Search

This paper tackles the challenge of detecting unreliable behavior in regression algorithms, which may arise from intrinsic variability (e.g., aleatoric uncertainty) or modeling errors (e.g., model uncertainty). First, we formally introduce the notion of unreliability in regression, i.e., when the output of the regressor exceeds a specified discrepancy (or error). Then, using powerful tools for probabilistic modeling, we estimate the discrepancy density, and we measure its statistical diversity using our proposed metric for statistical dissimilarity. In turn, this allows us to derive a data-driven score that expresses the uncertainty of the regression outcome. We show empirical improvements in error detection for multiple regression tasks, consistently outperforming popular baseline approaches, and contributing to the broader field of uncertainty quantification and safe machine learning systems. Our code is available at https://zenodo.org/records/11281964., Comment: To appear as spotlight at ICML 2024. 36 pages, 4 figures

Low-rank approximation techniques have become the de facto standard for fine-tuning Large Language Models (LLMs) due to their reduced computational and memory requirements. This paper investigates the effectiveness of these methods in capturing the shift of fine-tuning datasets from the initial pre-trained data distribution. Our findings reveal that there are cases in which low-rank fine-tuning falls short in learning such shifts. This, in turn, produces non-negligible side effects, especially when fine-tuning is adopted for toxicity mitigation in pre-trained models, or in scenarios where it is important to provide fair models. Through comprehensive empirical evidence on several models, datasets, and tasks, we show that low-rank fine-tuning inadvertently preserves undesirable biases and toxic behaviors. We also show that this extends to sequential decision-making tasks, emphasizing the need for careful evaluation to promote responsible LLMs development.

We introduce a formal statistical definition for the problem of backdoor detection in machine learning systems and use it to analyze the feasibility of such problems, providing evidence for the utility and applicability of our definition. The main contributions of this work are an impossibility result and an achievability result for backdoor detection. We show a no-free-lunch theorem, proving that universal (adversary-unaware) backdoor detection is impossible, except for very small alphabet sizes. Thus, we argue, that backdoor detection methods need to be either explicitly, or implicitly adversary-aware. However, our work does not imply that backdoor detection cannot work in specific scenarios, as evidenced by successful backdoor detection methods in the scientific literature. Furthermore, we connect our definition to the probably approximately correct (PAC) learnability of the out-of-distribution detection problem.

This paper explores a scenario in which a malicious actor employs a multi-armed attack strategy to manipulate data samples, offering them various avenues to introduce noise into the dataset. Our central objective is to protect the data by detecting any alterations to the input. We approach this defensive strategy with utmost caution, operating in an environment where the defender possesses significantly less information compared to the attacker. Specifically, the defender is unable to utilize any data samples for training a defense model or verifying the integrity of the channel. Instead, the defender relies exclusively on a set of pre-existing detectors readily available "off the shelf". To tackle this challenge, we derive an innovative information-theoretic defense approach that optimally aggregates the decisions made by these detectors, eliminating the need for any training data. We further explore a practical use-case scenario for empirical evaluation, where the attacker possesses a pre-trained classifier and launches well-known adversarial attacks against it. Our experiments highlight the effectiveness of our proposed solution, even in scenarios that deviate from the optimal setup., Comment: Accepted to appear in the 27th International Conference on Artificial Intelligence and Statistics (AISTATS), May 2nd - May 4th, 2024 This article supersedes arXiv:2302.02216

Ensuring privacy-preserving inference on cryptographically secure data is a well-known computational challenge. To alleviate the bottleneck of costly cryptographic computations in non-linear activations, recent methods have suggested linearizing a targeted portion of these activations in neural networks. This technique results in significantly reduced runtimes with often negligible impacts on accuracy. In this paper, we demonstrate that such computational benefits may lead to increased fairness costs. Specifically, we find that reducing the number of ReLU activations disproportionately decreases the accuracy for minority groups compared to majority groups. To explain these observations, we provide a mathematical interpretation under restricted assumptions about the nature of the decision boundary, while also showing the prevalence of this problem across widely used datasets and architectures. Finally, we show how a simple procedure altering the fine-tuning step for linearized models can serve as an effective mitigation strategy., Comment: Extended version of the paper accepted to appear at the Forty-first International Conference on Machine Learning (ICML) 2024

