Search

Sherpa is a general-purpose Monte Carlo event generator for the simulation of particle collisions in high-energy collider experiments. We summarise new developments, essential features, and ongoing improvements within the Sherpa 3 release series. Physics improvements include higher-order electroweak corrections, simulations of photoproduction and hard diffraction at NLO QCD, heavy-flavour matching in NLO multijet merging, spin-polarised cross section calculations, and a new model of colour reconnections. In addition, the modelling of hadronisation, the underlying event and QED effects in both production and decay has been improved, and the overall event generation efficiency has been enhanced., Comment: We proudly present the new major release of the Sherpa MC generator

While generative AI (GenAI) offers countless possibilities for creative and productive tasks, artificially generated media can be misused for fraud, manipulation, scams, misinformation campaigns, and more. To mitigate the risks associated with maliciously generated media, forensic classifiers are employed to identify AI-generated content. However, current forensic classifiers are often not evaluated in practically relevant scenarios, such as the presence of an attacker or when real-world artifacts like social media degradations affect images. In this paper, we evaluate state-of-the-art AI-generated image (AIGI) detectors under different attack scenarios. We demonstrate that forensic classifiers can be effectively attacked in realistic settings, even when the attacker does not have access to the target model and post-processing occurs after the adversarial examples are created, which is standard on social media platforms. These attacks can significantly reduce detection accuracy to the extent that the risks of relying on detectors outweigh their benefits. Finally, we propose a simple defense mechanism to make CLIP-based detectors, which are currently the best-performing detectors, robust against these attacks.

Accurate camera calibration is a well-known and widely used task in computer vision that has been researched for decades. However, the standard approach based on checkerboard calibration patterns has some drawbacks that limit its applicability. For example, the calibration pattern must be completely visible without any occlusions. Alternative solutions such as ChArUco boards allow partial occlusions, but require a higher camera resolution due to the fine details of the position encoding. We present a new calibration pattern that combines the advantages of checkerboard calibration patterns with a lightweight position coding that can be decoded at very low resolutions. The decoding algorithm includes error correction and is computationally efficient. The whole approach is backward compatible to both checkerboard calibration patterns and several checkerboard calibration algorithms. Furthermore, the method can be used not only for camera calibration but also for camera pose estimation and marker-based object localization tasks., Comment: To be published in German Conference on Pattern Recognition (GCPR) 2024. Further details: https://users.informatik.haw-hamburg.de/~stelldinger/pub/PuzzleBoard/

System prompts that include detailed instructions to describe the task performed by the underlying large language model (LLM) can easily transform foundation models into tools and services with minimal overhead. Because of their crucial impact on the utility, they are often considered intellectual property, similar to the code of a software product. However, extracting system prompts is easily possible by using prompt injection. As of today, there is no effective countermeasure to prevent the stealing of system prompts and all safeguarding efforts could be evaded with carefully crafted prompt injections that bypass all protection mechanisms. In this work, we propose an alternative to conventional system prompts. We introduce prompt obfuscation to prevent the extraction of the system prompt while maintaining the utility of the system itself with only little overhead. The core idea is to find a representation of the original system prompt that leads to the same functionality, while the obfuscated system prompt does not contain any information that allows conclusions to be drawn about the original system prompt. We implement an optimization-based method to find an obfuscated prompt representation while maintaining the functionality. To evaluate our approach, we investigate eight different metrics to compare the performance of a system using the original and the obfuscated system prompts, and we show that the obfuscated version is constantly on par with the original one. We further perform three different deobfuscation attacks and show that with access to the obfuscated prompt and the LLM itself, we are not able to consistently extract meaningful information. Overall, we showed that prompt obfuscation can be an effective method to protect intellectual property while maintaining the same utility as the original system prompt.

