Search

Pose skeleton images are an important reference in pose-controllable image generation. In order to enrich the source of skeleton images, recent works have investigated the generation of pose skeletons based on natural language. These methods are based on GANs. However, it remains challenging to perform diverse, structurally correct and aesthetically pleasing human pose skeleton generation with various textual inputs. To address this problem, we propose a framework with GUNet as the main model, PoseDiffusion. It is the first generative framework based on a diffusion model and also contains a series of variants fine-tuned based on a stable diffusion model. PoseDiffusion demonstrates several desired properties that outperform existing methods. 1) Correct Skeletons. GUNet, a denoising model of PoseDiffusion, is designed to incorporate graphical convolutional neural networks. It is able to learn the spatial relationships of the human skeleton by introducing skeletal information during the training process. 2) Diversity. We decouple the key points of the skeleton and characterise them separately, and use cross-attention to introduce textual conditions. Experimental results show that PoseDiffusion outperforms existing SoTA algorithms in terms of stability and diversity of text-driven pose skeleton generation. Qualitative analyses further demonstrate its superiority for controllable generation in Stable Diffusion.

In contemporary software development, the widespread use of indirect calls to achieve dynamic features poses challenges in constructing precise control flow graphs (CFGs), which further impacts the performance of downstream static analysis tasks. To tackle this issue, various types of indirect call analyzers have been proposed. However, they do not fully leverage the semantic information of the program, limiting their effectiveness in real-world scenarios. To address these issues, this paper proposes Semantic-Enhanced Analysis (SEA), a new approach to enhance the effectiveness of indirect call analysis. Our fundamental insight is that for common programming practices, indirect calls often exhibit semantic similarity with their invoked targets. This semantic alignment serves as a supportive mechanism for static analysis techniques in filtering out false targets. Notably, contemporary large language models (LLMs) are trained on extensive code corpora, encompassing tasks such as code summarization, making them well-suited for semantic analysis. Specifically, SEA leverages LLMs to generate natural language summaries of both indirect calls and target functions from multiple perspectives. Through further analysis of these summaries, SEA can determine their suitability as caller-callee pairs. Experimental results demonstrate that SEA can significantly enhance existing static analysis methods by producing more precise target sets for indirect calls., Comment: Accepted by ASE'24

Recently, Automated Vulnerability Localization (AVL) has attracted much attention, aiming to facilitate diagnosis by pinpointing the lines of code responsible for discovered vulnerabilities. Large Language Models (LLMs) have shown potential in various domains, yet their effectiveness in vulnerability localization remains underexplored. In this work, we perform the first comprehensive study of LLMs for AVL. Our investigation encompasses 10+ leading LLMs suitable for code analysis, including ChatGPT and various open-source models, across three architectural types: encoder-only, encoder-decoder, and decoder-only, with model sizes ranging from 60M to 16B parameters. We explore the efficacy of these LLMs using 4 distinct paradigms: zero-shot learning, one-shot learning, discriminative fine-tuning, and generative fine-tuning. Our evaluation framework is applied to the BigVul-based dataset for C/C++, and an additional dataset comprising smart contract vulnerabilities. The results demonstrate that discriminative fine-tuning of LLMs can significantly outperform existing learning-based methods for AVL, while other paradigms prove less effective or unexpectedly ineffective for the task. We also identify challenges related to input length and unidirectional context in fine-tuning processes for encoders and decoders. We then introduce two remedial strategies: the sliding window and the right-forward embedding, both of which substantially enhance performance. Furthermore, our findings highlight certain generalization capabilities of LLMs across Common Weakness Enumerations (CWEs) and different projects, indicating a promising pathway toward their practical application in vulnerability localization.

