Search

Neural networks have achieved remarkable performance across a wide range of tasks, yet they remain susceptible to adversarial perturbations, which pose significant risks in safety-critical applications. With the rise of multimodality, diffusion models have emerged as powerful tools not only for generative tasks but also for various applications such as image editing, inpainting, and super-resolution. However, these models still lack robustness due to limited research on attacking them to enhance their resilience. Traditional attack techniques, such as gradient-based adversarial attacks and diffusion model-based methods, are hindered by computational inefficiencies and scalability issues due to their iterative nature. To address these challenges, we introduce an innovative framework that leverages the distilled backbone of diffusion models and incorporates a precision-optimized noise predictor to enhance the effectiveness of our attack framework. This approach not only enhances the attack's potency but also significantly reduces computational costs. Our framework provides a cutting-edge solution for multi-modal adversarial attacks, ensuring reduced latency and the generation of high-fidelity adversarial examples with superior success rates. Furthermore, we demonstrate that our framework achieves outstanding transferability and robustness against purification defenses, outperforming existing gradient-based attack models in both effectiveness and efficiency.

In this paper, we showed that for suitable $(\beta,p, s,\ell)$ the $\beta$-order fractional derivative with respect to the last coordinate of the Fourier transform of an $L^p(\mathbb{R}^n)$ function is in $H^{-s}$ after restricting to a graph of a function with non-vanishing Gaussian curvature provided that the restriction of the Fourier transform of such function to the surface is in $H^{\ell}$. This is a generalization of the result in \cite{GoldStol}*{Theorem 1.12}., Comment: Fixed the description of Figure 3 and 4

Neural networks, despite their remarkable performance in widespread applications, including image classification, are also known to be vulnerable to subtle adversarial noise. Although some diffusion-based purification methods have been proposed, for example, DiffPure, those methods are time-consuming. In this paper, we propose One Step Control Purification (OSCP), a diffusion-based purification model that can purify the adversarial image in one Neural Function Evaluation (NFE) in diffusion models. We use Latent Consistency Model (LCM) and ControlNet for our one-step purification. OSCP is computationally friendly and time efficient compared to other diffusion-based purification methods; we achieve defense success rate of 74.19\% on ImageNet, only requiring 0.1s for each purification. Moreover, there is a fundamental incongruence between consistency distillation and adversarial perturbation. To address this ontological dissonance, we propose Gaussian Adversarial Noise Distillation (GAND), a novel consistency distillation framework that facilitates a more nuanced reconciliation of the latent space dynamics, effectively bridging the natural and adversarial manifolds. Our experiments show that the GAND does not need a Full Fine Tune (FFT); PEFT, e.g., LoRA is sufficient.

In dynamic discrete choice models, some parameters, such as the discount factor, are being fixed instead of being estimated. This paper proposes two sensitivity analysis procedures for dynamic discrete choice models with respect to the fixed parameters. First, I develop a local sensitivity measure that estimates the change in the target parameter for a unit change in the fixed parameter. This measure is fast to compute as it does not require model re-estimation. Second, I propose a global sensitivity analysis procedure that uses model primitives to study the relationship between target parameters and fixed parameters. I show how to apply the sensitivity analysis procedures of this paper through two empirical applications.

Recent advancements in generative AI, particularly Latent Diffusion Models (LDMs), have revolutionized image synthesis and manipulation. However, these generative techniques raises concerns about data misappropriation and intellectual property infringement. Adversarial attacks on machine learning models have been extensively studied, and a well-established body of research has extended these techniques as a benign metric to prevent the underlying misuse of generative AI. Current approaches to safeguarding images from manipulation by LDMs are limited by their reliance on model-specific knowledge and their inability to significantly degrade semantic quality of generated images. In response to these shortcomings, we propose the Posterior Collapse Attack (PCA) based on the observation that VAEs suffer from posterior collapse during training. Our method minimizes dependence on the white-box information of target models to get rid of the implicit reliance on model-specific knowledge. By accessing merely a small amount of LDM parameters, in specific merely the VAE encoder of LDMs, our method causes a substantial semantic collapse in generation quality, particularly in perceptual consistency, and demonstrates strong transferability across various model architectures. Experimental results show that PCA achieves superior perturbation effects on image generation of LDMs with lower runtime and VRAM. Our method outperforms existing techniques, offering a more robust and generalizable solution that is helpful in alleviating the socio-technical challenges posed by the rapidly evolving landscape of generative AI., Comment: 21 pages, 7 figures, 10 tables

