Search

An image encoder pre-trained by self-supervised learning can be used as a general-purpose feature extractor to build downstream classifiers for various downstream tasks. However, many studies showed that an attacker can embed a trojan into an encoder such that multiple downstream classifiers built based on the trojaned encoder simultaneously inherit the trojan behavior. In this work, we propose TrojanDec, the first data-free method to identify and recover a test input embedded with a trigger. Given a (trojaned or clean) encoder and a test input, TrojanDec first predicts whether the test input is trojaned. If not, the test input is processed in a normal way to maintain the utility. Otherwise, the test input will be further restored to remove the trigger. Our extensive evaluation shows that TrojanDec can effectively identify the trojan (if any) from a given test input and recover it under state-of-the-art trojan attacks. We further demonstrate by experiments that our TrojanDec outperforms the state-of-the-art defenses., Comment: To appear in AAAI 2025

One key challenge in backdoor attacks against large foundation models is the resource limits. Backdoor attacks usually require retraining the target model, which is impractical for very large foundation models. Existing backdoor attacks are mainly designed for supervised classifiers or small foundation models (e.g., BERT). None of these attacks has successfully compromised a very large foundation model, such as Llama-3-70B, especially with limited computational resources. In this paper, we propose TrojFM, a novel backdoor attack tailored for very large foundation models. Our primary technical contribution is the development of a novel backdoor injection method. This method forces a backdoored model to generate similar hidden representations for poisoned inputs regardless of their actual semantics. Our approach injects such backdoors by fine-tuning only a very small proportion of model parameters. This enables TrojFM to efficiently launch downstream task-agnostic backdoor attacks against very large foundation models under limited computational resources. Moreover, we optimize the fine-tuning process with our customized QLoRA technique, enabling launching our attack via only~\textit{one A100 GPU}. Furthermore, we design a new trigger injection method to ensure our attack stealthiness. Through extensive experiments, we first demonstrate that TrojFM can launch effective backdoor attacks against widely used large GPT-style models without jeopardizing their normal functionalities (and outperforming existing attacks on BERT-style models). Furthermore, we show that TrojFM is resilient to SOTA defenses and is insensitive to changes in key hyper-parameters. Finally, we conduct a resource analysis to quantify that our method can significantly save computational and memory costs compared to existing backdoor attacks.

Few-shot classification with foundation models (e.g., CLIP, DINOv2, PaLM-2) enables users to build an accurate classifier with a few labeled training samples (called support samples) for a classification task. However, an attacker could perform data poisoning attacks by manipulating some support samples such that the classifier makes the attacker-desired, arbitrary prediction for a testing input. Empirical defenses cannot provide formal robustness guarantees, leading to a cat-and-mouse game between the attacker and defender. Existing certified defenses are designed for traditional supervised learning, resulting in sub-optimal performance when extended to few-shot classification. In our work, we propose FCert, the first certified defense against data poisoning attacks to few-shot classification. We show our FCert provably predicts the same label for a testing input under arbitrary data poisoning attacks when the total number of poisoned support samples is bounded. We perform extensive experiments on benchmark few-shot classification datasets with foundation models released by OpenAI, Meta, and Google in both vision and text domains. Our experimental results show our FCert: 1) maintains classification accuracy without attacks, 2) outperforms existing state-of-the-art certified defenses for data poisoning attacks, and 3) is efficient and general., Comment: To appear in IEEE Symposium on Security and Privacy, 2024

Different from a unimodal model whose input is from a single modality, the input (called multi-modal input) of a multi-modal model is from multiple modalities such as image, 3D points, audio, text, etc. Similar to unimodal models, many existing studies show that a multi-modal model is also vulnerable to adversarial perturbation, where an attacker could add small perturbation to all modalities of a multi-modal input such that the multi-modal model makes incorrect predictions for it. Existing certified defenses are mostly designed for unimodal models, which achieve sub-optimal certified robustness guarantees when extended to multi-modal models as shown in our experimental results. In our work, we propose MMCert, the first certified defense against adversarial attacks to a multi-modal model. We derive a lower bound on the performance of our MMCert under arbitrary adversarial attacks with bounded perturbations to both modalities (e.g., in the context of auto-driving, we bound the number of changed pixels in both RGB image and depth image). We evaluate our MMCert using two benchmark datasets: one for the multi-modal road segmentation task and the other for the multi-modal emotion recognition task. Moreover, we compare our MMCert with a state-of-the-art certified defense extended from unimodal models. Our experimental results show that our MMCert outperforms the baseline., Comment: To appear in CVPR'24

