Daily Papers

A mobile ad hoc network (MANET) is a collection of autonomous nodes that communicate with each other by forming a multi-hop radio network and maintaining connections in a decentralized manner. Security remains a major challenge for these networks due to their features of open medium, dynamically changing topologies, reliance on cooperative algorithms, absence of centralized monitoring points, and lack of clear lines of defense. Protecting the network layer of a MANET from malicious attacks is an important and challenging security issue, since most of the routing protocols for MANETs are vulnerable to various types of attacks. Ad hoc on-demand distance vector routing (AODV) is a very popular routing algorithm. However, it is vulnerable to the well-known black hole attack, where a malicious node falsely advertises good paths to a destination node during the route discovery process but drops all packets in the data forwarding phase. This attack becomes more severe when a group of malicious nodes cooperate each other. The proposed mechanism does not apply any cryptographic primitives on the routing messages. Instead, it protects the network by detecting and reacting to malicious activities of the nodes. Simulation results show that the scheme has a significantly high detection rate with moderate network traffic overhead and computation overhead in the nodes.

A mobile ad hoc network (MANET) is a collection of autonomous nodes that communicate with each other by forming a multi-hop radio network and maintaining connections in a decentralized manner. Security remains a major challenge for these networks due to their features of open medium, dynamically changing topologies, reliance on cooperative algorithms,absence of centralized monitoring points, and lack of clear lines of defense. Most of the routing protocols for MANETs are thus vulnerable to various types of attacks. Ad hoc on-demand distance vector routing (AODV) is a very popular routing algorithm. However, it is vulnerable to the well-known black hole attack, where a malicious node falsely advertises good paths to a destination node during the route discovery process. This attack becomes more sever when a group of malicious nodes cooperate each other. In this paper, a defense mechanism is presented against a coordinated attack by multiple black hole nodes in a MANET. The simulation carried out on the proposed scheme has produced results that demonstrate the effectiveness of the mechanism in detection of the attack while maintaining a reasonable level of throughput in the network.

Understanding the loss landscape is an important problem in machine learning. One key feature of the loss function, common to many neural network architectures, is the presence of exponentially many low lying local minima. Physical systems with similar energy landscapes may provide useful insights. In this work, we point out that black holes naturally give rise to such landscapes, owing to the existence of black hole entropy. For definiteness, we consider 1/8 BPS black holes in N = 8 string theory. These provide an infinite family of potential landscapes arising in the microscopic descriptions of corresponding black holes. The counting of minima amounts to black hole microstate counting. Moreover, the exact numbers of the minima for these landscapes are a priori known from dualities in string theory. Some of the minima are connected by paths of low loss values, resembling mode connectivity. We estimate the number of runs needed to find all the solutions. Initial explorations suggest that Stochastic Gradient Descent can find a significant fraction of the minima.

We introduce and describe tt GrayHawk, a publicly available Mathematica-based tool designed for the efficient computation of gray-body factors for spherically symmetric and asymptotically flat black holes. This program provides users with a rapid and reliable means to compute gray-body factors for massless fields with spin \(s = 0, 1/2, 1, 2\) in modes specified by the angular quantum number \(l\), given a black hole metric and the associated parameter values. tt GrayHawk is preloaded with seven different black hole metrics, offering immediate applicability to a variety of theoretical models. Additionally, its modular structure allows users to extend its functionality easily by incorporating alternative metrics or configurations. This versatility makes tt GrayHawk a powerful and adaptable resource for researchers studying black hole physics and Hawking radiation. The codes described in this work are publicly available at https://github.com/marcocalza89/GrayHawk.

Binary black holes are one of the important sources for the TianQin gravitational wave project. Our research has revealed that, for TianQin, the signal-to-noise ratio of inspiral binary black holes can be computed analytically. This finding is expected to greatly simplify the estimation of detection capabilities for binary black holes. In this paper, we demonstrated the signal-to-noise ratio relationships from stellar-mass black holes to massive black holes. With the all-sky average condition, the signal-to-noise ratio for most binary black hole signals can be determined with a relative error of lesssim10%, with notable deviations only for chirp masses near 1000~M_odot. In contrast, the signal-to-noise ratio without the average includes an additional term, which we refer to as the response factor. Although this term is not easily calculated analytically, we provide a straightforward estimation method with an error margin of 1sigma within 2\%.

JWST has detected many overmassive galactic systems at z > 4, where the mass of the black hole, M_bullet, is 10-100 times larger than expected from local relations, given the host's stellar mass, M_star. This Letter presents a model to describe these overmassive systems in the high-z Universe. We suggest that the black hole mass is the main driver of high-z star formation quenching. SMBHs globally impact their high-z galaxies because their hosts are physically small, and the black holes have duty cycles close to unity at z > 4. In this regime, we assume that black hole mass growth is regulated by the quasar's output, while stellar mass growth is quenched by it and uncorrelated to the global properties of the host halo. We find that the ratio M_bullet/M_star controls the average star formation efficiency: if M_bullet/M_star > 8times 10^{18} (n Lambda/f_{edd})[(Omega_b M_h)/(Omega_m M_star) - 1], then the galaxy is unable to form stars efficiently. Once this ratio exceeds the threshold, a runaway process brings the originally overmassive system towards the local M_bullet - M_star relation. Furthermore, the M_bullet - M_star relation evolves with redshift as propto (1+z)^{5/2}. At z sim 5, we find an overmassive factor of sim 55, in excellent agreement with current JWST data and the high-z relation inferred from those. Extending the black hole horizon farther in redshift and lower in mass will test this model and improve our understanding of the early co-evolution of black holes and galaxies.

