over-parameterized neural networks exhibit superior predictive capabilities and generalization. However, having a large parameter space is considered one of the main suspects of the neural networks' vulnerability to adversarial example -- input samples crafted ad-hoc to induce a desired misclassification. Relevant literature has claimed contradictory remarks in support of and against the robustness of over-parameterized networks. These contradictory findings might be due to the failure of the attack employed to evaluate the networks' robustness. Previous research has demonstrated that depending on the considered model, the algorithm employed to generate adversarial examples may not function properly, leading to overestimating the model's robustness. In this work, we empirically study the robustness of over-parameterized networks against adversarial examples. However, unlike the previous works, we also evaluate the considered attack's reliability to support the results' veracity. Our results show that over-parameterized networks are robust against adversarial attacks as opposed to their under-parameterized counterparts.

We prove that the conjecture made by Peter Frankl in the late 1970s is true. In other words for every finite union-closed family which contains a non?empty set, there is an element that belongs to at least half of its m

Adversarial examples are typically optimized with gradient-based attacks. While novel attacks are continuously proposed, each is shown to outperform its predecessors using different experimental setups, hyperparameter settings, and number of forward and backward calls to the target models. This provides overly-optimistic and even biased evaluations that may unfairly favor one particular attack over the others. In this work, we aim to overcome these limitations by proposing AttackBench, i.e., the first evaluation framework that enables a fair comparison among different attacks. To this end, we first propose a categorization of gradient-based attacks, identifying their main components and differences. We then introduce our framework, which evaluates their effectiveness and efficiency. We measure these characteristics by (i) defining an optimality metric that quantifies how close an attack is to the optimal solution, and (ii) limiting the number of forward and backward queries to the model, such that all attacks are compared within a given maximum query budget. Our extensive experimental analysis compares more than $100$ attack implementations with a total of over $800$ different configurations against CIFAR-10 and ImageNet models, highlighting that only very few attacks outperform all the competing approaches. Within this analysis, we shed light on several implementation issues that prevent many attacks from finding better solutions or running at all. We release AttackBench as a publicly-available benchmark, aiming to continuously update it to include and evaluate novel gradient-based attacks for optimizing adversarial examples., Comment: https://attackbench.github.io

We consider two possible ways, i.e., the Maxwellian Iteration and the Chapman-Enskog Method, to recover Relativistic Ordinary Thermodynamics from Relativistic Extended Thermodynamics of Polyatomic gases with N moments. Both of these methods give the Eckart equations which are the relativistic version of the Navier-Stokes and Fourier laws as a first iteration. However, these methods do not lead to the same expressions of the heat conductivity \chi, the shear viscosity \mu, and the bulk viscosity \nu which appear as coefficients in the Eckart equations. In particular, we prove that the expressions of \chi, \mu, and \nu obtained via the Chapman-Enskog method do not depend on N , while those obtained through the Maxwellian Iteration depend on N . Moreover, we also prove that these two methods lead to the same results in the nonrelativistic limit.

Evaluating the adversarial robustness of machine learning models using gradient-based attacks is challenging. In this work, we show that hyperparameter optimization can improve fast minimum-norm attacks by automating the selection of the loss function, the optimizer and the step-size scheduler, along with the corresponding hyperparameters. Our extensive evaluation involving several robust models demonstrates the improved efficacy of fast minimum-norm attacks when hyper-up with hyperparameter optimization. We release our open-source code at https://github.com/pralab/HO-FMN., Comment: Accepted at ESANN23

Neural network pruning has shown to be an effective technique for reducing the network size, trading desirable properties like generalization and robustness to adversarial attacks for higher sparsity. Recent work has claimed that adversarial pruning methods can produce sparse networks while also preserving robustness to adversarial examples. In this work, we first re-evaluate three state-of-the-art adversarial pruning methods, showing that their robustness was indeed overestimated. We then compare pruned and dense versions of the same models, discovering that samples on thin ice, i.e., closer to the unpruned model's decision boundary, are typically misclassified after pruning. We conclude by discussing how this intuition may lead to designing more effective adversarial pruning methods in future work.

