arXiv subjects

Liwei Song

Publications and source records attributed to Liwei Song.

17 recordsLinked to original sources

arXiv2026

Full-span reversible space-time birefringence

Birefringence, the polarization-dependent splitting of light in anisotropic crystals, enables diverse optical phenomena and advanced functionalities such as optical communication, nonlinear optics, and quantum optics. However, conventional methods for controlling birefringence typically rely on engineering the optical crystal structure or applying external stimuli such as electric fields, mechanical stress or thermal variations, which are often constrained by limited tunability, challenges in integration with compact photonic devices or slow response time. Here, we introduce a new degree of freedom to manipulate the birefringence of light propagation in optical crystals through programming the spatiotemporal spectral phase of the incident light wave. We demonstrate this approach achieves continuous tuning of birefringence across a spectrum more than 100 times broader than that achievable with conventional birefringence tuning, spanning from positive through zero to negative values, irrespective of the crystal's optical sign and without inherent physical limitations. This unique optical behavior provides a versatile platform for investigating the complex dynamics of wave flow in anisotropic media, while the broad tunability of this space-time birefringence will spur innovations in ultrafast optical manipulation, optical computation, and quantum information processing-applications that demand rapid and flexible device reconfiguration.

physics.optics↗

arXiv2025

Structured Light at the Extreme: Harnessing Spatiotemporal Control for High-Field Laser-Matter Interactions

This review charts the emerging paradigm of intelligent structured light for high-field laser-matter interactions, where the precise spatiotemporal and vectorial control of light is a critical degree of freedom. We outline a transformative framework built upon three synergistic pillars. First, we survey the advanced electromagnetic toolkit, moving beyond conventional spatial light modulators to include robust static optics and the promising frontier of plasma light modulators. Second, we detail the optimization engine for this high-dimensional design space, focusing on physics-informed digital twins and AI-driven inverse design to automate the discovery of optimal light structures. Finally, we explore the groundbreaking applications enabled by this integrated approach, including programmable electron beams, orbital-angular-momentum-carrying {\gamma}-rays, compact THz accelerators, and robust communications. The path forward necessitates overcoming grand challenges in material science, real-time adaptive control at MHz rates, and the extension of these principles to the quantum realm. This review serves as a call to action for a coordinated, interdisciplinary effort to command, rather than merely observe, light-matter interactions at the extreme.

physics.optics↗

arXiv2025

Direct Reconstruction of Terahertz-driven Subcycle Electron Emission Dynamics

While field-driven electron emission is theoretically understood down to the subcycle regime, its direct experimental temporal characterization using long-wavelength terahertz (THz) fields remains elusive. Here, by driving a graphite tip with phase-stable quasi-single-cycle THz pulses, we reveal distinct subcycle electron emission dynamics including: (1) At a carrier-envelope phase (CEP) zero, spectral peaks scale linearly with THz field strength, characteristic of subcycle emission; (2) At nearly opposite CEP, dominant deceleration fields generate stationary low-energy peaks. Crucially, we develop a pump-probe-free, direct reconstruction method extracting electron pulse profiles solely from measured energy spectra, obtaining durations from 73.0 to 81.0 fs as the field increases (191-290 kV/cm). Phase-resolved simulations further reveal a 72.8% modulation in the cutoff energy and a near-total (99.7%) suppression of the emission current. This work not only validates the field-emisssion theory under THz excitation but also establishes a general framework for the direct temporal characterization of subcycle electron emission, opening pathways for precise electron control in ultrafast electron sources and lightwave nanoelectronics.

physics.optics↗

arXiv2025

BestServe: Serving Strategies with Optimal Goodput in Collocation and Disaggregation Architectures

Serving large language models (LLMs) to millions of users requires efficient resource allocation and parallelism strategies. It is a labor intensive trial-and-error process to find such a strategy. We present BestServe, a novel framework for ranking serving strategies by estimating goodput under various operating scenarios. Supporting both collocated and disaggregated architectures, BestServe leverages an inference simulator built on an adapted roofline model and CPU-GPU dispatch dynamics. Our framework determines the optimal strategy in minutes on a single standard CPU, eliminating the need for costly benchmarking, while achieving predictions within a $20\%$ error margin. It appeals to be practical for rapid deployment planning because of its lightweight design and strong extensibility.

cs.LG↗

arXiv2024

Towards Personalized Evaluation of Large Language Models with An Anonymous Crowd-Sourcing Platform

