Search

This study investigates vulnerabilities in dependencies of sampled open-source software (OSS) projects, the relationship between these and overall project security, and how developers' behaviors and practices influence their mitigation. Through analysis of OSS projects, we have identified common issues in outdated or unmaintained dependencies, including pointer dereferences and array bounds violations, that pose significant security risks. We have also examined developer responses to formal verifier reports, noting a tendency to dismiss potential issues as false positives, which can lead to overlooked vulnerabilities. Our results suggest that reducing the number of direct dependencies and prioritizing well-established libraries with strong security records are effective strategies for enhancing the software security landscape. Notably, four vulnerabilities were fixed as a result of this study, demonstrating the effectiveness of our mitigation strategies., Comment: 16 pages

The Southern Photometric Local Universe Survey (S-PLUS) is a project to map $\sim9300$ sq deg of the sky using twelve bands (seven narrow and five broadbands). Observations are performed with the T80-South telescope, a robotic telescope located at the Cerro Tololo Observatory in Chile. The survey footprint consists of several large contiguous areas, including fields at high and low galactic latitudes, and towards the Magellanic Clouds. S-PLUS uses fixed exposure times to reach point source depths of about $21$ mag in the $griz$ and $20$ mag in the $u$ and the narrow filters. This paper describes the S-PLUS Data Release 4 (DR4), which includes calibrated images and derived catalogues for over 3000 sq deg, covering the aforementioned area. The catalogues provide multi-band photometry performed with the tools \texttt{DoPHOT} and \texttt{SExtractor} -- point spread function (\PSF) and aperture photometry, respectively. In addition to the characterization, we also present the scientific potential of the data. We use statistical tools to present and compare the photometry obtained through different methods. Overall we find good agreement between the different methods, with a slight systematic offset of 0.05\,mag between our \PSF and aperture photometry. We show that the astrometry accuracy is equivalent to that obtained in previous S-PLUS data releases, even in very crowded fields where photometric extraction is challenging. The depths of main survey (MS) photometry for a minimum signal-to-noise ratio $S/N = 3$ reach from $\sim19.5$ for the bluer bands to $\sim21.5$ mag on the red. The range of magnitudes over which accurate \PSF photometry is obtained is shallower, reaching $\sim19$ to $\sim20.5$ mag depending on the filter. Based on these photometric data, we provide star-galaxy-quasar classification and photometric redshift for millions of objects., Comment: 26 pages, 17 figures, 14 tables, accepted for A&A

In the world of embedded systems, optimizing actions with the uncertain costs of multiple resources is a complex challenge. Existing methods include plan building based on Monte Carlo Tree Search (MCTS), an approach that thrives in multiple online planning scenarios. However, these methods often overlook uncertainty in worst-case cost estimations. A system can fail to operate before achieving a critical objective when actual costs exceed optimistic worst-case estimates. Conversely, a system based on pessimistic worst-case estimates would lead to resource over-provisioning even for less critical objectives. To solve similar issues, the Mixed Criticality (MC) approach has been developed in the real-time systems community. In this paper, we propose to extend the MCTS heuristic in three directions. Firstly, we reformulate the concept of MC to account for uncertain worst-case costs. High-criticality tasks must be executed regardless of their uncertain costs. Low-criticality tasks are either executed in low-criticality mode utilizing resources up-to their optimistic worst-case estimates, or executed in high-criticality mode by degrading them, or discarded when resources are scarce. Secondly, although the MC approach was originally developed for real-time systems, focusing primarily on worst-case execution time as the only uncertain resource, our approach extends the concept of resources to deal with several resources at once, such as the time and energy required to perform an action. Finally, we propose an extension of MCTS with MC concepts, which we refer to as $(MC)^2TS$, to efficiently adjust resource allocation to uncertain costs according to the criticality of actions. We demonstrate our approach in an active perception scenario. Our evaluation shows $(MC)^2TS$ outperforms the traditional MCTS regardless of whether the worst case estimates are optimistic or pessimistic.