Geometric frustration is a phenomenon in a lattice system where not all interactions can be satisfied, the simplest example being antiferromagnetically coupled spins on a triangular lattice. Frustrated systems are characterized by their many nearly degenerate ground states, leading to non-trivial phases such as spin ice and spin liquids. To date most studies are on geometric frustration of spins; much less explored is orbital geometric frustration. For electrons in twisted bilayer graphene (tBLG) at denominator 3 fractional filling, Coulomb interactions and the Wannier orbital shapes are predicted to strongly constrain spatial charge ordering, leading to geometrically frustrated ground states that produce a new class of correlated insulators (CIs). Here we report the observation of dominant denominator 3 fractional filling insulating states in large angle tBLG; these states persist in magnetic fields and display magnetic ordering signatures and tripled unit cell reconstruction. These results are in agreement with a strong-coupling theory of symmetry-breaking of geometrically frustrated fractional states.

A two-dimensional (2D) quantum electron system is characterized by the quantized energy levels, or subbands, in the out-of-plane direction. Populating higher subbands and controlling the inter-subband transitions have wide technological applications such as optical modulators and quantum cascade lasers. In conventional materials, however, the tunability of intersubband spacing is limited. Here we demonstrate electrostatic population and characterization of the second subband in few-layer InSe quantum wells, with giant tunability of its energy, population, and spin-orbit coupling strength, via the control of not only layer thickness but also out-of-plane displacement field. A modulation of as much as 350% or over 250 meV is achievable, underscoring the promise of InSe for tunable infrared and THz sources, detectors and modulators.

6G networks are envisioned to deliver a large diversity of applications and meet stringent quality of service (QoS) requirements. Hence, integrated terrestrial and non-terrestrial networks (TN-NTNs) are anticipated to be key enabling technologies. However, the TN-NTNs integration faces a number of challenges that could be addressed through network virtualization technologies such as Software-Defined Networking (SDN), Network Function Virtualization (NFV) and network slicing. In this survey, we provide a comprehensive review on the adaptation of these networking paradigms in 6G networks. We begin with a brief overview on NTNs and virtualization techniques. Then, we highlight the integral role of Artificial Intelligence in improving network virtualization by summarizing major research areas where AI models are applied. Building on this foundation, the survey identifies the main issues arising from the adaptation of SDN, NFV, and network slicing in integrated TN-NTNs, and proposes a taxonomy of integrated TN-NTNs virtualization offering a thorough review of relevant contributions. The taxonomy is built on a four-level classification indicating for each study the level of TN-NTNs integration, the used virtualization technology, the addressed problem, the type of the study and the proposed solution, which can be based on conventional or AI-enabled methods. Moreover, we present a summary on the simulation tools commonly used in the testing and validation of such networks. Finally, we discuss open issues and give insights on future research directions for the advancement of integrated TN-NTNs virtualization in the 6G era.

In this paper, we address the challenging task of whole-body biometric detection, recognition, and identification at distances of up to 500m and large pitch angles of up to 50 degree. We propose an end-to-end system evaluated on diverse datasets, including the challenging Biometric Recognition and Identification at Range (BRIAR) dataset. Our approach involves pre-training the detector on common image datasets and fine-tuning it on BRIAR's complex videos and images. After detection, we extract body images and employ a feature extractor for recognition. We conduct thorough evaluations under various conditions, such as different ranges and angles in indoor, outdoor, and aerial scenarios. Our method achieves an average F1 score of 98.29% at IoU = 0.7 and demonstrates strong performance in recognition accuracy and true acceptance rate at low false acceptance rates compared to existing models. On a test set of 100 subjects with 444 distractors, our model achieves a rank-20 recognition accuracy of 75.13% and a TAR@1%FAR of 54.09%.