Automated Static Analysis Tools (ASATs) have evolved over time to assist in detecting bugs. However, the excessive false warnings can impede developers' productivity and confidence in the tools. Previous research efforts have explored learning-based methods to validate the reported warnings. Nevertheless, their coarse granularity, focusing on either long-term warnings or function-level alerts, which are insensitive to individual bugs. Also, they rely on manually crafted features or solely on source code semantics, which is inadequate for effective learning. In this paper, we propose FineWAVE, a learning-based approach that verifies bug-sensitive warnings at a fine-grained granularity. Specifically, we design a novel LSTM-based model that captures multi-modal semantics of source code and warnings from ASATs and highlights their correlations with cross-attention. To tackle the data scarcity of training and evaluation, we collected a large-scale dataset of 280,273 warnings. We conducted extensive experiments on the dataset to evaluate FineWAVE. The experimental results demonstrate the effectiveness of our approach, with an F1-score of 97.79\% for reducing false alarms and 67.06% for confirming actual warnings, significantly outperforming all baselines. Moreover, we have applied our FineWAVE to filter out about 92% warnings in four popular real-world projects, and found 25 new bugs with minimal manual effort.

Communication protocols form the bedrock of our interconnected world, yet vulnerabilities within their implementations pose significant security threats. Recent developments have seen a surge in fuzzing-based research dedicated to uncovering these vulnerabilities within protocol implementations. However, there still lacks a systematic overview of protocol fuzzing for answering the essential questions such as what the unique challenges are, how existing works solve them, etc. To bridge this gap, we conducted a comprehensive investigation of related works from both academia and industry. Our study includes a detailed summary of the specific challenges in protocol fuzzing, and provides a systematic categorization and overview of existing research efforts. Furthermore, we explore and discuss potential future research directions in protocol fuzzing. This survey serves as a foundational guideline for researchers and practitioners in the field.

Large Language Models (LLMs) and Multi-Modal LLMs (MLLMs) have played a critical role in numerous applications. However, current LLMs are vulnerable to prompt-based attacks, with jailbreaking attacks enabling LLMs to generate harmful content, while hijacking attacks manipulate the model to perform unintended tasks, underscoring the necessity for detection methods. Unfortunately, existing detecting approaches are usually tailored to specific attacks, resulting in poor generalization in detecting various attacks across different modalities. To address it, we propose JailGuard, a universal detection framework for jailbreaking and hijacking attacks across LLMs and MLLMs. JailGuard operates on the principle that attacks are inherently less robust than benign ones, regardless of method or modality. Specifically, JailGuard mutates untrusted inputs to generate variants and leverages the discrepancy of the variants' responses on the model to distinguish attack samples from benign samples. We implement 18 mutators for text and image inputs and design a mutator combination policy to further improve detection generalization. To evaluate the effectiveness of JailGuard, we build the first comprehensive multi-modal attack dataset, containing 11,000 data items across 15 known attack types. The evaluation suggests that JailGuard achieves the best detection accuracy of 86.14%/82.90% on text and image inputs, outperforming state-of-the-art methods by 11.81%-25.73% and 12.20%-21.40%., Comment: 28 pages, 9 figures

Detecting non-termination is crucial for ensuring program correctness and security, such as preventing denial-of-service attacks. While termination analysis has been studied for many years, existing methods have limited scalability and are only effective on small programs. To address this issue, we propose a practical termination checking technique, called EndWatch, for detecting non-termination caused by infinite loops through testing. Specifically, we introduce two methods to generate non-termination oracles based on checking state revisits, i.e., if the program returns to a previously visited state at the same program location, it does not terminate. The non-termination oracles can be incorporated into testing tools (e.g., AFL used in this paper) to detect non-termination in large programs. For linear loops, we perform symbolic execution on individual loops to infer State Revisit Conditions (SRCs) and instrument SRCs into target loops. For non-linear loops, we instrument target loops for checking concrete state revisits during execution. We evaluated EndWatch on standard benchmarks with small-sized programs and real-world projects with large-sized programs. The evaluation results show that EndWatch is more effective than the state-of-the-art tools on standard benchmarks (detecting 87% of non-terminating programs while the best baseline detects only 67%), and useful in detecting non-termination in real-world projects (detecting 90% of known non-termination CVEs and 4 unknown bugs).

