Search

Large Language Models (LLMs) have become integral to many applications, with system prompts serving as a key mechanism to regulate model behavior and ensure ethical outputs. In this paper, we introduce a novel backdoor attack that systematically bypasses these system prompts, posing significant risks to the AI supply chain. Under normal conditions, the model adheres strictly to its system prompts. However, our backdoor allows malicious actors to circumvent these safeguards when triggered. Specifically, we explore a scenario where an LLM provider embeds a covert trigger within the base model. A downstream deployer, unaware of the hidden trigger, fine-tunes the model and offers it as a service to users. Malicious actors can purchase the trigger from the provider and use it to exploit the deployed model, disabling system prompts and achieving restricted outcomes. Our attack utilizes a permutation trigger, which activates only when its components are arranged in a precise order, making it computationally challenging to detect or reverse-engineer. We evaluate our approach on five state-of-the-art models, demonstrating that our method achieves an attack success rate (ASR) of up to 99.50% while maintaining a clean accuracy (CACC) of 98.58%, even after defensive fine-tuning. These findings highlight critical vulnerabilities in LLM deployment pipelines and underscore the need for stronger defenses.

Deep neural networks (DNNs) have demonstrated effectiveness in various fields. However, DNNs are vulnerable to backdoor attacks, which inject a unique pattern, called trigger, into the input to cause misclassification to an attack-chosen target label. While existing works have proposed various methods to mitigate backdoor effects in poisoned models, they tend to be less effective against recent advanced attacks. In this paper, we introduce a novel post-training defense technique UNIT that can effectively eliminate backdoor effects for a variety of attacks. In specific, UNIT approximates a unique and tight activation distribution for each neuron in the model. It then proactively dispels substantially large activation values that exceed the approximated boundaries. Our experimental results demonstrate that UNIT outperforms 7 popular defense methods against 14 existing backdoor attacks, including 2 advanced attacks, using only 5\% of clean training data. UNIT is also cost efficient. The code is accessible at https://github.com/Megum1/UNIT., Comment: The 18th European Conference on Computer Vision ECCV 2024

Human-Oriented Binary Reverse Engineering (HOBRE) lies at the intersection of binary and source code, aiming to lift binary code to human-readable content relevant to source code, thereby bridging the binary-source semantic gap. Recent advancements in uni-modal code model pre-training, particularly in generative Source Code Foundation Models (SCFMs) and binary understanding models, have laid the groundwork for transfer learning applicable to HOBRE. However, existing approaches for HOBRE rely heavily on uni-modal models like SCFMs for supervised fine-tuning or general LLMs for prompting, resulting in sub-optimal performance. Inspired by recent progress in large multi-modal models, we propose that it is possible to harness the strengths of uni-modal code models from both sides to bridge the semantic gap effectively. In this paper, we introduce a novel probe-and-recover framework that incorporates a binary-source encoder-decoder model and black-box LLMs for binary analysis. Our approach leverages the pre-trained knowledge within SCFMs to synthesize relevant, symbol-rich code fragments as context. This additional context enables black-box LLMs to enhance recovery accuracy. We demonstrate significant improvements in zero-shot binary summarization and binary function name recovery, with a 10.3% relative gain in CHRF and a 16.7% relative gain in a GPT4-based metric for summarization, as well as a 6.7% and 7.4% absolute increase in token-level precision and recall for name recovery, respectively. These results highlight the effectiveness of our approach in automating and improving binary code analysis.

Backdoor attack poses a significant security threat to Deep Learning applications. Existing attacks are often not evasive to established backdoor detection techniques. This susceptibility primarily stems from the fact that these attacks typically leverage a universal trigger pattern or transformation function, such that the trigger can cause misclassification for any input. In response to this, recent papers have introduced attacks using sample-specific invisible triggers crafted through special transformation functions. While these approaches manage to evade detection to some extent, they reveal vulnerability to existing backdoor mitigation techniques. To address and enhance both evasiveness and resilience, we introduce a novel backdoor attack LOTUS. Specifically, it leverages a secret function to separate samples in the victim class into a set of partitions and applies unique triggers to different partitions. Furthermore, LOTUS incorporates an effective trigger focusing mechanism, ensuring only the trigger corresponding to the partition can induce the backdoor behavior. Extensive experimental results show that LOTUS can achieve high attack success rate across 4 datasets and 7 model structures, and effectively evading 13 backdoor detection and mitigation techniques. The code is available at https://github.com/Megum1/LOTUS., Comment: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2024)

