Search

Two-dimensional transition metal carbides (MXenes), especially their few-layered nanosheets, have triggered burgeoning research attentions owing to their superiorities including extraordinary conductivity, accessible active surface, and adjustable processability. Molten salts etching route further achieves their controllable surface chemistry. However, the method encounters challenges in achieving few-layer structures due to more complex delamination behaviors. Herein, we present an efficient strategy to fabricate Cl- or Br-terminated MXene nanoflakes with few-layers, achieved by electrochemical intercalation of Li ions and concomitant solvent molecules in the electrolyte solution, with gaseous scissors (propylene molecules) to break up interlayer forces. By controlling cut-off voltages, the optimal protocol results in nanosheets with an ultrahigh yield (~93%) and preserved surface chemistry. The resultant MXenes dispersions were employed as lubricants to enhance tribovoltaic nanogenerators, where Ti3C2Br2 displayed superior electrical output. These findings facilitate the understanding of MXenes' intrinsic physical properties and enable the nanoengineering of advanced electronic devices.

Traditional unlearnable strategies have been proposed to prevent unauthorized users from training on the 2D image data. With more 3D point cloud data containing sensitivity information, unauthorized usage of this new type data has also become a serious concern. To address this, we propose the first integral unlearnable framework for 3D point clouds including two processes: (i) we propose an unlearnable data protection scheme, involving a class-wise setting established by a category-adaptive allocation strategy and multi-transformations assigned to samples; (ii) we propose a data restoration scheme that utilizes class-wise inverse matrix transformation, thus enabling authorized-only training for unlearnable data. This restoration process is a practical issue overlooked in most existing unlearnable literature, \ie, even authorized users struggle to gain knowledge from 3D unlearnable data. Both theoretical and empirical results (including 6 datasets, 16 models, and 2 tasks) demonstrate the effectiveness of our proposed unlearnable framework. Our code is available at \url{https://github.com/CGCL-codes/UnlearnablePC}, Comment: NeurIPS 2024

Segment Anything Model (SAM) has recently gained much attention for its outstanding generalization to unseen data and tasks. Despite its promising prospect, the vulnerabilities of SAM, especially to universal adversarial perturbation (UAP) have not been thoroughly investigated yet. In this paper, we propose DarkSAM, the first prompt-free universal attack framework against SAM, including a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. We first divide the output of SAM into foreground and background. Then, we design a shadow target strategy to obtain the semantic blueprint of the image as the attack target. DarkSAM is dedicated to fooling SAM by extracting and destroying crucial object features from images in both spatial and frequency domains. In the spatial domain, we disrupt the semantics of both the foreground and background in the image to confuse SAM. In the frequency domain, we further enhance the attack effectiveness by distorting the high-frequency components (i.e., texture information) of the image. Consequently, with a single UAP, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts. Experimental results on four datasets for SAM and its two variant models demonstrate the powerful attack capability and transferability of DarkSAM., Comment: This paper has been accepted by the 38th Annual Conference on Neural Information Processing Systems (NeurIPS'24)

The success of deep face recognition (FR) systems has raised serious privacy concerns due to their ability to enable unauthorized tracking of users in the digital world. Previous studies proposed introducing imperceptible adversarial noises into face images to deceive those face recognition models, thus achieving the goal of enhancing facial privacy protection. Nevertheless, they heavily rely on user-chosen references to guide the generation of adversarial noises, and cannot simultaneously construct natural and highly transferable adversarial face images in black-box scenarios. In light of this, we present a novel face privacy protection scheme with improved transferability while maintain high visual quality. We propose shaping the entire face space directly instead of exploiting one kind of facial characteristic like makeup information to integrate adversarial noises. To achieve this goal, we first exploit global adversarial latent search to traverse the latent space of the generative model, thereby creating natural adversarial face images with high transferability. We then introduce a key landmark regularization module to preserve the visual identity information. Finally, we investigate the impacts of various kinds of latent spaces and find that $\mathcal{F}$ latent space benefits the trade-off between visual naturalness and adversarial transferability. Extensive experiments over two datasets demonstrate that our approach significantly enhances attack transferability while maintaining high visual quality, outperforming state-of-the-art methods by an average 25% improvement in deep FR models and 10% improvement on commercial FR APIs, including Face++, Aliyun, and Tencent., Comment: Accepted by ACM MM 2024