This review provides an observational perspective on the fundamental properties of super-Eddington accretion onto supermassive black holes in quasars. It begins by outlining the selection criteria, particularly focusing on optical and UV broad-line intensity ratios, used to identify a population of unobscured super-Eddington candidates. Several defining features place these candidates at the extreme end of the Population A in main sequence of quasars: among them are the highest observed singly-ionized iron emission, extreme outflow velocities in UV resonance lines, and unusually high metal abundances. These key properties reflect the coexistence of a virialized sub-system within the broad-line region alongside powerful outflows, with the observed gas enrichment likely driven by nuclear or circumnuclear star formation. The most compelling evidence for the occurrence of super-Eddington accretion onto supermassive black holes comes from recent observations of massive black holes at early cosmic epochs. These black holes require rapid growth rates that are only achievable through radiatively inefficient super-Eddington accretion. Furthermore, extreme Eddington ratios, close to or slightly exceeding unity, are consistent with the saturation of radiative output per unit mass predicted by accretion disk theory for super-Eddington accretion rates. The extreme properties of super-Eddington candidates suggest that these quasars could make them stable and well-defined cosmological distance indicators, leveraging the correlation between broad-line width and luminosity expected in virialized systems. Finally, several analogies with accretion processes around stellar-mass black holes, particularly in the high/soft state, are explored to provide additional insight into the mechanisms driving super-Eddington accretion.

In this paper, we aim to examine the electric Penrose process (PP) around a charged black hole in 4D Einstein-Gauss-Bonnet (EGB) gravity and bring out the effect of the Gauss-Bonnet (GB) coupling parameter alpha and black hole charge on the efficiency of the energy extraction from the black hole. This research is motivated by the fact that electrostatic interactions significantly influence the behavior of charged particles in the vicinity of a charged static black hole. Under this interaction, decaying charged particles can have negative energies, causing energy to be released from black holes with no ergosphere. We show that the GB coupling parameter has a significant impact on the energy efficiency of the electric PP, but the efficiency can be strongly enhanced by the black hole charge due to the Coulomb force. Finally, we consider the accretion disk around the black hole and investigate in detail its radiation properties, such as the electromagnetic radiation flux, the temperature, and the differential luminosity. We show that the GB coupling parameter can have a significant impact on the radiation parameters, causing them to increase in the accretion disk in the vicinity of the black hole. Interestingly, it is found that the 4D EGB charged black hole is more efficient and favorable for the accretion disk radiation compared to a charged black hole in Einstein gravity.

On the basis of a large collection of detailed 3D core-collapse supernova simulations carried to late times, we identify four channels of stellar mass black hole formation. Our examples for Channel 1 involve the formation of lower-gap and above black holes in energetic asymmetric supernova explosions. Our Channel 2 example involves a modest supernova explosion that may leave behind a lower-gap to sim10 M_{odot} black hole. The latter may not be easily distinguishable from ``standard" supernovae that birth neutron stars. Our Channel 3 example experiences an aborted core-collapse explosion, more often in the context of a low-metallicity progenitor, whose residue is a black hole with a mass perhaps up to sim40 M_{odot}. The latter may be accompanied by a pulsational-pair instability supernova (PPISN). Channel 4 is the only quiescent or ``silent" scenario for which perhaps sim5 to 15 M_{odot} black holes are left. Where appropriate, we estimate ^{56}Ni yields, explosion energies, approximate recoil speeds, and residual black hole masses. The progenitor mass density and binding energy profiles at collapse influence the outcome in a systematic way. The statistics and prevalence of these various channels depend not only on still evolving supernova theory, but on remaining issues with the theory of massive star evolution, binary interaction, wind mass loss, metallicity, and the nuclear equation of state. Importantly, we suggest, but have not proven, that the silent channel for black hole formation may not be the dominant formation modality.

Formulating a quantum theory of gravity lies at the heart of fundamental theoretical physics. This collection of lecture notes encompasses a selection of topics that were covered in six mini-courses at the Nordita PhD school "Towards Quantum Gravity". The scope was to provide a coherent picture, from its foundation to forefront research, emphasizing connections between different areas. The lectures begin with perturbative quantum gravity and effective field theory. Subsequently, two ultraviolet-complete approaches are presented: asymptotically safe gravity and string theory. Finally, elements of quantum effects in black hole spacetimes are discussed.

Post-merger gravitational wave echoes provide a unique opportunity to probe the near-horizon structure of astrophysical black holes, that may be modified due to non-perturbative quantum gravity phenomena. However, since the waveform is subject to large theoretical uncertainties, it is necessary to develop model-agnostic search methods for detecting echoes from observational data. A promising strategy is to identify the characteristic quasinormal modes (QNMs) associated with echoes, {\it in frequency space}, which complements existing searches of quasiperiodic pulses in time. In this study, we build upon our previous work targeting these modes by incorporating relative phase information to optimize the Bayesian search algorithm. Using a new phase-marginalized likelihood, the performance can be significantly improved for well-resolved QNMs. This enables an efficient model-agnostic search for QNMs of different shapes by using a simple search template. To demonstrate the robustness of the search algorithm, we construct four complementary benchmarks for the echo waveform that span a diverse range of different theoretical possibilities for the near-horizon structure. We then validate our Bayesian search algorithms by injecting the benchmark models into different realizations of Gaussian noise. Using two types of phase-marginalized likelihoods, we find that the search algorithm can efficiently detect the corresponding QNMs. Therefore, our search strategy provides a concrete Bayesian and model-agnostic approach to "quantum black hole seismology".