Strong light-matter coupling between molecules and plasmonic nanoparticles give rise to new hybrid eigenstates of the coupled system, commonly referred to as polaritons, or more precisely, plexcitons. Over the last decade it has been amply shown that molecular electron dynamics and photophysics can be drastically affected by such interactions, thus paving the way for light-induced control of molecular excited-state properties and reactivity. Here, by combining ab initio molecular description and classical or quantum modelling of arbitrarily-shaped plasmonic nanostructures within Stochastic Schr\"odinger Equation, we present two approaches, one semi-classical and one full-quantum, to follow in real-time the electronic dynamics of plexcitons while realistically taking plasmonic dissipative losses into account. The full-quantum theory is compared with the semi-classical analogue under different interaction regimes, showing (numerically and theoretically) that even in the weak-field and weak-coupling limit a small-yet-observable difference arises.

Logic synthesis, a pivotal stage in chip design, entails optimizing chip specifications encoded in hardware description languages like Verilog into highly efficient implementations using Boolean logic gates. The process involves a sequential application of logic minimization heuristics (``synthesis recipe"), with their arrangement significantly impacting crucial metrics such as area and delay. Addressing the challenge posed by the broad spectrum of design complexities - from variations of past designs (e.g., adders and multipliers) to entirely novel configurations (e.g., innovative processor instructions) - requires a nuanced `synthesis recipe` guided by human expertise and intuition. This study conducts a thorough examination of learning and search techniques for logic synthesis, unearthing a surprising revelation: pre-trained agents, when confronted with entirely novel designs, may veer off course, detrimentally affecting the search trajectory. We present ABC-RL, a meticulously tuned $\alpha$ parameter that adeptly adjusts recommendations from pre-trained agents during the search process. Computed based on similarity scores through nearest neighbor retrieval from the training dataset, ABC-RL yields superior synthesis recipes tailored for a wide array of hardware designs. Our findings showcase substantial enhancements in the Quality-of-result (QoR) of synthesized circuits, boasting improvements of up to 24.8% compared to state-of-the-art techniques. Furthermore, ABC-RL achieves an impressive up to 9x reduction in runtime (iso-QoR) when compared to current state-of-the-art methodologies., Comment: Accepted in ICLR 2024

Misclassification detection is an important problem in machine learning, as it allows for the identification of instances where the model's predictions are unreliable. However, conventional uncertainty measures such as Shannon entropy do not provide an effective way to infer the real uncertainty associated with the model's predictions. In this paper, we introduce a novel data-driven measure of uncertainty relative to an observer for misclassification detection. By learning patterns in the distribution of soft-predictions, our uncertainty measure can identify misclassified samples based on the predicted class probabilities. Interestingly, according to the proposed measure, soft-predictions corresponding to misclassified instances can carry a large amount of uncertainty, even though they may have low Shannon entropy. We demonstrate empirical improvements over multiple image classification tasks, outperforming state-of-the-art misclassification detection methods., Comment: Accepted in ICLR2024

Electronic Energy Transfer (EET) between chromophores is fundamental in many natural light-harvesting complexes, serving as a critical step for solar energy funneling in photosynthetic plants and bacteria. The complicated role of the environment in mediating this process in natural architectures has been addressed by recent scanning tunneling microscope (STM) experiments involving EET between two molecules supported on a solid substrate. These measurements demonstrated that EET in such conditions has peculiar features, such as a steep dependence on the donor-acceptor distance, reminiscent of a short-range mechanism more than of a Forster-like process. By using state of the art hybrid ab initio electromagnetic modeling, here we provide a comprehensive theoretical analysis of tip-enhanced EET. In particular, we show that this process can be understood as a complex interplay of electromagnetic-based molecular plasmonic processes, whose result may effectively mimic short range effects. Therefore, the established identification of an exponential decay with Dexter-like effects does not hold for tip-enhanced EET, and accurate electromagnetic modeling is needed to identify the EET mechanism.

