Search

BaCo$_2$(AsO$_4$)$_2$ (BCAO), a honeycomb cobaltate, is considered a promising candidate for materials displaying the Kitaev quantum spin liquid state. This assumption is based on the distinctive characteristics of Co$^{2+}$ ions (3$d^7$) within an octahedral crystal environment, resulting in spin-orbit-coupled $J_{\rm eff}$~=~1/2 doublet states. However, recent experimental observations and theoretical analyses have raised questions regarding this hypothesis. Despite these uncertainties, reports of continuum excitations reminiscent of spinon excitations have prompted further investigations. In this study, we explore the magnetic phases of BCAO under both in-plane and out-of-plane magnetic fields, employing dc and ac magnetic susceptibilities, capacitance, and torque magnetometry measurement. Our results affirm the existence of multiple field-induced magnetic phases, with strong anisotropy of the phase boundaries between in-plane and out-of-plane fields. To elucidate the nature of these phases, we develop a minimal anisotropic exchange model. This model, supported by combined first principles calculations and theoretical modeling, quantitatively reproduces our experimental data. In BCAO, the combination of strong bond-independent XXZ anisotropy and geometric frustration leads to significant quantum order by disorder effects that stabilize collinear phases under both zero and finite magnetic fields., Comment: 14 pages, 5 main + 5 supplementary figures

We have investigated the magnetic properties and mapped out the phase diagram of the honeycomb magnet Na2Co2TeO6 with Co 3d7 in out-of-plane magnetic fields. This material has previously been proposed to show nearest-neighbor Kitaev interactions between Co spins and maybe even Kitaev quantum spin liquid behavior in high fields. At low magnetic fields, we observe a thermal phase transition at TN = 27 K, transitioning from a paramagnetic state to a canonical ferrimagnetic state. Under the application of magnetic fields, a spin flop-like phase transition occurred before saturation of J = 1/2 between 10 K and TN. Below 10 K, a peak-dip-peak structure emerges between 10 and 17 T in the magnetic susceptibility (dM/dH) before the magnetic saturation, reminiscent of magnetic plateau behavior. The measurement of the magnetocaloric effect also shows dip-peak-dip behavior in this field range. Our data can be explained by an XXZ model with a single ion anisotropy and possibly small Kitaev and {\Gamma} exchange interactions. We also unambiguously determined the magnetization saturation field that helps constrain the energy scale of the exchange interactions, Comment: LA-UR-24-24990

A quantum spin liquid (QSL) is a state of matter characterized by fractionalized quasiparticle excitations, quantum entanglement, and a lack of long-range magnetic order. However, QSLs have evaded definitive experimental observation. Several Yb$^{3+}$-based triangular lattice antiferromagnets with effective $S$ = $\frac{1}{2}$ have been suggested to stabilize the QSL state as the ground state. Here, we build a comprehensive magnetic temperature phase diagram of a high-quality single crystalline KYbSe$_2$ via heat capacity and magnetocaloric effect down to 30 mK with magnetic field applied along the $a$-axis. At zero magnetic field, we observe the magnetic long-range order at $T_N$ = 0.29 K entering 120 degrees ordered state in heat capacity, consistent with neutron scattering studies. Analysis of the low-temperature ($T$) specific heat ($C$) at zero magnetic field indicates linear $T$-dependence of $C/T$ and a broad hump of $C/T$ in the proximate QSL region above $T_N$. By applying magnetic field, we observe the up-up-down phase with 1/3 magnetization plateau and oblique phases, in addition to two new phases. These observations strongly indicate that while KYbSe$_2$ closely exhibits characteristics resembling an ideal triangular lattice, deviations may exist, such as the effect of the next-nearest-neighbor exchange interaction, calling for careful consideration for spin Hamiltonian modeling. Further investigations into tuning parameters, such as chemical pressure, could potentially induce an intriguing QSL phase in the material.