Decision-based black-box attacks often necessitate a large number of queries to craft an adversarial example. Moreover, decision-based attacks based on querying boundary points in the estimated normal vector direction often suffer from inefficiency and convergence issues. In this paper, we propose a novel query-efficient curvature-aware geometric decision-based black-box attack (CGBA) that conducts boundary search along a semicircular path on a restricted 2D plane to ensure finding a boundary point successfully irrespective of the boundary curvature. While the proposed CGBA attack can work effectively for an arbitrary decision boundary, it is particularly efficient in exploiting the low curvature to craft high-quality adversarial examples, which is widely seen and experimentally verified in commonly used classifiers under non-targeted attacks. In contrast, the decision boundaries often exhibit higher curvature under targeted attacks. Thus, we develop a new query-efficient variant, CGBA-H, that is adapted for the targeted attack. In addition, we further design an algorithm to obtain a better initial boundary point at the expense of some extra queries, which considerably enhances the performance of the targeted attack. Extensive experiments are conducted to evaluate the performance of our proposed methods against some well-known classifiers on the ImageNet and CIFAR10 datasets, demonstrating the superiority of CGBA and CGBA-H over state-of-the-art non-targeted and targeted attacks, respectively. The source code is available at https://github.com/Farhamdur/CGBA.

Neural ranking models (NRMs) have shown remarkable success in recent years, especially with pre-trained language models. However, deep neural models are notorious for their vulnerability to adversarial examples. Adversarial attacks may become a new type of web spamming technique given our increased reliance on neural information retrieval models. Therefore, it is important to study potential adversarial attacks to identify vulnerabilities of NRMs before they are deployed. In this paper, we introduce the Word Substitution Ranking Attack (WSRA) task against NRMs, which aims to promote a target document in rankings by adding adversarial perturbations to its text. We focus on the decision-based black-box attack setting, where the attackers cannot directly get access to the model information, but can only query the target model to obtain the rank positions of the partial retrieved list. This attack setting is realistic in real-world search engines. We propose a novel Pseudo Relevance-based ADversarial ranking Attack method (PRADA) that learns a surrogate model based on Pseudo Relevance Feedback (PRF) to generate gradients for finding the adversarial perturbations. Experiments on two web search benchmark datasets show that PRADA can outperform existing attack strategies and successfully fool the NRM with small indiscernible perturbations of text.

We performed variability analysis of the multiwavelength light curves for the flat-spectrum radio quasar PKS 0727-11. Using the generalized Lomb-Scargle periodogram, we identified a possible quasi-periodic oscillation (QPO) of sim 168.6 days (persisted for 6 cycles, with a significance of 3.8sigma) in the gamma-ray light curve during the flare period (MJD 54687-55738). It is the first time that periodic variations have been detected in this source, and further supported by other methods: weighted wavelet z-transform, phase dispersion minimization, REDFIT, autoregressive integrated moving average model, and structure function analysis. Cross-correlation analysis shows that there is a strong correlation between multi-band light variations, indicating that gamma-ray and radio flares may originate from the same disturbance, and the distance between the emission regions of gamma-ray and radio flares is calculated based on the time lag. We demonstrate that QPO arising from the non-ballistic helical jet motion driven by the orbital motion in a supermassive binary black hole is a plausible physical explanation. In this scenario, the estimated mass of the primary black hole is Msim3.66times10^8-5.79times10^{9}M_odot.

The James Webb Space Telescope (JWST) has recently discovered a new population of objects at high redshift referred to as `Little Red Dots' (LRDs). Their nature currently remains elusive, despite their surprisingly high inferred number densities. This emerging population of red point-like sources is reshaping our view of the early Universe and may shed light on the formation of high-redshift supermassive black holes. Here we present a spectroscopically confirmed LRD CANUCS-LRD-z8.6 at z_{rm spec}=8.6319pm 0.0005 hosting an Active Galactic Nucleus (AGN), using JWST data. This source shows the typical spectral shape of an LRD (blue UV and red optical continuum, unresolved in JWST imaging), along with broad Hbeta line emission, detection of high-ionization emission lines (CIV, NIV]) and very high electron temperature indicative of the presence of AGN. This is also combined with a very low metallicity (Z<0.1 Z_odot). The presence of all these diverse features in one source makes CANUCS-LRD-z8.6 unique. We show that the inferred black hole mass of CANUCS-LRD-z8.6 (M_{rm BH}=1.0^{+0.6}_{-0.4}times 10^{8}rm ~M_odot) strongly challenges current standard theoretical models and simulations of black hole formation, and forces us to adopt `ad hoc' prescriptions. Indeed if massive seeds, or light seeds with super-Eddington accretion, are considered, the observed BH mass of CANUCS-LRD-z8.6 at z=8.6 can be reproduced. Moreover, the black hole is over-massive compared to its host, relative to the local M_{rm BH}-M_* relations, pointing towards an earlier and faster evolution of the black hole compared to its host galaxy.