Large language models (LLMs) have shown great potential for automatic code generation and form the basis for various tools such as GitHub Copilot. However, recent studies highlight that many LLM-generated code contains serious security vulnerabilities. While previous work tries to address this by training models that generate secure code, these attempts remain constrained by limited access to training data and labor-intensive data preparation. In this paper, we introduce HexaCoder, a novel approach to enhance the ability of LLMs to generate secure codes by automatically synthesizing secure codes, which reduces the effort of finding suitable training data. HexaCoder comprises two key components: an oracle-guided data synthesis pipeline and a two-step process for secure code generation. The data synthesis pipeline generates pairs of vulnerable and fixed codes for specific Common Weakness Enumeration (CWE) types by utilizing a state-of-the-art LLM for repairing vulnerable code. A security oracle identifies vulnerabilities, and a state-of-the-art LLM repairs them by extending and/or editing the codes, creating data pairs for fine-tuning using the Low-Rank Adaptation (LoRA) method. Each example of our fine-tuning dataset includes the necessary security-related libraries and code that form the basis of our novel two-step generation approach. This allows the model to integrate security-relevant libraries before generating the main code, significantly reducing the number of generated vulnerable codes by up to 85% compared to the baseline methods. We perform extensive evaluations on three different benchmarks for four LLMs, demonstrating that HexaCoder not only improves the security of the generated code but also maintains a high level of functional correctness., Comment: 24 pages, 16 tables, 8 figures

Retrieval Augmented Generation (RAG) is a technique commonly used to equip models with out of distribution knowledge. This process involves collecting, indexing, retrieving, and providing information to an LLM for generating responses. Despite its growing popularity due to its flexibility and low cost, the security implications of RAG have not been extensively studied. The data for such systems are often collected from public sources, providing an attacker a gateway for indirect prompt injections to manipulate the responses of the model. In this paper, we investigate the security of RAG systems against end-to-end indirect prompt manipulations. First, we review existing RAG framework pipelines, deriving a prototypical architecture and identifying critical parameters. We then examine prior works searching for techniques that attackers can use to perform indirect prompt manipulations. Finally, we implemented Rag 'n Roll, a framework to determine the effectiveness of attacks against end-to-end RAG applications. Our results show that existing attacks are mostly optimized to boost the ranking of malicious documents during the retrieval phase. However, a higher rank does not immediately translate into a reliable attack. Most attacks, against various configurations, settle around a 40% success rate, which could rise to 60% when considering ambiguous answers as successful attacks (those that include the expected benign one as well). Additionally, when using unoptimized documents, attackers deploying two of them (or more) for a target query can achieve similar results as those using optimized ones. Finally, exploration of the configuration space of a RAG showed limited impact in thwarting the attacks, where the most successful combination severely undermines functionality.

In this paper, we calculate the differential transverse momentum and azimuthal decorrelation cross sections, $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}q_{\mathrm{T}}$ and $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}\Delta\phi_{t\bar{t}}$, in top-antitop pair production at the LHC up to NNLL$+$NNLO accuracy. Due to the emergence of Coulomb singularities in both the hard sector and the corresponding anomalous dimension as the relative $t\bar{t}$ pair velocity, $\beta_{t\bar{t}}$, approaches zero, extrapolating the soft-collinear resummation that is derived in the domain where the top and antitop quarks are kinematically well-separated into the full phase space is not trivial. Focussing on two observables that are insensitive to azimuthal asymmetric divergences, $q_{\mathrm{T}}$ and $\Delta\phi_{t\bar{t}}$, we will demonstrate that a literal application of a SCET$+$HQET based resummation onto $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}q_{\mathrm{T}}$ and $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}\Delta\phi_{t\bar{t}}$ is only possible up to NLL accuracy. Starting at NNLL, however, such a na\"ive procedure will develop power-like divergences in $\beta_{t\bar{t}}$ in the threshold regime. To this end, two prescriptions, dubbed the D- and R-schemes, are introduced to facilitate the extrapolation of the resummation framework from the well-separated region where $\beta_{t\bar{t}}\sim\mathcal{O}(1)$ to the threshold regime $\beta_{t\bar{t}}\to0$, enabling us to compute $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}q_{\mathrm{T}}$ and $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d}\Delta\phi_{t\bar{t}}$ at NNLL$+$NNLO accuracy throughout. Further, by comparing the results of both formulations, we can assess the theoretical uncertainty caused by the truncation of the Coulomb-enhanced terms in the perturbative series.