RGB-D object recognition systems improve their predictive performances by fusing color and depth information, outperforming neural network architectures that rely solely on colors. While RGB-D systems are expected to be more robust to adversarial examples than RGB-only systems, they have also been proven to be highly vulnerable. Their robustness is similar even when the adversarial examples are generated by altering only the original images' colors. Different works highlighted the vulnerability of RGB-D systems; however, there is a lacking of technical explanations for this weakness. Hence, in our work, we bridge this gap by investigating the learned deep representation of RGB-D systems, discovering that color features make the function learned by the network more complex and, thus, more sensitive to small perturbations. To mitigate this problem, we propose a defense based on a detection mechanism that makes RGB-D systems more robust against adversarial examples. We empirically show that this defense improves the performances of RGB-D systems against adversarial examples even when they are computed ad-hoc to circumvent this detection mechanism, and that is also more effective than adversarial training., Comment: Accepted for publication in the Information Sciences journal

Deep learning models undergo a significant increase in the number of parameters they possess, leading to the execution of a larger number of operations during inference. This expansion significantly contributes to higher energy consumption and prediction latency. In this work, we propose EAT, a gradient-based algorithm that aims to reduce energy consumption during model training. To this end, we leverage a differentiable approximation of the $\ell_0$ norm, and use it as a sparse penalty over the training loss. Through our experimental analysis conducted on three datasets and two deep neural networks, we demonstrate that our energy-aware training algorithm EAT is able to train networks with a better trade-off between classification performance and energy efficiency., Comment: 12 pages, 3 figures. Paper accepted at the 22nd International Conference on Image Analysis and Processing (ICIAP) 2023

We study the (1+1) focussing nonlinear Schr\"{o}dinger equation for an initial condition with compactly-supported parabolic profile and phase depending quadratically on the spatial coordinate. In the absence of dispersion, using the natural class of self-similar solutions, we provide a criterion for blow-up in finite time, generalising a result by Talanov et al. In the presence of dispersion, we numerically show that the same criterion determines, even beyond the semi-classical regime, whether the solution relaxes or develops a high-order rogue wave, whose onset time is predicted by the corresponding dispersionless catastrophe time. The sign of the chirp appears to determine the prevailing scenario among two competing mechanisms for rogue wave formation. For negative values, the numerical simulations are suggestive of the dispersive regularisation of a gradient catastrophe described by Bertola and Tovbis for a different class of smooth, bell-shaped initial data. As the chirp becomes positive, the rogue wave seems to result from the interaction of counter-propagating dispersive dam break flows, as in the box problem recently studied by El, Khamis and Tovbis. As the chirp and amplitude of the initial profile are relatively easy to manipulate in optical devices and water tank wave generators, we expect our observation to be relevant for experiments in nonlinear optics and fluid dynamics., Comment: 17 pages, 7 figures, 1 table, typos corrected, references added, figures improved

In this article we apply quaternionic linear algebra and quaternionic linear system theory to develop the inverse scattering transform theory for the nonlinear Schr\"odinger equation with nonvanishing boundary conditions. We also determine its soliton solutions by using triplets of quaternionic matrices.

Reinforcement learning allows machines to learn from their own experience. Nowadays, it is used in safety-critical applications, such as autonomous driving, despite being vulnerable to attacks carefully crafted to either prevent that the reinforcement learning algorithm learns an effective and reliable policy, or to induce the trained agent to make a wrong decision. The literature about the security of reinforcement learning is rapidly growing, and some surveys have been proposed to shed light on this field. However, their categorizations are insufficient for choosing an appropriate defense given the kind of system at hand. In our survey, we do not only overcome this limitation by considering a different perspective, but we also discuss the applicability of state-of-the-art attacks and defenses when reinforcement learning algorithms are used in the context of autonomous driving.