The popularity of automatic speech recognition (ASR) systems nowadays leads to an increasing need for improving their accessibility. Handling stuttering speech is an important feature for accessible ASR systems. To improve the accessibility of ASR systems for stutterers, we need to expose and analyze the failures of ASR systems on stuttering speech. The speech datasets recorded from stutterers are not diverse enough to expose most of the failures. Furthermore, these datasets lack ground truth information about the non-stuttered text, rendering them unsuitable as comprehensive test suites. Therefore, a methodology for generating stuttering speech as test inputs to test and analyze the performance of ASR systems is needed. However, generating valid test inputs in this scenario is challenging. The reason is that although the generated test inputs should mimic how stutterers speak, they should also be diverse enough to trigger more failures. To address the challenge, we propose ASTER, a technique for automatically testing the accessibility of ASR systems. ASTER can generate valid test cases by injecting five different types of stuttering. The generated test cases can both simulate realistic stuttering speech and expose failures in ASR systems. Moreover, ASTER can further enhance the quality of the test cases with a multi-objective optimization-based seed updating algorithm. We implemented ASTER as a framework and evaluated it on four open-source ASR models and three commercial ASR systems. We conduct a comprehensive evaluation of ASTER and find that it significantly increases the word error rate, match error rate, and word information loss in the evaluated ASR systems. Additionally, our user study demonstrates that the generated stuttering audio is indistinguishable from real-world stuttering audio clips.

LLM-based (Large Language Model) fuzz driver generation is a promising research area. Unlike traditional program analysis-based method, this text-based approach is more general and capable of harnessing a variety of API usage information, resulting in code that is friendly for human readers. However, there is still a lack of understanding regarding the fundamental issues on this direction, such as its effectiveness and potential challenges. To bridge this gap, we conducted the first in-depth study targeting the important issues of using LLMs to generate effective fuzz drivers. Our study features a curated dataset with 86 fuzz driver generation questions from 30 widely-used C projects. Six prompting strategies are designed and tested across five state-of-the-art LLMs with five different temperature settings. In total, our study evaluated 736,430 generated fuzz drivers, with 0.85 billion token costs ($8,000+ charged tokens). Additionally, we compared the LLM-generated drivers against those utilized in industry, conducting extensive fuzzing experiments (3.75 CPU-year). Our study uncovered that: - While LLM-based fuzz driver generation is a promising direction, it still encounters several obstacles towards practical applications; - LLMs face difficulties in generating effective fuzz drivers for APIs with intricate specifics. Three featured design choices of prompt strategies can be beneficial: issuing repeat queries, querying with examples, and employing an iterative querying process; - While LLM-generated drivers can yield fuzzing outcomes that are on par with those used in the industry, there are substantial opportunities for enhancement, such as extending contained API usage, or integrating semantic oracles to facilitate logical bug detection. Our insights have been implemented to improve the OSS-Fuzz-Gen project, facilitating practical fuzz driver generation in industry., Comment: 13 pages, 9 figures

Large language models~(LLMs) demonstrate significant potential to revolutionize software engineering (SE) by exhibiting outstanding performance in SE tasks such as code and document generation. However, the high reliability and risk control requirements in software engineering raise concerns about the lack of interpretability of LLMs. To address this concern, we conducted a study to evaluate the capabilities of LLMs and their limitations for code analysis in SE. We break down the abilities needed for artificial intelligence~(AI) models to address SE tasks related to code analysis into three categories: 1) syntax understanding, 2) static behavior understanding, and 3) dynamic behavior understanding. Our investigation focused on the ability of LLMs to comprehend code syntax and semantic structures, which include abstract syntax trees (AST), control flow graphs (CFG), and call graphs (CG). We employed four state-of-the-art foundational models, GPT4, GPT3.5, StarCoder and CodeLlama-13b-instruct. We assessed the performance of LLMs on cross-language tasks involving C, Java, Python, and Solidity. Our findings revealed that while LLMs have a talent for understanding code syntax, they struggle with comprehending code semantics, particularly dynamic semantics. We conclude that LLMs possess capabilities similar to an Abstract Syntax Tree (AST) parser, demonstrating initial competencies in static code analysis. Furthermore, our study highlights that LLMs are susceptible to hallucinations when interpreting code semantic structures and fabricating nonexistent facts. These results indicate the need to explore methods to verify the correctness of LLM output to ensure its dependability in SE. More importantly, our study provides an initial answer to why the codes generated by LLM are usually syntax-correct but vulnerable.

