-
BioDiscoveryAgent: An AI Agent for Designing Genetic Perturbation Experiments
Authors:
Yusuf Roohani,
Jian Vora,
Qian Huang,
Zachary Steinhart,
Alexander Marson,
Percy Liang,
Jure Leskovec
Abstract:
Agents based on large language models have shown great potential in accelerating scientific discovery by leveraging their rich background knowledge and reasoning capabilities. Here, we develop BioDiscoveryAgent, an agent that designs new experiments, reasons about their outcomes, and efficiently navigates the hypothesis space to reach desired solutions. We demonstrate our agent on the problem of d…
▽ More
Agents based on large language models have shown great potential in accelerating scientific discovery by leveraging their rich background knowledge and reasoning capabilities. Here, we develop BioDiscoveryAgent, an agent that designs new experiments, reasons about their outcomes, and efficiently navigates the hypothesis space to reach desired solutions. We demonstrate our agent on the problem of designing genetic perturbation experiments, where the aim is to find a small subset out of many possible genes that, when perturbed, result in a specific phenotype (e.g., cell growth). Utilizing its biological knowledge, BioDiscoveryAgent can uniquely design new experiments without the need to train a machine learning model or explicitly design an acquisition function. Moreover, BioDiscoveryAgent achieves an average of 18% improvement in detecting desired phenotypes across five datasets, compared to existing Bayesian optimization baselines specifically trained for this task. Our evaluation includes one dataset that is unpublished, ensuring it is not part of the language model's training data. Additionally, BioDiscoveryAgent predicts gene combinations to perturb twice as accurately as a random baseline, a task so far not explored in the context of closed-loop experiment design. The agent also has access to tools for searching the biomedical literature, executing code to analyze biological datasets, and prompting another agent to critically evaluate its predictions. Overall, BioDiscoveryAgent is interpretable at every stage, representing an accessible new paradigm in the computational design of biological experiments with the potential to augment scientists' capabilities.
△ Less
Submitted 27 May, 2024;
originally announced May 2024.
-
An informal account of recent results on initial-boundary value problems for systems of conservation laws
Authors:
Laura V. Spinolo,
Fabio Ancona,
Andrea Marson
Abstract:
This note aims at providing a rather informal and hopefully accessible overview of the fairly long and technical work [4]. In that paper, the authors established new global-in-time existence results for admissible solutions of nonlinear systems of conservation laws defined in domains with boundaries. The main novelty in [4] is that the solution is constructed by taking into account the underlying…
▽ More
This note aims at providing a rather informal and hopefully accessible overview of the fairly long and technical work [4]. In that paper, the authors established new global-in-time existence results for admissible solutions of nonlinear systems of conservation laws defined in domains with boundaries. The main novelty in [4] is that the solution is constructed by taking into account the underlying viscous mechanism, which is relevant because, in the case of initial-boundary value problems, different viscous approximations yield in general different limits. This note will frame the analysis of [4] in the relevant context, compare the main result with the previous existing literature, and touch upon the most innnovative technical points of the proof.
△ Less
Submitted 3 May, 2024;
originally announced May 2024.
-
Existence of vanishing physical viscosity solutions of characteristic initial-boundary value problems for systems of conservation laws
Authors:
Fabio Ancona,
Andrea Marson,
Laura V. Spinolo
Abstract:
We consider initial boundary-value problems for nonlinear systems of conservation laws in one space variable. It is known that in general different viscous mechanisms yield different solutions in the zero-viscosity limit. Here we focus on the most technically demanding case, known as boundary characteristic case, which occurs when one of the characteristic velocities of the system vanishes. We wor…
▽ More
We consider initial boundary-value problems for nonlinear systems of conservation laws in one space variable. It is known that in general different viscous mechanisms yield different solutions in the zero-viscosity limit. Here we focus on the most technically demanding case, known as boundary characteristic case, which occurs when one of the characteristic velocities of the system vanishes. We work in small total variation regimes and assume that every characteristic field is either genuinely nonlinear or linearly degenerate. We establish existence of admissible solutions satisfying a boundary condition consistent with the vanishing viscosity approximation given by a large class of physical (that is, mixed hyperbolic-parabolic) systems. In particular, our results apply to the zero-viscosity limit of the Navier-Stokes and viscous MHD equations, written in both Eulerian and Lagrangian coordinates. Our analysis relies on a fine boundary layers analysis and is based on the introduction of a new wave front-tracking algorithm. From the technical viewpoint, the most innovative elements are i) a new class of interaction estimates for boundary layers and boundary characteristic wave fronts hitting the boundary, which yields the introduction of a new Glimm-type functional; ii) a detailed analysis of the behavior of the wave front-tracking algorithm close to the boundary, which in turn yields relevant information on the limit.