Adversarial reprogramming allows stealing computational resources by repurposing machine learning models to perform a different task chosen by the attacker. For example, a model trained to recognize images of animals can be reprogrammed to recognize medical images by embedding an adversarial program in the images provided as inputs. This attack can be perpetrated even if the target model is a black box, supposed that the machine-learning model is provided as a service and the attacker can query the model and collect its outputs. So far, no defense has been demonstrated effective in this scenario. We show for the first time that this attack is detectable using stateful defenses, which store the queries made to the classifier and detect the abnormal cases in which they are similar. Once a malicious query is detected, the account of the user who made it can be blocked. Thus, the attacker must create many accounts to perpetrate the attack. To decrease this number, the attacker could create the adversarial program against a surrogate classifier and then fine-tune it by making few queries to the target model. In this scenario, the effectiveness of the stateful defense is reduced, but we show that it is still effective.

Semiconductor nanostructures hold great promise for high-efficiency waste heat recovery exploiting thermoelectric energy conversion, a technological breakthrough that could significantly contribute to providing environmentally friendly energy sources as well as in enabling the realization of self-powered biomedical and wearable devices. A crucial requirement in this field is the reduction of the thermal conductivity of the thermoelectric material without detrimentally affecting its electrical transport properties. In this work we demonstrate a drastic reduction of thermal conductivity in III-V semiconductor nanowires due to the presence of intentionally realized periodic crystal lattice twin planes. The electrical and thermal transport of these nanostructures, known as twinning superlattice nanowires, have been probed and compared with their twin-free counterparts, showing a one order of magnitude decrease of thermal conductivity while maintaining unaltered electrical transport properties, thus yielding a factor ten enhancement of the thermoelectric figure of merit, ZT. Our study reports for the first time the experimental measurement of electrical and thermal properties in twinning superlattice nanowires, which emerge as a novel class of nanomaterials for high efficiency thermoelectric energy harvesting.

The success of machine learning is fueled by the increasing availability of computing power and large training datasets. The training data is used to learn new models or update existing ones, assuming that it is sufficiently representative of the data that will be encountered at test time. This assumption is challenged by the threat of poisoning, an attack that manipulates the training data to compromise the model's performance at test time. Although poisoning has been acknowledged as a relevant threat in industry applications, and a variety of different attacks and defenses have been proposed so far, a complete systematization and critical review of the field is still missing. In this survey, we provide a comprehensive systematization of poisoning attacks and defenses in machine learning, reviewing more than 100 papers published in the field in the last 15 years. We start by categorizing the current threat models and attacks, and then organize existing defenses accordingly. While we focus mostly on computer-vision applications, we argue that our systematization also encompasses state-of-the-art attacks and defenses for other data modalities. Finally, we discuss existing resources for research in poisoning, and shed light on the current limitations and open research questions in this research field., Comment: 35 pages, Accepted at ACM Computing Surveys

The recent success of machine learning (ML) has been fueled by the increasing availability of computing power and large amounts of data in many different applications. However, the trustworthiness of the resulting models can be compromised when such data is maliciously manipulated to mislead the learning process. In this article, we first review poisoning attacks that compromise the training data used to learn ML models, including attacks that aim to reduce the overall performance, manipulate the predictions on specific test samples, and even implant backdoors in the model. We then discuss how to mitigate these attacks using basic security principles, or by deploying ML-oriented defensive mechanisms. We conclude our article by formulating some relevant open challenges which are hindering the development of testing methods and benchmarks suitable for assessing and improving the trustworthiness of ML models against data poisoning attacks, Comment: preprint, 10 pages, 3 figures. Paper accepted to the IEEE Computer - Special Issue on Trustworthy AI

Sponge examples are test-time inputs carefully optimized to increase energy consumption and latency of neural networks when deployed on hardware accelerators. In this work, we are the first to demonstrate that sponge examples can also be injected at training time, via an attack that we call sponge poisoning. This attack allows one to increase the energy consumption and latency of machine-learning models indiscriminately on each test-time input. We present a novel formalization for sponge poisoning, overcoming the limitations related to the optimization of test-time sponge examples, and show that this attack is possible even if the attacker only controls a few model updates; for instance, if model training is outsourced to an untrusted third-party or distributed via federated learning. Our extensive experimental analysis shows that sponge poisoning can almost completely vanish the effect of hardware accelerators. We also analyze the activations of poisoned models, identifying which components are more vulnerable to this attack. Finally, we examine the feasibility of countermeasures against sponge poisoning to decrease energy consumption, showing that sanitization methods may be overly expensive for most of the users., Comment: Preprint;16 pages