In the Standard Model Effective Field Theory (SMEFT), operators involving the top quark are generally difficult to probe, and can generate sizable loop contributions to the electroweak precision observables, measured by past and future lepton colliders. Could the high precision of the electroweak measurements compensate the loop suppression and provide competitive reaches on these operators? Would the inclusion of these contributions introduce too many additional parameters for a meaningful global electroweak analysis to be done? In this paper, we perform a detailed phenomenological study to address these two important questions. Focusing on eight dimension-6 operators that generate anomalous couplings between the electroweak gauge bosons and the third-generation quarks, we calculate their one loop contributions to the $e^+e^- \to f\bar{f}$ processes both on and off the Z-pole and the $e^-e^+ \to WW$ process. A global analysis is performed with these eight operators and the ones that contribute to the above processes at tree level, using the measurements at LEP, SLC and several low energy experiments. We find that, while the current electroweak precision measurements are sensitive to the one-loop effects of the top-quark operators, it is difficult to separate them from the operators that contribute at the tree level, making a global analysis rather challenging. Under more assumptions, competitive reaches could be obtained in a global fit. Another important finding of our study is that the two operators that generate dipole interactions of the bottom quark have significant impacts in the Z-pole measurements and should not be omitted. We also discuss the implication of the recently reported W-boson mass measurement at CDF to our results. Finally, we estimate the reaches of future lepton colliders in probing the top-quark operators with precision electroweak measurements., Comment: 38 pages, 14 figures

Moments of the leptonic angular distribution in the Drell-Yan process have recently been shown to be sensitive probes of a specific class of dimension-8, four-fermion operators in the Standard Model Effective Field Theory, involving a pair of quarks and leptons. The same operators are also subject to positivity bounds, when requiring the associated (unknown) UV completion to obey basic principles of quantum field theory. We perform a phenomenological study to quantify the sensitivity of the high-luminosity LHC to this set of operators and, by extension, the positivity bounds. We further extend the angular basis of moments and consider double differential information to improve the ability to disentangle the different operators, leading to a sensitivity to new physics scales up to 3 TeV. We use this information to explore the violation of positivity at the LHC as a way to test the underlying principles of quantum field theory. Finally, we present a case study which combines our results with information from other (current and prospective) experiments, as well as the positivity cone to infer the properties of possible tree-level UV completions. The data lead to robust, model-independent lower bounds on the $M/\sqrt{g}$ combination of the particle mass and coupling, for states that couple to right-handed leptons and/or up quarks., Comment: 54 pages, 8 figures, 9 tables, version to appear in JHEP

The truncation of the standard-model effective field theory, its validity and the associated uncertainties have been discussed in meetings of the LHC EFT WG. Proposals were made by participants to address these issues. No consensus was reached and no formal recommendation is therefore put forward at this time. None of the proposals has been approved or validated and further work is needed to establish a prescription. This note aims at summarizing the proposals and points of debate., Comment: LHC EFT WG note, 8 pages; v2 includes a summary of the additional proposal D

We study the "inverse problem" in the context of the Standard Model Effective Field Theory (SMEFT): how and to what extend can one reconstruct the UV theory, given the measured values of the operator coefficients in the IR? The main obstacle of this problem is the degeneracies in the space of coefficients: a given SMEFT truncated at a finite dimension can be mapped to infinitely many UV theories. We discuss these degeneracies at the dimension-8 level, and show that positivity bounds play a crucial role in the inverse problem. In particular, the degeneracies either vanish or become significantly limited for SMEFTs that live on or close to the positivity bounds. The UV particles of these SMEFTs, and their properties such as spin, charge, other quantum numbers, and interactions with the SM particles, can often be uniquely determined, assuming dimension-8 coefficients are measured. The allowed region for SMEFTs, which forms a convex cone, can be systematically constructed by enumerating its generators. We show that a geometric notion, extremality, conveniently connects the positivity problem with the inverse problem. We discuss the implications of a SMEFT living on an extremal ray, on a $k$-face, and on the vertex of the positive cone. We also show that the information of the dimension-8 coefficients can be used to set exclusion limits on all individual UV states that interact with the SM, independent of specific model assumptions. Our results indicate that the dimension-8 operators encode much more information about the UV than one would naively expect, which can be used to reverse engineer the UV physics from the SMEFT., Comment: 91 pages, 20 figures

