Search

Intense femtosecond x-ray pulses produced by an x-ray free-electron laser can trigger irreversible structural transitions in crystalline solids. For instance, irradiation of diamond can lead to graphitization and, at higher deposited doses, to amorphization. Our Monte Carlo simulations of irradiated diamond under realistic experimental conditions demonstrate that triggering graphitization or other phase transitions with hard x-ray photons can be challenging due to the ballistic escape of photoelectrons out of the beam focus. Decisive parameter here is the photoelectron range in proportion to the focal beam size. For future experiments on x-ray-induced transitions, such dedicated simulations of ballistic transport preceding the beamtime will be necessary. They can predict experimental conditions under which the desired distribution of the absorbed x-ray dose in the irradiated solid can be achieved., Comment: 15 pages, 2 figures, 1 table. Submitted to Phys. Rev. B

BM25, a widely-used lexical search algorithm, remains crucial in information retrieval despite the rise of pre-trained and large language models (PLMs/LLMs). However, it neglects query-document similarity and lacks semantic understanding, limiting its performance. We revisit BM25 and introduce BMX, a novel extension of BM25 incorporating entropy-weighted similarity and semantic enhancement techniques. Extensive experiments demonstrate that BMX consistently outperforms traditional BM25 and surpasses PLM/LLM-based dense retrieval in long-context and real-world retrieval benchmarks. This study bridges the gap between classical lexical search and modern semantic approaches, offering a promising direction for future information retrieval research. The reference implementation of BMX can be found in Baguetter, which was created in the context of this work. The code can be found here: https://github.com/mixedbread-ai/baguetter., Comment: correct the affiliation order

Dataspaces have recently gained adoption across various sectors, including traditionally less digitized domains such as culture. Leveraging Semantic Web technologies helps to make dataspaces FAIR, but their complexity poses a significant challenge to the adoption of dataspaces and increases their cost. The advent of Large Language Models (LLMs) raises the question of how these models can support the adoption of FAIR dataspaces. In this work, we demonstrate the potential of LLMs in dataspaces with a concrete example. We also derive a research agenda for exploring this emerging field., Comment: 8 pages. Preprint. Under review

Earth's surface is deficient in available forms of many elements considered limiting for prebiotic chemistry. In contrast, many extraterrestrial rocky objects are rich in these same elements. Limiting prebiotic ingredients may, therefore, have been delivered by exogenous material; however, the mechanisms by which exogeneous material may be reliably and non-destructively supplied to a planetary surface remains unclear. Today, the flux of extraterrestrial matter to Earth is dominated by fine-grained cosmic dust. Although this material is rarely discussed in a prebiotic context due to its delivery over a large surface area, concentrated cosmic dust deposits are known to form on Earth today due to the action of sedimentary processes. Here we combine empirical constraints on dust sedimentation with dynamical simulations of dust formation and planetary accretion to show that localized sedimentary deposits of cosmic dust could have accumulated in arid environments on early Earth, in particular glacial settings that today produce cryoconite sediments. Our results challenge the widely held assumption that cosmic dust is incapable of fertilizing prebiotic chemistry. Cosmic dust deposits may have plausibly formed on early Earth and acted to fertilize prebiotic chemistry., Comment: 5 figures

In recent years, data lakes emerged as away to manage large amounts of heterogeneous data for modern data analytics. One way to prevent data lakes from turning into inoperable data swamps is semantic data management. Some approaches propose the linkage of metadata to knowledge graphs based on the Linked Data principles to provide more meaning and semantics to the data in the lake. Such a semantic layer may be utilized not only for data management but also to tackle the problem of data integration from heterogeneous sources, in order to make data access more expressive and interoperable. In this survey, we review recent approaches with a specific focus on the application within data lake systems and scalability to Big Data. We classify the approaches into (i) basic semantic data management, (ii) semantic modeling approaches for enriching metadata in data lakes, and (iii) methods for ontologybased data access. In each category, we cover the main techniques and their background, and compare latest research. Finally, we point out challenges for future work in this research area, which needs a closer integration of Big Data and Semantic Web technologies.

Differentiable rendering methods promise the ability to optimize various parameters of 3d scenes to achieve a desired result. However, lighting design has so far received little attention in this field. In this paper, we introduce a method that enables continuous optimization of the arrangement of luminaires in a 3d scene via differentiable light tracing. Our experiments show two major issues when attempting to apply existing methods from differentiable path tracing to this problem: first, many rendering methods produce images, which restricts the ability of a designer to define lighting objectives to image space. Second, most previous methods are designed for scene geometry or material optimization and have not been extensively tested for the case of optimizing light sources. Currently available differentiable ray-tracing methods do not provide satisfactory performance, even on fairly basic test cases in our experience. In this paper, we propose a novel adjoint light tracing method that overcomes these challenges and enables gradient-based lighting design optimization in a view-independent (camera-free) way. Thus, we allow the user to paint illumination targets directly onto the 3d scene or use existing baked illumination data (e.g., light maps). Using modern ray-tracing hardware, we achieve interactive performance. We find light tracing advantageous over path tracing in this setting, as it naturally handles irregular geometry, resulting in less noise and improved optimization convergence. We compare our adjoint gradients to state-of-the-art image-based differentiable rendering methods. We also demonstrate that our gradient data works with various common optimization algorithms, providing good convergence behaviour. Qualitative comparisons with real-world scenes underline the practical applicability of our method.

X-ray laser-induced structural changes in silicon undergoing femtosecond melting have been investigated by using an x-ray pump-x-ray probe technique. The experimental results for different initial sample temperatures reveal that the onset time and the speed of the atomic disordering are independent of the initial temperature, suggesting that equilibrium atomic motion in the initial state does not play a pivotal role in the x-ray-induced ultrafast melting. By comparing the observed time-dependence of the atomic disordering and the dedicated theoretical simulations, we interpret that the energy transfer from the excited electrons to ions via electron-ion coupling (thermal effect) as well as a strong modification of the interatomic potential due to electron excitations (non-thermal effect) trigger the ultrafast atomic disordering. Our finding of the interplay of thermal and non-thermal effects in the x-ray-induced melting demonstrates that accurate modeling of intense x-ray interactions with matter is essential to ensure a correct interpretation of experiments using intense x-ray laser pulses.