Load balancers are pervasively used inside today's clouds to scalably distribute network requests across data center servers. Given the extensive use of load balancers and their associated operating costs, several efforts have focused on improving their efficiency by implementing Layer-4 load-balancing logic within the kernel or using hardware acceleration. This work explores whether the more complex and connection-oriented Layer-7 load-balancing capability can also benefit from hardware acceleration. In particular, we target the offloading of load-balancing capability onto programmable SmartNICs. We fully leverage the cost and energy efficiency of SmartNICs using three key ideas. First, we argue that a full and complex TCP/IP stack is not required for Layer-7 load balancers and instead propose a lightweight forwarding agent on the SmartNIC. Second, we develop connection management data structures with a high degree of concurrency with minimal synchronization when executed on multi-core SmartNICs. Finally, we describe how the load-balancing logic could be accelerated using custom packet-processing accelerators on SmartNICs. We prototype Laconic on two types of SmartNIC hardware, achieving over 150 Gbps throughput using all cores on BlueField-2, while a single SmartNIC core achieves 8.7x higher throughput and comparable latency to Nginx on a single x86 core.

Based on the point-coupling density functional, the time-odd deformed relativistic Hartree-Bogoliubov theory in continuum (TODRHBc) is developed. Then the effects of nuclear magnetism on halo phenomenon are explored by taking the experimentally suggested deformed halo nucleus $^{31}$Ne as an example. For $^{31}$Ne, nuclear magnetism contributes 0.09 MeV to total binding energy, and the breaking of Kramers degeneracy results in 0-0.2 MeV splitting in canonical single-particle spectra. The blocked neutron level has a dominant component of $p$ wave and it is marginally bound. However, if we ignore nuclear magnetism, the level becomes unbound. This shows a subtle mechanism that nuclear magnetism changes the single-particle energies, causing a nucleus to become bound. Based on the TODRHBc results, a prolate one-neutron halo is formed around the near-spherical core in $^{31}$Ne. The nucleon current is mostly contributed by the halo rather than the core, except near the center of the nucleus. A layered structure in the neutron current distribution is observed and studied in detail., Comment: 20 pages, 6 figures

Large Language Models (LLMs) have become prevalent across diverse sectors, transforming human life with their extraordinary reasoning and comprehension abilities. As they find increased use in sensitive tasks, safety concerns have gained widespread attention. Extensive efforts have been dedicated to aligning LLMs with human moral principles to ensure their safe deployment. Despite their potential, recent research indicates aligned LLMs are prone to specialized jailbreaking prompts that bypass safety measures to elicit violent and harmful content. The intrinsic discrete nature and substantial scale of contemporary LLMs pose significant challenges in automatically generating diverse, efficient, and potent jailbreaking prompts, representing a continuous obstacle. In this paper, we introduce RIPPLE (Rapid Optimization via Subconscious Exploitation and Echopraxia), a novel optimization-based method inspired by two psychological concepts: subconsciousness and echopraxia, which describe the processes of the mind that occur without conscious awareness and the involuntary mimicry of actions, respectively. Evaluations across 6 open-source LLMs and 4 commercial LLM APIs show RIPPLE achieves an average Attack Success Rate of 91.5\%, outperforming five current methods by up to 47.0\% with an 8x reduction in overhead. Furthermore, it displays significant transferability and stealth, successfully evading established detection mechanisms. The code of our work is available at \url{https://github.com/SolidShen/RIPPLE_official/tree/official}