△ Less
Submitted 26 January, 2024;
originally announced January 2024.
-
Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
Authors:
Pascal Zimmer,
Sébastien Andreina,
Giorgia Azzurra Marson,
Ghassan Karame
Abstract:
Although promising, existing defenses against query-based attacks share a common limitation: they offer increased robustness against attacks at the price of a considerable accuracy drop on clean samples. In this work, we show how to efficiently establish, at test-time, a solid tradeoff between robustness and accuracy when mitigating query-based attacks. Given that these attacks necessarily explore…
▽ More
Although promising, existing defenses against query-based attacks share a common limitation: they offer increased robustness against attacks at the price of a considerable accuracy drop on clean samples. In this work, we show how to efficiently establish, at test-time, a solid tradeoff between robustness and accuracy when mitigating query-based attacks. Given that these attacks necessarily explore low-confidence regions, our insight is that activating dedicated defenses, such as random noise defense and random image transformations, only for low-confidence inputs is sufficient to prevent them. Our approach is independent of training and supported by theory. We verify the effectiveness of our approach for various existing defenses by conducting extensive experiments on CIFAR-10, CIFAR-100, and ImageNet. Our results confirm that our proposal can indeed enhance these defenses by providing better tradeoffs between robustness and accuracy when compared to state-of-the-art approaches while being completely training-free.
△ Less
Submitted 21 March, 2024; v1 submitted 15 December, 2023;
originally announced December 2023.
-
LISA: LIghtweight single-server Secure Aggregation with a public source of randomness
Authors:
Elina van Kempen,
Qifei Li,
Giorgia Azzurra Marson,
Claudio Soriente
Abstract:
Secure Aggregation (SA) is a key component of privacy-friendly federated learning applications, where the server learns the sum of many user-supplied gradients, while individual gradients are kept private. State-of-the-art SA protocols protect individual inputs with zero-sum random shares that are distributed across users, have a per-user overhead that is logarithmic in the number of users, and ta…
▽ More
Secure Aggregation (SA) is a key component of privacy-friendly federated learning applications, where the server learns the sum of many user-supplied gradients, while individual gradients are kept private. State-of-the-art SA protocols protect individual inputs with zero-sum random shares that are distributed across users, have a per-user overhead that is logarithmic in the number of users, and take more than 5 rounds of interaction. In this paper, we introduce LISA, an SA protocol that leverages a source of public randomness to minimize per-user overhead and the number of rounds. In particular, LISA requires only two rounds and has a communication overhead that is asymptotically equal to that of a non-private protocol -- one where inputs are provided to the server in the clear -- for most of the users. In a nutshell, LISA uses public randomness to select a subset of the users -- a committee -- that aid the server to recover the aggregated input. Users blind their individual contributions with randomness shared with each of the committee members; each committee member provides the server with an aggregate of the randomness shared with each user. Hence, as long as one committee member is honest, the server cannot learn individual inputs but only the sum of threshold-many inputs. We compare LISA with state-of-the-art SA protocols both theoretically and by means of simulations and present results of our experiments. We also integrate LISA in a Federated Learning pipeline and compare its performance with a non-private protocol.
△ Less
Submitted 4 August, 2023;
originally announced August 2023.