Carbon nanotube (CNT) wires approach copper's specific conductivity and surpass carbon fiber's strength, with further improvement anticipated with greater aspect ratios and incorporation of dopants with long-range structural order. Fullerenes assemble into multitudes of process-dependent supramolecular crystals and, while initially insulating, they become marginally conductive (up to 0.05 MSm$^{-1}$) and superconductive ($T_c=18^\circ$K with K and 28$^\circ$K with Rb) after doping. These were small (100's $\mu$m long), soft (hardness comparable to indium), and typically unaligned, which hindered development of fullerene based wires. Individual fullerenes were previously incorporated into CNT fibers, although randomly without self-assembly into supramolecules. Here, a simple variation in established CNT acid extrusion creates a fiber composed of uniaxial chains of aligned fullerene supramolecules, self-assembled between aligned few-walled CNT bundles. This will provide a testbed for novel fullerene wire transport and prospects in CNT wire advancement.

Effective and flexible allocation of visual attention is key for pedestrians who have to navigate to a desired goal under different conditions of urgency and safety preferences. While automatic modelling of pedestrian attention holds great promise to improve simulations of pedestrian behavior, current saliency prediction approaches mostly focus on generic free-viewing scenarios and do not reflect the specific challenges present in pedestrian attention prediction. In this paper, we present Context-SalNET, a novel encoder-decoder architecture that explicitly addresses three key challenges of visual attention prediction in pedestrians: First, Context-SalNET explicitly models the context factors urgency and safety preference in the latent space of the encoder-decoder model. Second, we propose the exponentially weighted mean squared error loss (ew-MSE) that is able to better cope with the fact that only a small part of the ground truth saliency maps consist of non-zero entries. Third, we explicitly model epistemic uncertainty to account for the fact that training data for pedestrian attention prediction is limited. To evaluate Context-SalNET, we recorded the first dataset of pedestrian visual attention in VR that includes explicit variation of the context factors urgency and safety preference. Context-SalNET achieves clear improvements over state-of-the-art saliency prediction approaches as well as over ablations. Our novel dataset will be made fully available and can serve as a valuable resource for further research on pedestrian attention prediction.

Dark matter lighter than 10 GeV/c$^2$ encompasses a promising range of candidates. A conceptual design for a new detector, DarkSide-LowMass, is presented, based on the DarkSide-50 detector and progress toward DarkSide-20k, optimized for a low-threshold electron-counting measurement. Sensitivity to light dark matter is explored for various potential energy thresholds and background rates. These studies show that DarkSide-LowMass can achieve sensitivity to light dark matter down to the solar neutrino floor for GeV-scale masses and significant sensitivity down to 10 MeV/c$^2$ considering the Migdal effect or interactions with electrons. Requirements for optimizing the detector's sensitivity are explored, as are potential sensitivity gains from modeling and mitigating spurious electron backgrounds that may dominate the signal at the lowest energies.

We show how weakly supervised machine learning can improve the sensitivity of LHC mono-jet searches to new physics models with anomalous jet dynamics. The Classification Without Labels (CWoLa) method is used to extract all the information available from low-level detector information without any reference to specific new physics models. For the example of a strongly interacting dark matter model, we employ simulated data to show that the discovery potential of an existing generic search can be boosted considerably., Comment: 19 pages, 3 figures. v2: references added

Transient structural changes of Al$_2$O$_3$ on subatomic length scales following irradiation with an intense x-ray laser pulse (photon energy: 8.70 keV; pulse duration: 6 fs; fluence: 8$\times$10$^2$ J/cm$^{2}$) have been investigated by using an x-ray pump x-ray probe technique. The measurement reveals that aluminum and oxygen atoms remain in their original positions by $\sim$20 fs after the intensity maximum of the pump pulse, followed by directional atomic displacements at the fixed unit cell parameters. By comparing the experimental results and theoretical simulations, we interpret that electron excitation and relaxation triggered by the pump pulse modifies the potential energy surface and drives the directional atomic displacements. Our results indicate that high-resolution x-ray structural analysis with the accuracy of 0.01 \AA is feasible even with intense x-ray pulses by making the pulse duration shorter than the timescale needed to complete electron excitation and relaxation processes, which usually take up to a few tens of femtoseconds.

Memory utilization can be reduced by merging identical memory blocks into copy-on-write mappings. Previous work showed that this so-called memory deduplication can be exploited in local attacks to break ASLR, spy on other programs,and determine the presence of data, i.e., website images. All these attacks exploit memory deduplication across security domains, which in turn was disabled. However, within a security domain or on an isolated system with no untrusted local access, memory deduplication is still not considered a security risk and was recently re-enabled on Windows by default. In this paper, we present the first fully remote memorydeduplication attacks. Unlike previous attacks, our attacks require no local code execution. Consequently, we can disclose memory contents from a remote server merely by sending and timing HTTP/1 and HTTP/2 network requests. We demonstrate our attacks on deduplication both on Windows and Linux and attack widely used server software such as Memcached and InnoDB. Our side channel leaks up to 34.41 B/h over the internet, making it faster than comparable remote memory-disclosure channels. We showcase our remote memory-deduplication attack in three case studies: First, we show that an attacker can disclose the presence of data in memory on a server running Memcached. We show that this information disclosure channel can also be used for fingerprinting and detect the correct libc version over the internet in 166.51 s. Second, in combination with InnoDB, we present an information disclosure attack to leak MariaDB database records. Third, we demonstrate a fully remote KASLR break in less than 4 minutes allowing to derandomize the kernel image of a virtual machine over the Internet, i.e., 14 network hops away. We conclude that memory deduplication must also be considered a security risk if only applied within a single security domain.