Training large language models (LLMs) requires a substantial investment of time and money. To get a good return on investment, the developers spend considerable effort ensuring that the model never produces harmful and offensive outputs. However, bad-faith actors may still try to slander the reputation of an LLM by publicly reporting a forged output. In this paper, we show that defending against such slander attacks requires reconstructing the input of the forged output or proving that it does not exist. To do so, we propose and evaluate a search based approach for targeted adversarial attacks for LLMs. Our experiments show that we are rarely able to reconstruct the exact input of an arbitrary output, thus demonstrating that LLMs are still vulnerable to slander attacks., Comment: 4 pages, 3 figures

A framework with sets of attacking arguments (SETAF) is an extension of the well-known Dung's Abstract Argumentation Frameworks (AAFs) that allows joint attacks on arguments. In this paper, we provide a translation from Normal Logic Programs (NLPs) to SETAFs and vice versa, from SETAFs to NLPs. We show that there is pairwise equivalence between their semantics, including the equivalence between L-stable and semi-stable semantics. Furthermore, for a class of NLPs called Redundancy-Free Atomic Logic Programs (RFALPs), there is also a structural equivalence as these back-and-forth translations are each other's inverse. Then, we show that RFALPs are as expressive as NLPs by transforming any NLP into an equivalent RFALP through a series of program transformations already known in the literature. We also show that these program transformations are confluent, meaning that every NLP will be transformed into a unique RFALP. The results presented in this paper enhance our understanding that NLPs and SETAFs are essentially the same formalism. Under consideration in Theory and Practice of Logic Programming (TPLP)., Comment: 44 pages, 5 figures. Under consideration in Theory and Practice of Logic Programming (TPLP)

In heterogeneous scenarios where the data distribution amongst the Federated Learning (FL) participants is Non-Independent and Identically distributed (Non-IID), FL suffers from the well known problem of data heterogeneity. This leads the performance of FL to be significantly degraded, as the global model tends to struggle to converge. To solve this problem, we propose Differentially Private Synthetic Data Aided Federated Learning Using Foundation Models (DPSDA-FL), a novel data augmentation strategy that aids in homogenizing the local data present on the clients' side. DPSDA-FL improves the training of the local models by leveraging differentially private synthetic data generated from foundation models. We demonstrate the effectiveness of our approach by evaluating it on the benchmark image dataset: CIFAR-10. Our experimental results have shown that DPSDA-FL can improve class recall and classification accuracy of the global model by up to 26% and 9%, respectively, in FL with Non-IID issues.

This paper introduces a tool for verifying Python programs, which, using type annotation and front-end processing, can harness the capabilities of a bounded model-checking (BMC) pipeline. It transforms an input program into an abstract syntax tree to infer and add type information. Then, it translates Python expressions and statements into an intermediate representation. Finally, it converts this description into formulae evaluated with satisfiability modulo theories (SMT) solvers. The proposed approach was realized with the efficient SMT-based bounded model checker (ESBMC), which resulted in a tool called ESBMC-Python, the first BMC-based Python-code verifier. Experimental results, with a test suite specifically developed for this purpose, showed its effectiveness, where successful and failed tests were correctly evaluated. Moreover, it found a real problem in the Ethereum Consensus Specification.

This paper presents Efficient SMT-Based Context-Bounded Model Checker (ESBMC) v7.6, an extended version based on previous work on ESBMC v7.3 by K. Song et al. The v7.3 introduced a new Clang-based C++ front-end to address the challenges posed by modern C++ programs. Although the new front-end has demonstrated significant potential in previous studies, it remains in the developmental stage and lacks several essential features. ESBMC v7.6 further enhanced this foundation by adding and extending features based on the Clang AST, such as 1) exception handling, 2) extended memory management and memory safety verification, including dangling pointers, duplicate deallocation, memory leaks and rvalue references and 3) new operational models for STL updating the outdated C++ operational models. Our extensive experiments demonstrate that ESBMC v7.6 can handle a significantly broader range of C++ features introduced in recent versions of the C++ standard., Comment: 27 pages, 2 figures. arXiv admin note: substantial text overlap with arXiv:2308.05649

Bounded Model Checking (BMC) is a widely used software verification technique. Despite its successes, the technique has several limiting factors, from state-space explosion to lack of completeness. Over the years, interval analysis has repeatedly been proposed as a partial solution to these limitations. In this work, we evaluate whether the computational cost of interval analysis yields significant enough improvements in BMC's performance to justify its use. In more detail, we quantify the benefits of interval analysis on two benchmarks: the Intel Core Power Management firmware and 9537 programs in the ReachSafety category of the International Competition on Software Verification. Our results show that interval analysis is essential in solving 203 unique benchmarks., Comment: Submitted to IFM

Realm Management Monitor (RMM) is an essential firmware component within the recent Arm Confidential Computing Architecture (Arm CCA). Previous work applies formal techniques to verify the specification and prototype reference implementation of RMM. However, relying solely on a single verification tool may lead to the oversight of certain bugs or vulnerabilities. This paper discusses the application of ESBMC, a state-of-the-art Satisfiability Modulo Theories (SMT)-based software model checker, to further enhance RRM verification. We demonstrate ESBMC's ability to precisely parse the source code and identify specification failures within a reasonable time frame. Moreover, we propose potential improvements for ESBMC to enhance its efficiency for industry engineers. This work contributes to exploring the capabilities of formal verification techniques in real-world scenarios and suggests avenues for further improvements to better meet industrial verification needs.