Logic synthesis is the first and most vital step in chip design. This steps converts a chip specification written in a hardware description language (such as Verilog) into an optimized implementation using Boolean logic gates. State-of-the-art logic synthesis algorithms have a large number of logic minimization heuristics, typically applied sequentially based on human experience and intuition. The choice of the order greatly impacts the quality (e.g., area and delay) of the synthesized circuit. In this paper, we propose INVICTUS, a model-based offline reinforcement learning (RL) solution that automatically generates a sequence of logic minimization heuristics ("synthesis recipe") based on a training dataset of previously seen designs. A key challenge is that new designs can range from being very similar to past designs (e.g., adders and multipliers) to being completely novel (e.g., new processor instructions). %Compared to prior work, INVICTUS is the first solution that uses a mix of RL and search methods joint with an online out-of-distribution detector to generate synthesis recipes over a wide range of benchmarks. Our results demonstrate significant improvement in area-delay product (ADP) of synthesized circuits with up to 30\% improvement over state-of-the-art techniques. Moreover, INVICTUS achieves up to $6.3\times$ runtime reduction (iso-ADP) compared to the state-of-the-art., Comment: 20 pages, 8 figures and 15 tables

Strong coupling between molecules and quantized fields has emerged as an effective methodology to engineer molecular properties. New hybrid states are formed when molecules interact with quantized fields. Since the properties of these states can be modulated by fine-tuning the field features, an exciting and new side of chemistry can be explored. In particular, significant modifications of the molecular properties can be achieved in plasmonic nanocavities, where the field quantization volume is reduced to sub-nanometric volumes. Intriguing applications of nanoplasmonics include the possibility of coupling the plasmons with a single molecule, instrumental for sensing, high-resolution spectroscopy, and single-molecule imaging. In this work, we focus on phenomena where the simultaneous effects of multiple plasmonic modes are critical. We propose a theoretical methodology to account for many plasmonic modes simultaneously while retaining computational feasibility. Our approach is conceptually simple and allows us to accurately account for the multimode effects and rationalize the nature of the interaction between multiple plasmonic excitations and molecules., Comment: 27 pages, 6 figures

Multi-armed adversarial attacks, in which multiple algorithms and objective loss functions are simultaneously used at evaluation time, have been shown to be highly successful in fooling state-of-the-art adversarial examples detectors while requiring no specific side information about the detection mechanism. By formalizing the problem at hand, we can propose a solution that aggregates the soft-probability outputs of multiple pre-trained detectors according to a minimax approach. The proposed framework is mathematically sound, easy to implement, and modular, allowing for integrating existing or future detectors. Through extensive evaluation on popular datasets (e.g., CIFAR10 and SVHN), we show that our aggregation consistently outperforms individual state-of-the-art detectors against multi-armed adversarial attacks, making it an effective solution to improve the resilience of available methods., Comment: 10 pages, 13 figures, 14 tables

In the past twenty years, we have reached a broad understanding of many light-driven phenomena in nanoscale systems. The temporal dynamics of the excited states are instead quite challenging to explore, and, at the same time, crucial to study for understanding the origin of fundamental physical and chemical processes. In this review we examine the current state and prospects of ultrafast phenomena driven by plasmons both from a fundamental and applied point of view. This research area is referred to as ultrafast plasmonics and represents an outstanding playground to tailor and control fast optical and electronic processes at the nanoscale, such as ultrafast optical switching, single photon emission and strong coupling interactions to tailor photochemical reactions. Here, we provide an overview of the field, and describe the methodologies to monitor and control nanoscale phenomena with plasmons at ultrafast timescales in terms of both modeling and experimental characterization. Various directions are showcased, among others recent advances in ultrafast plasmon-driven chemistry and multi-functional plasmonics, in which charge, spin, and lattice degrees of freedom are exploited to provide active control of the optical and electronic properties of nanoscale materials. As the focus shifts to the development of practical devices, such as all-optical transistors, we also emphasize new materials and applications in ultrafast plasmonics and highlight recent development in the relativistic realm. The latter is a promising research field with potential applications in fusion research or particle and light sources providing properties such as attosecond duration.