Two main trends characterize today's communication landscape and are finding their way into industrial facilities: the rollout of 5G with its distinct support for vertical industries and the increasing success of machine learning (ML). The combination of those two technologies open the doors to many exciting industrial applications and its impact is expected to rapidly increase in the coming years, given the abundant data growth and the availability of powerful edge computers in production facilities. Unlike most previous work that has considered the application of 5G and ML in industrial environment separately, this paper highlights the potential and synergies that result from combining them. The overall vision presented here generates from the KICK project, a collaboration of several partners from the manufacturing and communication industry as well as research institutes. This unprecedented blend of 5G and ML expertise creates a unique perspective on ML-supported industrial communications and their role in facilitating industrial automation. The paper identifies key open industrial challenges that are grouped into four use cases: wireless connectivity and edge-cloud integration, flexibility in network reconfiguration, dynamicity of heterogeneous network services, and mobility of robots and vehicles. Moreover, the paper provides insights into the advantages of ML-based industrial communications and discusses current challenges of data acquisition in real systems.

Magnetic Resonance Fingerprinting (MRF) enables the simultaneous quantification of multiple properties of biological tissues. It relies on a pseudo-random acquisition and the matching of acquired signal evolutions to a precomputed dictionary. However, the dictionary is not scalable to higher-parametric spaces, limiting MRF to the simultaneous mapping of only a small number of parameters (proton density, T1 and T2 in general). Inspired by diffusion-weighted SSFP imaging, we present a proof-of-concept of a novel MRF sequence with embedded diffusion-encoding gradients along all three axes to efficiently encode orientational diffusion and T1 and T2 relaxation. We take advantage of a convolutional neural network (CNN) to reconstruct multiple quantitative maps from this single, highly undersampled acquisition. We bypass expensive dictionary matching by learning the implicit physical relationships between the spatiotemporal MRF data and the T1, T2 and diffusion tensor parameters. The predicted parameter maps and the derived scalar diffusion metrics agree well with state-of-the-art reference protocols. Orientational diffusion information is captured as seen from the estimated primary diffusion directions. In addition to this, the joint acquisition and reconstruction framework proves capable of preserving tissue abnormalities in multiple sclerosis lesions.

A java-based graphical tool for drawing Feynman diagrams is presented. It differs from similar existing tools in various respects. For example, it is based on models, consisting of particles (lines) and (optionally) vertices, each of which can be given their individual properties (line style, color, arrows, label, etc.). The diagrams can be exported in any standard image format, or as PDF. Aside from its plain graphical aspect, the goal of FeynGame is also educative, as it can check a Feynman diagrams validity. This provides the basis to play games with diagrams, for example. Here we describe on such game where a given set of initial and final states must be connected through a Feynman diagram within a given interaction model., Comment: 26 pages, several figures and screenshots. FeynGame is available from https://gitlab.com/feyngame/FeynGame

With the rapid development of short-pulse intense laser sources, studies of matter under extreme irradiation conditions enter further unexplored regimes. In addition, an application of X-ray Free- Electron Lasers (XFELs), delivering intense femtosecond X-ray pulses allows to investigate sample evolution in IR pump - X-ray probe experiments with an unprecedented time resolution. Here we present the detailed study of periodic plasma created from the colloidal crystal. Both experimental data and theory modeling show that the periodicity in the sample survives to a large extent the extreme excitation and shock wave propagation inside the colloidal crystal. This feature enables probing the excited crystal, using the powerful Bragg peak analysis, in contrast to the conventional studies of dense plasma created from bulk samples for which probing with Bragg diffraction technique is not possible. X-ray diffraction measurements of excited colloidal crystals may then lead towards a better understanding of matter phase transitions under extreme irradiation conditions., Comment: 52 pages, 22 figures, 64 references

We present version 3 of the open-source simulator for flow and transport processes in porous media DuMu$^\text{x}$. DuMu$^\text{x}$ is based on the modular C++ framework Dune (Distributed and Unified Numerics Environment) and is developed as a research code with a focus on modularity and reusability. We describe recent efforts in improving the transparency and efficiency of the development process and community-building, as well as efforts towards quality assurance and reproducible research. In addition to a major redesign of many simulation components in order to facilitate setting up complex simulations in DuMu$^\text{x}$, version 3 introduces a more consistent abstraction of finite volume schemes. Finally, the new framework for multi-domain simulations is described, and three numerical examples demonstrate its flexibility.

A living cell senses its environment and responds to external signals. In this work, we study theoretically, the precision at which cells can determine the position of a spatially localized transient extracellular signal. To this end, we focus on the case, where the stimulus is converted into the release of a small molecule that acts as a second messenger, for example, Ca$^{2+}$, and activates kinases that change the activity of enzymes by phosphorylating them. We analyze the spatial distribution of phosphorylation events using stochastic simulations as well as a mean-field approach. Kinases that need to bind to the cell membrane for getting activated provide more accurate estimates than cytosolic kinases. Our results could explain why the rate of Ca$^{2+}$ detachment from the membrane-binding conventional Protein Kinase C$\alpha$ is larger than its phosphorylation rate.

Recently, out-of-order execution, an important performance optimization in modern high-end processors, has been revealed to pose a significant security threat, allowing information leaks across security domains. In particular, the Meltdown attack leaks information from the operating system kernel to user space, completely eroding the security of the system. To address this and similar attacks, without incurring the performance costs of software countermeasures, Intel includes hardware-based defenses in its recent Coffee Lake R processors. In this work, we show that the recent hardware defenses are not sufficient. Specifically, we present Fallout, a new transient execution attack that leaks information from a previously unexplored microarchitectural component called the store buffer. We show how unprivileged user processes can exploit Fallout to reconstruct privileged information recently written by the kernel. We further show how Fallout can be used to bypass kernel address space randomization. Finally, we identify and explore microcode assists as a hitherto ignored cause of transient execution. Fallout affects all processor generations we have tested. However, we notice a worrying regression, where the newer Coffee Lake R processors are more vulnerable to Fallout than older generations.