In this study, we utilize the minimal geometric deformation technique of gravitational decoupling to extend the regular Bardeen black hole, leading to the derivation of new black hole solutions within the framework of Rastall theory. By decoupling the field equations associated with an extended matter source into two subsystems, we address the first subsystem using the metric components of the regular Bardeen black hole. The second subsystem, incorporating the effects of the additional source, is solved through a constraint imposed by a linear equation of state. By linearly combining the solutions of these subsystems, we obtain two extended models. We then explore the distinct physical properties of these models for specific values of the Rastall and decoupling parameters. Our investigations encompass effective thermodynamic variables such as density and anisotropic pressure, asymptotic flatness, energy conditions, and thermodynamic properties including Hawking temperature, entropy, and specific heat. The results reveal that both models violate asymptotic flatness of the resulting spacetimes. The violation of energy conditions indicate the presence of exotic matter, for both models. Nonetheless, the energy density, radial pressure, as well as the Hawking temperature exhibit acceptable behavior, while the specific heat and Hessian matrix suggest thermodynamic stability.

We study quantum corrections in the gravitational path integral around nearly 1/16-BPS black holes in asymptotically AdS_5 times S^5 space, dual to heavy states in 4D N=4 super Yang-Mills. The analysis provides a gravitational explanation of why 1/16-BPS black holes exhibit an exact degeneracy at large N and why all such states have the same charges, confirming the belief that the superconformal index precisely counts the entropy of extremal black holes. We show the presence of a gap of order N^{-2} between the 1/16-BPS black holes and the lightest near-BPS black holes within the same charge sector. This is the first example of such a gap for black holes states within the context of AdS_5 holography. We also derive the spectrum of near-BPS states that lie above this gap. Our computation relies on finding the correct version of the N=2 super-Schwarzian theory which captures the breaking of the SU(1, 1|1) symmetry when the black hole has finite temperature and non-zero chemical potential. Finally, we comment on possible stringy and non-perturbative corrections that can affect the black hole spectrum.

Neural ranking models (NRMs) have attracted considerable attention in information retrieval. Unfortunately, NRMs may inherit the adversarial vulnerabilities of general neural networks, which might be leveraged by black-hat search engine optimization practitioners. Recently, adversarial attacks against NRMs have been explored in the paired attack setting, generating an adversarial perturbation to a target document for a specific query. In this paper, we focus on a more general type of perturbation and introduce the topic-oriented adversarial ranking attack task against NRMs, which aims to find an imperceptible perturbation that can promote a target document in ranking for a group of queries with the same topic. We define both static and dynamic settings for the task and focus on decision-based black-box attacks. We propose a novel framework to improve topic-oriented attack performance based on a surrogate ranking model. The attack problem is formalized as a Markov decision process (MDP) and addressed using reinforcement learning. Specifically, a topic-oriented reward function guides the policy to find a successful adversarial example that can be promoted in rankings to as many queries as possible in a group. Experimental results demonstrate that the proposed framework can significantly outperform existing attack strategies, and we conclude by re-iterating that there exist potential risks for applying NRMs in the real world.

Recent work has shown it is possible to construct adversarial examples that cause an aligned language model to emit harmful strings or perform harmful behavior. Existing attacks work either in the white-box setting (with full access to the model weights), or through transferability: the phenomenon that adversarial examples crafted on one model often remain effective on other models. We improve on prior work with a query-based attack that leverages API access to a remote language model to construct adversarial examples that cause the model to emit harmful strings with (much) higher probability than with transfer-only attacks. We validate our attack on GPT-3.5 and OpenAI's safety classifier; we can cause GPT-3.5 to emit harmful strings that current transfer attacks fail at, and we can evade the safety classifier with nearly 100% probability.

With the aim of testing massive gravity in the context of black hole physics, we investigate the gravitational radiation emitted by a massive particle plunging into a Schwarzschild black hole from slightly below the innermost stable circular orbit. To do so, we first construct the quasinormal and quasibound resonance spectra of the spin-2 massive field for odd and even parity. Then, we compute the waveforms produced by the plunging particle and study their spectral content. This allows us to highlight and interpret important phenomena in the plunge regime, including (i) the excitation of quasibound states, with particular emphasis on the amplification and slow decay of the post-ringdown phase of the even-parity dipolar mode due to harmonic resonance; (ii) during the adiabatic phase, the waveform emitted by the plunging particle is very well described by the waveform emitted by the particle living on the innermost stable circular orbit, and (iii) the regularized waveforms and their unregularized counterparts constructed from the quasinormal mode spectrum are in excellent agreement. Finally, we construct, for arbitrary directions of observation and, in particular, outside the orbital plane of the plunging particle, the regularized multipolar waveforms, i.e., the waveforms constructed by summing over partial waveforms.

Decision-based evasion attacks repeatedly query a black-box classifier to generate adversarial examples. Prior work measures the cost of such attacks by the total number of queries made to the classifier. We argue this metric is flawed. Most security-critical machine learning systems aim to weed out "bad" data (e.g., malware, harmful content, etc). Queries to such systems carry a fundamentally asymmetric cost: queries detected as "bad" come at a higher cost because they trigger additional security filters, e.g., usage throttling or account suspension. Yet, we find that existing decision-based attacks issue a large number of "bad" queries, which likely renders them ineffective against security-critical systems. We then design new attacks that reduce the number of bad queries by 1.5-7.3times, but often at a significant increase in total (non-bad) queries. We thus pose it as an open problem to build black-box attacks that are more effective under realistic cost metrics.