Detection of adversarial examples has been a hot topic in the last years due to its importance for safely deploying machine learning algorithms in critical applications. However, the detection methods are generally validated by assuming a single implicitly known attack strategy, which does not necessarily account for real-life threats. Indeed, this can lead to an overoptimistic assessment of the detectors' performance and may induce some bias in the comparison between competing detection schemes. We propose a novel multi-armed framework, called MEAD, for evaluating detectors based on several attack strategies to overcome this limitation. Among them, we make use of three new objectives to generate attacks. The proposed performance metric is based on the worst-case scenario: detection is successful if and only if all different attacks are correctly recognized. Empirically, we show the effectiveness of our approach. Moreover, the poor performance obtained for state-of-the-art detectors opens a new exciting line of research., Comment: This paper has been accepted to appear in the Proceedings of the 2022 European Conference on Machine Learning and Data Mining (ECML-PKDD), 19th to the 23rd of September, Grenoble, France

Molecular polaritons are hybrid light-matter states that emerge when a molecular transition strongly interacts with photons in a resonator. At optical frequencies, this interaction unlocks a way to explore and control new chemical phenomena at the nanoscale. Achieving such a control at ultrafast timescales, however, is an outstanding challenge, as it requires a deep understanding of the dynamics of the collectively coupled molecular excitation and the nanoconfined electromagnetic fields. Here, we investigate the dynamics of collective polariton states, realized by coupling molecular photoswitches to optically anisotropic plasmonic nanoantennas. Pump-probe experiments reveal an ultrafast collapse of polaritons to a single-molecule transition triggered by femtosecond-pulse excitation at room-temperature. Through a synergistic combination of experiments and quantum mechanical modelling, we show that the response of the system is governed by intramolecular dynamics, occurring one order of magnitude faster with respect to the unperturbed excited molecule relaxation to the ground state.

Federated Learning is expected to provide strong privacy guarantees, as only gradients or model parameters but no plain text training data is ever exchanged either between the clients or between the clients and the central server. In this paper, we challenge this claim by introducing a simple but still very effective membership inference attack algorithm, which relies only on a single training step. In contrast to the popular honest-but-curious model, we investigate a framework with a dishonest central server. Our strategy is applicable to models with ReLU activations and uses the properties of this activation function to achieve perfect accuracy. Empirical evaluation on visual classification tasks with MNIST, CIFAR10, CIFAR100 and CelebA datasets show that our method provides perfect accuracy in identifying one sample in a training set with thousands of samples. Occasional failures of our method lead us to discover duplicate images in the CIFAR100 and CelebA datasets., Comment: accepted for publication in IEEE Transactions on Dependable and Secure Computing

Deep neural networks (DNNs) have shown to perform very well on large scale object recognition problems and lead to widespread use for real-world applications, including situations where DNN are implemented as "black boxes". A promising approach to secure their use is to accept decisions that are likely to be correct while discarding the others. In this work, we propose DOCTOR, a simple method that aims to identify whether the prediction of a DNN classifier should (or should not) be trusted so that, consequently, it would be possible to accept it or to reject it. Two scenarios are investigated: Totally Black Box (TBB) where only the soft-predictions are available and Partially Black Box (PBB) where gradient-propagation to perform input pre-processing is allowed. Empirically, we show that DOCTOR outperforms all state-of-the-art methods on various well-known images and sentiment analysis datasets. In particular, we observe a reduction of up to $4\%$ of the false rejection rate (FRR) in the PBB scenario. DOCTOR can be applied to any pre-trained model, it does not require prior information about the underlying dataset and is as simple as the simplest available methods in the literature., Comment: This paper has been accepted to appear as a spotlight in the Proceedings of the 2021 Conference on Neural Information Processing Systems (NeurIPS 2021), December 6-14, 2021, Virtual Event