Large language model evaluation plays a pivotal role in the enhancement of its capacity. Previously, numerous methods for evaluating large language models have been proposed in this area. Despite their effectiveness, these existing works mainly focus on assessing objective questions, overlooking the capability to evaluate subjective questions which is extremely common for large language models. Additionally, these methods predominantly utilize centralized datasets for evaluation, with question banks concentrated within the evaluation platforms themselves. Moreover, the evaluation processes employed by these platforms often overlook personalized factors, neglecting to consider the individual characteristics of both the evaluators and the models being evaluated. To address these limitations, we propose a novel anonymous crowd-sourcing evaluation platform, BingJian, for large language models that employs a competitive scoring mechanism where users participate in ranking models based on their performance. This platform stands out not only for its support of centralized evaluations to assess the general capabilities of models but also for offering an open evaluation gateway. Through this gateway, users have the opportunity to submit their questions, testing the models on a personalized and potentially broader range of capabilities. Furthermore, our platform introduces personalized evaluation scenarios, leveraging various forms of human-computer interaction to assess large language models in a manner that accounts for individual user preferences and contexts. The demonstration of BingJian can be accessed at https://github.com/Mingyue-Cheng/Bingjian.

cs.CL↗

arXiv2023

Highly-stable, flexible delivery of microjoule-level ultrafast pulses in vacuumized anti-resonant hollow-core fibers for active synchronization

We demonstrate the stable and flexible light delivery of multi-μJ, sub-200-fs pulses over a ~10-m-long vacuumized anti-resonant hollow-core fiber (AR-HCF), which was successfully used for high-performance pulse synchronization. Compared with the pulse train launched into the AR-HCF, the transmitted pulse train out of the fiber exhibits excellent stabilities in pulse power and spectrum, with pointing stability largely improved. The walk-off between the fiber-delivery and the other free-space-propagation pulse trains, in an open loop, was measured to be <6 fs root-mean-square (RMS) over 90 minutes, corresponding to a relative optical-path variation of <2x10-7. This walk-off can be further suppressed to ~2 fs RMS simply using an active control loop, highlighting the great application potentials of this AR-HCF set-up in large-scale laser and accelerator facilities.

physics.optics↗

arXiv2021

Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecture

Membership inference attacks are a key measure to evaluate privacy leakage in machine learning (ML) models. These attacks aim to distinguish training members from non-members by exploiting differential behavior of the models on member and non-member inputs. The goal of this work is to train ML models that have high membership privacy while largely preserving their utility; we therefore aim for an empirical membership privacy guarantee as opposed to the provable privacy guarantees provided by techniques like differential privacy, as such techniques are shown to deteriorate model utility. Specifically, we propose a new framework to train privacy-preserving models that induces similar behavior on member and non-member inputs to mitigate membership inference attacks. Our framework, called SELENA, has two major components. The first component and the core of our defense is a novel ensemble architecture for training. This architecture, which we call Split-AI, splits the training data into random subsets, and trains a model on each subset of the data. We use an adaptive inference strategy at test time: our ensemble architecture aggregates the outputs of only those models that did not contain the input sample in their training data. We prove that our Split-AI architecture defends against a large family of membership inference attacks, however, it is susceptible to new adaptive attacks. Therefore, we use a second component in our framework called Self-Distillation to protect against such stronger attacks. The Self-Distillation component (self-)distills the training dataset through our Split-AI ensemble, without using any external public datasets. Through extensive experiments on major benchmark datasets we show that SELENA presents a superior trade-off between membership privacy and utility compared to the state of the art.

cs.CR↗

arXiv2021

Universal Adversarial Attacks with Natural Triggers for Text Classification

Recent work has demonstrated the vulnerability of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifiers. Despite being successful, the word sequences produced in such attacks are often ungrammatical and can be easily distinguished from natural text. We develop adversarial attacks that appear closer to natural English phrases and yet confuse classification systems when added to benign inputs. We leverage an adversarially regularized autoencoder (ARAE) to generate triggers and propose a gradient-based search that aims to maximize the downstream classifier's prediction loss. Our attacks effectively reduce model accuracy on classification tasks while being less identifiable than prior models as per automatic detection metrics and human-subject studies. Our aim is to demonstrate that adversarial attacks can be made harder to detect than previously thought and to enable the development of appropriate defenses.