In this letter, we report the discovery of the highest redshift, heavily obscured, radio-loud QSO candidate selected using JWST NIRCam/MIRI, mid-IR, sub-mm, and radio imaging in the COSMOS-Web field. Using multi-frequency radio observations and mid-IR photometry, we identify a powerful, radio-loud (RL), growing supermassive black hole (SMBH) with significant spectral steepening of the radio SED (f_{1.32 GHz} sim 2 mJy, q_{24mu m} = -1.1, alpha_{1.32-3GHz}=-1.2, Delta alpha = -0.4). In conjunction with ALMA, deep ground-based observations, ancillary space-based data, and the unprecedented resolution and sensitivity of JWST, we find no evidence of QSO contribution to the UV/optical/NIR data and thus infer heavy amounts of obscuration (N_{H} > 10^{23} cm^{-2}). Using the wealth of deep UV to sub-mm photometric data, we report a singular solution photo-z of z_phot = 7.65^{+0.4}_{-0.3} and estimate an extremely massive host-galaxy (log M_{star} = 11.92 pm 0.06,M_{odot}). This source represents the furthest known obscured RL QSO candidate, and its level of obscuration aligns with the most representative but observationally scarce population of QSOs at these epochs.

Gravitational waves (GWs) are lensed by matter, offering a unique probe of both the large-scale structure of the Universe and the fundamental properties of GW propagation. GWs can also be affected by wave optics effects when their wavelength is comparable to the size of the lens. While this regime has been well studied in the Newtonian approximation, the role of strong gravitational fields remains largely unexplored. This is particularly relevant for lensing by intermediate and supermassive black holes (BHs), which can occur near active galactic nuclei or in compact triple systems. In this work, we analyze the lensing of GWs by a non-rotating BH and compare our results to the Newtonian point-mass approximation. We construct frequency-dependent amplification factors that incorporate strong-field effects, revealing explicit polarization mixing and absorption by the event horizon. Using a fiducial GW event, we explore key phenomenological signatures of BH lensing, highlighting new observational opportunities to probe strong gravitational fields through GW lensing.

Recently, autonomous agents built on large language models (LLMs) have experienced significant development and are being deployed in real-world applications. These agents can extend the base LLM's capabilities in multiple ways. For example, a well-built agent using GPT-3.5-Turbo as its core can outperform the more advanced GPT-4 model by leveraging external components. More importantly, the usage of tools enables these systems to perform actions in the real world, moving from merely generating text to actively interacting with their environment. Given the agents' practical applications and their ability to execute consequential actions, it is crucial to assess potential vulnerabilities. Such autonomous systems can cause more severe damage than a standalone language model if compromised. While some existing research has explored harmful actions by LLM agents, our study approaches the vulnerability from a different perspective. We introduce a new type of attack that causes malfunctions by misleading the agent into executing repetitive or irrelevant actions. We conduct comprehensive evaluations using various attack methods, surfaces, and properties to pinpoint areas of susceptibility. Our experiments reveal that these attacks can induce failure rates exceeding 80\% in multiple scenarios. Through attacks on implemented and deployable agents in multi-agent scenarios, we accentuate the realistic risks associated with these vulnerabilities. To mitigate such attacks, we propose self-examination detection methods. However, our findings indicate these attacks are difficult to detect effectively using LLMs alone, highlighting the substantial risks associated with this vulnerability.

Magnetohydrodynamic turbulence drives the central engine of post-merger remnants, potentially powering both a nucleosynthetically active disk wind and the relativistic jet behind a short gamma ray burst. We explore the impact of the magnetic field on this engine by simulating three post-merger black hole accretion disks using general relativistic magnetohydrodynamics with Monte Carlo neutrino transport, in each case varying the initial magnetic field strength. We find increasing ejecta masses associated with increasing magnetic field strength. We find that a fairly robust main r -process pattern is produced in all three cases, scaled by the ejected mass. Changing the initial magnetic field strength has a considerable effect on the geometry of the outflow and hints at complex central engine dynamics influencing lanthanide outflows. We find that actinide production is especially sensitive to magnetic field strength, with overall actinide mass fraction calculated at 1 Gyr post-merger increasing by more than a factor of six with a tenfold increase in magnetic field strength. This hints at a possible connection to the variability in actinide enhancements exhibited by metal poor, r -process-enhanced stars.

Components of cyber physical systems, which affect real-world processes, are often exposed to the internet. Replacing conventional control methods with Deep Reinforcement Learning (DRL) in energy systems is an active area of research, as these systems become increasingly complex with the advent of renewable energy sources and the desire to improve their efficiency. Artificial Neural Networks (ANN) are vulnerable to specific perturbations of their inputs or features, called adversarial examples. These perturbations are difficult to detect when properly regularized, but have significant effects on the ANN's output. Because DRL uses ANN to map optimal actions to observations, they are similarly vulnerable to adversarial examples. This work proposes a novel attack technique for continuous control using Group Difference Logits loss with a bifurcation layer. By combining aspects of targeted and untargeted attacks, the attack significantly increases the impact compared to an untargeted attack, with drastically smaller distortions than an optimally targeted attack. We demonstrate the impacts of powerful gradient-based attacks in a realistic smart energy environment, show how the impacts change with different DRL agents and training procedures, and use statistical and time-series analysis to evaluate attacks' stealth. The results show that adversarial attacks can have significant impacts on DRL controllers, and constraining an attack's perturbations makes it difficult to detect. However, certain DRL architectures are far more robust, and robust training methods can further reduce the impact.