This paper considers the problem of estimating the information leakage of a system in the black-box scenario. It is assumed that the system's internals are unknown to the learner, or anyway too complicated to analyze, and the only available information are pairs of input-output data samples, possibly obtained by submitting queries to the system or provided by a third party. Previous research has mainly focused on counting the frequencies to estimate the input-output conditional probabilities (referred to as frequentist approach), however this method is not accurate when the domain of possible outputs is large. To overcome this difficulty, the estimation of the Bayes error of the ideal classifier was recently investigated using Machine Learning (ML) models and it has been shown to be more accurate thanks to the ability of those models to learn the input-output correspondence. However, the Bayes vulnerability is only suitable to describe one-try attacks. A more general and flexible measure of leakage is the g-vulnerability, which encompasses several different types of adversaries, with different goals and capabilities. In this paper, we propose a novel approach to perform black-box estimation of the g-vulnerability using ML. A feature of our approach is that it does not require to estimate the conditional probabilities, and that it is suitable for a large class of ML algorithms. First, we formally show the learnability for all data distributions. Then, we evaluate the performance via various experiments using k-Nearest Neighbors and Neural Networks. Our results outperform the frequentist approach when the observables domain is large., Comment: This is the extended version of the paper which will appear in the Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS '20), November 9-13, 2020, Virtual Event, USA

Feature selection, in the context of machine learning, is the process of separating the highly predictive feature from those that might be irrelevant or redundant. Information theory has been recognized as a useful concept for this task, as the prediction power stems from the correlation, i.e., the mutual information, between features and labels. Many algorithms for feature selection in the literature have adopted the Shannon-entropy-based mutual information. In this paper, we explore the possibility of using R\'enyi min-entropy instead. In particular, we propose an algorithm based on a notion of conditional R\'enyi min-entropy that has been recently adopted in the field of security and privacy, and which is strictly related to the Bayes error. We prove that in general the two approaches are incomparable, in the sense that we show that we can construct datasets on which the R\'enyi-based algorithm performs better than the corresponding Shannon-based one, and datasets on which the situation is reversed. In practice, however, when considering datasets of real data, it seems that the R\'enyi-based algorithm tends to outperform the other one. We have effectuate several experiments on the BASEHOCK, SEMEION, and GISETTE datasets, and in all of them we have indeed observed that the R\'enyi-based algorithm gives better results., Comment: 16 pages

We consider the problem of obfuscating sensitive information while preserving utility, and we propose a machine learning approach inspired by the generative adversarial networks paradigm. The idea is to set up two nets: the generator, that tries to produce an optimal obfuscation mechanism to protect the data, and the classifier, that tries to de-obfuscate the data. By letting the two nets compete against each other, the mechanism improves its degree of protection, until an equilibrium is reached. We apply our method to the case of location privacy, and we perform experiments on synthetic data and on real data from the Gowalla dataset. We evaluate the privacy of the mechanism not only by its capacity to defeat the classifier, but also in terms of the Bayes error, which represents the strongest possible adversary. We compare the privacy-utility tradeoff of our method to that of the planar Laplace mechanism used in geo-indistinguishability, showing favorable results. Like the Laplace mechanism, our system can be deployed at the user end for protecting his location., Comment: Preprint version of a paper that will appear on the Proceedings of the IEEE 33rd Computer Security Foundations Symposium, CSF 2020

The phase synchronization of two semiconductor DFB lasers submitted to both frequency-shifted cross-injection and self-feedback is investigated, both numerically and experimentally. A dedicated setup based on monolithic DFB lasers permits to effectively lock the frequency difference of the two lasers on an external reference over a broad range of parameters. In agreement with a delayed rate equation model, it is shown that the sensitivity of the locking to the optical feedback phases is mitigated by using strong cross-injection, thus paving the way to applications for microwave photonics. Other synchronization dynamics can also be observed, such as bounded-phase oscillations.

A new method for measuring the linewidth enhancement factor of a laser is proposed. It is based on frequency-modulated optical injection, combined with dual-frequency laser operation. The linewidth enhancement factor {\alpha} is deduced from the experimental data using a theoretical analysis based on a standard rate equation model. As the intracavity power is kept constant, the method allows to free the process from the thermal effects that are usually present in AM/FM techniques. Measurement of {\alpha}=0.28$\pm$0.04 in a diode-pumped Nd:YAG laser demonstrates that the method is well-suited for characterizing small values of {\alpha}.