The mass table in the deformed relativistic Hartree-Bogoliubov theory in continuum (DRHBc) with the PC-PK1 density functional has been established for even-$Z$ nuclei with $8\le Z\le120$, extended from the previous work for even-even nuclei [Zhang $\it{et.~al.}$ (DRHBc Mass Table Collaboration), At. Data Nucl. Data Tables 144, 101488 (2022)]. The calculated binding energies, two-nucleon and one-neutron separation energies, root-mean-square (rms) radii of neutron, proton, matter, and charge distributions, quadrupole deformations, and neutron and proton Fermi surfaces are tabulated and compared with available experimental data. A total of 4829 even-$Z$ nuclei are predicted to be bound, with an rms deviation of 1.477 MeV from the 1244 mass data. Good agreement with the available experimental odd-even mass differences, $\alpha$ decay energies, and charge radii is also achieved. The description accuracy for nuclear masses and nucleon separation energies as well as the prediction for drip lines is compared with the results obtained from other relativistic and nonrelativistic density functional. The comparison shows that the DRHBc theory with PC-PK1 provides an excellent microscopic description for the masses of even-$Z$ nuclei. The systematics of the nucleon separation energies, odd-even mass differences, pairing energies, two-nucleon gaps, $\alpha$ decay energies, rms radii, quadrupole deformations, potential energy curves, neutron density distributions, and neutron mean-field potentials are discussed., Comment: 394 pages, 17 figures, 2 tables, published in Atomic Data and Nuclear Data Tables, data file in the TXT form is available for download under "Ancillary files"

Diffusion models (DM) have become state-of-the-art generative models because of their capability to generate high-quality images from noises without adversarial training. However, they are vulnerable to backdoor attacks as reported by recent studies. When a data input (e.g., some Gaussian noise) is stamped with a trigger (e.g., a white patch), the backdoored model always generates the target image (e.g., an improper photo). However, effective defense strategies to mitigate backdoors from DMs are underexplored. To bridge this gap, we propose the first backdoor detection and removal framework for DMs. We evaluate our framework Elijah on hundreds of DMs of 3 types including DDPM, NCSN and LDM, with 13 samplers against 3 existing backdoor attacks. Extensive experiments show that our approach can have close to 100% detection accuracy and reduce the backdoor effects to close to zero without significantly sacrificing the model utility., Comment: AAAI 2024

We consider a multidimensional Markov Chain $X$ converging to a multidimensional Brownian Motion. We construct a positive harmonic function for $X$ killed on exiting the cone. We show that its asymptotic behavior is similar to that of to the harmonic function of Brownian motion. We use the harmonic function to study the asymptotic behaviour of the tail distribution of the exit time $\tau$ of $X$ from a cone., Comment: 27 pages

Electroencephalography(EEG) classification is a crucial task in neuroscience, neural engineering, and several commercial applications. Traditional EEG classification models, however, have often overlooked or inadequately leveraged the brain's topological information. Recognizing this shortfall, there has been a burgeoning interest in recent years in harnessing the potential of Graph Neural Networks (GNN) to exploit the topological information by modeling features selected from each EEG channel in a graph structure. To further facilitate research in this direction, we introduce GNN4EEG, a versatile and user-friendly toolkit for GNN-based modeling of EEG signals. GNN4EEG comprises three components: (i)A large benchmark constructed with four EEG classification tasks based on EEG data collected from 123 participants. (ii)Easy-to-use implementations on various state-of-the-art GNN-based EEG classification models, e.g., DGCNN, RGNN, etc. (iii)Implementations of comprehensive experimental settings and evaluation protocols, e.g., data splitting protocols, and cross-validation protocols. GNN4EEG is publicly released at https://github.com/Miracle-2001/GNN4EEG.

Backdoor attacks have emerged as a prominent threat to natural language processing (NLP) models, where the presence of specific triggers in the input can lead poisoned models to misclassify these inputs to predetermined target classes. Current detection mechanisms are limited by their inability to address more covert backdoor strategies, such as style-based attacks. In this work, we propose an innovative test-time poisoned sample detection framework that hinges on the interpretability of model predictions, grounded in the semantic meaning of inputs. We contend that triggers (e.g., infrequent words) are not supposed to fundamentally alter the underlying semantic meanings of poisoned samples as they want to stay stealthy. Based on this observation, we hypothesize that while the model's predictions for paraphrased clean samples should remain stable, predictions for poisoned samples should revert to their true labels upon the mutations applied to triggers during the paraphrasing process. We employ ChatGPT, a state-of-the-art large language model, as our paraphraser and formulate the trigger-removal task as a prompt engineering problem. We adopt fuzzing, a technique commonly used for unearthing software vulnerabilities, to discover optimal paraphrase prompts that can effectively eliminate triggers while concurrently maintaining input semantics. Experiments on 4 types of backdoor attacks, including the subtle style backdoors, and 4 distinct datasets demonstrate that our approach surpasses baseline methods, including STRIP, RAP, and ONION, in precision and recall.