We develop a formalism to extract triple crossing symmetric positivity bounds for effective field theories with multiple degrees of freedom, by making use of $su$ symmetric dispersion relations supplemented with positivity of the partial waves, $st$ null constraints and the generalized optical theorem. This generalizes the convex cone approach to constrain the $s^2$ coefficient space to higher orders. Optimal positive bounds can be extracted by semi-definite programs with a continuous decision variable, compared with linear programs for the case of a single field. As an example, we explicitly compute the positivity constraints on bi-scalar theories, and find all the Wilson coefficients can be constrained in a finite region, including the coefficients with odd powers of $s$, which are absent in the single scalar case., Comment: 28 pages, 4 figures, 1 table; corrected error about upper bounds on s^2 coefficients, conclusions remain unchanged

Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes. However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel.) That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU. In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built upon. We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions, 37 device models, and 24 vendors. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them,710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO

We present a global interpretation of Higgs, diboson, and top quark production and decay measurements from the LHC in the framework of the Standard Model Effective Field Theory (SMEFT) at dimension six. We constrain simultaneously 36 independent directions in its parameter space, and compare the outcome of the global analysis with that from individual and two-parameter fits. Our results are obtained by means of state-of-the-art theoretical calculations for the SM and the EFT cross-sections, and account for both linear and quadratic corrections in the $1/\Lambda^2$ expansion. We demonstrate how the inclusion of NLO QCD and $\mathcal{O}\left( \Lambda^{-4}\right)$ effects is instrumental to accurately map the posterior distributions associated to the fitted Wilson coefficients. We assess the interplay and complementarity between the top quark, Higgs, and diboson measurements, deploy a variety of statistical estimators to quantify the impact of each dataset in the parameter space, and carry out fits in BSM-inspired scenarios such as the top-philic model. Our results represent a stepping stone in the ongoing program of model-independent searches at the LHC from precision measurements, and pave the way towards yet more global SMEFT interpretations extended to other high-$p_T$ processes as well as to low-energy observables., Comment: 93 pages, 31 figures, results available from https://lhcfitnikhef.github.io/SMEFT/. v2: updated results. v3: version accepted for publication in JHEP. This paper is dedicated to the memory of our friend and collaborator Cen Zhang

We discuss the general method for obtaining full positivity bounds on multi-field effective field theories (EFTs). While the leading order forward positivity bounds are commonly derived from the elastic scattering of two (superposed) external states, we show that for a generic EFT containing 3 or more low-energy modes, this approach only gives incomplete bounds. We then identify the allowed parameter space as the dual to a spectrahedron, constructed from crossing symmetries of the amplitude, and show that finding the optimal bounds for a given number of modes is equivalent to a geometric problem: finding the extremal rays of a spectrahedron. We show how this is done analytically for simple cases, and numerically formulated as semidefinite programming (SDP) problems for more complicated cases. We demonstrate this approach with a number of well-motivated examples in particle physics and cosmology, including EFTs of scalars, vectors, fermions and gravitons. In all these cases, we find that the SDP approach leads to results that either improve the previous ones or are completely new. We also find that the SDP approach is numerically much more efficient., Comment: 5 pages + refs + supplementary material, 5 figures; to appear in PRL