Gravitational waves from asymmetric mass-ratio black-hole binaries carry unique information about their astrophysical environment. For instance, the Laser Interferometer Space Antenna (LISA) could potentially measure the amplitude and slope of gas torques in binaries embedded in the accretion disks of Active Galactic Nuclei, helping differentiate competing accretion disk models. However, this relies on simplified analytic models, which do not account for the stochastic variability of torques seen in hydrodynamic simulations. In this work, we use hydrodynamic simulations to create gravitational waveforms for extreme and intermediate mass-ratio inspirals in the LISA band. We then analyze these simulated waveforms using simpler templates that assume analytic torques, without stochastic time variability. By performing realistic Bayesian parameter estimation, we find no bias at 90% confidence in the binary parameters; however, estimates of accretion disk parameters, such as torque amplitude and slope, may be biased. Typically, the posterior distribution is centered around the average value of the torques, but when stochastic variability is large, the posterior can indicate no torques, even though they are present in the simulation. Our results suggest that while simplified analytic torque models work well for estimating binary parameters, caution is needed when using them to infer properties of the accretion disk. This work moves towards a more realistic assessment of one of the LISA science objectives, i.e., probing the properties of the astrophysical environments of black holes.

Non-trivial gravitational saddles have played a key role in the island proposal for the black hole information paradox. It is worth asking if non-trivial saddles exist in microscopic descriptions of black holes. We show this to be the case for 1/8 BPS black holes in N = 8 String Theory in a duality frame, where all charges are Ramond Ramond. The saddles are in the Coulomb branch, where they describe marginally stable bound states of the constituent branes, and correspond to vacua of the BFSS model. The non-perturbative suppression scale is determined by the binding energy.

We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples for deep learning models solely based on information limited to output label~(hard label) to a queried data input. We propose a simple and efficient Bayesian Optimization~(BO) based approach for developing black-box adversarial attacks. Issues with BO's performance in high dimensions are avoided by searching for adversarial examples in a structured low-dimensional subspace. We demonstrate the efficacy of our proposed attack method by evaluating both ell_infty and ell_2 norm constrained untargeted and targeted hard label black-box attacks on three standard datasets - MNIST, CIFAR-10 and ImageNet. Our proposed approach consistently achieves 2x to 10x higher attack success rate while requiring 10x to 20x fewer queries compared to the current state-of-the-art black-box adversarial attacks.

This paper introduces a new method for adversarial attacks on large language models (LLMs) called the Single-Turn Crescendo Attack (STCA). Building on the multi-turn crescendo attack method introduced by Russinovich, Salem, and Eldan (2024), which gradually escalates the context to provoke harmful responses, the STCA achieves similar outcomes in a single interaction. By condensing the escalation into a single, well-crafted prompt, the STCA bypasses typical moderation filters that LLMs use to prevent inappropriate outputs. This technique reveals vulnerabilities in current LLMs and emphasizes the importance of stronger safeguards in responsible AI (RAI). The STCA offers a novel method that has not been previously explored.

Deep learning models are susceptible to adversarial samples in white and black-box environments. Although previous studies have shown high attack success rates, coupling DNN models with interpretation models could offer a sense of security when a human expert is involved, who can identify whether a given sample is benign or malicious. However, in white-box environments, interpretable deep learning systems (IDLSes) have been shown to be vulnerable to malicious manipulations. In black-box settings, as access to the components of IDLSes is limited, it becomes more challenging for the adversary to fool the system. In this work, we propose a Query-efficient Score-based black-box attack against IDLSes, QuScore, which requires no knowledge of the target model and its coupled interpretation model. QuScore is based on transfer-based and score-based methods by employing an effective microbial genetic algorithm. Our method is designed to reduce the number of queries necessary to carry out successful attacks, resulting in a more efficient process. By continuously refining the adversarial samples created based on feedback scores from the IDLS, our approach effectively navigates the search space to identify perturbations that can fool the system. We evaluate the attack's effectiveness on four CNN models (Inception, ResNet, VGG, DenseNet) and two interpretation models (CAM, Grad), using both ImageNet and CIFAR datasets. Our results show that the proposed approach is query-efficient with a high attack success rate that can reach between 95% and 100% and transferability with an average success rate of 69% in the ImageNet and CIFAR datasets. Our attack method generates adversarial examples with attribution maps that resemble benign samples. We have also demonstrated that our attack is resilient against various preprocessing defense techniques and can easily be transferred to different DNN models.

Pre-trained models of code have achieved success in many important software engineering tasks. However, these powerful models are vulnerable to adversarial attacks that slightly perturb model inputs to make a victim model produce wrong outputs. Current works mainly attack models of code with examples that preserve operational program semantics but ignore a fundamental requirement for adversarial example generation: perturbations should be natural to human judges, which we refer to as naturalness requirement. In this paper, we propose ALERT (nAturaLnEss AwaRe ATtack), a black-box attack that adversarially transforms inputs to make victim models produce wrong outputs. Different from prior works, this paper considers the natural semantic of generated examples at the same time as preserving the operational semantic of original inputs. Our user study demonstrates that human developers consistently consider that adversarial examples generated by ALERT are more natural than those generated by the state-of-the-art work by Zhang et al. that ignores the naturalness requirement. On attacking CodeBERT, our approach can achieve attack success rates of 53.62%, 27.79%, and 35.78% across three downstream tasks: vulnerability prediction, clone detection and code authorship attribution. On GraphCodeBERT, our approach can achieve average success rates of 76.95%, 7.96% and 61.47% on the three tasks. The above outperforms the baseline by 14.07% and 18.56% on the two pre-trained models on average. Finally, we investigated the value of the generated adversarial examples to harden victim models through an adversarial fine-tuning procedure and demonstrated the accuracy of CodeBERT and GraphCodeBERT against ALERT-generated adversarial examples increased by 87.59% and 92.32%, respectively.