In this work, we present the first full NLO predictions for the process $\mathrm{p}\mathrm{p}\to\mu^+\nu_\mu\mathrm{e}^+\nu_\mathrm{e}\mathrm{j}\mathrm{j}$ at the LHC in a typical tri-boson phase space. The NLO corrections reach 50% at the level of the fiducial cross section and have a very different hierarchy with respect to vector-boson-scattering phase spaces. By comparing the cross section of the full off-shell process with the sum of contributing on-shell electroweak-boson production subchannels, we find that the process is dominated by WWW and WH production, while vector-boson-scattering topologies still play a non-negligible role. In addition, NLO QCD predictions matched to parton shower which are supplemented by approximate electroweak corrections are provided. For the fiducial cross section, the electroweak corrections turn out to be small but the QCD corrections reach 47%. For the inclusive cross section, matching to parton shower affects the predictions by 7%. However, for differential distributions corrections due to the parton shower can be much more sizeable, depending on the region of phase space., Comment: 41 pages, 40 pdf files

Large language model systems face important security risks from maliciously crafted messages that aim to overwrite the system's original instructions or leak private data. To study this problem, we organized a capture-the-flag competition at IEEE SaTML 2024, where the flag is a secret string in the LLM system prompt. The competition was organized in two phases. In the first phase, teams developed defenses to prevent the model from leaking the secret. During the second phase, teams were challenged to extract the secrets hidden for defenses proposed by the other teams. This report summarizes the main insights from the competition. Notably, we found that all defenses were bypassed at least once, highlighting the difficulty of designing a successful defense and the necessity for additional research to protect LLM systems. To foster future research in this direction, we compiled a dataset with over 137k multi-turn attack chats and open-sourced the platform.

Large Language Models (LLMs) are increasingly augmented with external tools and commercial services into LLM-integrated systems. While these interfaces can significantly enhance the capabilities of the models, they also introduce a new attack surface. Manipulated integrations, for example, can exploit the model and compromise sensitive data accessed through other interfaces. While previous work primarily focused on attacks targeting a model's alignment or the leakage of training data, the security of data that is only available during inference has escaped scrutiny so far. In this work, we demonstrate the vulnerabilities associated with external components and introduce a systematic approach to evaluate confidentiality risks in LLM-integrated systems. We identify two specific attack scenarios unique to these systems and formalize these into a tool-robustness framework designed to measure a model's ability to protect sensitive information. Our findings show that all examined models are highly vulnerable to confidentiality attacks, with the risk increasing significantly when models are used together with external tools.

Evaluating the adversarial robustness of deep networks to gradient-based attacks is challenging. While most attacks consider $\ell_2$- and $\ell_\infty$-norm constraints to craft input perturbations, only a few investigate sparse $\ell_1$- and $\ell_0$-norm attacks. In particular, $\ell_0$-norm attacks remain the least studied due to the inherent complexity of optimizing over a non-convex and non-differentiable constraint. However, evaluating adversarial robustness under these attacks could reveal weaknesses otherwise left untested with more conventional $\ell_2$- and $\ell_\infty$-norm attacks. In this work, we propose a novel $\ell_0$-norm attack, called $\sigma$-zero, which leverages a differentiable approximation of the $\ell_0$ norm to facilitate gradient-based optimization, and an adaptive projection operator to dynamically adjust the trade-off between loss minimization and perturbation sparsity. Extensive evaluations using MNIST, CIFAR10, and ImageNet datasets, involving robust and non-robust models, show that $\sigma$-zero finds minimum $\ell_0$-norm adversarial examples without requiring any time-consuming hyperparameter tuning, and that it outperforms all competing sparse attacks in terms of success rate, perturbation size, and efficiency., Comment: Code available at https://github.com/Cinofix/sigma-zero-adversarial-attack

In this paper, we present an algorithm to construct the qT distribution at NLO accuracy to arbitrary power precision, including the assembly of suitable zero-bin subtrahends, in a mathematically well-defined way for a generic choice of rapidity-divergence regularisation prescription. In its derivation, we divide the phase space into two sectors, the interior of the integration domain as well as the integration boundary, which we include here for the first time. To demonstrate the applicability and usefulness of our algorithm, we calculate the NNLP corrections for Higgs hadroproduction for the first time. We observe that our approximate NNLP-accurate qT spectra replicate the asymptotic behaviour of the full QCD calculation to a much better degree than the previously available results, both within the $q_{\mathrm{T}}\to 0$ limit and in the large-qT domain for all the involved partonic processes. While playing a minor role at larger transverse momenta, we show that the newly incorporated boundary contribution plays a vital role in the $q_{\mathrm{T}}\to 0$ limit, where any subleading power accuracy would be lost without them. In particular, our NNLP-accurate qT expansion can approximate the exact qT distribution up to $q_{\mathrm{T}}\sim30\,\text{GeV}$ at the percent level for rapidities $|Y_H|\lesssim 3$.