Out-of-order execution and speculative execution are among the biggest contributors to performance and efficiency of modern processors. However, they are inconsiderate, leaking secret data during the transient execution of instructions. Many solutions have been proposed against transient execution attacks. However, they do not eliminate the leakage entirely or introduce unacceptable performance penalties. In this paper, we propose ConTExT, a Considerate Transient Execution Technique. The basic idea of ConTExT is that secrets can enter registers, but not transiently leave them. ConTExT transforms Spectre from a problem that cannot be solved purely in software [53], to a problem that is not easy to solve, but solvable in software. For this, ConTExT requires minimal modifications of applications, compilers, operating systems, and the hardware. ConTExT offers full protection for secrets in memory and secrets in registers. We evaluate the security and performance of ConTExT. With its principled approach it inherently mitigates the recently found microarchitectural data sampling attacks on small processor buffers. Even when over-approximating, we observe no performance overhead for unprotected code and data, and an overhead of 71.14% for security-critical applications, which is below the overhead of currently recommended state-of-the-art mitigation strategies. The actual overhead of ConTExT is below 1% for real-world workloads.

In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space by exploiting side-effects from transient instructions. While this attack has been mitigated through stronger isolation boundaries between user and kernel space, Meltdown inspired an entirely new class of fault-driven transient execution attacks. Particularly, over the past year, Meltdown-type attacks have been extended to not only leak data from the L1 cache but also from various other microarchitectural structures, including the FPU register file and store buffer. In this paper, we present the ZombieLoad attack which uncovers a novel Meltdown-type effect in the processor's previously unexplored fill-buffer logic. Our analysis shows that faulting load instructions (i.e., loads that have to be re-issued for either architectural or microarchitectural reasons) may transiently dereference unauthorized destinations previously brought into the fill buffer by the current or a sibling logical CPU. Hence, we report data leakage of recently loaded stale values across logical cores. We demonstrate ZombieLoad's effectiveness in a multitude of practical attack scenarios across CPU privilege rings, OS processes, virtual machines, and SGX enclaves. We discuss both short and long-term mitigation approaches and arrive at the conclusion that disabling hyperthreading is the only possible workaround to prevent this extremely powerful attack on current processors.

We develop an electronic-temperature dependent interatomic potential $\Phi (T_\text{e})$ for unexcited and laser-excited silicon. The potential is designed to reproduce ab initio molecular dynamics simulations by requiring force- and energy matching for each time step. $\Phi (T_\text{e})$ has a simple and flexible analytical form, can describe all relevant interactions and is applicable for any kind of boundary conditions (bulk, thin films, clusters). Its overall shape is automatically adjusted by a self-learning procedure, which finally finds the global minimum in the parameter space. We show that $\Phi (T_\text{e})$ can reproduce all thermal and nonthermal features provided by ab initio simulations. We apply the potential to simulate laser-excited Si nanoparticles and find critical damping of their breathing modes due to nonthermal melting.

Research on transient execution attacks including Spectre and Meltdown showed that exception or branch misprediction events might leave secret-dependent traces in the CPU's microarchitectural state. This observation led to a proliferation of new Spectre and Meltdown attack variants and even more ad-hoc defenses (e.g., microcode and software patches). Both the industry and academia are now focusing on finding effective defenses for known issues. However, we only have limited insight on residual attack surface and the completeness of the proposed defenses. In this paper, we present a systematization of transient execution attacks. Our systematization uncovers 6 (new) transient execution attacks that have been overlooked and not been investigated so far: 2 new exploitable Meltdown effects: Meltdown-PK (Protection Key Bypass) on Intel, and Meltdown-BND (Bounds Check Bypass) on Intel and AMD; and 4 new Spectre mistraining strategies. We evaluate the attacks in our classification tree through proof-of-concept implementations on 3 major CPU vendors (Intel, AMD, ARM). Our systematization yields a more complete picture of the attack surface and allows for a more systematic evaluation of defenses. Through this systematic evaluation, we discover that most defenses, including deployed ones, cannot fully mitigate all attack variants.

In this paper, we present NetSpectre, a generic remote Spectre variant 1 attack. For this purpose, we demonstrate the first access-driven remote Evict+Reload cache attack over network, leaking 15 bits per hour. Beyond retrofitting existing attacks to a network scenario, we also demonstrate the first Spectre attack which does not use a cache covert channel. Instead, we present a novel high-performance AVX-based covert channel that we use in our cache-free Spectre attack. We show that in particular remote Spectre attacks perform significantly better with the AVX-based covert channel, leaking 60 bits per hour from the target system. We verified that our NetSpectre attacks work in local-area networks as well as between virtual machines in the Google cloud. NetSpectre marks a paradigm shift from local attacks, to remote attacks, exposing a much wider range and larger number of devices to Spectre attacks. Spectre attacks now must also be considered on devices which do not run any potentially attacker-controlled code at all. We show that especially in this remote scenario, attacks based on weaker gadgets which do not leak actual data, are still very powerful to break address-space layout randomization remotely. Several of the Spectre gadgets we discuss are more versatile than anticipated. In particular, value-thresholding is a technique we devise, which leaks a secret value without the typical bit selection mechanisms. We outline challenges for future research on Spectre attacks and Spectre mitigations.

We study the following classes of beyond-planar graphs: 1-planar, IC-planar, and NIC-planar graphs. These are the graphs that admit a 1-planar, IC-planar, and NIC-planar drawing, respectively. A drawing of a graph is 1-planar if every edge is crossed at most once. A 1-planar drawing is IC-planar if no two pairs of crossing edges share a vertex. A 1-planar drawing is NIC-planar if no two pairs of crossing edges share two vertices. We study the relations of these beyond-planar graph classes (beyond-planar graphs is a collective term for the primary attempts to generalize the planar graphs) to right-angle crossing (RAC) graphs that admit compact drawings on the grid with few bends. We present four drawing algorithms that preserve the given embeddings. First, we show that every $n$-vertex NIC-planar graph admits a NIC-planar RAC drawing with at most one bend per edge on a grid of size $O(n) \times O(n)$. Then, we show that every $n$-vertex 1-planar graph admits a 1-planar RAC drawing with at most two bends per edge on a grid of size $O(n^3) \times O(n^3)$. Finally, we make two known algorithms embedding-preserving; for drawing 1-planar RAC graphs with at most one bend per edge and for drawing IC-planar RAC graphs straight-line.