Adversarial patches are optimized contiguous pixel blocks in an input image that cause a machine-learning model to misclassify it. However, their optimization is computationally demanding, and requires careful hyperparameter tuning, potentially leading to suboptimal robustness evaluations. To overcome these issues, we propose ImageNet-Patch, a dataset to benchmark machine-learning models against adversarial patches. It consists of a set of patches, optimized to generalize across different models, and readily applicable to ImageNet data after preprocessing them with affine transformations. This process enables an approximate yet faster robustness evaluation, leveraging the transferability of adversarial perturbations. We showcase the usefulness of this dataset by testing the effectiveness of the computed patches against 127 models. We conclude by discussing how our dataset could be used as a benchmark for robustness, and how our methodology can be generalized to other domains. We open source our dataset and evaluation code at https://github.com/pralab/ImageNet-Patch., Comment: Published in Pattern Recognition. DOI: https://doi.org/10.1016/j.patcog.2022.109064

We relate the scattering theory of the focusing AKNS system with vanishing boundary conditions to that of the matrix Schroedinger equation. The corresponding Miura transformation which allows this connection, converts the focusing matrix nonlinear Schroedinger (NLS) equation into a new nonlocal integrable equation. We apply the matrix triplet method to derive the multisoliton solutions of the nonlocal integrable equation, thus proposing a new method to solve the matrix NLS equation.

Adversarial reprogramming allows repurposing a machine-learning model to perform a different task. For example, a model trained to recognize animals can be reprogrammed to recognize digits by embedding an adversarial program in the digit images provided as input. Recent work has shown that adversarial reprogramming may not only be used to abuse machine-learning models provided as a service, but also beneficially, to improve transfer learning when training data is scarce. However, the factors affecting its success are still largely unexplained. In this work, we develop a first-order linear model of adversarial reprogramming to show that its success inherently depends on the size of the average input gradient, which grows when input gradients are more aligned, and when inputs have higher dimensionality. The results of our experimental analysis, involving fourteen distinct reprogramming tasks, show that the above factors are correlated with the success and the failure of adversarial reprogramming.

AI has provided us with the ability to automate tasks, extract information from vast amounts of data, and synthesize media that is nearly indistinguishable from the real thing. However, positive tools can also be used for negative purposes. In particular, cyber adversaries can use AI (such as machine learning) to enhance their attacks and expand their campaigns. Although offensive AI has been discussed in the past, there is a need to analyze and understand the threat in the context of organizations. For example, how does an AI-capable adversary impact the cyber kill chain? Does AI benefit the attacker more than the defender? What are the most significant AI threats facing organizations today and what will be their impact on the future? In this survey, we explore the threat of offensive AI on organizations. First, we present the background and discuss how AI changes the adversary's methods, strategies, goals, and overall attack model. Then, through a literature review, we identify 33 offensive AI capabilities which adversaries can use to enhance their attacks. Finally, through a user study spanning industry and academia, we rank the AI threats and provide insights on the adversaries.

Evaluating robustness of machine-learning models to adversarial examples is a challenging problem. Many defenses have been shown to provide a false sense of robustness by causing gradient-based attacks to fail, and they have been broken under more rigorous evaluations. Although guidelines and best practices have been suggested to improve current adversarial robustness evaluations, the lack of automatic testing and debugging tools makes it difficult to apply these recommendations in a systematic manner. In this work, we overcome these limitations by: (i) categorizing attack failures based on how they affect the optimization of gradient-based attacks, while also unveiling two novel failures affecting many popular attack implementations and past evaluations; (ii) proposing six novel indicators of failure, to automatically detect the presence of such failures in the attack optimization process; and (iii) suggesting a systematic protocol to apply the corresponding fixes. Our extensive experimental analysis, involving more than 15 models in 3 distinct application domains, shows that our indicators of failure can be used to debug and improve current adversarial robustness evaluations, thereby providing a first concrete step towards automatizing and systematizing them. Our open-source code is available at: https://github.com/pralab/IndicatorsOfAttackFailure., Comment: Accepted at NeurIPS 2022