cs.CL↗

arXiv2020

Systematic Evaluation of Privacy Risks of Machine Learning Models

Machine learning models are prone to memorizing sensitive data, making them vulnerable to membership inference attacks in which an adversary aims to guess if an input sample was used to train the model. In this paper, we show that prior work on membership inference attacks may severely underestimate the privacy risks by relying solely on training custom neural network classifiers to perform attacks and focusing only on the aggregate results over data samples, such as the attack accuracy. To overcome these limitations, we first propose to benchmark membership inference privacy risks by improving existing non-neural network based inference attacks and proposing a new inference attack method based on a modification of prediction entropy. We also propose benchmarks for defense mechanisms by accounting for adaptive adversaries with knowledge of the defense and also accounting for the trade-off between model accuracy and privacy risks. Using our benchmark attacks, we demonstrate that existing defense approaches are not as effective as previously reported. Next, we introduce a new approach for fine-grained privacy analysis by formulating and deriving a new metric called the privacy risk score. Our privacy risk score metric measures an individual sample's likelihood of being a training member, which allows an adversary to identify samples with high privacy risks and perform attacks with high confidence. We experimentally validate the effectiveness of the privacy risk score and demonstrate that the distribution of privacy risk score across individual samples is heterogeneous. Finally, we perform an in-depth investigation for understanding why certain samples have high privacy risks, including correlations with model sensitivity, generalization error, and feature embeddings. Our work emphasizes the importance of a systematic and rigorous evaluation of privacy risks of machine learning models.

cs.CR↗

arXiv2020

Towards Probabilistic Verification of Machine Unlearning

The right to be forgotten, also known as the right to erasure, is the right of individuals to have their data erased from an entity storing it. The status of this long held notion was legally solidified recently by the General Data Protection Regulation (GDPR) in the European Union. Consequently, there is a need for mechanisms whereby users can verify if service providers comply with their deletion requests. In this work, we take the first step in proposing a formal framework to study the design of such verification mechanisms for data deletion requests -- also known as machine unlearning -- in the context of systems that provide machine learning as a service (MLaaS). Our framework allows the rigorous quantification of any verification mechanism based on standard hypothesis testing. Furthermore, we propose a novel backdoor-based verification mechanism and demonstrate its effectiveness in certifying data deletion with high confidence, thus providing a basis for quantitatively inferring machine unlearning. We evaluate our approach over a range of network architectures such as multi-layer perceptrons (MLP), convolutional neural networks (CNN), residual networks (ResNet), and long short-term memory (LSTM), as well as over 5 different datasets. We demonstrate that our approach has minimal effect on the ML service's accuracy but provides high confidence verification of unlearning. Our proposed mechanism works even if only a handful of users employ our system to ascertain compliance with data deletion requests. In particular, with just 5% of users participating, modifying half their data with a backdoor, and with merely 30 test queries, our verification mechanism has both false positive and false negative ratios below $10^{-3}$. We also show the effectiveness of our approach by testing it against an adaptive adversary that uses a state-of-the-art backdoor defense method.

cs.CR↗

arXiv2020

A Critical Evaluation of Open-World Machine Learning

Open-world machine learning (ML) combines closed-world models trained on in-distribution data with out-of-distribution (OOD) detectors, which aim to detect and reject OOD inputs. Previous works on open-world ML systems usually fail to test their reliability under diverse, and possibly adversarial conditions. Therefore, in this paper, we seek to understand how resilient are state-of-the-art open-world ML systems to changes in system components? With our evaluation across 6 OOD detectors, we find that the choice of in-distribution data, model architecture and OOD data have a strong impact on OOD detection performance, inducing false positive rates in excess of $70\%$. We further show that OOD inputs with 22 unintentional corruptions or adversarial perturbations render open-world ML systems unusable with false positive rates of up to $100\%$. To increase the resilience of open-world ML, we combine robust classifiers with OOD detection techniques and uncover a new trade-off between OOD detection and robustness.

cs.LG↗

arXiv2019

Privacy Risks of Securing Machine Learning Models against Adversarial Examples

The arms race between attacks and defenses for machine learning models has come to a forefront in recent years, in both the security community and the privacy community. However, one big limitation of previous research is that the security domain and the privacy domain have typically been considered separately. It is thus unclear whether the defense methods in one domain will have any unexpected impact on the other domain. In this paper, we take a step towards resolving this limitation by combining the two domains. In particular, we measure the success of membership inference attacks against six state-of-the-art defense methods that mitigate the risk of adversarial examples (i.e., evasion attacks). Membership inference attacks determine whether or not an individual data record has been part of a model's training set. The accuracy of such attacks reflects the information leakage of training algorithms about individual members of the training set. Adversarial defense methods against adversarial examples influence the model's decision boundaries such that model predictions remain unchanged for a small area around each input. However, this objective is optimized on training data. Thus, individual data records in the training set have a significant influence on robust models. This makes the models more vulnerable to inference attacks. To perform the membership inference attacks, we leverage the existing inference methods that exploit model predictions. We also propose two new inference methods that exploit structural properties of robust models on adversarially perturbed data. Our experimental evaluation demonstrates that compared with the natural training (undefended) approach, adversarial defense methods can indeed increase the target model's risk against membership inference attacks.