Magnetic gels with embedded micro/nano-sized magnetic particles in crosslinked polymer networks can be actuated by external magnetic fields, with changes in their internal microscopic structures and macroscopic mechanical properties. We investigate the responses of such magnetic gels to an external magnetic field, by means of coarse-grained molecular dynamics simulations. We find that the dynamics of magnetic particles are determined by the interplay of between magnetic dipole-dipole interactions, polymer elasticity and thermal fluctuations. The corresponding microscopic structures formed by the magnetic particles such as elongated chains can be controlled by the external magnetic field. Furthermore, the magnetic gels can exhibit reinforced macroscopic mechanical properties, where the elastic modulus increases algebraically with the magnetic moments of the particles in the form of $\propto(m-m_{\mathrm{c}})^{2}$ when magnetic chains are formed. This simulation work can not only serve as a tool for studying the microscopic and the macroscopic responses of the magnetic gels, but also facilitate future fabrications and practical controls of magnetic composites with desired physical properties.

Flocking and vortical are two typical motion modes in active matter. Although it is known that the two modes can spontaneously switch between each other in a finite-size system, the switching dynamics remain elusive. In this work, by computer simulation of a two-dimensional Vicsek-like system with 1000 particles, we find from the perspective of classical nucleation theory that the forward and backward switching dynamics are asymmetric: from flocking to vortical is a one-step nucleation process, while the opposite is a two-step nucleation process with the system staying in a metastable state before reaching the final flocking state., Comment: 4 pages, 4 figures

The space-air-ground integrated network (SAGIN) is dynamic and flexible, which can support transmitting data in environments lacking ground communication facilities. However, the nodes of SAGIN are heterogeneous and it is intractable to share the resources to provide multiple services. Therefore, in this paper, we consider using network function virtualization technology to handle the problem of agile resource allocation. In particular, the service function chains (SFCs) are constructed to deploy multiple virtual network functions of different tasks. To depict the dynamic model of SAGIN, we propose the reconfigurable time extension graph. Then, an optimization problem is formulated to maximize the number of completed tasks, i.e., the successful deployed SFC. It is a mixed integer linear programming problem, which is hard to solve in limited time complexity. Hence, we transform it as a many-to-one two-sided matching game problem. Then, we design a Gale-Shapley based algorithm. Finally, via abundant simulations, it is verified that the designed algorithm can effectively deploy SFCs with efficient resource utilization.

Phase behaviors of two-dimensional (2D) systems constitute a fundamental topic in condensed matter and statistical physics. Although hard polygons and interactive point-like particles are well studied, the phase behaviors of more realistic molecular systems considering intermolecular interaction and molecular shape remain elusive. Here we investigate by molecular dynamics simulation thermal stabilities of 2D ball-stick polygons, serving as simplified models for molecular systems. Below the melting temperature $T_{m}$, we identify a critical edge number $n_{c}$, at which a waving superlattice structure emerges; when n < $n_{c}$,the triangular system stabilizes at a spin-ice-like glassy state; when n > $n_{c}$,the polygons stabilize at crystalline states, and $T_{m}$ is higher for polygons with more edges at higher pressures but exhibits a crossover for hexagon and octagon at low pressures. A theoretical framework taking into account the competition between entropy and enthalpy is proposed to provide a comprehensive understanding of our results, which is anticipated to facilitate the design of 2D materials., Comment: Version 4 is accepted by Nature Communications

Ionic liquids (ILs), also known as room-temperature molten salts, are composed of pure ions with melting points usually below 100 degrees centigrade. Because of their low volatility and vast amounts of species, ILs can serve as "green solvents" and "designer solvents" to meet the requirements of various applications by fine tuning their molecular structures. A good understanding of the phase behaviors of ILs is certainly fundamentally important in terms of their wide applications. This review intends to summarize the major conclusions so far drawn on phase behaviors of ILs by computational, theoretical, and experimental studies, illustrating the intrinsic relationship between their dual ionic and organic nature and the crystalline phases, nanoscale segregation liquid phase, ionic liquid crystal phases, as well as phase behaviors of their mixture with small organic molecules., Comment: 21 pages, 12 figures, 157 references

The Stokes-Einstein (SE) relation is commonly regarded as being breakdown in supercooled water. However, this conclusion is drawn upon testing the validities of some variants of the SE relation rather than its original form, and it appears conflicting with the fact that supercooled water is in its local equilibrium. In this work, we show by molecular dynamics simulation that both the Einstein and Stokes relations are indeed conserved in supercooled water. The inconsistency between the original SE relation and its variants comes from two facts: (1) the substitutes of the shear viscosity in the SE variants are wavevector-dependent, so it is only a cursory approximation; (2) the effective hydrodynamic radius actually decreases with decreasing temperature, instead of being a constant as assumed in the SE variants. Besides supercooled water, this inconsistency may also exist in other supercooled liquids.