We prove that local stable/unstable sets of homeomorphisms of an infinite compact metric space satisfying the gluing-orbit property always contain compact and perfect subsets of the space. As a consequence, we prove that if a positively countably expansive homeomorphism satisfies the gluing-orbit property, then the space is a single periodic orbit. We also prove that there are homeomorphisms with gluing-orbit such that its induced homeomorphism on the hyperspace of compact subsets does not have gluing-orbit, contrasting with the case of the shadowing and specification properties, proving that if the induced map has gluing-orbit, then the base map has gluing-orbit and is topologically mixing., Comment: 13 pages, 1 figure

The next generation of AI systems requires strong safety guarantees. This report looks at the software implementation of neural networks and related memory safety properties, including NULL pointer deference, out-of-bound access, double-free, and memory leaks. Our goal is to detect these vulnerabilities, and automatically repair them with the help of large language models. To this end, we first expand the size of NeuroCodeBench, an existing dataset of neural network code, to about 81k programs via an automated process of program mutation. Then, we verify the memory safety of the mutated neural network implementations with ESBMC, a state-of-the-art software verifier. Whenever ESBMC spots a vulnerability, we invoke a large language model to repair the source code. For the latest task, we compare the performance of various state-of-the-art prompt engineering techniques, and an iterative approach that repeatedly calls the large language model.

We demonstrate the acousto-optic modulation of a hybrid-lattice hollow core fiber (HL-HCF) for the first time. For many years, optical fibers with reduced diameters have been the main solution to increase the interaction of acoustic and optical waves. However, the high drive voltages and large modulator components still employed drastically affect the efficiency and miniaturization of these devices. Here, we experimentally show that combining Kagom\'e and tubular lattices in HL-HCFs allows for enhancing the amplification of the acoustic waves and the modulation of the guided optical modes thus providing high modulation efficiency even when using a fiber with a 240 um diameter. To the best of our knowledge, the measured HL-HCF's modulation efficiency (1.3 dB/V) is the highest compared to devices employing reduced diameter fibers. Additionally, we demonstrate a compact acousto-optic modulator with driver dimensions smaller than the HL-HCF diameter. Overall, our results show a promising alternative to solve the compromise of speed, efficiency, and compactness for integration with microscale all-fiber photonic devices.

Extented Reality (XR) refers to a class of contemporary services that are intertwined with a plethora of rather demanding Quality of Service (QoS) and functional requirements. Despite Kubernetes being the de-facto standard in terms of deploying and managing contemporary containerized microservices, it lacks adequate support for cross-cluster networking, hindering service-to-service communication across diverse cloud domains. Although there are tools that may be leveraged alongside Kubernetes in order to establish multi-cluster deployments, each one of them comes with its drawbacks and limitations. The purpose of this article is to explore the various potential technologies that may facilitate multi-cluster deployments and to propose how they may be leveraged to provide a cross-cluster connectivity solution that caters to the intricacies of XR services. The proposed solution is based on the use of two open source frameworks, namely Cluster API for multi-cluster management, and Liqo for multi-cluster interconnectivity. The efficiency of this approach is evaluated in the context of two experiments. This work is the first attempt at proposing a solution for supporting multi-cluster deployments in a manner that is aligned with the requirements of XR services