Self-supervised learning in computer vision trains on unlabeled data, such as images or (image, text) pairs, to obtain an image encoder that learns high-quality embeddings for input data. Emerging backdoor attacks towards encoders expose crucial vulnerabilities of self-supervised learning, since downstream classifiers (even further trained on clean data) may inherit backdoor behaviors from encoders. Existing backdoor detection methods mainly focus on supervised learning settings and cannot handle pre-trained encoders especially when input labels are not available. In this paper, we propose DECREE, the first backdoor detection approach for pre-trained encoders, requiring neither classifier headers nor input labels. We evaluate DECREE on over 400 encoders trojaned under 3 paradigms. We show the effectiveness of our method on image encoders pre-trained on ImageNet and OpenAI's CLIP 400 million image-text pairs. Our method consistently has a high detection accuracy even if we have only limited or no access to the pre-training dataset., Comment: Accepted at CVPR 2023. Code is available at https://github.com/GiantSeaweed/DECREE

Deep Learning backdoor attacks have a threat model similar to traditional cyber attacks. Attack forensics, a critical counter-measure for traditional cyber attacks, is hence of importance for defending model backdoor attacks. In this paper, we propose a novel model backdoor forensics technique. Given a few attack samples such as inputs with backdoor triggers, which may represent different types of backdoors, our technique automatically decomposes them to clean inputs and the corresponding triggers. It then clusters the triggers based on their properties to allow automatic attack categorization and summarization. Backdoor scanners can then be automatically synthesized to find other instances of the same type of backdoor in other models. Our evaluation on 2,532 pre-trained models, 10 popular attacks, and comparison with 9 baselines show that our technique is highly effective. The decomposed clean inputs and triggers closely resemble the ground truth. The synthesized scanners substantially outperform the vanilla versions of existing scanners that can hardly generalize to different kinds of attacks.

Federated Learning (FL) is a distributed learning paradigm that enables different parties to train a model together for high quality and strong privacy protection. In this scenario, individual participants may get compromised and perform backdoor attacks by poisoning the data (or gradients). Existing work on robust aggregation and certified FL robustness does not study how hardening benign clients can affect the global model (and the malicious clients). In this work, we theoretically analyze the connection among cross-entropy loss, attack success rate, and clean accuracy in this setting. Moreover, we propose a trigger reverse engineering based defense and show that our method can achieve robustness improvement with guarantee (i.e., reducing the attack success rate) without affecting benign accuracy. We conduct comprehensive experiments across different datasets and attack settings. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks. Code is available at https://github.com/KaiyuanZh/FLIP., Comment: Accepted by ICLR 2023. Code is available at https://github.com/KaiyuanZh/FLIP

The aim of this work is to extend the deformed relativistic Hartree-Bogoliubov theory in continuum (DRHBc) based on the point-coupling density functionals to odd-$A$ and odd-odd nuclei and examine its applicability by taking odd-$A$ Nd isotopes as examples. In the DRHBc theory, the densities and potentials with axial deformation are expanded in terms of Legendre polynomials, and the relativistic Hartree-Bogoliubov equations are solved in a Dirac Woods-Saxon basis to include the continuum effects. For an odd-$A$ or odd-odd nucleus, the blocking effect of unpaired nucleon(s) is taken into account with the equal filling approximation. To determine its ground state, an automatic blocking procedure is adopted, in which the orbital with the lowest quasiparticle energy is blocked during the iteration. This procedure is justified by comparing with the results from the orbital-fixed blocking calculations, in which the blocked orbital near the Fermi surface is fixed during the iteration. The ground states for both light and heavy nuclei can be provided by the automatic blocking procedure as the orbital-fixed blocking procedure, but with considerably reduced computational cost. The numerical details for even-even nuclei are found to be valid for odd-$A$ and odd-odd nuclei as well. Taking Nd isotopes including both even-even and odd-$A$ ones as examples, the calculated ground-state properties with PC-PK1 are in good agreement with the available experimental data. This work paves the way to construct the DRHBc mass table including all even-even, odd-$A$ and odd-odd nuclei in the nuclear chart., Comment: 39 pages, 13 figures, and 1 table

