Search

Pixel-wise regression tasks (e.g., monocular depth estimation (MDE) and optical flow estimation (OFE)) have been widely involved in our daily life in applications like autonomous driving, augmented reality and video composition. Although certain applications are security-critical or bear societal significance, the adversarial robustness of such models are not sufficiently studied, especially in the black-box scenario. In this work, we introduce the first unified black-box adversarial patch attack framework against pixel-wise regression tasks, aiming to identify the vulnerabilities of these models under query-based black-box attacks. We propose a novel square-based adversarial patch optimization framework and employ probabilistic square sampling and score-based gradient estimation techniques to generate the patch effectively and efficiently, overcoming the scalability problem of previous black-box patch attacks. Our attack prototype, named BadPart, is evaluated on both MDE and OFE tasks, utilizing a total of 7 models. BadPart surpasses 3 baseline methods in terms of both attack performance and efficiency. We also apply BadPart on the Google online service for portrait depth estimation, causing 43.5% relative distance error with 50K queries. State-of-the-art (SOTA) countermeasures cannot defend our attack effectively., Comment: Paper accepted at ICML 2024

Backdoor attack poses a significant security threat to Deep Learning applications. Existing attacks are often not evasive to established backdoor detection techniques. This susceptibility primarily stems from the fact that these attacks typically leverage a universal trigger pattern or transformation function, such that the trigger can cause misclassification for any input. In response to this, recent papers have introduced attacks using sample-specific invisible triggers crafted through special transformation functions. While these approaches manage to evade detection to some extent, they reveal vulnerability to existing backdoor mitigation techniques. To address and enhance both evasiveness and resilience, we introduce a novel backdoor attack LOTUS. Specifically, it leverages a secret function to separate samples in the victim class into a set of partitions and applies unique triggers to different partitions. Furthermore, LOTUS incorporates an effective trigger focusing mechanism, ensuring only the trigger corresponding to the partition can induce the backdoor behavior. Extensive experimental results show that LOTUS can achieve high attack success rate across 4 datasets and 7 model structures, and effectively evading 13 backdoor detection and mitigation techniques. The code is available at https://github.com/Megum1/LOTUS., Comment: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2024)

Binary similarity analysis determines if two binary executables are from the same source program. Existing techniques leverage static and dynamic program features and may utilize advanced Deep Learning techniques. Although they have demonstrated great potential, the community believes that a more effective representation of program semantics can further improve similarity analysis. In this paper, we propose a new method to represent binary program semantics. It is based on a novel probabilistic execution engine that can effectively sample the input space and the program path space of subject binaries. More importantly, it ensures that the collected samples are comparable across binaries, addressing the substantial variations of input specifications. Our evaluation on 9 real-world projects with 35k functions, and comparison with 6 state-of-the-art techniques show that PEM can achieve a precision of 96% with common settings, outperforming the baselines by 10-20%.

Ground level enhancements (GLEs) are extreme solar energetic particle (SEP) events that are of particular importance in space weather. In solar cycle 24, two GLEs were recorded on 2012 May 17 (GLE 71) and 2017 September 10 (GLE 72), respectively, by a range of advanced modern instruments. Here we conduct a comparative analysis of the two events by focusing on the effects of large-scale magnetic field configuration near active regions on particle acceleration and release. Although the active regions both located near the western limb, temporal variations of SEP intensities and energy spectra measured in-situ display different behaviors at early stages. By combining a potential field model, we find the CME in GLE 71 originated below the streamer belt, while in GLE 72 near the edge of the streamer belt. We reconstruct the CME shock fronts with an ellipsoid model based on nearly simultaneous coronagraph images from multi-viewpoints, and further derive the 3D shock geometry at the GLE onset. The highest-energy particles are primarily accelerated in the shock-streamer interaction regions, i.e., likely at the nose of the shock in GLE 71 and the eastern flank in GLE 72, due to quasi-perpendicular shock geometry and confinement of closed fields. Subsequently, they are released to the field lines connecting to near-Earth spacecraft when the shocks move through the streamer cusp region. This suggests that magnetic structures in the corona, especially shock-streamer interactions, may have played an important role in the acceleration and release of the highest-energy particles in the two events., Comment: Accepted for publication in ApJ