AI-generated media has become a threat to our digital society as we know it. These forgeries can be created automatically and on a large scale based on publicly available technology. Recognizing this challenge, academics and practitioners have proposed a multitude of automatic detection strategies to detect such artificial media. However, in contrast to these technical advances, the human perception of generated media has not been thoroughly studied yet. In this paper, we aim at closing this research gap. We perform the first comprehensive survey into people's ability to detect generated media, spanning three countries (USA, Germany, and China) with 3,002 participants across audio, image, and text media. Our results indicate that state-of-the-art forgeries are almost indistinguishable from "real" media, with the majority of participants simply guessing when asked to rate them as human- or machine-generated. In addition, AI-generated media receive is voted more human like across all media types and all countries. To further understand which factors influence people's ability to detect generated media, we include personal variables, chosen based on a literature review in the domains of deepfake and fake news research. In a regression analysis, we found that generalized trust, cognitive reflection, and self-reported familiarity with deepfakes significantly influence participant's decision across all media categories., Comment: Security and Privacy 2024 (S&P 24)

Measurements of vector boson polarisation in vector boson production processes offer a powerful probe of the electroweak symmetry breaking mechanism, scrutinising the Standard Model and new physics scenarios alike. Since massive vector bosons can only be observed as intermediate particles, polarised cross section templates from simulation are necessary to extract their polarisation from measurable unpolarised distributions. In this work we present an extension of the SHERPA Monte-Carlo event generator allowing the simulation of polarised cross sections for vector boson production processes. Based on the narrow-width approximation, polarised cross sections of all possible polarisation combinations for an arbitrary number of intermediate vector bosons can be simulated in a single simulation run. In addition, it is possible to directly predict the interference between different intermediate polarisation states, and various differing polarisation definitions can be studied simultaneously. Besides the simulation of polarised cross sections at fixed LO and LO+PS accuracy as well as in multijet merged calculations, we also present parton-shower-matched polarised cross sections with approximate NLO QCD corrections in the vector boson production processes. We demonstrate that the differences of this approximation to full NLO QCD predictions are small and it thus opens up the possibility for fully-simulated calculations at the hadron level including polarisation information and higher-order QCD effects for the first time., Comment: 32 pages, 10 figures, 11 tables

There is an growing interest in using Large Language Models (LLMs) in multi-agent systems to tackle interactive real-world tasks that require effective collaboration and assessing complex situations. Yet, we still have a limited understanding of LLMs' communication and decision-making abilities in multi-agent setups. The fundamental task of negotiation spans many key features of communication, such as cooperation, competition, and manipulation potentials. Thus, we propose using scorable negotiation to evaluate LLMs. We create a testbed of complex multi-agent, multi-issue, and semantically rich negotiation games. To reach an agreement, agents must have strong arithmetic, inference, exploration, and planning capabilities while integrating them in a dynamic and multi-turn setup. We propose multiple metrics to rigorously quantify agents' performance and alignment with the assigned role. We provide procedures to create new games and increase games' difficulty to have an evolving benchmark. Importantly, we evaluate critical safety aspects such as the interaction dynamics between agents influenced by greedy and adversarial players. Our benchmark is highly challenging; GPT-3.5 and small models mostly fail, and GPT-4 and SoTA large models (e.g., Llama-3 70b) still underperform., Comment: Updated version with major additions (new experiments, evaluation, and attacks)