Embodied AI represents systems where AI is integrated into physical entities, enabling them to perceive and interact with their surroundings. Large Language Model (LLM), which exhibits powerful language understanding abilities, has been extensively employed in embodied AI by facilitating sophisticated task planning. However, a critical safety issue remains overlooked: could these embodied LLMs perpetrate harmful behaviors? In response, we introduce BadRobot, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions. Specifically, three vulnerabilities are exploited to achieve this type of attack: (i) manipulation of LLMs within robotic systems, (ii) misalignment between linguistic outputs and physical actions, and (iii) unintentional hazardous behaviors caused by world knowledge's flaws. Furthermore, we construct a benchmark of various malicious physical action queries to evaluate BadRobot's attack performance. Based on this benchmark, extensive experiments against existing prominent embodied LLM frameworks (e.g., Voxposer, Code as Policies, and ProgPrompt) demonstrate the effectiveness of our BadRobot. Warning: This paper contains harmful AI-generated language and aggressive actions., Comment: 38 pages, 16 figures

Multi-wavelength switchable single-frequency microlasers in a broad spectral range are highly desirable for integrated photonic applications due to their dynamic switching functionality, narrow linewidth, and high side-mode-suppression-ratio (SMSR). Here, a strategy based on highly efficient successive excitation of different stimulated multi-photon hyper-Raman scattering (SMPHRS) processes is proposed to generate multi-wavelength switchable single-frequency hyper-Raman microlasers. This is achieved through collective precise dispersion management for arranging excitation wavelengths to trigger different phase-matched SMPHRS processes in order, mode-hopping-free tuning of the pump wavelength within a wide range of 0.75 nm by leveraging strong thermo-optical broadening of ultra-high Q modes, and simultaneously suppressing harmonics generation in a lithium niobate microcavity with high second-order nonlinearity. As a result, under continuous-wave laser pump at a low level of only 3.9 mW, SMPHRS processes from two- to five-photons emerged step by step and almost depleted previously generated multi-photon Raman signal. Consequently, four-wavelength dynamically switchable single-mode lasing from near infrared (857 nm) to ultraviolet (350 nm) spanning beyond the record range (~500 nm) with high SMSRs >35 dB is reported., Comment: 17 pages,5 figures, and 1 table

We present the phase-connected timing solutions of all the five pulsars in globular cluster (GC) M3 (NGC 5272), namely PSRs M3A to F (PSRs J1342+2822A to F), with the exception of PSR M3C, from FAST archival data. In these timing solutions, those of PSRs M3E, and F are obtained for the first time. We find that PSRs M3E and F have low mass companions, and are in circular orbits with periods of 7.1 and 3.0 days, respectively. For PSR M3C, we have not detected it in all the 41 observations. We found no X-ray counterparts for these pulsars in archival Chandra images in the band of 0.2-20 keV. We noticed that the pulsars in M3 seem to be native. From the Auto-Correlation Function (ACF) analysis of the M3A's and M3B's dynamic spectra, the scintillation timescale ranges from $7.0\pm0.3$ min to $60.0\pm0.6$ min, and the scintillation bandwidth ranges from $4.6\pm0.2$ MHz to $57.1\pm1.1$ MHz. The measured scintillation bandwidths from the dynamic spectra indicate strong scintillation, and the scattering medium is anisotropic. From the secondary spectra, we captured a scintillation arc only for PSR M3B with a curvature of $649\pm23 {\rm m}^{-1} {\rm mHz}^{-2}$., Comment: 14 pages, 4 figures, accepted for publication in The Astrophysical Journal