Two-dimensional (2D) materials have drawn immense interest in scientific and technological communities, owing to their extraordinary properties that are profoundly altered from their bulk counterparts and their enriched tunability by gating, proximity, strain, and external fields. For digital applications, an ideal 2D material would have high mobility, air stability, sizable band gap, and be compatible with large-scale synthesis. Here we demonstrate air-stable field-effect transistors using atomically thin few-layer PdSe2 sheets that are sandwiched between hexagonal BN (hBN), with record high saturation current >350{\mu}A/{\mu}m, and field effect mobilities 700 and 10,000 cm2/Vs at 300K and 2K, respectively. At low temperatures, magnetotransport studies reveal unique octets in quantum oscillations, arising from 2-fold spin and 4-fold valley degeneracies, which can be broken by in-plane and out-of-plane magnetic fields toward quantum Hall spin and orbital ferromagnetism., Comment: 4 figures, In review

Gait recognition holds the promise of robustly identifying subjects based on walking patterns instead of appearance information. While previous approaches have performed well for curated indoor data, they tend to underperform in unconstrained situations, e.g. in outdoor, long distance scenes, etc. We propose a framework, termed GAit DEtection and Recognition (GADER), for human authentication in challenging outdoor scenarios. Specifically, GADER leverages a Double Helical Signature to detect segments that contain human movement and builds discriminative features through a novel gait recognition method, where only frames containing gait information are used. To further enhance robustness, GADER encodes viewpoint information in its architecture, and distills representation from an auxiliary RGB recognition model, which enables GADER to learn from silhouette and RGB data at training time. At test time, GADER only infers from the silhouette modality. We evaluate our method on multiple State-of-The-Arts(SoTA) gait baselines and demonstrate consistent improvements on indoor and outdoor datasets, especially with a significant 25.2% improvement on unconstrained, remote gait data., Comment: Accepted by IJCB 2024

The increasingly pervasive facial recognition (FR) systems raise serious concerns about personal privacy, especially for billions of users who have publicly shared their photos on social media. Several attempts have been made to protect individuals from being identified by unauthorized FR systems utilizing adversarial attacks to generate encrypted face images. However, existing methods suffer from poor visual quality or low attack success rates, which limit their utility. Recently, diffusion models have achieved tremendous success in image generation. In this work, we ask: can diffusion models be used to generate adversarial examples to improve both visual quality and attack performance? We propose DiffProtect, which utilizes a diffusion autoencoder to generate semantically meaningful perturbations on FR systems. Extensive experiments demonstrate that DiffProtect produces more natural-looking encrypted images than state-of-the-art methods while achieving significantly higher attack success rates, e.g., 24.5% and 25.1% absolute improvements on the CelebA-HQ and FFHQ datasets., Comment: Code will be available at https://github.com/joellliu/DiffProtect/

The increasingly pervasive facial recognition (FR) systems raise serious concerns about personal privacy, especially for billions of users who have publicly shared their photos on social media. Several attempts have been made to protect individuals from unauthorized FR systems utilizing adversarial attacks to generate encrypted face images to protect users from being identified by FR systems. However, existing methods suffer from poor visual quality or low attack success rates, which limit their usability in practice. In this paper, we propose Attribute Guided Encryption with Facial Texture Masking (AGE-FTM) that performs a dual manifold adversarial attack on FR systems to achieve both good visual quality and high black box attack success rates. In particular, AGE-FTM utilizes a high fidelity generative adversarial network (GAN) to generate natural on-manifold adversarial samples by modifying facial attributes, and performs the facial texture masking attack to generate imperceptible off-manifold adversarial samples. Extensive experiments on the CelebA-HQ dataset demonstrate that our proposed method produces more natural-looking encrypted images than state-of-the-art methods while achieving competitive attack performance. We further evaluate the effectiveness of AGE-FTM in the real world using a commercial FR API and validate its usefulness in practice through an user study.

