Lina Ma

Lina Ma, Xiantao Li, Chun Liu

We present a derivation of a coarse-grained model from the Langevin dynamics. The focus is placed on the memory kernel function and the fluctuation-dissipation theorem. Also presented is an hierarchy of approximations for the memory and random noise terms, using rational approximations in the Laplace domain. These approximations offer increasing accuracy. More importantly, they eliminate the need to evaluate the integral associated with the memory term at each time step.

Lina Ma, Xiantao Li, Chun Liu

This paper considers the reduction of the Langevin equation arising from bio-molecular models. To facilitate the construction and implementation of the reduced models, the problem is formulated as a reduced-order modeling problem. The reduced models can then be directly obtained from a Galerkin projection to appropriately defined Krylov subspaces. The equivalence to a moment-matching procedure, previously implemented in , 2), is proved. A particular emphasis is placed on the reduction of the stochastic noise, which is absent in many order-reduction problems. In particular, for order less than six we can show the reduced model obtained from the subspace projection automatically satisfies the fluctuation-dissipation theorem. Details for the implementations, including a bi-orthogonalization procedure and the minimization of the number of matrix multiplications, will be discussed as well.

Lina Ma, Xiantao Li, Chun Liu

We present the reduction of generalized Langevin equations to a coordinate-only stochastic model, which in its exact form, involves a forcing term with memory and a general Gaussian noise. It will be shown that a similar fluctuation-dissipation theorem still holds at this level. We study the approximation by the typical Brownian dynamics as a first approximation. Our numerical test indicates how the intrinsic frequency of the kernel function influences the accuracy of this approximation. In the case when such an approximate is inadequate, further approximations can be derived by embedding the nonlocal model into an extended dynamics without memory. By imposing noises in the auxiliary variables, we show how the second fluctuation-dissipation theorem is still exactly satisfied.

Fuxiang Huang, Xiaowei Fu, Shiyu Ye et al.

Unsupervised domain adaptation (UDA) aims to transfer knowledge from a label-rich source domain to an unlabeled target domain by addressing domain shifts. Most UDA approaches emphasize transfer ability, but often overlook robustness against adversarial attacks. Although vanilla adversarial training (VAT) improves the robustness of deep neural networks, it has little effect on UDA. This paper focuses on answering three key questions: 1) Why does VAT, known for its defensive effectiveness, fail in the UDA paradigm? 2) What is the generalization bound theory under attacks and how does it evolve from classical UDA theory? 3) How can we implement a robustification training procedure without complex modifications? Specifically, we explore and reveal the inherent entanglement challenge in general UDA+VAT paradigm, and propose an unsupervised robust domain adaptation (URDA) paradigm. We further derive the generalization bound theory of the URDA paradigm so that it can resist adversarial noise and domain shift. To the best of our knowledge, this is the first time to establish the URDA paradigm and theory. We further introduce a simple, novel yet effective URDA algorithm called Disentangled Adversarial Robustness Training (DART), a two-step training procedure that ensures both transferability and robustness. DART first pre-trains an arbitrary UDA model, and then applies an instantaneous robustification post-training step via disentangled distillation.Experiments on four benchmark datasets with/without attacks show that DART effectively enhances robustness while maintaining domain adaptability, and validate the URDA paradigm and theory.

Lina Ma, Xiaowei Fu, Fuxiang Huang et al.

Existing defense methods fail to defend against unknown attacks and thus raise generalization issue of adversarial robustness. To remedy this problem, we attempt to delve into some underlying common characteristics among various attacks for generality. In this work, we reveal the commonly overlooked low entropy prior (LE) implied in various adversarial samples, and shed light on the universal robustness against unseen attacks in inference phase. LE prior is elaborated as two properties across various attacks as shown in Fig. 1 and Fig. 2: 1) low entropy misclassification for adversarial samples and 2) lower entropy prediction for higher attack intensity. This phenomenon stands in stark contrast to the naturally distributed samples. The LE prior can instruct existing test-time defense methods, thus we propose a two-stage REAL approach: Rectify Adversarial sample based on LE prior for test-time adversarial rectification. Specifically, to align adversarial samples more closely with clean samples, we propose to first rectify adversarial samples misclassified with low entropy by reverse maximizing prediction entropy, thereby eliminating their adversarial nature. To ensure the rectified samples can be correctly classified with low entropy, we carry out secondary rectification by forward minimizing prediction entropy, thus creating a Max-Min entropy optimization scheme. Further, based on the second property, we propose an attack-aware weighting mechanism to adaptively adjust the strengths of Max-Min entropy objectives. Experiments on several datasets show that REAL can greatly improve the performance of existing sample rectification models.

Xiaowei Fu, Yuhang Zhou, Lina Ma et al.

Adversarial attacks pose a challenge to the deployment of deep neural networks (DNNs), while previous defense models overlook the generalization to various attacks. Inspired by targeted therapies for cancer, we view adversarial samples as local lesions of natural benign samples, because a key finding is that salient attack in an adversarial sample dominates the attacking process, while trivial attack unexpectedly provides trustworthy evidence for obtaining generalizable robustness. Based on this finding, a Pixel Surgery and Semantic Regeneration (PSSR) model following the targeted therapy mechanism is developed, which has three merits: 1) To remove the salient attack, a score-based Pixel Surgery module is proposed, which retains the trivial attack as a kind of invariance information. 2) To restore the discriminative content, a Semantic Regeneration module based on a conditional alignment extrapolator is proposed, which achieves pixel and semantic consistency. 3) To further harmonize robustness and accuracy, an intractable problem, a self-augmentation regularizer with adversarial R-drop is designed. Experiments on numerous benchmarks show the superiority of PSSR.