We present the discovery of 8 isolated millisecond pulsars in Globular Cluster (GC) NGC 6517 using the Five-Hundred-meter Aperture Spherical radio Telescope (FAST). The spin periods of those pulsars (namely PSR J1801-0857K to R, or, NGC 6517K to R) are all shorter than 10 ms. With these discoveries, NGC 6517 is currently the GC with the most known pulsars in the FAST sky. The largest difference in dispersion measure of the pulsars in NGC 6517 is 11.2 cm$^{-3}$ pc, the second among all GCs. The fraction of isolated pulsars in this GC (16 of 17, 94$\%$) is consistent with previous studies indicating an overabundance of isolated pulsars in the densest GCs, especially in those undergoing cluster core collapse. Considering the FAST GC pulsar discoveries, we modeled the GC pulsar population using the empirical Bayesian method described by Turk and Lorimer with the recent counts. Using this approach, we find that the expected number of potential pulsars in GCs seems to be correlated with the central escape velocity, hence, the GCs Liller 1, NGC 6441, M54 (NGC 6715), and $\omega$-Cen (NGC 5139) are expected to host the largest numbers of pulsars., Comment: 21 pages, 2 figures, accepted for publication in The Astrophysical Journal Letters

Federated learning (FL) has been demonstrated to be susceptible to backdoor attacks. However, existing academic studies on FL backdoor attacks rely on a high proportion of real clients with main task-related data, which is impractical. In the context of real-world industrial scenarios, even the simplest defense suffices to defend against the state-of-the-art attack, 3DFed. A practical FL backdoor attack remains in a nascent stage of development. To bridge this gap, we present DarkFed. Initially, we emulate a series of fake clients, thereby achieving the attacker proportion typical of academic research scenarios. Given that these emulated fake clients lack genuine training data, we further propose a data-free approach to backdoor FL. Specifically, we delve into the feasibility of injecting a backdoor using a shadow dataset. Our exploration reveals that impressive attack performance can be achieved, even when there is a substantial gap between the shadow dataset and the main task dataset. This holds true even when employing synthetic data devoid of any semantic information as the shadow dataset. Subsequently, we strategically construct a series of covert backdoor updates in an optimized manner, mimicking the properties of benign updates, to evade detection by defenses. A substantial body of empirical evidence validates the tangible effectiveness of DarkFed., Comment: This paper has been accepted by IJCAI 2024

With the evolution of self-supervised learning, the pre-training paradigm has emerged as a predominant solution within the deep learning landscape. Model providers furnish pre-trained encoders designed to function as versatile feature extractors, enabling downstream users to harness the benefits of expansive models with minimal effort through fine-tuning. Nevertheless, recent works have exposed a vulnerability in pre-trained encoders, highlighting their susceptibility to downstream-agnostic adversarial examples (DAEs) meticulously crafted by attackers. The lingering question pertains to the feasibility of fortifying the robustness of downstream models against DAEs, particularly in scenarios where the pre-trained encoders are publicly accessible to the attackers. In this paper, we initially delve into existing defensive mechanisms against adversarial examples within the pre-training paradigm. Our findings reveal that the failure of current defenses stems from the domain shift between pre-training data and downstream tasks, as well as the sensitivity of encoder parameters. In response to these challenges, we propose Genetic Evolution-Nurtured Adversarial Fine-tuning (Gen-AF), a two-stage adversarial fine-tuning approach aimed at enhancing the robustness of downstream models. Our extensive experiments, conducted across ten self-supervised training methods and six datasets, demonstrate that Gen-AF attains high testing accuracy and robust testing accuracy against state-of-the-art DAEs.