This study provides a comparative analysis of state-of-the-art large language models (LLMs), analyzing how likely they generate vulnerabilities when writing simple C programs using a neutral zero-shot prompt. We address a significant gap in the literature concerning the security properties of code produced by these models without specific directives. N. Tihanyi et al. introduced the FormAI dataset at PROMISE '23, containing 112,000 GPT-3.5-generated C programs, with over 51.24% identified as vulnerable. We expand that work by introducing the FormAI-v2 dataset comprising 265,000 compilable C programs generated using various LLMs, including robust models such as Google's GEMINI-pro, OpenAI's GPT-4, and TII's 180 billion-parameter Falcon, to Meta's specialized 13 billion-parameter CodeLLama2 and various other compact models. Each program in the dataset is labelled based on the vulnerabilities detected in its source code through formal verification using the Efficient SMT-based Context-Bounded Model Checker (ESBMC). This technique eliminates false positives by delivering a counterexample and ensures the exclusion of false negatives by completing the verification process. Our study reveals that at least 63.47% of the generated programs are vulnerable. The differences between the models are minor, as they all display similar coding errors with slight variations. Our research highlights that while LLMs offer promising capabilities for code generation, deploying their output in a production environment requires risk assessment and validation.

Prompting has become one of the main approaches to leverage emergent capabilities of Large Language Models [Brown et al. NeurIPS 2020, Wei et al. TMLR 2022, Wei et al. NeurIPS 2022]. During the last year, researchers and practitioners have been playing with prompts to see how to make the most of LLMs. By homogeneously dissecting 80 papers, we investigate in deep how software testing and verification research communities have been abstractly architecting their LLM-enabled solutions. More precisely, first, we want to validate whether downstream tasks are an adequate concept to convey the blueprint of prompt-based solutions. We also aim at identifying number and nature of such tasks in solutions. For such goal, we develop a novel downstream task taxonomy that enables pinpointing some engineering patterns in a rather varied spectrum of Software Engineering problems that encompasses testing, fuzzing, debugging, vulnerability detection, static analysis and program verification approaches.

This paper is addressing the quantification and the comparison of pumped storage power plants, PSPP, contribution to synchronous inertia and synthetic inertia when fixed speed and variable speed motor-generators technologies are considered, respectively. Therefore, a grid stability study was conducted by means of 1D SIMSEN simulation for the 2 x 395 MW PSPP Frades 2 in Portugal with both fixed speed and variable speed technologies in case of operation connected to an infinite power network or to an islanded 4.4 GW synchronous power network., Comment: 20 pages, Proceedings of 21th International Seminar on Hydropower Plants, 9-11 November 2022, Vienna, Austria

We present FuSeBMC-AI, a test generation tool grounded in machine learning techniques. FuSeBMC-AI extracts various features from the program and employs support vector machine and neural network models to predict a hybrid approach optimal configuration. FuSeBMC-AI utilizes Bounded Model Checking and Fuzzing as back-end verification engines. FuSeBMC-AI outperforms the default configuration of the underlying verification engine in certain cases while concurrently diminishing resource consumption.

How could we have an outlier detector that works even with nondimensional data, and ranks together both singleton microclusters ('one-off' outliers) and nonsingleton microclusters by their anomaly scores? How to obtain scores that are principled in one scalable and 'hands-off' manner? Microclusters of outliers indicate coalition or repetition in fraud activities, etc.; their identification is thus highly desirable. This paper presents McCatch: a new algorithm that detects microclusters by leveraging our proposed 'Oracle' plot (1NN Distance versus Group 1NN Distance). We study 31 real and synthetic datasets with up to 1M data elements to show that McCatch is the only method that answers both of the questions above; and, it outperforms 11 other methods, especially when the data has nonsingleton microclusters or is nondimensional. We also showcase McCatch's ability to detect meaningful microclusters in graphs, fingerprints, logs of network connections, text data, and satellite imagery. For example, it found a 30-elements microcluster of confirmed 'Denial of Service' attacks in the network logs, taking only ~3 minutes for 222K data elements on a stock desktop., Comment: \c{opyright} 2024 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works

The modulation efficiency of a tubular-lattice hollow-core fiber (HCF) by means of flexural acoustic waves is investigated in detail for the first time. The main acousto-optic properties of the HCF are evaluated employing 2D and 3D models based on the finite element method. The induced coupling of the fundamental and first higher-order modes is simulated in the wavelength range from 743 to 1355 nm. Significant acoustic (amplitude, period, strain, energy) and optical parameters (effective index, beat length, birefringence, coupling coefficient) are analyzed. The simulations are compared to experimental results, indicating higher modulation performance in HCFs compared to standard optical fibers. In addition, useful insights into the design and fabrication of all-fiber acousto-optic devices based on HCFs are provided, enabling potential application in tunable spectral filters and mode-locked fiber lasers.

