arXiv subjects

David Wagner

Publications and source records attributed to David Wagner.

At least 73 records · Page 4Linked to original sources

arXiv2023

Generating Tensor Polarization from Shear Stress

We derive an expression for the tensor polarization of a system of massive spin-1 particles in a hydrodynamic framework. Starting from quantum kinetic theory based on the Wigner-function formalism, we employ a modified method of moments which also takes into account all spin degrees of freedom. It is shown that the tensor polarization of an uncharged fluid is determined by the shear-stress tensor. In order to quantify this novel polarization effect, we provide a formula which can be used for numerical calculations of vector-meson spin alignment in relativistic heavy-ion collisions.

nucl-th↗

arXiv2022

Relativistic second-order dissipative spin hydrodynamics from the method of moments

We derive relativistic second-order dissipative fluid-dynamical equations of motion for massive spin-1/2 particles from kinetic theory using the method of moments. Besides the usual conservation laws for charge, energy, and momentum, such a theory of relativistic dissipative spin hydrodynamics features an equation of motion for the rank-3 spin tensor, which follows from the conservation of total angular momentum. Extending the conventional method of moments for spin-0 particles, we expand the spin-dependent distribution function near local equilibrium in terms of moments of the momentum and spin variables. We work to next-to-leading order in the Planck constant $\hbar$. As shown in previous work, at this order in $\hbar$ the Boltzmann equation for spin-1/2 particles features a nonlocal collision term. From the Boltzmann equation, we then obtain an infinite set of equations of motion for the irreducible moments of the deviation of the single-particle distribution function from local equilibrium. In order to close this system of moment equations, a truncation procedure is needed. We employ the "14+24-moment approximation", where "14" corresponds to the components of the charge current and the energy-momentum tensor and "24" to the components of the spin tensor, which completes the derivation of the equations of motion of second-order dissipative spin hydrodynamics. For applications to heavy-ion phenomenology, we also determine dissipative corrections to the Pauli-Lubanski vector.

nucl-th↗

arXiv2022

Relativistic dissipative spin hydrodynamics from kinetic theory with a nonlocal collision term

We derive relativistic dissipative spin hydrodynamics from kinetic theory featuring a nonlocal collision term using the method of moments. In this framework, the components of the spin tensor are dynamical variables which obey relaxation-type equations. We find that the corresponding relaxation times are determined by the local part of the collision term, while the nonlocal part contributes to the Navier-Stokes terms in these equations of motion. The spin relaxation time scales are comparable to those of the usual dissipative currents. Finally, the Navier-Stokes limit of the Pauli-Lubanski vector receives contributions proportional to the shear tensor of the fluid, which implies that the polarization of hadrons observed in heavy-ion collisions is influenced by dissipative effects.

nucl-th↗

arXiv2022

Lorentz-covariant nonlocal collision term for spin-1/2 particles

We revisit the derivation of the nonlocal collision term in the Boltzmann equation for spin-1/2 particles, using both the Wigner-function approach by de Groot, van Leeuwen, and van Weert, and the Kadanoff-Baym equation in $T$-matrix approximation. Contrary to previous calculations, our results maintain full Lorentz covariance of the nonlocal collision term.

nucl-th↗

arXiv2022

Kinetic theory for massive spin-1 particles

We calculate the Wigner function for charged spin-1 particles in inhomogeneous classical electromagnetic fields, going to first order in a power series in $\hbar$. The Boltzmann equation for the scalar distribution function obtained from this formalism agrees with previous calculations for spin-1/2 particles. In particular, we recover a Mathisson force of twice the magnitude, correctly reflecting the higher dipole moment of vector mesons. Evolution equations for vector and tensor degrees of freedom are obtained, and global equilibrium is discussed.

nucl-th↗

arXiv2022

Pseudo-gauges and relativistic spin hydrodynamics for interacting Dirac and Proca fields

We present the explicit expressions of different pseudo-gauge transformations for Dirac and Proca fields considering a general interaction term. The particular case of the interaction of Dirac and Proca fields with a background electromagnetic field is also studied. Starting from the quantum kinetic theory with collisions derived from the Wigner-function formalism for massive spin-1/2 and spin-1 particles, we establish a connection between different pseudo-gauges and relativistic spin hydrodynamics. The physical implications of the various decompositions of orbital and spin angular momentum are discussed.