Model stealing aims at inferring a victim model's functionality at a fraction of the original training cost. While the goal is clear, in practice the model's architecture, weight dimension, and original training data can not be determined exactly, leading to mutual uncertainty during stealing. In this work, we explicitly tackle this uncertainty by generating multiple possible networks and combining their predictions to improve the quality of the stolen model. For this, we compare five popular uncertainty quantification models in a model stealing task. Surprisingly, our results indicate that the considered models only lead to marginal improvements in terms of label agreement (i.e., fidelity) to the stolen model. To find the cause of this, we inspect the diversity of the model's prediction by looking at the prediction variance as a function of training iterations. We realize that during training, the models tend to have similar predictions, indicating that the network diversity we wanted to leverage using uncertainty quantification models is not (high) enough for improvements on the model stealing task., Comment: 6 pages, 1 figure, 2 table, paper submitted to European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning

Large language models (LLMs) for automatic code generation have achieved breakthroughs in several programming tasks. Their advances in competition-level programming problems have made them an essential pillar of AI-assisted pair programming, and tools such as GitHub Copilot have emerged as part of the daily programming workflow used by millions of developers. The training data for these models is usually collected from the Internet (e.g., from open-source repositories) and is likely to contain faults and security vulnerabilities. This unsanitized training data can cause the language models to learn these vulnerabilities and propagate them during the code generation procedure. While these models have been extensively assessed for their ability to produce functionally correct programs, there remains a lack of comprehensive investigations and benchmarks addressing the security aspects of these models. In this work, we propose a method to systematically study the security issues of code language models to assess their susceptibility to generating vulnerable code. To this end, we introduce the first approach to automatically find generated code that contains vulnerabilities in black-box code generation models. To achieve this, we present an approach to approximate inversion of the black-box code generation models based on few-shot prompting. We evaluate the effectiveness of our approach by examining code language models in generating high-risk security weaknesses. Furthermore, we establish a collection of diverse non-secure prompts for various vulnerability scenarios using our method. This dataset forms a benchmark for evaluating and comparing the security weaknesses in code language models., Comment: 23 pages, 9 figures

The transverse momentum distribution of the $t\bar{t}$ system is of both experimental and theoretical interest. In the presence of the azimuthally asymmetric divergences, pursuing the resummation at the high logarithmic precision is rather demanding in general. In this paper, we propose the projected transverse momentum spectrum $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} q_{\tau}$, which is derived from the classical $\vec{q}_{\mathrm{T}}$ spectrum by integrating out the rejection component $q_{\tau_{\perp}}$ with respect to a reference unit vector $\vec{\tau}$, to serve as an alternative resolution to curb those asymmetric influences, in additional to the azimuthally averaged case $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} |\vec{q}_{\mathrm{T}}|$. In the context of the effective field theories, SCET$_{\mathrm{II}}$ and HQET, we will demonstrate that in spite of the $q_{\tau_{\perp}}$ integrations, the leading asymptotic terms of $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} q_{\tau}$ still observe the factorization pattern in terms of the hard, beam, and soft functions in the vicinity of $ q_{\tau}=0$~GeV. With the help of the renormalisation group equation techniques, we evaluate the resummed spectra $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} q_{\mathrm{T,in}}$, $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} q_{\mathrm{T,out}}$, and $\mathrm{d}\sigma_{t\bar{t}}/\mathrm{d} \Delta\Phi_{t\bar{t}}$ at NLL+NLO, NNLL+NNLO, and approximate NNLL'+NNLO accuracy. This is the first time the azimuthal spectrum $\Delta\Phi_{t\bar{t}}$ is appraised at or beyond the NNLL level including a consistent treatment of both beam collinear and soft radiation.

In this paper we present an algorithm to add photon-splitting corrections to the Yennie-Frautschi-Suura-style soft-photon resummation available in the Sherpa Monte-Carlo event generator. Photon-splitting corrections enter at NNLO in QED and, as these effects are not incorporated in the standard QED FSR resummations, their size is larger than the pure hard photon-emission corrections at the same order. We introduce different lepton dressing strategies which incorporate further leptons and hadrons in addition to the customary photons, and discuss their sensitivity to dressing parameters such as the cone size. Finally, we quantify the effects of photon splittings into charged fermions and scalars under different such dressing strategies on $Z\to e^+e^-$ decays and find effects of up to 1% for suitably inclusive dressing strategies independent of the dressing cone size, and up to 9% if only photons are used in the dressing procedure with large dressing cones., Comment: 25 pages, 10 figures