Decompilation aims to recover the source code form of a binary executable. It has many security applications such as malware analysis, vulnerability detection and code hardening. A prominent challenge in decompilation is to recover variable names. We propose a novel technique that leverages the strengths of generative models while mitigating model biases and potential hallucinations. We build a prototype, GenNm, from pre-trained generative models CodeGemma-2B and CodeLlama-7B. We finetune GenNm on decompiled functions, and mitigate model biases by incorporating symbol preference to the training pipeline. GenNm includes names from callers and callees while querying a function, providing rich contextual information within the model's input token limitation. It further leverages program analysis to validate the consistency of names produced by the generative model. Our results show that GenNm improves the state-of-the-art name recovery accuracy by 8.6 and 11.4 percentage points on two commonly used datasets, and improves the state-of-the-art from 8.5% to 22.8% in the most challenging setup where ground-truth variable names are not seen in the training dataset.

Solar coronal waves frequently appear as bright disturbances that propagate globally from the eruption center in the solar atmosphere, just like the tsunamis in the ocean on Earth. Theoretically, coronal waves can sweep over the underlying chromosphere and leave an imprint in the form of Moreton wave, due to the enhanced pressure beneath their coronal wavefront. Despite the frequent observations of coronal waves, their counterparts in the chromosphere are rarely detected. Why the chromosphere rarely bears the imprints of solar tsunamis remained a mystery since their discovery three decades ago. To resolve this question, all coronal waves and associated Moreton waves in the last decade have been initially surveyed, though the detection of Moreton waves could be hampered by utilising the low-quality H$\alpha$ data from Global Oscillations Network Group. Here, we present 8 cases (including 5 in Appendix) of the coexistence of coronal and Moreton waves in inclined eruptions where it is argued that the extreme inclination is key to providing an answer to address the question. For all these events, the lowest part of the coronal wavefront near the solar surface appears very bright, and the simultaneous disturbances in the solar transition region and the chromosphere predominantly occur beneath the bright segment. Therefore, evidenced by observations, we propose a scenario for the excitation mechanism of the coronal-Moreton waves in highly inclined eruptions, in which the lowest part of a coronal wave can effectively disturb the chromosphere even for a weak (e.g., B-class) solar flare., Comment: 24 pages, 14 figures

Multi-sensor fusion (MSF) is widely used in autonomous vehicles (AVs) for perception, particularly for 3D object detection with camera and LiDAR sensors. The purpose of fusion is to capitalize on the advantages of each modality while minimizing its weaknesses. Advanced deep neural network (DNN)-based fusion techniques have demonstrated the exceptional and industry-leading performance. Due to the redundant information in multiple modalities, MSF is also recognized as a general defence strategy against adversarial attacks. In this paper, we attack fusion models from the camera modality that is considered to be of lesser importance in fusion but is more affordable for attackers. We argue that the weakest link of fusion models depends on their most vulnerable modality, and propose an attack framework that targets advanced camera-LiDAR fusion-based 3D object detection models through camera-only adversarial attacks. Our approach employs a two-stage optimization-based strategy that first thoroughly evaluates vulnerable image areas under adversarial attacks, and then applies dedicated attack strategies for different fusion models to generate deployable patches. The evaluations with six advanced camera-LiDAR fusion models and one camera-only model indicate that our attacks successfully compromise all of them. Our approach can either decrease the mean average precision (mAP) of detection performance from 0.824 to 0.353, or degrade the detection score of a target object from 0.728 to 0.156, demonstrating the efficacy of our proposed attack framework. Code is available., Comment: Accepted at ICLR'2024

Self-supervised learning in computer vision trains on unlabeled data, such as images or (image, text) pairs, to obtain an image encoder that learns high-quality embeddings for input data. Emerging backdoor attacks towards encoders expose crucial vulnerabilities of self-supervised learning, since downstream classifiers (even further trained on clean data) may inherit backdoor behaviors from encoders. Existing backdoor detection methods mainly focus on supervised learning settings and cannot handle pre-trained encoders especially when input labels are not available. In this paper, we propose DECREE, the first backdoor detection approach for pre-trained encoders, requiring neither classifier headers nor input labels. We evaluate DECREE on over 400 encoders trojaned under 3 paradigms. We show the effectiveness of our method on image encoders pre-trained on ImageNet and OpenAI's CLIP 400 million image-text pairs. Our method consistently has a high detection accuracy even if we have only limited or no access to the pre-training dataset., Comment: Accepted at CVPR 2023. Code is available at https://github.com/GiantSeaweed/DECREE