The theoretical treatment of jet quenching lacks a full description of the interplay between vacuum-like emissions, usually formulated in momentum space, and medium induced ones that demand an interface with a space-time picture of the expanding medium and thus must be formulated in position space. In this work we build a toy Monte-Carlo parton shower ordered in formation time, virtual mass, and opening angle, which are equivalent at leading logarithmic accuracy. Aiming to explore a link with jet substructure, we compute the Lund plane distributions for the different ordering prescriptions. Further, we investigate the sensitivity of ordering prescriptions to medium effects by counting the number of events eliminated by a decoherence condition., Comment: 4 pages, 3 figures. Proceedings for a parallel presentation at Quark Matter 2023 in Houston, Texas, United States of America from 3-9 September 2023. arXiv admin note: text overlap with arXiv:2307.08410

The higher order contact of a quadric with a surface in $3$-space at a non-degenerate point is obtained by the Moutard quadric in the Darboux direction. In this paper, we discuss the extension of this result to hypersurfaces in arbitrary dimensions., Comment: 10 pages

In this work, we analyze the observational properties of thin-shell gravastars under two astrophysical frameworks, namely surrounded by optically-thin accretion disks and orbited by hot-spots. We consider the thin-shell gravastar model with two free parameters, the gravastar radius and ratio of mass allocated at the thin-shell, and produce the corresponding observables via the use of numerical backwards ray-tracing codes. Regarding the observations of accretion disks, our results indicate that, due to the absence of a strong gravitational redshift effect, smooth gravastar configurations cannot reproduce shadow observations when internal emission is assumed. We thus expect such models to be excluded as candidates for supermassive objects in galactic cores. Nevertheless, thin-shell gravastars with a large portion of their total mass allocated at the surface can produce such an effect and are thus adequate candidates for black-hole mimickers. In the context of hot-spot orbits, the astrometrical observational properties of ultra-compact gravastars resemble closely those of other ultra-compact objects e.g. fluid stars and bosonic stars. However, for low-compacticity configurations, the time-integrated fluxes feature additional contributions in the form of a high-intensity plunge through image. These qualitative differences in the observational properties of gravastars in comparison with black-hole spacetimes could potentially be discriminated by the next generation of interferometric experiments in gravitational physics., Comment: 20 pages, 16 Figures. v2: published version

We report on high-temperature sensing measurements using a tubular-lattice hollow-core photonic crystal fiber displaying a microstructure formed of eight 2.4 um-thick cladding tubes. The larger thickness of our fiber's cladding tubes compared to other hollow fibers operating in the visible and infrared ranges entails multiple narrow transmission bands in its transmission spectrum (6 bands in the spectral range between 400 nm and 950 nm) and benefits the realization of the temperature sensing measurements. The principle of operation of our device is based on the thermo-optic effect and thermal expansion-induced spectral shifts of the fiber transmission bands due to temperature variations. To study the sensor operation, we monitored the fiber transmission bands' spectral positions from room temperature to 1085 oC in both ramp-up and ramp-down scenarios. Additionally, we investigated the optimization opportunities by assessing an analytical model describing the fiber transmission characteristics and discussed the alternatives for enhancing the sensor performance. Moreover, our fiber characterization experiments revealed a consistent confinement loss trend aligned with the scaling laws in tubular-lattice hollow-core fibers. We thus understand that the results presented in this manuscript highlight a relevant path for the development of temperature sensors based on microstructured hollow-core optical fibers endowed with thick cladding tubes.

ESBMC implements many state-of-the-art techniques for model checking. We report on new and improved features that allow us to obtain verification results for previously unsupported programs and properties. ESBMC employs a new static interval analysis of expressions in programs to increase verification performance. This includes interval-based reasoning over booleans and integers, forward and backward contractors, and particular optimizations related to singleton intervals because of their ubiquity. Other relevant improvements concern the verification of concurrent programs, as well as several operational models, internal ones, and also those of libraries such as pthread and the C mathematics library. An extended memory safety analysis now allows tracking of memory leaks that are considered still reachable.

We derive necessary and sufficient conditions under which a large class of relativistic generalizations of Braginskii's magnetohydrodynamics with shear, bulk, and heat diffusion effects is causal and strongly hyperbolic in the fully nonlinear regime in curved spacetime. We find that causality severely constrains the size of nonideal effects and the onset of kinetic instabilities. Our results are crucial for assessing the regime of validity of fluid dynamical simulations of plasmas near supermassive black holes., Comment: 16 pages, 1 figure, includes Supplemental Material. Accepted for publication in Physical Review Letters