We use generalized elastic positivity bounds to constrain the parameter space of multi-field spin-2 effective field theories. These generalized bounds involve inelastic scattering amplitudes between particles with different masses, which contain kinematic singularities even in the $t=0$ limit. We apply these bounds to the pseudo-linear spin-2 theory, the cycle spin-2 theory and the line spin-2 theory respectively. For the pseudo-linear theory, we exclude the remaining operators that are unconstrained by the usual elastic positivity bounds, thus excluding all the leading (or highest cutoff) interacting operators in the theory. For the cycle and line theory, our approach also provides new bounds on the Wilson coefficients previously unconstrained, bounding the parameter space in both theories to be a finite region ({\it i.e.}, every Wilson coefficient being constrained from both sides). To help visualize these finite regions, we sample various cross sections of them and estimate the total volumes., Comment: 29 pages, 14 figures

The diphoton channel at lepton colliders, $e^+e^- (\mu^+\mu^-) \to \gamma \gamma$, has a remarkable feature that the leading new physics contribution comes only from dimension-eight operators. This contribution is subject to a set of positivity bounds, derived from the fundamental principles of Quantum Field Theory, such as unitarity, locality, analyticity and Lorentz invariance. These positivity bounds are thus applicable to the most direct observable -- the diphoton cross section. This unique feature provides a clear, robust, and unambiguous test of these principles. We estimate the capability of various future lepton colliders in probing the dimension-eight operators and testing the positivity bounds in this channel. We show that positivity bounds can lift certain flat directions among the effective operators and significantly change the perspectives of a global analysis. We also discuss the positivity bounds of the $Z\gamma/ZZ$ processes which are related to the $\gamma\gamma$ ones, but are more complicated due to the massive $Z$ boson., Comment: 9 pages, 2+4 figures, v2: extended discussion on positivity bounds, matches published version

The positivity bounds, derived from the axiomatic principles of quantum field theory (QFT), constrain the signs of Wilson coefficients and their linear combinations in the Standard Model Effective Field Theory (SMEFT). The precise determination of these bounds, however, can become increasingly difficult as more and more SM modes and operators are taken into account. We study two approaches that aim at obtaining the full set of bounds for a given set of SM fields: 1) the traditional elastic positivity approach, which exploits the elastic scattering amplitudes of states with arbitrarily superposed helicities as well as other quantum numbers, and 2) the newly proposed extremal positivity approach, which constructs the allowed coefficient space directly by using the extremal representation of convex cones. Considering the electroweak gauge-bosons as an example, we demonstrate how the best analytical and numerical positivity bounds can be obtained in several ways. We further compare the constraining power and the efficiency of various approaches, as well as their applicability to more complex problems. While the new extremal approach is more constraining by construction, we also find that it is analytically easier to use, numerically much faster than the elastic approach, and much more applicable when more SM particle states and operators are taken into account. As a byproduct, we provide the best positivity bounds on the transversal quartic-gauge-boson couplings, required by the axiomatic principles of QFT, and show that they exclude $\approx 99.3\%$ of the parameter space currently being searched at the LHC., Comment: 62 pages, 5 figures; correction on discussion regarding previous literature; typo in bounds with dim-6 coefficient corrected

We consider the positivity bounds on dimension-8 four-electron operators and study two related phenomenological aspects at future lepton colliders. First, if positivity is violated, probing such violations will revolutionize our understanding of the fundamental pillars of quantum field theory and the $S$-matrix theory. We observe that positivity violation at scales of 1--10 TeV can potentially be probed at future lepton colliders even if one assumes that dimension-6 operators are also present. Second, the positive nature of the dimension-8 parameter space often allows us to either directly infer the existence of UV-scale particles together with their quantum numbers or exclude them up to certain scales in a model-independent way. In particular, dimension-8 positivity plays an important role in the test of the Standard Model. If no deviations from the Standard Model are observed, it allows for simultaneous exclusion limits on all kinds of potential UV-complete models. Unlike the dimension-6 case, these limits apply regardless of the UV model setup and cannot be removed by possible cancellations among various UV contributions. This thus consists of a novel and universal test to confirm the Standard Model. We demonstrate with realistic examples how all the previously mentioned possibilities, including the test of positivity violation, can be achieved. Hence, we provide an important motivation for studying dimension-8 operators more comprehensively., Comment: 24 pages, 6 figures; typos corrected