Decision-based adversarial attacks construct inputs that fool a machine-learning model into making targeted mispredictions by making only hard-label queries. For the most part, these attacks have been applied directly to isolated neural network models. However, in practice, machine learning models are just a component of a much larger system. By adding just a single preprocessor in front of a classifier, we find that state-of-the-art query-based attacks are as much as seven times less effective at attacking a prediction pipeline than attacking the machine learning model alone. Hence, attacks that are unaware of this invariance inevitably waste a large number of queries to re-discover or overcome it. We, therefore, develop techniques to first reverse-engineer the preprocessor and then use this extracted information to attack the end-to-end system. Our extraction method requires only a few hundred queries to learn the preprocessors used by most publicly available model pipelines, and our preprocessor-aware attacks recover the same efficacy as just attacking the model alone. The code can be found at https://github.com/google-research/preprocessor-aware-black-box-attack.

Compact binary millisecond pulsars (MSPs) with orbital periods lesssim1d are key to understanding binary evolution involving massive neutron stars (NSs). Due to the ablation of the companion by the rapidly spinning pulsar, these systems are also known as spiders and categorized into two main branches: redbacks (RBs; companion mass in the range of 0.1 to 0.5\,\Msun) and black widows (BWs; companion mass lesssim\,0.1\,\Msun). We present models of low- and intermediate-mass X-ray binaries and compare them with observations of Galactic spiders (including the presence or absence of hydrogen lines in their optical spectra), and we constrain and quantify the interaction between the pulsar and the companion. Using MESA, we created the allowed initial parameter space. For the first time in MESA, we also included the detailed evolution of the pulsar spin and modeled the irradiation of the companion by the pulsar wind. Efficient mass accretion onto the NS (at least 70% of the mass transferred is accreted) with an X-ray irradiated disk followed by strong irradiation of the companion can explain most of the properties of the observed spiders. Our RB evolutionary tracks continue to the BW regime, connecting the two branches of spiders. Our models explain the lack of hydrogen in some observed BWs with ultra-light companions. During accretion induced spin up, the mass required to spin up an NS to sub-milliseconds is high enough to collapse it into a black hole. Finally, after analyzing the formation of RB-like spiders with giant companions and orbital periods of several days (huntsmen), we conclude that they are unlikely to produce super-massive NSs (maximum accreted mass lesssim0.5M_{odot}). Cannibalistic MSP binary formation depends heavily on the interplay between accretion onto the pulsar and pulsar wind irradiation.

Active Galactic Nuclei (AGN) are some of the most luminous and extreme environments in the Universe. The central engines of AGN, believed to be super-massive black-holes, are fed by accretion discs threaded by magnetic fields within a dense magneto-ionic medium. We report our findings from polarimetric Very-long-baseline Interferometry (VLBI) observations of quasar NRAO150 taken in October 2022 using a combined network of the Very Long Baseline Array (VLBA) and Effelsberg 100-m Radio Telescope. These observations are the first co-temporal multi-frequency polarimetric VLBI observations of NRAO150 at frequencies above 15GHz. We use the new VLBI polarization calibration procedure, GPCAL, with polarization observations of frequencies of 12GHz, 15GHz, 24GHz, and 43GHz of NRAO150. From these observations, we measure Faraday rotation. Using our measurement of Faraday rotation, we also derive the intrinsic electric vector position angle (EVPA0) for the source. As a complementary measurement we determine the behavior of polarization as a function of observed frequency. The polarization from NRAO150 only comes from the core region, with a peak polarization intensity occurring at 24GHz. Across the core region of NRAO150 we see clear gradients in Faraday rotation and EVPA0 values that are aligned with the direction of the jet curving around the core region. We find that for the majority of the polarized region the polarization fraction is greater at higher frequencies, with intrinsic polarization fractions in the core 3%. The Faraday rotation gradients and circular patterns in EVPA0 are strong evidence for a helical/toroidal magnetic field, and the presence of low intrinsic polarization fractions indicate that the polarized emission and hence the helical/toroidal magnetic field, occur within the innermost jet.

We investigate thermodynamics of static and spherically symmetric black holes (BHs) in the Horndeski theories. Because of the presence of the higher-derivative interactions and the nonminimal derivative couplings of the scalar field, the standard Wald entropy formula may not be directly applicable. Hence, following the original formulation by Iyer and Wald, we obtain the differentials of the BH entropy and the total mass of the system in the Horndeski theories, which lead to the first-law of thermodynamics via the conservation of the Hamiltonian. Our formulation covers the case of the static and spherically symmetric BH solutions with the static scalar field and those with the linearly time-dependent scalar field in the shift-symmetric Horndeski theories. We then apply our results to explicit BH solutions in the Horndeski theories. In the case of the conventional scalar-tensor theories and the Einstein-scalar-Gauss-Bonnet theories, we recover the BH entropy obtained by the Wald entropy formula. In the shift-symmetric theories, in the case of the BH solutions with the static scalar field we show that the BH entropy follows the ordinary area law even in the presence of the nontrivial profile of the scalar field. On the other hand, in the case of the BH solutions where the scalar field linearly depends on time, i.e., the stealth Schwarzschild and Schwarzschild-(anti-) de Sitter solutions, the BH entropy also depends on the profile of the scalar field. By use of the entropy, we find that there exists some range of the parameters in which Schwarzschild-(AdS) BH with non-trivial scalar field is thermodynamically stable than Schwarzschild-(AdS) BH without scalar field in general relativity.