nucl-th↗

arXiv2022

Inverse-Reynolds-Dominance approach to transient fluid dynamics

We consider the evolution equations for the bulk viscous pressure, diffusion current and shear tensor derived within second-order relativistic dissipative hydrodynamics from kinetic theory. By matching the higher order moments directly to the dissipative quantities, all terms which are of second order in the Knudsen number Kn vanish, leaving only terms of order $\mathcal{O}(\textrm{Re}^{-1} \textrm{Kn})$ and $\mathcal{O}(\textrm{Re}^{-2})$ in the relaxation equations, where $\textrm{Re}^{-1}$ is the inverse Reynolds number. We therefore refer to this scheme as the Inverse-Reynolds-Dominance (IReD) approach. The remaining (non-vanishing) transport coefficients can be obtained exclusively in terms of the inverse of the collision matrix. This procedure fixes unambiguously the relaxation times of the dissipative quantities, which are no longer related to the eigenvalues of the inverse of the collision matrix. In particular, we find that the relaxation times corresponding to higher-order moments grow as their order increases, thereby contradicting the \textit{separation of scales} paradigm. The formal (up to second order) equivalence with the standard DNMR approach is proven and the connection between the IReD transport coefficients and the usual DNMR ones is established.

nucl-th↗

arXiv2022

Demystifying the Adversarial Robustness of Random Transformation Defenses

Neural networks' lack of robustness against attacks raises concerns in security-sensitive settings such as autonomous vehicles. While many countermeasures may look promising, only a few withstand rigorous evaluation. Defenses using random transformations (RT) have shown impressive results, particularly BaRT (Raff et al., 2019) on ImageNet. However, this type of defense has not been rigorously evaluated, leaving its robustness properties poorly understood. Their stochastic properties make evaluation more challenging and render many proposed attacks on deterministic models inapplicable. First, we show that the BPDA attack (Athalye et al., 2018a) used in BaRT's evaluation is ineffective and likely overestimates its robustness. We then attempt to construct the strongest possible RT defense through the informed selection of transformations and Bayesian optimization for tuning their parameters. Furthermore, we create the strongest possible attack to evaluate our RT defense. Our new attack vastly outperforms the baseline, reducing the accuracy by 83% compared to the 19% reduction by the commonly used EoT attack ($4.3\times$ improvement). Our result indicates that the RT defense on the Imagenette dataset (a ten-class subset of ImageNet) is not robust against adversarial examples. Extending the study further, we use our new attack to adversarially train RT defense (called AdvRT), resulting in a large robustness gain. Code is available at https://github.com/wagner-group/demystify-random-transform.

cs.CR↗

arXiv2022

Diffix Elm: Simple Diffix

Historically, strong data anonymization requires substantial domain expertise and custom design for the given data set and use case. Diffix is an anonymization framework designed to make strong data anonymization available to non-experts. This paper describes Diffix Elm, a version of Diffix that is very easy to use at the expense of query features. We describe Diffix Elm, and show that it provides strong anonymity based on the General Data Protection Regulation (GDPR) criteria. This document is the third version of Diffix Elm. The second version added ceiling, round, and bucket\_width functions (in addition to floor). This document adds the ability to protect multiple different kinds of protected entities (a feature not found in earlier versions of Diffix). It also adds counting distinct values for any column (rather than only the AID column).

cs.CR↗

arXiv2021

SLIP: Self-supervision meets Language-Image Pre-training

Recent work has shown that self-supervised pre-training leads to improvements over supervised learning on challenging visual recognition tasks. CLIP, an exciting new approach to learning with language supervision, demonstrates promising performance on a wide variety of benchmarks. In this work, we explore whether self-supervised learning can aid in the use of language supervision for visual representation learning. We introduce SLIP, a multi-task learning framework for combining self-supervised learning and CLIP pre-training. After pre-training with Vision Transformers, we thoroughly evaluate representation quality and compare performance to both CLIP and self-supervised learning under three distinct settings: zero-shot transfer, linear classification, and end-to-end finetuning. Across ImageNet and a battery of additional datasets, we find that SLIP improves accuracy by a large margin. We validate our results further with experiments on different model sizes, training schedules, and pre-training datasets. Our findings show that SLIP enjoys the best of both worlds: better performance than self-supervision (+8.1% linear accuracy) and language supervision (+5.2% zero-shot accuracy).