We present the automation of one-loop computations in the standard-model effective field theory at dimension six. Our general implementation, dubbed SMEFT@NLO, covers all types of operators: bosonic, two- and four-fermion ones. Included ultraviolet and rational counterterms presently allow for fully differential predictions, possibly matched to parton shower, up to the one-loop level in the strong coupling or in four-quark operator coefficients. Exact flavor symmetries are imposed among light quark generations and an initial focus is set on top-quark interactions in the fermionic sector. We illustrate the potential of this implementation with novel loop-induced and next-to-leading-order computations relevant for top-quark, electroweak, and Higgs-boson phenomenology at the LHC and future colliders., Comment: 6 pages, 3 figures, 4 tables, v2: matches published version, minor changes and new scale choice in four-top-quark production (table II)

Grey-box fuzz testing has revealed thousands of vulnerabilities in real-world software owing to its lightweight instrumentation, fast coverage feedback, and dynamic adjusting strategies. However, directly applying grey-box fuzzing to input-dependent multithreaded programs can be extremely inefficient. In practice, multithreading-relevant bugs are usually buried in sophisticated program flows. Meanwhile, the existing grey-box fuzzing techniques do not stress thread-interleavings which affect execution states in multithreaded programs. Therefore, mainstream grey-box fuzzers cannot effectively test problematic segments in multithreaded programs despite they might obtain high code coverage statistics. To this end, we propose MUZZ, a new grey-box fuzzing technique that hunts for bugs in multithreaded programs. MUZZ owns three novel thread-aware instrumentations, namely coverage-oriented instrumentation, thread-context instrumentation, and schedule-intervention instrumentation. During fuzzing, these instrumentations engender runtime feedback to stress execution states caused by thread interleavings. By leveraging the feedback in the dynamic seed selection and execution strategies, MUZZ preserves more valuable seeds that expose bugs in a multithreading context. We evaluate MUZZ on 12 real-world software programs. Experiments show that MUZZ outperforms AFL in both multithreading-relevant seed generation and concurrency-vulnerability detection. Further, by replaying the target programs against the generated seeds, MUZZ also reveals more concurrency-bugs (e.g., data-races, thread-leaks) than AFL. In total, MUZZ detected 8 new concurrency-vulnerabilities and 19 new concurrency-bugs. At the time of writing, 4 CVE IDs have been assigned to the reported issues., Comment: Technical paper accepted by USENIX Security 2020 (https://www.usenix.org/conference/usenixsecurity20/technical-sessions)

We present a convex geometry perspective to the Effective Field Theory (EFT) parameter space. We show that the second $s$ derivatives of the forward EFT amplitudes form a convex cone, whose extremal rays are closely connected with states in the UV theory. For tree-level UV-completions, these rays are simply theories with all UV particles living in at most one irreducible representation of the symmetries of the theory. In addition, all the extremal rays are determined by the symmetries and can be systematically identified via group theoretical considerations. The implications are twofold. First, geometric information encoded in the EFT space can help reconstruct the UV-completion. In particular, we will show that the dim-8 operators are important in reverse-engineering the UV physics from the Standard Model EFT, and thus deserve more theoretical and experimental investigations. Second, theoretical bounds on the Wilson coefficients can be obtained by identifying the boundaries of the cone and are in general stronger than the current positivity bounds. We show explicit examples of these new bounds, and demonstrate that they originate from the scattering amplitudes corresponding to entangled states., Comment: 7 pages, 2 figures; version accepted by prl

Recently, a new set of positivity bounds with $t$ derivatives have been discovered. We explore the generic features of these generalized positivity bounds with loop amplitudes and apply these bounds to constrain the parameters in chiral perturbation theory up to the next-to-next-to-leading order. We show that the generalized positivity bounds give rise to stronger constraints on the $\bar l_i$ constants, compared to the existing axiomatic bounds. The parameter space of the $b_i$ constants is constrained by the generalized positivity bounds to be a convex region that is enclosed for many sections of the total space. We also show that the improved version of these positivity bounds can further enhance the constraints on the parameters. The often used Pad\'e unitarization method however does not improve the analyticity of the amplitudes in the chiral perturbation theory at low energies., Comment: 31 pages, 15 figures; JHEP version