In machine learning, novelty detection is the task of identifying novel unseen data. During training, only samples from the normal class are available. Test samples are classified as normal or abnormal by assignment of a novelty score. Here we propose novelty detection methods based on training variational autoencoders (VAEs) on normal data. Since abnormal samples are not used during training, we define novelty metrics based on the (partially complementary) assumptions that the VAE is less capable of reconstructing abnormal samples well; that abnormal samples more strongly violate the VAE regularizer; and that abnormal samples differ from normal samples not only in input-feature space, but also in the VAE latent space and VAE output. These approaches, combined with various possibilities of using (e.g. sampling) the probabilistic VAE to obtain scalar novelty scores, yield a large family of methods. We apply these methods to magnetic resonance imaging, namely to the detection of diffusion-space (q-space) abnormalities in diffusion MRI scans of multiple sclerosis patients, i.e. to detect multiple sclerosis lesions without using any lesion labels for training. Many of our methods outperform previously proposed q-space novelty detection methods. We also evaluate the proposed methods on the MNIST handwritten digits dataset and show that many of them are able to outperform the state of the art., Comment: 11 pages, 2 figures

We review the results of our research on damage mechanisms in materials irradiated with femtosecond free-electron-laser (FEL) pulses. They were obtained using our hybrid approach, XTANT (X-ray-induced Thermal And Nonthermal Transitions). Various damage mechanisms are discussed with respect to the pulse fluence and material properties on examples of diamond, amorphous carbon, C60 crystal, and silicon. We indicate conditions: producing thermal melting of targets as a result of electron-ion energy exchange; nonthermal phase transitions due to modification of the interatomic potential; Coulomb explosion due to accumulated net charge in finite-size systems; spallation or ablation at higher fluences due to detachment of sample fragments; and warm dense matter formation. Transient optical coefficients are compared with experimental data whenever available, proving the validity of our modeling approach. Predicted diffraction patterns can be compared with the results of ongoing or future FEL experiments. Limitations of our model and possible future directions of development are outlined., Comment: This brief review is submitted for publication

A fundamental assumption in software security is that memory contents do not change unless there is a legitimate deliberate modification. Classical fault attacks show that this assumption does not hold if the attacker has physical access. Rowhammer attacks showed that local code execution is already sufficient to break this assumption. Rowhammer exploits parasitic effects in DRAM to modify the content of a memory cell without accessing it. Instead, other memory locations are accessed at a high frequency. All Rowhammer attacks so far were local attacks, running either in a scripted language or native code. In this paper, we present Nethammer. Nethammer is the first truly remote Rowhammer attack, without a single attacker-controlled line of code on the targeted system. Systems that use uncached memory or flush instructions while handling network requests, e.g., for interaction with the network device, can be attacked using Nethammer. Other systems can still be attacked if they are protected with quality-of-service techniques like Intel CAT. We demonstrate that the frequency of the cache misses is in all three cases high enough to induce bit flips. We evaluated different bit flip scenarios. Depending on the location, the bit flip compromises either the security and integrity of the system and the data of its users, or it can leave persistent damage on the system, i.e., persistent denial of service. We investigated Nethammer on personal computers, servers, and mobile phones. Nethammer is a security landslide, making the formerly local attack a remote attack.

Modern processors use branch prediction and speculative execution to maximize performance. For example, if the destination of a branch depends on a memory value that is in the process of being read, CPUs will try guess the destination and attempt to execute ahead. When the memory value finally arrives, the CPU either discards or commits the speculative computation. Speculative logic is unfaithful in how it executes, can access to the victim's memory and registers, and can perform operations with measurable side effects. Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim's confidential information via a side channel to the adversary. This paper describes practical attacks that combine methodology from side channel attacks, fault attacks, and return-oriented programming that can read arbitrary memory from the victim's process. More broadly, the paper shows that speculative execution implementations violate the security assumptions underpinning numerous software security mechanisms, including operating system process separation, static analysis, containerization, just-in-time (JIT) compilation, and countermeasures to cache timing/side-channel attacks. These attacks represent a serious threat to actual systems, since vulnerable speculative execution capabilities are found in microprocessors from Intel, AMD, and ARM that are used in billions of devices. While makeshift processor-specific countermeasures are possible in some cases, sound solutions will require fixes to processor designs as well as updates to instruction set architectures (ISAs) to give hardware architects and software developers a common understanding as to what computation state CPU implementations are (and are not) permitted to leak.

The security of computer systems fundamentally relies on memory isolation, e.g., kernel address ranges are marked as non-accessible and are protected from user access. In this paper, we present Meltdown. Meltdown exploits side effects of out-of-order execution on modern processors to read arbitrary kernel-memory locations including personal data and passwords. Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors. The attack works on different Intel microarchitectures since at least 2010 and potentially other processors are affected. The root cause of Meltdown is the hardware. The attack is independent of the operating system, and it does not rely on any software vulnerabilities. Meltdown breaks all security assumptions given by address space isolation as well as paravirtualized environments and, thus, every security mechanism building upon this foundation. On affected systems, Meltdown enables an adversary to read memory of other processes or virtual machines in the cloud without any permissions or privileges, affecting millions of customers and virtually every user of a personal computer. We show that the KAISER defense mechanism for KASLR has the important (but inadvertent) side effect of impeding Meltdown. We stress that KAISER must be deployed immediately to prevent large-scale exploitation of this severe information leakage.