cs.CV↗

arXiv2021

Learning Security Classifiers with Verified Global Robustness Properties

Many recent works have proposed methods to train classifiers with local robustness properties, which can provably eliminate classes of evasion attacks for most inputs, but not all inputs. Since data distribution shift is very common in security applications, e.g., often observed for malware detection, local robustness cannot guarantee that the property holds for unseen inputs at the time of deploying the classifier. Therefore, it is more desirable to enforce global robustness properties that hold for all inputs, which is strictly stronger than local robustness. In this paper, we present a framework and tools for training classifiers that satisfy global robustness properties. We define new notions of global robustness that are more suitable for security classifiers. We design a novel booster-fixer training framework to enforce global robustness properties. We structure our classifier as an ensemble of logic rules and design a new verifier to verify the properties. In our training algorithm, the booster increases the classifier's capacity, and the fixer enforces verified global robustness properties following counterexample guided inductive synthesis. We show that we can train classifiers to satisfy different global robustness properties for three security datasets, and even multiple properties at the same time, with modest impact on the classifier's performance. For example, we train a Twitter spam account classifier to satisfy five global robustness properties, with 5.4% decrease in true positive rate, and 0.1% increase in false positive rate, compared to a baseline XGBoost model that doesn't satisfy any property.

cs.CR↗

arXiv2021

SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing

Adversarial training (AT) has become a popular choice for training robust networks. However, it tends to sacrifice clean accuracy heavily in favor of robustness and suffers from a large generalization error. To address these concerns, we propose Smooth Adversarial Training (SAT), guided by our analysis on the eigenspectrum of the loss Hessian. We find that curriculum learning, a scheme that emphasizes on starting "easy" and gradually ramping up on the "difficulty" of training, smooths the adversarial loss landscape for a suitably chosen difficulty metric. We present a general formulation for curriculum learning in the adversarial setting and propose two difficulty metrics based on the maximal Hessian eigenvalue (H-SAT) and the softmax probability (P-SA). We demonstrate that SAT stabilizes network training even for a large perturbation norm and allows the network to operate at a better clean accuracy versus robustness trade-off curve compared to AT. This leads to a significant improvement in both clean accuracy and robustness compared to AT, TRADES, and other baselines. To highlight a few results, our best model improves normal and robust accuracy by 6% and 1% on CIFAR-100 compared to AT, respectively. On Imagenette, a ten-class subset of ImageNet, our model outperforms AT by 23% and 3% on normal and robust accuracy respectively.

cs.LG↗

arXiv2021

Adversarial Examples for $k$-Nearest Neighbor Classifiers Based on Higher-Order Voronoi Diagrams

Adversarial examples are a widely studied phenomenon in machine learning models. While most of the attention has been focused on neural networks, other practical models also suffer from this issue. In this work, we propose an algorithm for evaluating the adversarial robustness of $k$-nearest neighbor classification, i.e., finding a minimum-norm adversarial example. Diverging from previous proposals, we take a geometric approach by performing a search that expands outwards from a given input point. On a high level, the search radius expands to the nearby Voronoi cells until we find a cell that classifies differently from the input point. To scale the algorithm to a large $k$, we introduce approximation steps that find perturbations with smaller norm, compared to the baselines, in a variety of datasets. Furthermore, we analyze the structural properties of a dataset where our approach outperforms the competition.

cs.LG↗

arXiv2021

Hopper: Modeling and Detecting Lateral Movement (Extended Report)