The illumination of the accretion disks is frequently studied assuming that the incident X-ray flux is a point-like source. The approach is referred as lamppost model.The most recent computations of the X-ray reprocessing by the disk take into account the departure from the simple lamppost models. However, in computations of the incident flux thermalization and subsequent re-emission in the optical-UV band the lamppost approximation is most frequently assumed. We test if the UV-optical reverberation mapping and time delay measurements are sensitive to this assumption. We assume that the incident radiation originates from a region extended along the symmetry axis. To model this, we adopt a simple setup by representing the emission as two lamps irradiating the disk simultaneously from two different heights. We then compare the resulting predictions with those obtained for a single lamppost located at an intermediate height. We show at the basis of the transfer function that the deviation of the wavelength-dependent delay curve shows at most a difference of 20% in comparison to a single lamppost, assuming the black hole mass of 10^8 M_{odot}, Eddington ratio 1, and the location of the lamps at 5 and 100 rg. The maximum deviation happens for the lamp luminosity ratio sim3. When simulating light curves for a two-lamp setup and a standard lamppost with the same black hole mass and a sampling rate of 0.1 days, we find no measurable differences in the ICCF profiles between the two setups. Larger black hole mass and considerably lower Eddington ratio would allow to see larger differences between a single lamppost and a two-lampost model. UV/optical reverberation mapping is not very sensitive to the vertical extension of the corona.

Extreme-mass-ratio inspirals (EMRIs) and intermediate-mass-ratio inspirals (IMRIs) are important gravitational wave (GW) sources for the Laser Interferometer Space Antenna (LISA). It has been recently suggested that EMRIs and IMRIs can both form in the accretion disk of an active galactic nucleus (AGN). Considering the likely encounter between a sBH and an IMBH during the migration in the AGN disk, Paper I showed that a gap-opening IMBH can drive a surrounding sBH to migrate synchronously. In this work, we extend the study in Paper I with a more sophisticated model. We first use 3D hydrodynamical simulations to study the co-evolution of the disk and the migration of a sBH in the vicinity of an IMBH. We find that the gaseous torque, together with the tidal torque exerted by the IMBH, can drive synchronized migration until sim 10 Schwarzschild radii from the central supermassive black hole (SMBH). We further use a relativistic three-body code to study the final fate of the sBH in the GW-dominated regime. We find that the sBH can be either captured or kicked out by the IMBH, which will result in either two subsequent IMRIs or an EMRI followed by an IMRI. These events will bring rich information about the formation and evolution of sBHs and IMBHs in AGNs.

Recent research has highlighted the vulnerability of Deep Neural Networks (DNNs) against data poisoning attacks. These attacks aim to inject poisoning samples into the models' training dataset such that the trained models have inference failures. While previous studies have executed different types of attacks, one major challenge that greatly limits their effectiveness is the uncertainty of the re-training process after the injection of poisoning samples, including the re-training initialization or algorithms. To address this challenge, we propose a novel attack method called ''Sharpness-Aware Data Poisoning Attack (SAPA)''. In particular, it leverages the concept of DNNs' loss landscape sharpness to optimize the poisoning effect on the worst re-trained model. It helps enhance the preservation of the poisoning effect, regardless of the specific retraining procedure employed. Extensive experiments demonstrate that SAPA offers a general and principled strategy that significantly enhances various types of poisoning attacks.

Pre-trained programming language (PL) models (such as CodeT5, CodeBERT, GraphCodeBERT, etc.,) have the potential to automate software engineering tasks involving code understanding and code generation. However, these models operate in the natural channel of code, i.e., they are primarily concerned with the human understanding of the code. They are not robust to changes in the input and thus, are potentially susceptible to adversarial attacks in the natural channel. We propose, CodeAttack, a simple yet effective black-box attack model that uses code structure to generate effective, efficient, and imperceptible adversarial code samples and demonstrates the vulnerabilities of the state-of-the-art PL models to code-specific adversarial attacks. We evaluate the transferability of CodeAttack on several code-code (translation and repair) and code-NL (summarization) tasks across different programming languages. CodeAttack outperforms state-of-the-art adversarial NLP attack models to achieve the best overall drop in performance while being more efficient, imperceptible, consistent, and fluent. The code can be found at https://github.com/reddy-lab-code-research/CodeAttack.

A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model's training dataset. These attacks are currently evaluated using average-case "accuracy" metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., <0.1%) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is 10x more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.

Quantum computing promises to enhance machine learning and artificial intelligence. Different quantum algorithms have been proposed to improve a wide spectrum of machine learning tasks. Yet, recent theoretical works show that, similar to traditional classifiers based on deep classical neural networks, quantum classifiers would suffer from the vulnerability problem: adding tiny carefully-crafted perturbations to the legitimate original data samples would facilitate incorrect predictions at a notably high confidence level. This will pose serious problems for future quantum machine learning applications in safety and security-critical scenarios. Here, we report the first experimental demonstration of quantum adversarial learning with programmable superconducting qubits. We train quantum classifiers, which are built upon variational quantum circuits consisting of ten transmon qubits featuring average lifetimes of 150 mus, and average fidelities of simultaneous single- and two-qubit gates above 99.94% and 99.4% respectively, with both real-life images (e.g., medical magnetic resonance imaging scans) and quantum data. We demonstrate that these well-trained classifiers (with testing accuracy up to 99%) can be practically deceived by small adversarial perturbations, whereas an adversarial training process would significantly enhance their robustness to such perturbations. Our results reveal experimentally a crucial vulnerability aspect of quantum learning systems under adversarial scenarios and demonstrate an effective defense strategy against adversarial attacks, which provide a valuable guide for quantum artificial intelligence applications with both near-term and future quantum devices.