Deep Learning backdoor attacks have a threat model similar to traditional cyber attacks. Attack forensics, a critical counter-measure for traditional cyber attacks, is hence of importance for defending model backdoor attacks. In this paper, we propose a novel model backdoor forensics technique. Given a few attack samples such as inputs with backdoor triggers, which may represent different types of backdoors, our technique automatically decomposes them to clean inputs and the corresponding triggers. It then clusters the triggers based on their properties to allow automatic attack categorization and summarization. Backdoor scanners can then be automatically synthesized to find other instances of the same type of backdoor in other models. Our evaluation on 2,532 pre-trained models, 10 popular attacks, and comparison with 9 baselines show that our technique is highly effective. The decomposed clean inputs and triggers closely resemble the ground truth. The synthesized scanners substantially outperform the vanilla versions of existing scanners that can hardly generalize to different kinds of attacks.

Federated Learning (FL) is a distributed learning paradigm that enables different parties to train a model together for high quality and strong privacy protection. In this scenario, individual participants may get compromised and perform backdoor attacks by poisoning the data (or gradients). Existing work on robust aggregation and certified FL robustness does not study how hardening benign clients can affect the global model (and the malicious clients). In this work, we theoretically analyze the connection among cross-entropy loss, attack success rate, and clean accuracy in this setting. Moreover, we propose a trigger reverse engineering based defense and show that our method can achieve robustness improvement with guarantee (i.e., reducing the attack success rate) without affecting benign accuracy. We conduct comprehensive experiments across different datasets and attack settings. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks. Code is available at https://github.com/KaiyuanZh/FLIP., Comment: Accepted by ICLR 2023. Code is available at https://github.com/KaiyuanZh/FLIP

Compound eruptions represent that multiple closely spaced magnetic structures erupt consecutively within a short interval, and then lead to a single flare and a single CME. However, it is still subtle for the links between multiple eruptions and the associated single flare or/and single CME. In this Letter, we report the compound eruptions of twin close flux ropes (FR1 and FR2) within a few minutes that resulted in a flare with a single soft X-ray peak and a CME with two cores. The successive groups of expanding loops and double peaks of intensity flux in AIA cool wavelengths indicate two episodes of internal magnetic reconnections during the compound eruptions. Following the eruption of FR2, the erupting FR1 was accelerated, and then the expanding loops overlying FR2 were deflected. Moreover, the eruption of FR2 likely involved the external magnetic reconnection between the bottom of the overlying stretching field lines and the rebounding loops that were previously pushed by the eruption of FR1, which was evidenced by a pair of groups of newly-formed loops. All results suggest that the compound eruptions involved both internal and external magnetic reconnections, and two erupting structures of twin FRs interacted at the initial stage. We propose that two episodes of internal magnetic reconnections were likely united within a few minutes to form the continuous impulsive phase of the single peaked flare, and two separated cores of the CME was possibly because that the latter core was too slow to merge with the former one.

The celebrated Seq2Seq technique and its numerous variants achieve excellent performance on many tasks such as neural machine translation, semantic parsing, and math word problem solving. However, these models either only consider input objects as sequences while ignoring the important structural information for encoding, or they simply treat output objects as sequence outputs instead of structural objects for decoding. In this paper, we present a novel Graph-to-Tree Neural Networks, namely Graph2Tree consisting of a graph encoder and a hierarchical tree decoder, that encodes an augmented graph-structured input and decodes a tree-structured output. In particular, we investigated our model for solving two problems, neural semantic parsing and math word problem. Our extensive experiments demonstrate that our Graph2Tree model outperforms or matches the performance of other state-of-the-art models on these tasks., Comment: Long Paper in EMNLP 2020. 12 pages including references