Recently, numerous highly-valuable Deep Neural Networks (DNNs) have been trained using deep learning algorithms. To protect the Intellectual Property (IP) of the original owners over such DNN models, backdoor-based watermarks have been extensively studied. However, most of such watermarks fail upon model extraction attack, which utilizes input samples to query the target model and obtains the corresponding outputs, thus training a substitute model using such input-output pairs. In this paper, we propose a novel watermark to protect IP of DNN models against model extraction, named MEA-Defender. In particular, we obtain the watermark by combining two samples from two source classes in the input domain and design a watermark loss function that makes the output domain of the watermark within that of the main task samples. Since both the input domain and the output domain of our watermark are indispensable parts of those of the main task samples, the watermark will be extracted into the stolen model along with the main task during model extraction. We conduct extensive experiments on four model extraction attacks, using five datasets and six models trained based on supervised learning and self-supervised learning algorithms. The experimental results demonstrate that MEA-Defender is highly robust against different model extraction attacks, and various watermark removal/detection approaches., Comment: To Appear in IEEE Symposium on Security and Privacy 2024 (IEEE S&P 2024), MAY 20-23, 2024, SAN FRANCISCO, CA, USA

Continuous spin excitations are widely recognized as one of the hallmarks of novel spin states in quantum magnets, such as quantum spin liquids (QSLs). Here, we report the observation of such kind of excitations in K2Ni2(SO4)3, which consists of two sets of intersected spin-1 Ni2+ trillium lattices. Our inelastic neutron scattering measurement on single crystals clearly shows a dominant excitation continuum, which exhibits a distinct temperature-dependent behavior from that of spin waves, and is rooted in strong quantum spin fluctuations. Further using the self-consistent-gaussian-approximation method, we determined the fourth- and fifth-nearest neighbor exchange interactions are dominant. These two bonds together form a unique three-dimensional network of corner-sharing tetrahedra, which we name as ''hyper-trillium'' lattice. Our results provide direct evidence for the existence of QSL features in K2Ni2(SO4)3 and highlight the potential for the hyper-trillium lattice to host frustrated quantum magnetism., Comment: 6 pages and 5 figures, plus several pages of supplemental material, comments are welcome

The 3$d^7$ Co$^{2+}$-based insulating magnet \NCTO{} has recently been reported to have strong Kitaev interactions on a honeycomb lattice, and is thus being considered as a Kitaev quantum spin liquid candidate. However, due to the existence of other types of interactions, a spontaneous long-range magnetic order occurs. This order is suppressed by applied magnetic fields leading to a succession of phases and ultimately saturation of the magnetic moments. The precise phase diagram, the nature of the phases, and the possibility that one of the field-induced phases is a Kitaev quantum spin liquid phase are still a matter of debate. Here we measured an extensive set of physical properties to build the complete temperature-field phase diagrams to magnetic saturation at 10 T for magnetic fields along the $a$- and $a^*$-axes, and a partial phase diagram up to 60 T along $c$. We probe the phases using magnetization, specific heat, magnetocaloric effect, magnetostriction, dielectric constant, and electric polarization, which is a symmetry-sensitive probe. With these measurements we identify all the previously incomplete phase boundaries and find new high-field phase boundaries. We find strong magnetoelectric coupling in the dielectric constant and moderate magnetostrictive coupling at several phase boundaries. Furthermore, we detect the symmetry of the magnetic order using electrical polarization measurements under magnetic fields. Based on our analysis, the absence of electric polarization under zero or finite magnetic field in any of the phases or after..., Comment: LA-UR-22-32574

Recent years have witnessed tremendous success in Self-Supervised Learning (SSL), which has been widely utilized to facilitate various downstream tasks in Computer Vision (CV) and Natural Language Processing (NLP) domains. However, attackers may steal such SSL models and commercialize them for profit, making it crucial to verify the ownership of the SSL models. Most existing ownership protection solutions (e.g., backdoor-based watermarks) are designed for supervised learning models and cannot be used directly since they require that the models' downstream tasks and target labels be known and available during watermark embedding, which is not always possible in the domain of SSL. To address such a problem, especially when downstream tasks are diverse and unknown during watermark embedding, we propose a novel black-box watermarking solution, named SSL-WM, for verifying the ownership of SSL models. SSL-WM maps watermarked inputs of the protected encoders into an invariant representation space, which causes any downstream classifier to produce expected behavior, thus allowing the detection of embedded watermarks. We evaluate SSL-WM on numerous tasks, such as CV and NLP, using different SSL models both contrastive-based and generative-based. Experimental results demonstrate that SSL-WM can effectively verify the ownership of stolen SSL models in various downstream tasks. Furthermore, SSL-WM is robust against model fine-tuning, pruning, and input preprocessing attacks. Lastly, SSL-WM can also evade detection from evaluated watermark detection approaches, demonstrating its promising application in protecting the ownership of SSL models., Comment: To Appear in the Network and Distributed System Security (NDSS) Symposium 2024, 26 February - 1 March 2024, San Diego, CA, USA