Double-fetch bugs are a special type of race condition, where an unprivileged execution thread is able to change a memory location between the time-of-check and time-of-use of a privileged execution thread. If an unprivileged attacker changes the value at the right time, the privileged operation becomes inconsistent, leading to a change in control flow, and thus an escalation of privileges for the attacker. More severely, such double-fetch bugs can be introduced by the compiler, entirely invisible on the source-code level. We propose novel techniques to efficiently detect, exploit, and eliminate double-fetch bugs. We demonstrate the first combination of state-of-the-art cache attacks with kernel-fuzzing techniques to allow fully automated identification of double fetches. We demonstrate the first fully automated reliable detection and exploitation of double-fetch bugs, making manual analysis as in previous work superfluous. We show that cache-based triggers outperform state-of-the-art exploitation techniques significantly, leading to an exploitation success rate of up to 97%. Our modified fuzzer automatically detects double fetches and automatically narrows down this candidate set for double-fetch bugs to the exploitable ones. We present the first generic technique based on hardware transactional memory, to eliminate double-fetch bugs in a fully automated and transparent manner. We extend defensive programming techniques by retrofitting arbitrary code with automated double-fetch prevention, both in trusted execution environments as well as in syscalls, with a performance overhead below 1%.

The Rowhammer bug allows unauthorized modification of bits in DRAM cells from unprivileged software, enabling powerful privilege-escalation attacks. Sophisticated Rowhammer countermeasures have been presented, aiming at mitigating the Rowhammer bug or its exploitation. However, the state of the art provides insufficient insight on the completeness of these defenses. In this paper, we present novel Rowhammer attack and exploitation primitives, showing that even a combination of all defenses is ineffective. Our new attack technique, one-location hammering, breaks previous assumptions on requirements for triggering the Rowhammer bug, i.e., we do not hammer multiple DRAM rows but only keep one DRAM row constantly open. Our new exploitation technique, opcode flipping, bypasses recent isolation mechanisms by flipping bits in a predictable and targeted way in userspace binaries. We replace conspicuous and memory-exhausting spraying and grooming techniques with a novel reliable technique called memory waylaying. Memory waylaying exploits system-level optimizations and a side channel to coax the operating system into placing target pages at attacker-chosen physical locations. Finally, we abuse Intel SGX to hide the attack entirely from the user and the operating system, making any inspection or detection of the attack infeasible. Our Rowhammer enclave can be used for coordinated denial-of-service attacks in the cloud and for privilege escalation on personal computers. We demonstrate that our attacks evade all previously proposed countermeasures for commodity systems., Comment: Preprint of the work accepted at the 39th IEEE Symposium on Security and Privacy 2018

Storyline visualizations show the structure of a story, by depicting the interactions of the characters over time. Each character is represented by an x-monotone curve from left to right, and a meeting is represented by having the curves of the participating characters run close together for some time. There have been various approaches to drawing storyline visualizations in an automated way. In order to keep the visual complexity low, rather than minimizing pairwise crossings of curves, we count block crossings, that is, pairs of intersecting bundles of lines. Partly inspired by the ILP-based approach of Gronemann et al. [GD 2016] for minimizing the number of pairwise crossings, we model the problem as a satisfiability problem (since the straightforward ILP formulation becomes more complicated and harder to solve). Having restricted ourselves to a decision problem, we can apply powerful SAT solvers to find optimal drawings in reasonable time. We compare this SAT-based approach with two exact algorithms for block crossing minimization, using both the benchmark instances of Gronemann et al. and random instances. We show that the SAT approach is suitable for real-world instances and identify cases where the other algorithms are preferable., Comment: Appears in the Proceedings of the 25th International Symposium on Graph Drawing and Network Visualization (GD 2017)

Using the satellite structure of the $L_{\gamma1}$ line in non-resonant x-ray emission spectra, we probe the high-pressure evolution of the bare 4f signature of the early light lanthanides at ambient temperature. For Ce and Pr the satellite peak experiences a sudden reduction concurrent with their respective volume collapse (VC) transitions. These new experimental results are supported by calculations using state-of-the-art extended atomic structure codes for Ce and Pr, and also for Nd, which does not exhibit a VC. Our work suggests that changes to the 4f occupation are more consistently associated with evolution of the satellite than is the reduction of the 4f moment. Indeed, we show that in the case of Ce, mixing of a higher atomic angular momentum state, driven by the increased hybridization, acts to obscure the expected satellite reduction. These measurements emphasize the importance of a unified study of a full set of microscopic observables to obtain the most discerning test of the underlying, fundamental f-electron phenomena at high pressures., Comment: 9 pages, 4 figures

Living cells respond to spatial signals. Signal transmission to the cell interior often involves the release of second messengers like $Ca^{2+}$ . They will eventually trigger a physiological response by activating kinases that in turn activate target proteins through phosphorylation. Here, we investigate theoretically how positional information can be accurately read out by protein phosphorylation in spite of rapid second messenger diffusion. We find that accuracy is increased by binding of the kinases to the cell membrane prior to phosphorylation and by increasing the rate of $Ca^{2+}$ loss from the cell interior. These findings could explain some salient features of conventional protein kinases C.

Besides cryptographic secrets, side-channel attacks also leak sensitive user input. The most accurate attacks exploit cache timings or interrupt information to monitor keystroke timings and subsequently infer typed words and sentences. Previously proposed countermeasures fail to prevent keystroke timing attacks as they do not protect keystroke processing among the entire software stack. We close this gap with KeyDrown, a new defense mechanism against keystroke timing attacks. KeyDrown injects a large number of fake keystrokes in the kernel to prevent interrupt-based attacks and Prime+Probe attacks on the kernel. All keystrokes, including fake keystrokes, are carefully propagated through the shared library in order to hide any cache activity and thus to prevent Flush+Reload attacks. Finally, we provide additional protection against Prime+Probe for password input in user space programs. We show that attackers cannot distinguish fake keystrokes from real keystrokes anymore and we evaluate KeyDrown on a commodity notebook as well as on two Android smartphones. We show that KeyDrown eliminates any advantage an attacker can gain from using interrupt or cache side-channel information.