Source imaging of solar radio bursts can be used to track energetic electrons and associated magnetic structures. Here we present a combined analysis of data at different wavelengths for an eruption associated with a moving type-IV (t-IVm) radio burst. In the inner corona, the sources are correlated with a hot and twisted eruptive EUV structure, while in the outer corona the sources are associated with the top front of the bright core of a white light coronal mass ejection (CME). This reveals the potential of using t-IVm imaging data to continuously track the CME by lighting up the specific component containing radio-emitting electrons. It is found that the t-IVm burst presents a clear spatial dispersion with observing frequencies. The burst manifests broken power-law like spectra in brightness temperature, which is as high as $10^7$-$10^9$ K while the polarization level is in-general weak. In addition, the t-IVm burst starts during the declining phase of the flare with a duration as long as 2.5 hours. From the differential emission measure analysis of AIA data, the density of the T-IVm source is likely at the level of 10$^8$ cm$^{-3}$ at the start of the burst, and the temperature may reach up to several MK. These observations do not favor gyro-synchrotron to be the radiation mechanism, yet in line with a coherent plasma emission excited by energetic electrons trapped within the source. Further studies are demanded to elucidate the emission mechanism and explore the full diagnostic potential of t-IVm bursts., Comment: 22 pages, 8 figures, Accepted for publication in APJ

Extreme ultraviolet (EUV) waves, spectacular horizontally propagating disturbances in the low solar corona, always trigger horizontal secondary waves (SWs) when they encounter ambient coronal structure. We present a first example of upward SWs in a streamer-like structure after the passing of an EUV wave. The event occurred on 2017 June 1. The EUV wave happened during a typical solar eruption including a filament eruption, a CME, a C6.6 flare. The EUV wave was associated with quasi-periodic fast propagating (QFP) wave trains and a type II radio burst that represented the existence of a coronal shock. The EUV wave had a fast initial velocity of $\sim$1000 km s$^{-1}$, comparable to high speeds of the shock and the QFP wave trains. Intriguingly, upward SWs rose slowly ($\sim$80 km s$^{-1}$) in the streamer-like structure after the sweeping of the EUV wave. The upward SWs seemed to originate from limb brightenings that were caused by the EUV wave. All the results show the EUV wave is a fast-mode magnetohydrodynamic shock wave, likely triggered by the flare impulses. We suggest that part of the EUV wave was probably trapped in the closed magnetic fields of streamer-like structure, and upward SWs possibly resulted from the release of trapped waves in the form of slow-mode. It is believed that an interplay of the strong compression of the coronal shock and the configuration of the streamer-like structure is crucial for the formation of upward SWs., Comment: 5 figures

This paper presents the latest observations from the newly-built solar radio spectrograph at the \emph{Chashan Solar Observatory}. On July 18 2016, the spectrograph records a solar spike burst event, which has several episodes showing harmonic structures, with the second, third, and fourth harmonics. The lower harmonic radio spike emissions are observed later than the higher harmonic bands, and the temporal delay of the second (third) harmonic relative to the fourth harmonic is about 30\ --\ 40 (10) ms. Based on the electron cyclotron maser emission mechanism, we analyze possible causes of the temporal delay and further infer relevant coronal parameters, such as the magnetic field strength and the electron density at the radio source., Comment: 17 pages,6 figures

Type-I bursts (i.e. noise storms) are the earliest-known type of solar radio emission at the metre wavelength. They are believed to be excited by non-thermal energetic electrons accelerated in the corona. The underlying dynamic process and exact emission mechanism still remain unresolved. Here, with a combined analysis of extreme ultraviolet (EUV), radio and photospheric magnetic field data of unprecedented quality recorded during a type-I storm on 30 July 2011, we identify a good correlation between the radio bursts and the co-spatial EUV and magnetic activities. The EUV activities manifest themselves as three major brightening stripes above a region adjacent to a compact sunspot, while the magnetic field there presents multiple moving magnetic features (MMFs) with persistent coalescence or cancelation and a morphologically similar three-part distribution. We find that the type-I intensities are correlated with those of the EUV emissions at various wavelengths with a correlation coefficient of 0.7-0.8. In addition, in the region between the brightening EUV stripes and the radio sources there appear consistent dynamic motions with a series of bi-directional flows, suggesting ongoing small-scale reconnection there. Mainly based on the induced connection between the magnetic motion at the photosphere and the EUV and radio activities in the corona, we suggest that the observed type-I noise storms and the EUV brightening activities are the consequence of small-scale magnetic reconnection driven by MMFs. This is in support of the original proposal made by Bentely et al. (Solar Phys. 193, 227, 2000).