-
Estimating Patch Propagation Times across (Blockchain) Forks
Authors:
Sebastien Andreina,
Lorenzo Alluminio,
Giorgia Azzurra Marson,
Ghassan Karame
Abstract:
The wide success of Bitcoin has led to a huge surge of alternative cryptocurrencies (altcoins). Most altcoins essentially fork Bitcoin's code with minor modifications, such as the number of coins to be minted, the block size, and the block generation time. As such, they are often deemed identical to Bitcoin in terms of security, robustness, and maturity.
In this paper, we show that this common c…
▽ More
The wide success of Bitcoin has led to a huge surge of alternative cryptocurrencies (altcoins). Most altcoins essentially fork Bitcoin's code with minor modifications, such as the number of coins to be minted, the block size, and the block generation time. As such, they are often deemed identical to Bitcoin in terms of security, robustness, and maturity.
In this paper, we show that this common conception is misleading. By mining data retrieved from the GitHub repositories of various altcoin projects, we estimate the time it took to propagate relevant patches from Bitcoin to the altcoins. We find that, while the Bitcoin development community is quite active in fixing security flaws of Bitcoin's code base, forked cryptocurrencies are not as rigorous in patching the same vulnerabilities (inherited from Bitcoin). In some cases, we observe that even critical vulnerabilities, discovered and fixed within the Bitcoin community, have been addressed by the altcoins tens of months after disclosure. Besides raising awareness of this problem, our work aims to motivate the need for a proper responsible disclosure of vulnerabilities to all forked chains prior to reporting them publicly.
△ Less
Submitted 9 February, 2023; v1 submitted 16 May, 2022;
originally announced May 2022.
-
MITOSIS: Practically Scaling Permissioned Blockchains
Authors:
Giorgia Azzurra Marson,
Sebastien Andreina,
Lorenzo Alluminio,
Konstantin Munichev,
Ghassan Karame
Abstract:
Scalability remains one of the biggest challenges to the adoption of permissioned blockchain technologies for large-scale deployments. Permissioned blockchains typically exhibit low latencies, compared to permissionless deployments -- however at the cost of poor scalability. Various solutions were proposed to capture "the best of both worlds", targeting low latency and high scalability simultaneou…
▽ More
Scalability remains one of the biggest challenges to the adoption of permissioned blockchain technologies for large-scale deployments. Permissioned blockchains typically exhibit low latencies, compared to permissionless deployments -- however at the cost of poor scalability. Various solutions were proposed to capture "the best of both worlds", targeting low latency and high scalability simultaneously, the most prominent technique being blockchain sharding. However, most existing sharding proposals exploit features of the permissionless model and are therefore restricted to cryptocurrency applications.
We present MITOSIS, a novel approach to practically improve scalability of permissioned blockchains. Our system allows the dynamic creation of blockchains, as more participants join the system, to meet practical scalability requirements. Crucially, it enables the division of an existing blockchain (and its participants) into two -- reminiscent of mitosis, the biological process of cell division. MITOSIS inherits the low latency of permissioned blockchains while preserving high throughput via parallel processing. Newly created chains in our system are fully autonomous, can choose their own consensus protocol, and yet they can interact with each other to share information and assets -- meeting high levels of interoperability. We analyse the security of MITOSIS and evaluate experimentally the performance of our solution when instantiated over Hyperledger Fabric. Our results show that MITOSIS can be ported with little modifications and manageable overhead to existing permissioned blockchains, such as Hyperledger Fabric.
△ Less
Submitted 21 September, 2021;
originally announced September 2021.