Establishing good electrical contacts to nanoscale devices is a major issue for modern technology and contacting 2D materials is no exception to the rule. One-dimensional edge-contacts to graphene were recently shown to outperform surface contacts but the method remains difficult to scale up. We report a resist-free and scalable method to fabricate few graphene layers with electrical contacts in a single growth step. This method derives from the discovery reported here of the growth of few graphene layers on a metallic carbide by thermal annealing of a carbide forming metallic film on SiC in high vacuum. We exploit the combined effect of edge-contact and partially-covalent surface epitaxy between graphene and the metallic carbide to fabricate devices in which low contact-resistance and Josephson effect are observed. Implementing this approach could significantly simplify the realization of large-scale graphene circuits., Comment: supplementary information available at the publisher's site

Storyline visualizations help visualize encounters of the characters in a story over time. Each character is represented by an x-monotone curve that goes from left to right. A meeting is represented by having the characters that participate in the meeting run close together for some time. In order to keep the visual complexity low, rather than just minimizing pairwise crossings of curves, we propose to count block crossings, that is, pairs of intersecting bundles of lines. Our main results are as follows. We show that minimizing the number of block crossings is NP-hard, and we develop, for meetings of bounded size, a constant-factor approximation. We also present two fixed-parameter algorithms and, for meetings of size 2, a greedy heuristic that we evaluate experimentally., Comment: Appears in the Proceedings of the 24th International Symposium on Graph Drawing and Network Visualization (GD 2016)

We introduce and study the $\textit{OrthoSEFE}-k$ problem: Given $k$ planar graphs each with maximum degree 4 and the same vertex set, do they admit an OrthoSEFE, that is, is there an assignment of the vertices to grid points and of the edges to paths on the grid such that the same edges in distinct graphs are assigned the same path and such that the assignment induces a planar orthogonal drawing of each of the $k$ graphs? We show that the problem is NP-complete for $k \geq 3$ even if the shared graph is a Hamiltonian cycle and has sunflower intersection and for $k \geq 2$ even if the shared graph consists of a cycle and of isolated vertices. Whereas the problem is polynomial-time solvable for $k=2$ when the union graph has maximum degree five and the shared graph is biconnected. Further, when the shared graph is biconnected and has sunflower intersection, we show that every positive instance has an OrthoSEFE with at most three bends per edge., Comment: Appears in the Proceedings of the 24th International Symposium on Graph Drawing and Network Visualization (GD 2016)

It is well known that any graph admits a crossing-free straight-line drawing in $\mathbb{R}^3$ and that any planar graph admits the same even in $\mathbb{R}^2$. For a graph $G$ and $d \in \{2,3\}$, let $\rho^1_d(G)$ denote the smallest number of lines in $\mathbb{R}^d$ whose union contains a crossing-free straight-line drawing of $G$. For $d=2$, $G$ must be planar. Similarly, let $\rho^2_3(G)$ denote the smallest number of planes in $\mathbb{R}^3$ whose union contains a crossing-free straight-line drawing of $G$. We investigate the complexity of computing these three parameters and obtain the following hardness and algorithmic results. - For $d\in\{2,3\}$, we prove that deciding whether $\rho^1_d(G)\le k$ for a given graph $G$ and integer $k$ is ${\exists\mathbb{R}}$-complete. - Since $\mathrm{NP}\subseteq{\exists\mathbb{R}}$, deciding $\rho^1_d(G)\le k$ is NP-hard for $d\in\{2,3\}$. On the positive side, we show that the problem is fixed-parameter tractable with respect to $k$. - Since ${\exists\mathbb{R}}\subseteq\mathrm{PSPACE}$, both $\rho^1_2(G)$ and $\rho^1_3(G)$ are computable in polynomial space. On the negative side, we show that drawings that are optimal with respect to $\rho^1_2$ or $\rho^1_3$ sometimes require irrational coordinates. - We prove that deciding whether $\rho^2_3(G)\le k$ is NP-hard for any fixed $k \ge 2$. Hence, the problem is not fixed-parameter tractable with respect to $k$ unless $\mathrm{P}=\mathrm{NP}$., Comment: A preliminary version appeared in Proc. WADS 2017

We investigate the problem of drawing graphs in 2D and 3D such that their edges (or only their vertices) can be covered by few lines or planes. We insist on straight-line edges and crossing-free drawings. This problem has many connections to other challenging graph-drawing problems such as small-area or small-volume drawings, layered or track drawings, and drawing graphs with low visual complexity. While some facts about our problem are implicit in previous work, this is the first treatment of the problem in its full generality. Our contribution is as follows. We show lower and upper bounds for the numbers of lines and planes needed for covering drawings of graphs in certain graph classes. In some cases our bounds are asymptotically tight; in some cases we are able to determine exact values. We relate our parameters to standard combinatorial characteristics of graphs (such as the chromatic number, treewidth, maximum degree, or arboricity) and to parameters that have been studied in graph drawing (such as the track number or the number of segments appearing in a drawing). We pay special attention to planar graphs. For example, we show that there are planar graphs that can be drawn in 3-space on a lot fewer lines than in the plane., Comment: Appears in the Proceedings of the 24th International Symposium on Graph Drawing and Network Visualization (GD 2016)

Obstacle representations of graphs have been investigated quite intensely over the last few years. We focus on graphs that can be represented by a single obstacle. Given a (topologically open) polygon $C$ and a finite set $P$ of points in general position in the complement of $C$, the visibility graph $G_C(P)$ has a vertex for each point in $P$ and an edge $pq$ for any two points $p$ and $q$ in $P$ that can see each other, that is, $\overline{pq} \cap C=\emptyset$. We draw $G_C(P)$ straight-line. Given a graph $G$, we want to compute an obstacle representation of $G$, that is, an obstacle $C$ and a set of points $P$ such that $G=G_C(P)$. The complexity of this problem is open, even for the case that the points are exactly the vertices of a simple polygon and the obstacle is the complement of the polygon-the simple-polygon visibility graph problem. There are two types of obstacles; an inside obstacle lies in a bounded component of the complement of the visibility drawing, whereas an outside obstacle lies in the unbounded component. We show that the class of graphs with an inside-obstacle representation is incomparable with the class of graphs that have an outside-obstacle representation. We further show that any graph with at most seven vertices or circumference at most 6 has an outside-obstacle representation, which does not hold for a specific graph with 8 vertices and circumference 8. Finally, we consider the outside-obstacle graph sandwich problem: given graphs $G$ and $H$ on the same vertex set, is there a graph $K$ such that $G \subseteq K \subseteq H$ and $K$ has an outside-obstacle representation? We show that this problem is NP-hard even for co-bipartite graphs. With slight modifications, our proof also shows that the inside-obstacle graph sandwich problem, the single-obstacle graph sandwich problem, and the simple-polygon visibility graph sandwich problem are all NP-hard., Comment: Appears in the Proceedings of the 24th International Symposium on Graph Drawing and Network Visualization (GD 2016)