\textit{Federated learning} (FL) and \textit{split learning} (SL) are prevailing distributed paradigms in recent years. They both enable shared global model training while keeping data localized on users' devices. The former excels in parallel execution capabilities, while the latter enjoys low dependence on edge computing resources and strong privacy protection. \textit{Split federated learning} (SFL) combines the strengths of both FL and SL, making it one of the most popular distributed architectures. Furthermore, a recent study has claimed that SFL exhibits robustness against poisoning attacks, with a fivefold improvement compared to FL in terms of robustness. In this paper, we present a novel poisoning attack known as MISA. It poisons both the top and bottom models, causing a \textbf{\underline{misa}}lignment in the global model, ultimately leading to a drastic accuracy collapse. This attack unveils the vulnerabilities in SFL, challenging the conventional belief that SFL is robust against poisoning attacks. Extensive experiments demonstrate that our proposed MISA poses a significant threat to the availability of SFL, underscoring the imperative for academia and industry to accord this matter due attention., Comment: This paper has been accepted by the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP 2024)

Photonic integrated Raman microlasers, particularly discrete multi-color lasers which are crucial for extending the emission wavelength range of chip-scale laser sources to much shorter wavelength, are highly in demand for various spectroscopy, microscopy analysis, and biological detection. However, integrated multi-color Raman microlasers have yet to be demonstrated because of the requirement of high-Q microresonators possessing large second-order nonlinearity and strong Raman phonon branches and the challenging in cavity-enhanced multi-photon hyper-Raman scattering parametric process. In this work, integrated multi-color Raman lasers have been demonstrated for the first time at weak pump levels, via the excitation of high-Q (>6 X 10^6) phase-matched modes in single thin-film lithium niobate (TFLN) microresonators by dispersion engineering. Raman lasing was observed at 1712 nm for a 1546-nm pump threshold power of only 620 uW. Furthermore, multi-color Raman lasers were realized at discrete wavelengths of 1712 nm, 813 nm, 533 nm and 406 nm with pump levels as low as 1.60 mW, which is more than two order of magnitude lower than the current records (i.e., 200 mW) in bulk resonators, allowed by the fulfillment of the requisite conditions consisting of broadband natural phase match, multiple-resonance and high Q-factors., Comment: 16 pages,4 figures

We present the discovery of three pulsars in the Globular Cluster (GC) M15 (NGC 7078) by the Five-hundred-meter Aperture Spherical radio Telescope (FAST). PSR J2129+1210J (M15J) is a millisecond pulsar with a spin period of 11.84 ms and a dispersion measure of 66.68 pc cm-3. Both PSR J2129+1210K and L (M15K and L) are long-period pulsars with spin periods of 1928 ms and 3961 ms, respectively. M15L is the GC pulsar with the longest spin period known. The timing solutions of M15A to M15H are updated. As predicted by Ridolfi et al.(2018), the flux density of M15C keeps decreasing and the latest detection in our dataset was on December 20th, 2022. We have also detected M15I's signal for the first time since its discovery. Current timing suggests that it is an isolated pulsar., Comment: 13 pages, 4 figures, 3 tables, accepted by ApJ Letters

Unlearnable datasets lead to a drastic drop in the generalization performance of models trained on them by introducing elaborate and imperceptible perturbations into clean training sets. Many existing defenses, e.g., JPEG compression and adversarial training, effectively counter UDs based on norm-constrained additive noise. However, a fire-new type of convolution-based UDs have been proposed and render existing defenses all ineffective, presenting a greater challenge to defenders. To address this, we express the convolution-based unlearnable sample as the result of multiplying a matrix by a clean sample in a simplified scenario, and formalize the intra-class matrix inconsistency as $\Theta_{imi}$, inter-class matrix consistency as $\Theta_{imc}$ to investigate the working mechanism of the convolution-based UDs. We conjecture that increasing both of these metrics will mitigate the unlearnability effect. Through validation experiments that commendably support our hypothesis, we further design a random matrix to boost both $\Theta_{imi}$ and $\Theta_{imc}$, achieving a notable degree of defense effect. Hence, by building upon and extending these facts, we first propose a brand-new image COrruption that employs randomly multiplicative transformation via INterpolation operation to successfully defend against convolution-based UDs. Our approach leverages global pixel random interpolations, effectively suppressing the impact of multiplicative noise in convolution-based UDs. Additionally, we have also designed two new forms of convolution-based UDs, and find that our defense is the most effective against them.