We present a comprehensive computational study of a class of linear system solvers, called {\it Triangle Algorithm} (TA) and {\it Centering Triangle Algorithm} (CTA), developed by Kalantari \cite{kalantari23}. The algorithms compute an approximate solution or minimum-norm solution to $Ax=b$ or $A^TAx=A^Tb$, where $A$ is an $m \times n$ real matrix of arbitrary rank. The algorithms specialize when $A$ is symmetric positive semi-definite. Based on the description and theoretical properties of TA and CTA from \cite{kalantari23}, we give an implementation of the algorithms that is easy-to-use for practitioners, versatile for a wide range of problems, and robust in that our implementation does not necessitate any constraints on $A$. Next, we make computational comparisons of our implementation with the Matlab implementations of two state-of-the-art algorithms, GMRES and ``lsqminnorm". We consider square and rectangular matrices, for $m$ up to $10000$ and $n$ up to $1000000$, encompassing a variety of applications. These results indicate that our implementation outperforms GMRES and ``lsqminnorm" both in runtime and quality of residuals. Moreover, the relative residuals of CTA decrease considerably faster and more consistently than GMRES, and our implementation provides high precision approximation, faster than GMRES reports lack of convergence. With respect to ``lsqminnorm", our implementation runs faster, producing better solutions. Additionally, we present a theoretical study in the dynamics of iterations of residuals in CTA and complement it with revealing visualizations. Lastly, we extend TA for LP feasibility problems, handling non-negativity constraints. Computational results show that our implementation for this extension is on par with those of TA and CTA, suggesting applicability in linear programming and related problems., Comment: 34 pages, 10 figures. arXiv admin note: text overlap with arXiv:2304.04940

We first consider two types of localizations of singular integral operators of convolution type, and show, under mild decay and smoothness conditions on the auxiliary functions, that their boundedness on the local Hardy space $h^1(\mathbb{R}^n)$ is equivalent. We then study the boundedness on $h^1(\mathbb{R}^n)$ of the commutator $[b,T]$ of an inhomogeneous singular integral operator with $b$ in $bmo(\mathbb{R}^n)$, the nonhomogeneous space of functions of bounded mean oscillation. We define local analogues of the atomic space $H^1_b(\mathbb{R}^n)$ introduced by P\'erez in the case of the homogeneous Hardy space and $BMO$, including a variation involving atoms with approximate cancellation conditions. For such an atom $a$, we prove integrability of the associated commutator maximal function and of $[b,T](a)$. For $b$ in $lmo(\mathbb{R}^n)$, this gives $h^1$ to $L^1$ boundedness of $[b,T]$. Finally, under additional approximate cancellation conditions on $T$, we show boundedness to $h^1$.

The paradigm of classifying three-dimensional (3D) topological insulators into strong and weak ones (STI and WTI) opens the door for the discovery of various topological phases of matter protected by different symmetries and defined in different dimensions. However, in contrast to the vast realization of STIs, very few materials have been experimentally identified as being close to WTI. Even amongst those identified, none exists with topological surface states (TSS) exposed in a global bulk band gap that is stable at all temperatures. Here we report the design and observation of an ideal WTI in a quasi-one-dimensional (quasi-1D) bismuth halide, Bi$_{4}$I$_{1.2}$Br$_{2.8}$ (BIB). Via angle-resolved photoemission spectroscopy (ARPES), we identify that BIB hosts TSS on the (100)$\prime$ side surface in the form of two anisotropic $\pi$-offset Dirac cones (DCs) separated in momentum while topologically dark on the (001) top surface. The ARPES data fully determine a unique side-surface Hamiltonian and thereby identify two pairs of non-degenerate helical saddle points and a series of four Lifshitz transitions. The fact that both the surface Dirac and saddle points are in the global bulk band gap of 195 meV, combined with the small Dirac velocities, nontrivial spin texture, and the near-gap chemical potential, qualifies BIB to be not only an ideal WTI but also a fertile ground for topological many-body physics.