We present a finite-difference integration algorithm for solution of a system of differential equations containing a diffusion equation with nonlinear terms. The approach is based on Crank-Nicolson method with predictor-corrector algorithm and provides high stability and precision. Using a specific example of short-pulse laser interaction with semiconductors, we give a detailed description of the method and apply it for the solution of the corresponding system of differential equations, one of which is a nonlinear diffusion equation. The calculated dynamics of the energy density and the number density of photoexcited free carriers upon the absorption of laser energy are presented for the irradiated thin silicon film. The energy conservation within 0.2% has been achieved for the time step $10^4$ times larger than that in case of the explicit scheme, for the chosen numerical setup. We also present a few examples of successful application of the method demonstrating its benefits for the theoretical studies of laser-matter interaction problems.

In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices., Comment: Original publication in the Proceedings of the 25th Annual USENIX Security Symposium (USENIX Security 2016). https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/lipp

We present an atomistic-continuum model to simulate ultrashort laser-induced melting processes in semiconductor solids on the example of silicon. The kinetics of transient non-equilibrium phase transition mechanisms is addressed with a Molecular Dynamics method at atomic level, whereas the laser light absorption, strong generated electron-phonon non-equilibrium, fast diffusion and heat conduction due to photo-excited free carriers are accounted for in the continuum. We give a detailed description of the model, which is then applied to study the mechanism of short laser pulse melting of free standing Si films. The effect of laser-induced pressure and temperature of the lattice on the melting kinetics is investigated. Two competing melting mechanisms, heterogeneous and homogeneous, were identified. Apart of classical heterogeneous melting mechanism, the nucleation of the liquid phase homogeneously inside the material significantly contributes to the melting process. The simulations showed, that due to the open diamond structure of the crystal, the laser-generated internal compressive stresses reduce the crystal stability against the homogeneous melting. Consequently, the latter can take a massive character within several picoseconds upon the laser heating. Due to negative volume of melting of modeled Si material, -7.5%, the material contracts upon the phase transition, relaxes the compressive stresses and the subsequent melting proceeds heterogeneously until the excess of thermal energy is consumed. The threshold fluence value, at which homogeneous nucleation of liquid starts contributing to the classical heterogeneous propagation of the solid-liquid interface, is found from the series of simulations at different laser input fluences. On the example of Si, the laser melting kinetics of semiconductors was found to be noticeably different from that of metals with fcc crystal structure., Comment: 38 pages, 27 figures

Much of the anticipation accompanying the development of a quantum computer relates to its application to simulating dynamics of another quantum system of interest. Here we study the building blocks for simulating quantum spin systems with linear optics. We experimentally generate the eigenstates of the XY Hamiltonian under an external magnetic field. The implemented quantum circuit consists of two CNOT gates, which are realized experimentally by harnessing entanglement from a photon source and by applying a CPhase gate. We tune the ratio of coupling constants and magnetic field by changing local parameters. This implementation of the XY model using linear quantum optics might open the door to the future studies of quenching dynamics using linear optics.

Using non-resonant Fe K-beta x-ray emission spectroscopy, we reveal that Sr-doping of CaFe2As2 decouples the Fe moment from the volume collapse transition, yielding a collapsed-tetragonal, paramagnetic normal state out of which superconductivity develops. X-ray diffraction measurements implicate the c-axis lattice parameter as the controlling criterion for the Fe moment, promoting a generic description for the appearance of pressure-induced superconductivity in the alkaline-earth-based 122 ferropnictides (AFe2As2). The evolution of the superconducting critical temperature with pressure lends support to theories for superconductivity involving unconventional pairing mediated by magnetic fluctuations.

Systems of linear equations are used to model a wide array of problems in all fields of science and engineering. Recently, it has been shown that quantum computers could solve linear systems exponentially faster than classical computers, making for one of the most promising applications of quantum computation. Here, we demonstrate this quantum algorithm by implementing various instances on a photonic quantum computing architecture. Our implementation involves the application of two consecutive entangling gates on the same pair of polarisation-encoded qubits. We realize two separate controlled-NOT gates where the successful operation of the first gate is heralded by a measurement of two ancillary photons. Our work thus demonstrates the implementation of a quantum algorithm with high practical significance as well as an important technological advance which brings us closer to a comprehensive control of photonic quantum information.

Quantum entanglement is widely recognized as one of the key resources for the advantages of quantum information processing, including universal quantum computation, reduction of communication complexity or secret key distribution. However, computational models have been discovered, which consume very little or no entanglement and still can efficiently solve certain problems thought to be classically intractable. The existence of these models suggests that separable or weakly entangled states could be extremely useful tools for quantum information processing as they are much easier to prepare and control even in dissipative environments. It has been proposed that a requirement for useful quantum states is the generation of so-called quantum discord, a measure of non-classical correlations that includes entanglement as a subset. Although a link between quantum discord and few quantum information tasks has been studied, its role in computation speed-up is still open and its operational interpretation remains restricted to only few somewhat contrived situations. Here we show that quantum discord is the optimal resource for the remote quantum state preparation, a variant of the quantum teleportation protocol. Using photonic quantum systems, we explicitly show that the geometric measure of quantum discord is related to the fidelity of this task, which provides an operational meaning. Moreover, we demonstrate that separable states with non-zero quantum discord can outperform entangled states. Therefore, the role of quantum discord might provide fundamental insights for resource-efficient quantum information processing., Comment: 6 pages, 2 figures, journal reference added