The nonclassicality of a macroscopic single-mode optical superposition state is potentially convertible into entanglement, when the state is mixed with the vacuum on a beam splitter. Considering light beams with polarization degree of freedom in Euclidean space as coherent product states in a bipartite Hilbert space, we propose a method to convert the two orthogonal polarizations into simultaneous entanglement and classical nonseparability through nonclassicality in the superpositions of coherent and displaced Fock states. Equivalent Bell state emerges from the resulted superpositions and the proportion of mixed entanglement and nonseparablity is determined by the displacement amplitudes along the polarization directions. We characterize the state nonclassicality via features in Wigner distributions and propose an experimental method for generating these states and measuring them via homodyne tomography.

We demonstrate single-mode microdisk lasers in the telecom band with ultra-low thresholds on erbium-ytterbium co-doped thin-film lithium niobate (TFLN). The active microdisk were fabricated with high-Q factors by photo-lithography assisted chemo-mechanical etching. Thanks to the erbium-ytterbium co-doping providing high optical gain, the ultra-low loss nanostructuring, and the excitation of high-Q coherent polygon modes which suppresses multi-mode lasing and allows high spatial mode overlap factor between pump and lasing modes, single-mode laser emission operating at 1530 nm wavelength was observed with an ultra-low threshold, under 980-nm-band optical pump. The threshold was measured as low as 1 uW, which is one order of magnitude smaller than the best results previously reported in single-mode active TFLN microlasers. And the conversion efficiency reaches 0.406%, which is also the highest value reported in single-mode active TFLN microlasers., Comment: 5 pages,3 figures

Multimodal contrastive learning aims to train a general-purpose feature extractor, such as CLIP, on vast amounts of raw, unlabeled paired image-text data. This can greatly benefit various complex downstream tasks, including cross-modal image-text retrieval and image classification. Despite its promising prospect, the security issue of cross-modal pre-trained encoder has not been fully explored yet, especially when the pre-trained encoder is publicly available for commercial use. In this work, we propose AdvCLIP, the first attack framework for generating downstream-agnostic adversarial examples based on cross-modal pre-trained encoders. AdvCLIP aims to construct a universal adversarial patch for a set of natural images that can fool all the downstream tasks inheriting the victim cross-modal pre-trained encoder. To address the challenges of heterogeneity between different modalities and unknown downstream tasks, we first build a topological graph structure to capture the relevant positions between target samples and their neighbors. Then, we design a topology-deviation based generative adversarial network to generate a universal adversarial patch. By adding the patch to images, we minimize their embeddings similarity to different modality and perturb the sample distribution in the feature space, achieving unviersal non-targeted attacks. Our results demonstrate the excellent attack performance of AdvCLIP on two types of downstream tasks across eight datasets. We also tailor three popular defenses to mitigate AdvCLIP, highlighting the need for new defense mechanisms to defend cross-modal pre-trained encoders., Comment: This paper has been accepted by the ACM International Conference on Multimedia (ACM MM '23, October 29-November 3, 2023, Ottawa, ON, Canada)