stat.ML↗

arXiv2019

Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples

A large body of recent work has investigated the phenomenon of evasion attacks using adversarial examples for deep learning systems, where the addition of norm-bounded perturbations to the test inputs leads to incorrect output classification. Previous work has investigated this phenomenon in closed-world systems where training and test inputs follow a pre-specified distribution. However, real-world implementations of deep learning applications, such as autonomous driving and content classification are likely to operate in the open-world environment. In this paper, we demonstrate the success of open-world evasion attacks, where adversarial examples are generated from out-of-distribution inputs (OOD adversarial examples). In our study, we use 11 state-of-the-art neural network models trained on 3 image datasets of varying complexity. We first demonstrate that state-of-the-art detectors for out-of-distribution data are not robust against OOD adversarial examples. We then consider 5 known defenses for adversarial examples, including state-of-the-art robust training methods, and show that against these defenses, OOD adversarial examples can achieve up to 4$\times$ higher target success rates compared to adversarial examples generated from in-distribution data. We also take a quantitative look at how open-world evasion attacks may affect real-world systems. Finally, we present the first steps towards a robust open-world machine learning system.

cs.LG↗

arXiv2017

Acoustic Denial of Service Attacks on HDDs

Among storage components, hard disk drives (HDDs) have become the most commonly-used type of non-volatile storage due to their recent technological advances, including, enhanced energy efficacy and significantly-improved areal density. Such advances in HDDs have made them an inevitable part of numerous computing systems, including, personal computers, closed-circuit television (CCTV) systems, medical bedside monitors, and automated teller machines (ATMs). Despite the widespread use of HDDs and their critical role in real-world systems, there exist only a few research studies on the security of HDDs. In particular, prior research studies have discussed how HDDs can potentially leak critical private information through acoustic or electromagnetic emanations. Borrowing theoretical principles from acoustics and mechanics, we propose a novel denial-of-service (DoS) attack against HDDs that exploits a physical phenomenon, known as acoustic resonance. We perform a comprehensive examination of physical characteristics of several HDDs and create acoustic signals that cause significant vibrations in HDD's internal components. We demonstrate that such vibrations can negatively influence the performance of HDDs embedded in real-world systems. We show the feasibility of the proposed attack in two real-world case studies, namely, personal computers and CCTVs.

cs.CR↗

arXiv2017

Inaudible Voice Commands

Voice assistants like Siri enable us to control IoT devices conveniently with voice commands, however, they also provide new attack opportunities for adversaries. Previous papers attack voice assistants with obfuscated voice commands by leveraging the gap between speech recognition system and human voice perception. The limitation is that these obfuscated commands are audible and thus conspicuous to device owners. In this paper, we propose a novel mechanism to directly attack the microphone used for sensing voice data with inaudible voice commands. We show that the adversary can exploit the microphone's non-linearity and play well-designed inaudible ultrasounds to cause the microphone to record normal voice commands, and thus control the victim device inconspicuously. We demonstrate via end-to-end real-world experiments that our inaudible voice commands can attack an Android phone and an Amazon Echo device with high success rates at a range of 2-3 meters.

cs.CR↗

arXiv2013

Initial carrier-envelope phase of few-cycle pulses determined by THz emission from air plasma

The evolution of THz waveform generated in air plasma provides a sensitive probe to the variation of the carrier envelope phase (CEP) of propagating intense few-cycle pulses. Our experimental observation and calculation reveal that the number and positions of the inversion of THz waveform are dependent on the initial CEP, which is near 0.5π constantly under varied input pulse energies when two inversions of THz waveform in air plasma become one. This provides a method of measuring the initial CEP in an accuracy that is only limited by the stability of the driving few-cycle pulses.

physics.optics↗

arXiv2012

Waveform-Controlled Terahertz Radiation from the Air Filament Produced by Few-Cycle Laser Pulses

Waveform-controlled Terahertz (THz) radiation is of great importance due to its potential application in THz sensing and coherent control of quantum systems. We demonstrated a novel scheme to generate waveform-controlled THz radiation from air plasma produced when carrier-envelope-phase (CEP) stabilized few-cycle laser pulses undergo filamentation in ambient air. We launched CEP-stabilized 10 fs-long (~ 1.7 optical cycles) laser pulses at 1.8 μm into air and found that the generated THz waveform can be controlled by varying the filament length and the CEP of driving laser pulses. Calculations using the photocurrent model and including the propagation effects well reproduce the experimental results, and the origins of various phase shifts in the filament are elucidated.

physics.optics↗