-
On the Synchronization Power of Token Smart Contracts
Authors:
Orestis Alpos,
Christian Cachin,
Giorgia Azzurra Marson,
Luca Zanolini
Abstract:
Modern blockchains support a variety of distributed applications beyond cryptocurrencies, including smart contracts -- which let users execute arbitrary code in a distributed and decentralized fashion. Regardless of their intended application, blockchain platforms implicitly assume consensus for the correct execution of a smart contract, thus requiring that all transactions are totally ordered. It…
▽ More
Modern blockchains support a variety of distributed applications beyond cryptocurrencies, including smart contracts -- which let users execute arbitrary code in a distributed and decentralized fashion. Regardless of their intended application, blockchain platforms implicitly assume consensus for the correct execution of a smart contract, thus requiring that all transactions are totally ordered. It was only recently recognized that consensus is not necessary to prevent double-spending in a cryptocurrency (Guerraoui et al., PODC'19), contrary to common belief. This result suggests that current implementations may be sacrificing efficiency and scalability because they synchronize transactions much more tightly than actually needed. In this work, we study the synchronization requirements of Ethereum's ERC20 token contract, one of the most widely adopted smart contacts. Namely, we model a smart-contract token as a concurrent object and analyze its consensus number as a measure of synchronization power. We show that the richer set of methods supported by ERC20 tokens, compared to standard cryptocurrencies, results in strictly stronger synchronization requirements. More surprisingly, the synchronization power of ERC20 tokens depends on the object's state and can thus be modified by method invocations. To prove this result, we develop a dedicated framework to express how the object's state affects the needed synchronization level. Our findings indicate that ERC20 tokens, as well as other token standards, are more powerful and versatile than plain cryptocurrencies, and are subject to dynamic requirements. Develo** specific synchronization protocols that exploit these dynamic requirements will pave the way towards more robust and scalable blockchain platforms.
△ Less
Submitted 14 January, 2021;
originally announced January 2021.
-
BaFFLe: Backdoor detection via Feedback-based Federated Learning
Authors:
Sebastien Andreina,
Giorgia Azzurra Marson,
Helen Möllering,
Ghassan Karame
Abstract:
Recent studies have shown that federated learning (FL) is vulnerable to poisoning attacks that inject a backdoor into the global model. These attacks are effective even when performed by a single client, and undetectable by most existing defensive techniques. In this paper, we propose Backdoor detection via Feedback-based Federated Learning (BAFFLE), a novel defense to secure FL against backdoor a…
▽ More
Recent studies have shown that federated learning (FL) is vulnerable to poisoning attacks that inject a backdoor into the global model. These attacks are effective even when performed by a single client, and undetectable by most existing defensive techniques. In this paper, we propose Backdoor detection via Feedback-based Federated Learning (BAFFLE), a novel defense to secure FL against backdoor attacks. The core idea behind BAFFLE is to leverage data of multiple clients not only for training but also for uncovering model poisoning. We exploit the availability of diverse datasets at the various clients by incorporating a feedback loop into the FL process, to integrate the views of those clients when deciding whether a given model update is genuine or not. We show that this powerful construct can achieve very high detection rates against state-of-the-art backdoor attacks, even when relying on straightforward methods to validate the model. Through empirical evaluation using the CIFAR-10 and FEMNIST datasets, we show that by combining the feedback loop with a method that suspects poisoning attempts by assessing the per-class classification performance of the updated model, BAFFLE reliably detects state-of-the-art backdoor attacks with a detection accuracy of 100% and a false-positive rate below 5%. Moreover, we show that our solution can detect adaptive attacks aimed at bypassing the defense.
△ Less
Submitted 18 April, 2021; v1 submitted 4 November, 2020;
originally announced November 2020.
-
On the Security of Randomized Defenses Against Adversarial Samples
Authors:
Kumar Sharad,
Giorgia Azzurra Marson,
Hien Thi Thu Truong,
Ghassan Karame
Abstract:
Deep Learning has been shown to be particularly vulnerable to adversarial samples. To combat adversarial strategies, numerous defensive techniques have been proposed. Among these, a promising approach is to use randomness in order to make the classification process unpredictable and presumably harder for the adversary to control. In this paper, we study the effectiveness of randomized defenses aga…
▽ More
Deep Learning has been shown to be particularly vulnerable to adversarial samples. To combat adversarial strategies, numerous defensive techniques have been proposed. Among these, a promising approach is to use randomness in order to make the classification process unpredictable and presumably harder for the adversary to control. In this paper, we study the effectiveness of randomized defenses against adversarial samples. To this end, we categorize existing state-of-the-art adversarial strategies into three attacker models of increasing strength, namely blackbox, graybox, and whitebox (a.k.a.~adaptive) attackers. We also devise a lightweight randomization strategy for image classification based on feature squeezing, that consists of pre-processing the classifier input by embedding randomness within each feature, before applying feature squeezing. We evaluate the proposed defense and compare it to other randomized techniques in the literature via thorough experiments. Our results indeed show that careful integration of randomness can be effective against both graybox and blackbox attacks without significantly degrading the accuracy of the underlying classifier. However, our experimental results offer strong evidence that in the present form such randomization techniques cannot deter a whitebox adversary that has access to all classifier parameters and has full knowledge of the defense. Our work thoroughly and empirically analyzes the impact of randomization techniques against all classes of adversarial strategies.