Hot channel (HC) structure, observed in the high-temperature passbands of the AIA/SDO, is regarded as one candidate of coronal flux rope which is an essential element of solar eruptions. Here we present the first radio imaging study of an HC structure in the metric wavelength. The associated radio emission manifests as a moving type-IV (t-IVm) burst. We show that the radio sources co-move outwards with the HC, indicating that the t-IV emitting energetic electrons are efficiently trapped within the structure. The t-IV sources at different frequencies present no considerable spatial dispersion during the early stage of the event, while the sources spread gradually along the eruptive HC structure at later stage with significant spatial dispersion. The t-IV bursts are characterized by a relatively-high brightness temperature ($\sim$ 10$^{7}$ $-$ 10$^{9}$ K), a moderate polarization, and a spectral shape that evolves considerably with time. This study demonstrates the possibility of imaging the eruptive HC structure at the metric wavelength and provides strong constraints on the t-IV emision mechanism, which, if understood, can be used to diagnose the essential parameters of the eruptive structure., Comment: 16 pages, 5 figures, Accepted for Publication in APJ Letters

Type III and type-III-like radio bursts are produced by energetic electron beams guided along coronal magnetic fields. As a variant of type III bursts, Type N bursts appear as the letter "N" in the radio dynamic spectrum and reveal a magnetic mirror effect in coronal loops. Here, we report a well-observed N-shaped burst consisting of three successive branches at metric wavelength with both fundamental and harmonic components and a high brightness temperature ($>$10$^9$ K). We verify the burst as a true type N burst generated by the same electron beam from three aspects of the data. First, durations of the three branches at a given frequency increase gradually, may due to the dispersion of the beam along its path. Second, the flare site, as the only possible source of non-thermal electrons, is near the western feet of large-scale closed loops. Third, the first branch and the following two branches are localized at different legs of the loops with opposite sense of polarization. We also find that the sense of polarization of the radio burst is in contradiction to the O-mode and there exists a fairly large time delay ($\sim$3-5 s) between the fundamental and harmonic components. Possible explanations accounting for these observations are presented. Assuming the classical plasma emission mechanism, we can infer coronal parameters such as electron density and magnetic field near the radio source and make diagnostics on the magnetic mirror process., Comment: Accepted by ApJ

First-of-its-kind radio imaging of decameter solar stationary type IV radio burst has been presented in this paper. On 6 September 2014 the observations of type IV burst radio emission have been carried out with the two-dimensional heliograph based on the Ukrainian T-shaped radio telescope (UTR-2) together with other telescope arrays. Starting at 09:55 UT and throughout 3 hours, the radio emission was kept within the observational session of UTR-2. The interesting observation covered the full evolution of this burst, "from birth to death". During the event lifetime, two C-class solar X-ray flares with peak times 11:29 UT and 12:24 UT took place. The time profile of this burst in radio has a double-humped shape that can be explained by injection of energetic electrons, accelerated by the two flares, into the burst source. According to the heliographic observations we suggest the burst source was confined within a high coronal loop, which was a part of a relatively slow coronal mass ejection. The latter has been developed for several hours before the onset of the event. Through analyzing about 1.5 million of heliograms (3700 temporal frames with 4096 images in each frame that correspond to the number of frequency channels) the radio burst source imaging shows a fascinating dynamical evolution. Both space-based (GOES, SDO, SOHO, STEREO) data and various ground-based instrumentation (ORFEES, NDA, RSTO, NRH) records have been used for this study.

With a test-particle simulation, we investigate the effect of large-scale coronal magnetic fields on electron acceleration at an outward-propagating coronal shock with a circular front. The coronal field is approximated by an analytical solution with a streamer-like magnetic field featured by partially open magnetic field and a current sheet at the equator atop the closed region. We show that the large-scale shock-field configuration, especially the relative curvature of the shock and the magnetic field line across which the shock is sweeping, plays an important role in the efficiency of electron acceleration. At low shock altitudes, when the shock curvature is larger than that of magnetic field lines, the electrons are mainly accelerated at the shock flanks; at higher altitudes, when the shock curvature is smaller, the electrons are mainly accelerated at the shock nose around the top of closed field lines. The above process reveals the shift of efficient electron acceleration region along the shock front during its propagation. It is also found that in general the electron acceleration at the shock flank is not so efficient as that at the top of closed field since at the top a collapsing magnetic trap can be formed. In addition, we find that the energy spectra of electrons is power-law like, first hardening then softening with the spectral index varying in a range of -3 to -6. Physical interpretations of the results and implications on the study of solar radio bursts are discussed., Comment: accepted by ApJ