Interlayer excitons, or bound electron-hole pairs whose constituent quasiparticles are located in distinct stacked semiconducting layers, are being intensively studied in heterobilayers of two dimensional semiconductors. They owe their existence to an intrinsic type-II band alignment between both layers that convert these into p-n junctions. Here, we unveil a pronounced interlayer exciton (IX) in heterobilayers of metal monochalcogenides, namely gamma-InSe on epsilon-GaSe, whose pronounced emission is adjustable just by varying their thicknesses given their number of layers dependent direct bandgaps. Time-dependent photoluminescense spectroscopy unveils considerably longer interlayer exciton lifetimes with respect to intralayer ones, thus confirming their nature. The linear Stark effect yields a bound electron-hole pair whose separation d is just (3.6 \pm 0.1) {\AA} with d being very close to dSe = 3.4 {\AA} which is the calculated interfacial Se separation. The envelope of IX is twist angle dependent and describable by superimposed emissions that are nearly equally spaced in energy, as if quantized due to localization induced by the small moir\'e periodicity. These heterostacks are characterized by extremely flat interfacial valence bands making them prime candidates for the observation of magnetism or other correlated electronic phases upon carrier doping., Comment: ACS Nano, in press 42 pages plus, 4 figures, plus supplementary information file, containing 21 supplementary figures

In this work we present necessary cancellation conditions for the continuity of linear operators in $h^p(\mathbb{R}^n)$, $0

Whole-body-based human authentication is a promising approach for remote biometrics scenarios. Current literature focuses on either body recognition based on RGB images or gait recognition based on body shapes and walking patterns; both have their advantages and drawbacks. In this work, we propose Dual-Modal Ensemble (DME), which combines both RGB and silhouette data to achieve more robust performances for indoor and outdoor whole-body based recognition. Within DME, we propose GaitPattern, which is inspired by the double helical gait pattern used in traditional gait analysis. The GaitPattern contributes to robust identification performance over a large range of viewing angles. Extensive experimental results on the CASIA-B dataset demonstrate that the proposed method outperforms state-of-the-art recognition systems. We also provide experimental results using the newly collected BRIAR dataset.

We use the variational approach to investigate periodic measures for a class of SPDEs with regime-switching. The hybrid system is driven by degenerate L\'{e}vy noise. We use the Lyapunov function method to study the existence of periodic measures and show the uniqueness of periodic measures by establishing the strong Feller property and irreducibility of the associated time-inhomogeneous semigroup. The main results are applied to stochastic porous media equations with regime-switching.

Long-distance spin transport through anti-ferromagnetic insulators (AFMIs) is a long-standing goal of spintronics research. Unlike conventional spintronics systems, monolayer graphene in quantum Hall regime (QH) offers an unprecedented tuneability of spin-polarization and charge carrier density in QH edge states. Here, using gate-controlled QH edges as spin-dependent injectors and detectors in an all-graphene electrical circuit, for the first time we demonstrate a selective tuning of ambipolar spin transport through graphene $\nu$=0 AFMIs. By modulating polarities of the excitation bias, magnetic fields, and charge carriers that host opposite chiralities, we show that the difference between spin chemical potentials of adjacent edge channels in the spin-injector region is crucial in tuning spin-transport observed across graphene AFMI. We demonstrate that non-local response vanishes upon reversing directions of the co-propagating edge channels when the spin-filters in our devices are no longer selective for a particular spin-polarization. Our results establish a versatile set of methods to tune pure spin transport via an anti-ferromagnetic media and open a pathway to explore their applications for a broad field of antiferromagnetic spintronics research.

Engineering magnetic anisotropy in a ferro- or ferrimagnetic (FM) thin film is crucial in spintronic device. One way to modify the magnetic anisotropy is through the surface of the FM thin film. Here, we report the emergence of a perpendicular magnetic anisotropy (PMA) induced by interfacial interactions in a heterostructure comprised of a garnet ferrimagnet, Y3Fe5O12 (YIG), and the low-symmetry, high spin orbit coupling (SOC) transition metal dichalcogenide, WTe2. At the same time, we also observed an enhancement in Gilbert damping in the WTe2 covered YIG area. Both the magnitude of interface-induced PMA and the Gilbert damping enhancement have no observable WTe2 thickness dependence down to single quadruple-layer, indicating that the interfacial interaction plays a critical role. The ability of WTe2 to enhance the PMA in FM thin film, combined with its previously reported capability to generate out-of-plane damping like spin torque, makes it desirable for magnetic memory applications., Comment: Nano Letters, in press

Light-emitting electronic devices are ubiquitous in key areas of current technology, such as data communications, solid-state lighting, displays, and optical interconnects. Controlling the spectrum of the emitted light electrically, by simply acting on the device bias conditions, is an important goal with potential technological repercussions. However, identifying a material platform enabling broad electrical tuning of the spectrum of electroluminescent devices remains challenging. Here, we propose light-emitting field-effect transistors based on van der Waals interfaces of atomically thin semiconductors as a promising class of devices to achieve this goal. We demonstrate that large spectral changes in room-temperature electroluminescence can be controlled both at the device assembly stage -- by suitably selecting the material forming the interfaces -- and on-chip, by changing the bias to modify the device operation point. Even though the precise relation between device bias and kinetics of the radiative transitions remains to be understood, our experiments show that the physical mechanism responsible for light emission is robust, making these devices compatible with simple large areas device production methods.