△ Less
Submitted 16 March, 2020; v1 submitted 11 December, 2018;
originally announced December 2018.
-
On the structure of solutions for general hyperbolic systems of balance laws
Authors:
Fabio Ancona,
Laura Caravenna,
Andrea Marson
Abstract:
The paper describes the qualitative structure of BV entropy solutions of a strictly hyperbolic system of balance laws with characteristic fields either piecewise genuinely nonlinear or linearly degenerate. In particular, we provide an accurate description of the local and global wave-front structure of a BV solution generated by a fractional step scheme combined with a wave-front tracking algorith…
▽ More
The paper describes the qualitative structure of BV entropy solutions of a strictly hyperbolic system of balance laws with characteristic fields either piecewise genuinely nonlinear or linearly degenerate. In particular, we provide an accurate description of the local and global wave-front structure of a BV solution generated by a fractional step scheme combined with a wave-front tracking algorithm. This extends the corresponding results by Binahcini and Yu for strictly hyperbolic systems of conservation laws.
△ Less
Submitted 5 March, 2018;
originally announced March 2018.
-
A locally quadratic Glimm functional and sharp convergence rate of the Glimm scheme for nonlinear hyperbolic systems
Authors:
F. Ancona,
A. Marson
Abstract:
Consider the Cauchy problem for a strictly hyperbolic, $N\times N$ quasilinear system in one space dimension $$ u_t+A(u) u_x=0,\qquad u(0,x)=\bar u(x), \eqno (1) $$ where $u \mapsto A(u)$ is a smooth matrix-valued map, and the initial data $\overline u$ is assumed to have small total variation. We investigate the rate of convergence of approximate solutions of (1) constructed by the Glimm scheme…
▽ More
Consider the Cauchy problem for a strictly hyperbolic, $N\times N$ quasilinear system in one space dimension $$ u_t+A(u) u_x=0,\qquad u(0,x)=\bar u(x), \eqno (1) $$ where $u \mapsto A(u)$ is a smooth matrix-valued map, and the initial data $\overline u$ is assumed to have small total variation. We investigate the rate of convergence of approximate solutions of (1) constructed by the Glimm scheme, under the assumption that, letting $λ_k(u)$, $r_k(u)$ denote the $k$-th eigenvalue and a corresponding eigenvector of $A(u)$, respectively, for each $k$-th characteristic family the linearly degenerate manifold $$
\mathcal{M}_k \doteq \big\{u\inΩ: \nablaλ_k(u)\cdot r_k(u)=0\big\} $$ is either the whole space, or it is empty, or it consists of a finite number of smooth, $N-1$-dimensional, connected, manifolds that are transversal to the characteristic vector field $r_k$. We introduce a Glimm type functional which is the sum of the cubic interaction potential defined in \cite{sie}, and of a quadratic term that takes into account interactions of waves of the same family with strength smaller than some fixed threshold parameter. Relying on an adapted wave tracing method, and on the decrease amount of such a functional, we obtain the same type of error estimates valid for Glimm approximate solutions of hyperbolic systems satisfying the classical Lax assumptions of genuine nonlinearity or linear degeneracy of the characteristic families.
△ Less
Submitted 19 April, 2009;
originally announced April 2009.