Recently, transformer architecture has demonstrated its significance in both Natural Language Processing (NLP) and Computer Vision (CV) tasks. Though other network models are known to be vulnerable to the backdoor attack, which embeds triggers in the model and controls the model behavior when the triggers are presented, little is known whether such an attack is still valid on the transformer models and if so, whether it can be done in a more cost-efficient manner. In this paper, we propose DBIA, a novel data-free backdoor attack against the CV-oriented transformer networks, leveraging the inherent attention mechanism of transformers to generate triggers and injecting the backdoor using the poisoned surrogate dataset. We conducted extensive experiments based on three benchmark transformers, i.e., ViT, DeiT and Swin Transformer, on two mainstream image classification tasks, i.e., CIFAR10 and ImageNet. The evaluation results demonstrate that, consuming fewer resources, our approach can embed backdoors with a high success rate and a low impact on the performance of the victim transformers. Our code is available at https://anonymous.4open.science/r/DBIA-825D.

Due to the wide use of highly-valuable and large-scale deep neural networks (DNNs), it becomes crucial to protect the intellectual property of DNNs so that the ownership of disputed or stolen DNNs can be verified. Most existing solutions embed backdoors in DNN model training such that DNN ownership can be verified by triggering distinguishable model behaviors with a set of secret inputs. However, such solutions are vulnerable to model fine-tuning and pruning. They also suffer from fraudulent ownership claim as attackers can discover adversarial samples and use them as secret inputs to trigger distinguishable behaviors from stolen models. To address these problems, we propose a novel DNN watermarking solution, named HufuNet, for protecting the ownership of DNN models. We evaluate HufuNet rigorously on four benchmark datasets with five popular DNN models, including convolutional neural network (CNN) and recurrent neural network (RNN). The experiments demonstrate HufuNet is highly robust against model fine-tuning/pruning, kernels cutoff/supplement, functionality-equivalent attack, and fraudulent ownership claims, thus highly promising to protect large-scale DNN models in the real-world.

With the wide use of Automatic Speech Recognition (ASR) in applications such as human machine interaction, simultaneous interpretation, audio transcription, etc., its security protection becomes increasingly important. Although recent studies have brought to light the weaknesses of popular ASR systems that enable out-of-band signal attack, adversarial attack, etc., and further proposed various remedies (signal smoothing, adversarial training, etc.), a systematic understanding of ASR security (both attacks and defenses) is still missing, especially on how realistic such threats are and how general existing protection could be. In this paper, we present our systematization of knowledge for ASR security and provide a comprehensive taxonomy for existing work based on a modularized workflow. More importantly, we align the research in this domain with that on security in Image Recognition System (IRS), which has been extensively studied, using the domain knowledge in the latter to help understand where we stand in the former. Generally, both IRS and ASR are perceptual systems. Their similarities allow us to systematically study existing literature in ASR security based on the spectrum of attacks and defense solutions proposed for IRS, and pinpoint the directions of more advanced attacks and the directions potentially leading to more effective protection in ASR. In contrast, their differences, especially the complexity of ASR compared with IRS, help us learn unique challenges and opportunities in ASR security. Particularly, our experimental study shows that transfer learning across ASR models is feasible, even in the absence of knowledge about models (even their types) and training data., Comment: 17 pages