In a flat band superconductor, the charge carriers' group velocity vF is extremely slow, quenching their kinetic energy. The emergence of superconductivity thus appears paradoxical, as conventional BCS theory implies a vanishing coherence length, superfluid stiffness, and critical current. Here, using twisted bilayer graphene (tBLG), we explore the profound effect of vanishingly small vF in a Dirac superconducting flat band system Using Schwinger-limited non-linear transport studies, we demonstrate an extremely slow vF ~ 1000 m/s for filling fraction nu between -1/2 and -3/4 of the moire superlattice. In the superconducting state, the same velocity limit constitutes a new limiting mechanism for the critical current, analogous to a relativistic superfluid. Importantly, our measurement of superfluid stiffness, which controls the superconductor's electrodynamic response, shows that it is not dominated by the kinetic energy, but instead by the interaction-driven superconducting gap, consistent with recent theories on a quantum geometric contribution. We find evidence for small pairs, characteristic of the BCS to Bose-Einstein condensation (BEC) crossover, with an unprecedented ratio of the superconducting transition temperature to the Fermi temperature exceeding unity, and discuss how this arises for very strong coupling superconductivity in ultra-flat Dirac bands., Comment: 4 figures

In this work we present a new approach to molecules on Goldberg's local Hardy spaces $h^p(\mathbb{R}^n)$, $0

Adversarial training (AT) is considered to be one of the most reliable defenses against adversarial attacks. However, models trained with AT sacrifice standard accuracy and do not generalize well to novel attacks. Recent works show generalization improvement with adversarial samples under novel threat models such as on-manifold threat model or neural perceptual threat model. However, the former requires exact manifold information while the latter requires algorithm relaxation. Motivated by these considerations, we exploit the underlying manifold information with Normalizing Flow, ensuring that exact manifold assumption holds. Moreover, we propose a novel threat model called Joint Space Threat Model (JSTM), which can serve as a special case of the neural perceptual threat model that does not require additional relaxation to craft the corresponding adversarial attacks. Under JSTM, we develop novel adversarial attacks and defenses. The mixup strategy improves the standard accuracy of neural networks but sacrifices robustness when combined with AT. To tackle this issue, we propose the Robust Mixup strategy in which we maximize the adversity of the interpolated images and gain robustness and prevent overfitting. Our experiments show that Interpolated Joint Space Adversarial Training (IJSAT) achieves good performance in standard accuracy, robustness, and generalization in CIFAR-10/100, OM-ImageNet, and CIFAR-10-C datasets. IJSAT is also flexible and can be used as a data augmentation method to improve standard accuracy and combine with many existing AT approaches to improve robustness., Comment: Under submission

Recent studies have shown that robustness to adversarial attacks can be transferred across networks. In other words, we can make a weak model more robust with the help of a strong teacher model. We ask if instead of learning from a static teacher, can models "learn together" and "teach each other" to achieve better robustness? In this paper, we study how interactions among models affect robustness via knowledge distillation. We propose mutual adversarial training (MAT), in which multiple models are trained together and share the knowledge of adversarial examples to achieve improved robustness. MAT allows robust models to explore a larger space of adversarial samples, and find more robust feature spaces and decision boundaries. Through extensive experiments on CIFAR-10 and CIFAR-100, we demonstrate that MAT can effectively improve model robustness and outperform state-of-the-art methods under white-box attacks, bringing $\sim$8% accuracy gain to vanilla adversarial training (AT) under PGD-100 attacks. In addition, we show that MAT can also mitigate the robustness trade-off among different perturbation types, bringing as much as 13.1% accuracy gain to AT baselines against the union of $l_\infty$, $l_2$ and $l_1$ attacks. These results show the superiority of the proposed method and demonstrate that collaborative learning is an effective strategy for designing robust models., Comment: Under submission

Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to state-of-the-art object detectors. Developing reliable defenses for object detectors against patch attacks is critical but severely understudied. In this paper, we propose Segment and Complete defense (SAC), a general framework for defending object detectors against patch attacks through detection and removal of adversarial patches. We first train a patch segmenter that outputs patch masks which provide pixel-level localization of adversarial patches. We then propose a self adversarial training algorithm to robustify the patch segmenter. In addition, we design a robust shape completion algorithm, which is guaranteed to remove the entire patch from the images if the outputs of the patch segmenter are within a certain Hamming distance of the ground-truth patch masks. Our experiments on COCO and xView datasets demonstrate that SAC achieves superior robustness even under strong adaptive attacks with no reduction in performance on clean images, and generalizes well to unseen patch shapes, attack budgets, and unseen attack methods. Furthermore, we present the APRICOT-Mask dataset, which augments the APRICOT dataset with pixel-level annotations of adversarial patches. We show SAC can significantly reduce the targeted attack success rate of physical patch attacks. Our code is available at https://github.com/joellliu/SegmentAndComplete., Comment: CVPR 2022 camera ready

The adversarial attack literature contains a myriad of algorithms for crafting perturbations which yield pathological behavior in neural networks. In many cases, multiple algorithms target the same tasks and even enforce the same constraints. In this work, we show that different attack algorithms produce adversarial examples which are distinct not only in their effectiveness but also in how they qualitatively affect their victims. We begin by demonstrating that one can determine the attack algorithm that crafted an adversarial example. Then, we leverage recent advances in parameter-space saliency maps to show, both visually and quantitatively, that adversarial attack algorithms differ in which parts of the network and image they target. Our findings suggest that prospective adversarial attacks should be compared not only via their success rates at fooling models but also via deeper downstream effects they have on victims.

Quasi-one-dimensional (1D) materials provide a superior platform for characterizing and tuning topological phases for two reasons: i) existence for multiple cleavable surfaces that enables better experimental identification of topological classification, and ii) stronger response to perturbations such as strain for tuning topological phases compared to higher dimensional crystal structures. In this paper, we present experimental evidence for a room-temperature topological phase transition in the quasi-1D material Bi$_4$I$_4$, mediated via a first order structural transition between two distinct stacking orders of the weakly-coupled chains. Using high resolution angle-resolved photoemission spectroscopy on the two natural cleavable surfaces, we identify the high temperature $\beta$ phase to be the first weak topological insulator with gapless Dirac cones on the (100) surface and no Dirac crossing on the (001) surface, while in the low temperature $\alpha$ phase, the topological surface state on the (100) surface opens a gap, consistent with a recent theoretical prediction of a higher-order topological insulator beyond the scope of the established topological materials databases that hosts gapless hinge states. Our results not only identify a rare topological phase transition between first-order and second-order topological insulators but also establish a novel quasi-1D material platform for exploring unprecedented physics., Comment: 9 pages, 4 figures, accepted for publication in Phys. Rev. X

Symmetry breaking in two-dimensional layered materials plays a significant role in their macroscopic electrical, optical, magnetic and topological properties, including but not limited to spin-polarization effects, valley-contrasting physics, nonlinear Hall effects, nematic order, ferroelectricity, Bose-Einstein condensation and unconventional superconductivity. Engineering symmetry breaking of two-dimensional layered materials not only offers extraordinary opportunities to tune their physical properties, but also provides unprecedented possibilities to introduce completely new physics and technological innovations in electronics, photonics and optoelectronics. Indeed, over the past 15 years, a wide variety of physical, structural and chemical approaches have been developed to engineer symmetry breaking of two-dimensional layered materials. In this Review, we focus on the recent progresses on engineering the breaking of inversion, rotational, time reversal and spontaneous gauge symmetries in two-dimensional layered materials, and illustrate our perspectives on how these may lead to potential new physics and applications., Comment: 35 pages, 4 figures