Lead halide perovskite materials have been emerging as promising candidates for high-performance optoelectronic devices. Significant efforts have sought to realize monocrystalline perovskite films at a large scale. Here, we epitaxially grow monocrystalline methylammonium lead tribromide (MAPbBr3) films on lattice-matched gallium arsenide (GaAs) substrates at a centimeter scale. In particular, a solution-processed lead(II) sulfide (PbS) layer provides a lattice-matched and chemical protective interface for the solid-gas reaction to form MAPbBr3 films on GaAs. Structure characterizations identify the crystal orientations in the trilayer MAPbBr3/PbS/GaAs epi-structure and confirm the monocrystalline nature of MAPbBr3 on PbS/GaAs. The dynamic evolution of surface morphologies during the growth indicates a two-step epitaxial process. These fundamental understandings and practical growth techniques offer a viable guideline to approach high-quality perovskite films for previously inaccessible applications.

Ground-state properties of even-even nuclei with $8\le Z\le120$ from the proton drip line to the neutron drip line have been investigated using the deformed relativistic Hartree-Bogoliubov theory in continuum (DRHBc) with the density functional PC-PK1. With the effects of deformation and continuum included simultaneously, 2583 even-even nuclei are predicted to be bound. The calculated binding energies, two-nucleon separation energies, root-mean-square (rms) radii of neutron, proton, matter, and charge distributions, quadrupole deformations, and neutron and proton Fermi surfaces are tabulated and compared with available experimental data. The rms deviation from the 637 mass data is 1.518 MeV, providing one of the best microscopic descriptions for nuclear masses. The drip lines obtained from DRHBc calculations are compared with other calculations, including the spherical relativistic continuum Hartree-Bogoliubov (RCHB) and triaxial relativistic Hartree-Bogoliubov (TRHB) calculations with PC-PK1. The deformation and continuum effects on the limits of the nuclear landscape are discussed. Possible peninsulas consisting of bound nuclei beyond the two-neutron drip line are predicted. The systematics of the two-nucleon separation energies, two-nucleon gaps, rms radii, quadrupole deformations, potential energy curves, neutron densities, neutron mean-field potentials, and pairing energies in the DRHBc calculations are also discussed. In addition, the $\alpha$ decay energies extracted are in good agreement with available data., Comment: 217 pages, 15 figures, 2 tables, accepted for publication in Atomic Data and Nuclear Data Tables, data file in the TXT form is available for download under "Ancillary files"

The predictive power of the deformed relativistic Hartree-Bogoliubov theory in continuum (DRHBc) for nuclear mass is examined in the superheavy region, $102 \le Z \le 120$. The accuracy of predicting the 10 (56) measured (measured and empirical) masses is $0.635$ ($0.642$) MeV, in comparison with $0.515$ ($1.360$) MeV by WS4 and $0.910$ ($2.831$) MeV by FRDM. Possible stability against multineutron emission beyond the two-neutron drip line is explored by the DRHBc theory, which takes into account simultaneously the deformation effects, the pairing correlations, and the continuum effects. Nuclei stable against two- and multineutron emissions beyond the two-neutron drip line are predicted in $_{106}$Sg, $_{108}$Hs, $_{110}$Ds, and $_{112}$Cn isotopic chains, forming a peninsula of stability adjacent to the nuclear mainland. This stability is mainly due to the deformation which significantly affects the shell structure around the Fermi surface. The pairing correlations and continuum influence the stability peninsula in a self-consistent way., Comment: 13 pages, 5 figures, minor updates according to the published version