Speaker verification, as a biometric authentication mechanism, has been widely used due to the pervasiveness of voice control on smart devices. However, the task of "in-the-wild" speaker verification is still challenging, considering the speech samples may contain lots of identity-unrelated information, e.g., background noise, reverberation, emotion, etc. Previous works focus on optimizing the model to improve verification accuracy, without taking into account the elimination of the impact from the identity-unrelated information. To solve the above problem, we propose SEEF-ALDR, a novel Speaker Embedding Enhancement Framework via Adversarial Learning based Disentangled Representation, to reinforce the performance of existing models on speaker verification. The key idea is to retrieve as much speaker identity information as possible from the original speech, thus minimizing the impact of identity-unrelated information on the speaker verification task by using adversarial learning. Experimental results demonstrate that the proposed framework can significantly improve the performance of speaker verification by 20.3% and 23.8% on average over 13 tested baselines on dataset Voxceleb1 and 8 tested baselines on dataset Voxceleb2 respectively, without adjusting the structure or hyper-parameters of them. Furthermore, the ablation study was conducted to evaluate the contribution of each module in SEEF-ALDR. Finally, porting an existing model into the proposed framework is straightforward and cost-efficient, with very little effort from the model owners due to the modular design of the framework., Comment: 12 pages, 4 figures, Accepted by ACSAC 2020

In this paper, we presented systematic solutions to build robust and practical AEs against real world object detectors. Particularly, for Hiding Attack (HA), we proposed the feature-interference reinforcement (FIR) method and the enhanced realistic constraints generation (ERG) to enhance robustness, and for Appearing Attack (AA), we proposed the nested-AE, which combines two AEs together to attack object detectors in both long and short distance. We also designed diverse styles of AEs to make AA more surreptitious. Evaluation results show that our AEs can attack the state-of-the-art real-time object detectors (i.e., YOLO V3 and faster-RCNN) at the success rate up to 92.4% with varying distance from 1m to 25m and angles from -60{\deg} to 60{\deg}. Our AEs are also demonstrated to be highly transferable, capable of attacking another three state-of-the-art black-box models with high success rate., Comment: 13 pages, 12 figures

The popularity of ASR (automatic speech recognition) systems, like Google Voice, Cortana, brings in security concerns, as demonstrated by recent attacks. The impacts of such threats, however, are less clear, since they are either less stealthy (producing noise-like voice commands) or requiring the physical presence of an attack device (using ultrasound). In this paper, we demonstrate that not only are more practical and surreptitious attacks feasible but they can even be automatically constructed. Specifically, we find that the voice commands can be stealthily embedded into songs, which, when played, can effectively control the target system through ASR without being noticed. For this purpose, we developed novel techniques that address a key technical challenge: integrating the commands into a song in a way that can be effectively recognized by ASR through the air, in the presence of background noise, while not being detected by a human listener. Our research shows that this can be done automatically against real world ASR applications. We also demonstrate that such CommanderSongs can be spread through Internet (e.g., YouTube) and radio, potentially affecting millions of ASR users. We further present a new mitigation technique that controls this threat., Comment: Accepted by USENIX Security 2018

The rapid evolution of Internet-of-Things (IoT) technologies has led to an emerging need to make it smarter. A variety of applications now run simultaneously on an ARM-based processor. For example, devices on the edge of the Internet are provided with higher horsepower to be entrusted with storing, processing and analyzing data collected from IoT devices. This significantly improves efficiency and reduces the amount of data that needs to be transported to the cloud for data processing, analysis and storage. However, commodity OSes are prone to compromise. Once they are exploited, attackers can access the data on these devices. Since the data stored and processed on the devices can be sensitive, left untackled, this is particularly disconcerting. In this paper, we propose a new system, TrustShadow that shields legacy applications from untrusted OSes. TrustShadow takes advantage of ARM TrustZone technology and partitions resources into the secure and normal worlds. In the secure world, TrustShadow constructs a trusted execution environment for security-critical applications. This trusted environment is maintained by a lightweight runtime system that coordinates the communication between applications and the ordinary OS running in the normal world. The runtime system does not provide system services itself. Rather, it forwards requests for system services to the ordinary OS, and verifies the correctness of the responses. To demonstrate the efficiency of this design, we prototyped TrustShadow on a real chip board with ARM TrustZone support, and evaluated its performance using both microbenchmarks and real-world applications. We showed TrustShadow introduces only negligible overhead to real-world applications., Comment: MobiSys 2017