Adversarial training is a popular defense strategy against attack threat models with bounded Lp norms. However, it often degrades the model performance on normal images and the defense does not generalize well to novel attacks. Given the success of deep generative models such as GANs and VAEs in characterizing the underlying manifold of images, we investigate whether or not the aforementioned problems can be remedied by exploiting the underlying manifold information. To this end, we construct an "On-Manifold ImageNet" (OM-ImageNet) dataset by projecting the ImageNet samples onto the manifold learned by StyleGSN. For this dataset, the underlying manifold information is exact. Using OM-ImageNet, we first show that adversarial training in the latent space of images improves both standard accuracy and robustness to on-manifold attacks. However, since no out-of-manifold perturbations are realized, the defense can be broken by Lp adversarial attacks. We further propose Dual Manifold Adversarial Training (DMAT) where adversarial perturbations in both latent and image spaces are used in robustifying the model. Our DMAT improves performance on normal images, and achieves comparable robustness to the standard adversarial training against Lp attacks. In addition, we observe that models defended by DMAT achieve improved robustness against novel attacks which manipulate images by global color shifts or various types of image filtering. Interestingly, similar improvements are also achieved when the defended models are tested on out-of-manifold natural images. These results demonstrate the potential benefits of using manifold information in enhancing robustness of deep learning models against various types of novel adversarial attacks.

Twisted bilayer graphene (TBG) with interlayer twist angles near the magic angle $\approx 1.08^{\circ}$ hosts flat bands and exhibits correlated states including Mott-like insulators, superconductivity and magnetism. Here we report combined temperature-dependent transport measurements of the longitudinal and Hall resistivities in close to magic-angle TBG. While the observed longitudinal resistivity follows linear temperature $T$ dependence consistent with previous reports, the Hall resistance shows an anomalous $T$ dependence with the cotangent of the Hall angle cot $\Theta{_H} \propto T^2$. Boltzmann theory for quasiparticle transport predicts that both the resistivity and cot $\Theta{_H}$ should have the same $T$ dependence, contradicting the observed behavior. This failure of quasiparticle-based theories is reminiscent of other correlated strange metals such as cuprates.

Helical conductors with spin-momentum locking are promising platforms for Majorana fermions. Here we report observation of two topologically distinct phases supporting helical edge states in charge neutral Bernal-stacked tetralayer graphene in Hall bar and Corbino geometries. As the magnetic field B and out-of-plane displacement field D are varied, we observe a phase diagram consisting of an insulating phase and two metallic phases, with 0, 1 and 2 helical edge states, respectively. These phases are accounted for by a theoretical model that relates their conductance to spin-polarization plateaus. Transitions between them arise from a competition among inter-layer hopping, electrostatic and exchange interaction energies. Our work highlights the complex competing symmetries and the rich quantum phases in few-layer graphene., Comment: Accepted by PRL

Based on the geometric {\it Triangle Algorithm} for testing membership of a point in a convex set, we present a novel iterative algorithm for testing the solvability of a real linear system $Ax=b$, where $A$ is an $m \times n$ matrix of arbitrary rank. Let $C_{A,r}$ be the ellipsoid determined as the image of the Euclidean ball of radius $r$ under the linear map $A$. The basic procedure in our algorithm computes a point in $C_{A,r}$ that is either within $\varepsilon$ distance to $b$, or acts as a certificate proving $b \not \in C_{A,r}$. Each iteration takes $O(mn)$ operations and when $b$ is well-situated in $C_{A,r}$, the number of iterations is proportional to $\log{(1/\varepsilon)}$. If $Ax=b$ is solvable the algorithm computes an approximate solution or the minimum-norm solution. Otherwise, it computes a certificate to unsolvability, or the minimum-norm least-squares solution. It is also applicable to complex input. In a computational comparison with the state-of-the-art algorithm BiCGSTAB ({\it Bi-conjugate gradient method stabilized}), the Triangle Algorithm is very competitive. In fact, when the iterates of BiCGSTAB do not converge, our algorithm can verify $Ax=b$ is unsolvable and approximate the minimum-norm least-squares solution. The Triangle Algorithm is robust, simple to implement, and requires no preconditioner, making it attractive to practitioners, as well as researchers and educators., Comment: 12 pages, 6 figures