In successful enterprise attacks, adversaries often need to gain access to additional machines beyond their initial point of compromise, a set of internal movements known as lateral movement. We present Hopper, a system for detecting lateral movement based on commonly available enterprise logs. Hopper constructs a graph of login activity among internal machines and then identifies suspicious sequences of loginsthat correspond to lateral movement. To understand the larger context of each login, Hopper employs an inference algorithm to identify the broader path(s) of movement that each login belongs to and the causal user responsible for performing a path's logins. Hopper then leverages this path inference algorithm, in conjunction with a set of detection rules and a new anomaly scoring algorithm, to surface the login paths most likely to reflect lateral movement. On a 15-month enterprise dataset consisting of over 780 million internal logins, Hop-per achieves a 94.5% detection rate across over 300 realistic attack scenarios, including one red team attack, while generating an average of <9 alerts per day. In contrast, to detect the same number of attacks, prior state-of-the-art systems would need to generate nearly 8x as many false positives.

cs.CR↗

arXiv2021

Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

Adversarial attacks optimize against models to defeat defenses. Existing defenses are static, and stay the same once trained, even while attacks change. We argue that models should fight back, and optimize their defenses against attacks at test time. We propose dynamic defenses, to adapt the model and input during testing, by defensive entropy minimization (dent). Dent alters testing, but not training, for compatibility with existing models and train-time defenses. Dent improves the robustness of adversarially-trained defenses and nominally-trained models against white-box, black-box, and adaptive attacks on CIFAR-10/100 and ImageNet. In particular, dent boosts state-of-the-art defenses by 20+ points absolute against AutoAttack on CIFAR-10 at $ε_\infty$ = 8/255.

cs.LG↗

arXiv2021

Model-Agnostic Defense for Lane Detection against Adversarial Attack

Susceptibility of neural networks to adversarial attack prompts serious safety concerns for lane detection efforts, a domain where such models have been widely applied. Recent work on adversarial road patches have successfully induced perception of lane lines with arbitrary form, presenting an avenue for rogue control of vehicle behavior. In this paper, we propose a modular lane verification system that can catch such threats before the autonomous driving system is misled while remaining agnostic to the particular lane detection model. Our experiments show that implementing the system with a simple convolutional neural network (CNN) can defend against a wide gamut of attacks on lane detection models. With a 10% impact to inference time, we can detect 96% of bounded non-adaptive attacks, 90% of bounded adaptive attacks, and 98% of patch attacks while preserving accurate identification at least 95% of true lanes, indicating that our proposed verification system is effective at mitigating lane detection security risks with minimal overhead.

cs.CV↗

arXiv2020

A Large-Scale Analysis of Attacker Activity in Compromised Enterprise Accounts

We present a large-scale characterization of attacker activity across 111 real-world enterprise organizations. We develop a novel forensic technique for distinguishing between attacker activity and benign activity in compromised enterprise accounts that yields few false positives and enables us to perform fine-grained analysis of attacker behavior. Applying our methods to a set of 159 compromised enterprise accounts, we quantify the duration of time attackers are active in accounts and examine thematic patterns in how attackers access and leverage these hijacked accounts. We find that attackers frequently dwell in accounts for multiple days to weeks, suggesting that delayed (non-real-time) detection can still provide significant value. Based on an analysis of the attackers' timing patterns, we observe two distinct modalities in how attackers access compromised accounts, which could be explained by the existence of a specialized market for hijacked enterprise accounts: where one class of attackers focuses on compromising and selling account access to another class of attackers who exploit the access such hijacked accounts provide. Ultimately, our analysis sheds light on the state of enterprise account hijacking and highlights fruitful directions for a broader space of detection methods, ranging from new features that home in on malicious account behavior to the development of non-real-time detection methods that leverage malicious activity after an attack's initial point of compromise to more accurately identify attacks.

cs.CR↗

arXiv2020

Minority Reports Defense: Defending Against Adversarial Patches

Deep learning image classification is vulnerable to adversarial attack, even if the attacker changes just a small patch of the image. We propose a defense against patch attacks based on partially occluding the image around each candidate patch location, so that a few occlusions each completely hide the patch. We demonstrate on CIFAR-10, Fashion MNIST, and MNIST that our defense provides certified security against patch attacks of a certain size.

cs.LG↗