\textit{Federated learning} (FL) is a nascent distributed learning paradigm to train a shared global model without violating users' privacy. FL has been shown to be vulnerable to various Byzantine attacks, where malicious participants could independently or collusively upload well-crafted updates to deteriorate the performance of the global model. However, existing defenses could only mitigate part of Byzantine attacks, without providing an all-sided shield for FL. It is difficult to simply combine them as they rely on totally contradictory assumptions. In this paper, we propose FPD, a \underline{\textbf{f}}our-\underline{\textbf{p}}ronged \underline{\textbf{d}}efense against both non-colluding and colluding Byzantine attacks. Our main idea is to utilize absolute similarity to filter updates rather than relative similarity used in existingI works. To this end, we first propose a reliable client selection strategy to prevent the majority of threats in the bud. Then we design a simple but effective score-based detection method to mitigate colluding attacks. Third, we construct an enhanced spectral-based outlier detector to accurately discard abnormal updates when the training data is \textit{not independent and identically distributed} (non-IID). Finally, we design update denoising to rectify the direction of the slightly noisy but harmful updates. The four sequentially combined modules can effectively reconcile the contradiction in addressing non-colluding and colluding Byzantine attacks. Extensive experiments over three benchmark image classification datasets against four state-of-the-art Byzantine attacks demonstrate that FPD drastically outperforms existing defenses in IID and non-IID scenarios (with $30\%$ improvement on model accuracy)., Comment: This paper has been accepted by the 31st ACM International Conference on Multimedia (MM '23)

Adversarial examples (AEs) for DNNs have been shown to be transferable: AEs that successfully fool white-box surrogate models can also deceive other black-box models with different architectures. Although a bunch of empirical studies have provided guidance on generating highly transferable AEs, many of these findings lack explanations and even lead to inconsistent advice. In this paper, we take a further step towards understanding adversarial transferability, with a particular focus on surrogate aspects. Starting from the intriguing little robustness phenomenon, where models adversarially trained with mildly perturbed adversarial samples can serve as better surrogates, we attribute it to a trade-off between two predominant factors: model smoothness and gradient similarity. Our investigations focus on their joint effects, rather than their separate correlations with transferability. Through a series of theoretical and empirical analyses, we conjecture that the data distribution shift in adversarial training explains the degradation of gradient similarity. Building on these insights, we explore the impacts of data augmentation and gradient regularization on transferability and identify that the trade-off generally exists in the various training mechanisms, thus building a comprehensive blueprint for the regulation mechanism behind transferability. Finally, we provide a general route for constructing better surrogates to boost transferability which optimizes both model smoothness and gradient similarity simultaneously, e.g., the combination of input gradient regularization and sharpness-aware minimization (SAM), validated by extensive experiments. In summary, we call for attention to the united impacts of these two factors for launching effective transfer attacks, rather than optimizing one while ignoring the other, and emphasize the crucial role of manipulating surrogate models., Comment: IEEE Symposium on Security and Privacy (Oakland) 2024; Extended version of camera-ready

Objective: Social media-based public health research is crucial for epidemic surveillance, but most studies identify relevant corpora with keyword-matching. This study develops a system to streamline the process of curating colloquial medical dictionaries. We demonstrate the pipeline by curating a UMLS-colloquial symptom dictionary from COVID-19-related tweets as proof of concept. Methods: COVID-19-related tweets from February 1, 2020, to April 30, 2022 were used. The pipeline includes three modules: a named entity recognition module to detect symptoms in tweets; an entity normalization module to aggregate detected entities; and a mapping module that iteratively maps entities to Unified Medical Language System concepts. A random 500 entity sample were drawn from the final dictionary for accuracy validation. Additionally, we conducted a symptom frequency distribution analysis to compare our dictionary to a pre-defined lexicon from previous research. Results: We identified 498,480 unique symptom entity expressions from the tweets. Pre-processing reduces the number to 18,226. The final dictionary contains 38,175 unique expressions of symptoms that can be mapped to 966 UMLS concepts (accuracy = 95%). Symptom distribution analysis found that our dictionary detects more symptoms and is effective at identifying psychiatric disorders like anxiety and depression, often missed by pre-defined lexicons. Conclusions: This study advances public health research by implementing a novel, systematic pipeline for curating symptom lexicons from social media data. The final lexicon's high accuracy, validated by medical professionals, underscores the potential of this methodology to reliably interpret and categorize vast amounts of unstructured social media data into actionable medical insights across diverse linguistic and regional landscapes., Comment: Updated full paper. Abstract presented at IEEE ICHI 2023 and AMIA Annual Symposium 2023