搜索结果：chain

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques

We exploit a uniform recursive procedure to construct morphisms of chain complexes in a wide variety of situations, using free bases of domains and preferred null homotopies $h$ of targets. Preferred null homotopies satisfy $dh + hd = Id$ and $h^2 = 0$. In the presence of group actions we construct equivariant chain maps. The basic procedure extends to construct functorial maps $F_*(X_i) \to K_*(X_i)$, where $F_*$ and $K_*$ are chain complex functors of one or more simplicial set variables $X_i$, using contractible models for generators of the domain and null homotopies of $K_*$ applied to these models. Examples include classical Alexander-Whitney and Eilenberg-Zilber maps, chain maps related to homology and cohomology operations, operad structure maps for various chain complex operads, and chain maps that define morphisms between operads. Various uniqueness theorems characterize the chain maps produced by our procedures. We give new unified extended treatments of the operads known as the Barratt-Eccles operad and the surjection operads. In another paper we plan to use the results and methods of this paper to establish properties of the Steenrod algebra of mod p cohomology operatio

Small Office/Home Office (SOHO) devices are widely popular, yet often attacked due to security vulnerabilities in their firmware, affecting thousands of devices. These security vulnerabilities often stem from outdated Linux kernel versions included in SOHO device firmware. Naturally, prior work audited the extent and impact of this issue by simple Linux version extraction and version number based vulnerability mapping. However, it is unclear how many of these anticipated vulnerabilities actually exist in the heavily customized SOHO kernels and if there are any barriers towards updating Linux kernels in SOHO firmwares. To address this gap, we uncover actual kernel-related vulnerabilities found in 306 SOHO devices using a high-precision template-based CVE detection mechanism on GPL source releases of more than 900 firmwares from these devices. Next, as a first, we traced the supply chain of these vulnerable SOHO devices at scale and identify kernel lock-in as a significant security issue -- SOHO vendors are effectively locked to specific (often older) kernel versions due to the system-on-chip (SoC) SDKs they use. This kernel lock-in produces a vulnerability debt that is inherited alo

We investigate the synchronization dynamics in a chain of coupled chaotic maps organized in a single-parent family tree, whose properties can be captured considering each parent node connected to two children, one of which also serves as the parent for the subsequent node. Our analysis focuses on two distinct synchronization behaviors: parent-child synchronization, defined by the vanishing distance between successive nodes along the chain, and sibling synchronization, corresponding to the convergence of the states of two child nodes. Our findings reveal significant differences in these two type of synchronization mechanisms, which are closely associated with the probability distribution of the state of parent node. Theoretical analysis and simulations with the logistic map support our findings. We further investigate numerical aspects of the implementation corresponding to cases for which the simulated regimes differ from the theoretically predicted one due to computational finite accuracy. We perform a detailed study on how instabilities are numerically suppressed or amplified along the chain. In some cases, a properly adjusted computational scheme can solve this problem.

Supply Chain Management requires addressing a variety of complex decision-making challenges, from sourcing strategies to planning and execution. Over the last few decades, advances in computation and information technologies have enabled the transition from manual, intuition and experience-based decision-making, into more automated and data-driven decisions using a variety of tools that apply optimization techniques. These techniques use mathematical methods to improve decision-making. Unfortunately, business planners and executives still need to spend considerable time and effort to (i) understand and explain the recommendations coming out of these technologies; (ii) analyze various scenarios and answer what-if questions; and (iii) update the mathematical models used in these tools to reflect current business environments. Addressing these challenges requires involving data science teams and/or the technology providers to explain results or make the necessary changes in the technology and hence significantly slows down decision making. Motivated by the recent advances in Large Language Models (LLMs), we report how this disruptive technology can democratize supply chain technology

Under the widely accepted but unproven assumption that the one-dimensional S=1 antiferromagnetic Heisenberg model has a unique gapped ground state, we prove that the model belongs to a nontrivial symmetry-protected topological (SPT) phase. In other words, we rigorously rule out the possibility that the model has a unique gapped ground state that is topologically trivial. To be precise, we assume that the models on open finite chains with boundary magnetic field have unique ground states with a uniform gap and prove that the ground state of the infinite chain has a nontrivial topological index. This further implies the presence of a gapless edge excitation in the model on the half-infinite chain and the existence of a topological phase transition in the model that interpolates between the Heisenberg chain and the trivial model.

Electric vertical takeoff and landing (eVTOL) aircraft manufacturers await numerous pre-orders for eVTOLs and expect demand for such advanced air mobility (AAM) aircraft to rise dramatically soon. However, eVTOL manufacturers (EMs) cannot commence mass production of commercial eVTOLs due to a lack of supply chain planning for eVTOL manufacturing. The eVTOL supply chain differs from traditional ones due to stringent quality standards and limited suppliers for eVTOL parts, shortages in skilled labor and machinery, and contract renegotiations with major aerospace suppliers. The emerging AAM aircraft market introduces uncertainties in supplier pricing and capacities, eVTOL manufacturing costs, and eVTOL demand, further compounding the supply chain planning challenges for EMs. Despite this critical need, no study has been conducted to develop a comprehensive supply chain planning model for EMs. To address this research gap, we propose a stochastic optimization model for integrated supply chain planning of EMs while maximizing their operating profits under the abovementioned uncertainties. We conduct various numerical cases to analyze the impact of 1) endogenous eVTOL demand influenced b

In Go, the widespread adoption of open-source software has led to a flourishing ecosystem of third-party dependencies, which are often integrated into critical systems. However, the reuse of dependencies introduces significant supply chain security risks, as a single compromised package can have cascading impacts. Existing supply chain attack taxonomies overlook language-specific features that can be exploited by attackers to hide malicious code. In this paper, we propose a novel taxonomy of 12 distinct attack vectors tailored for the Go language and its package lifecycle. Our taxonomy identifies patterns in which language-specific Go features, intended for benign purposes, can be misused to propagate malicious code stealthily through supply chains. Additionally, we introduce GoSurf, a static analysis tool that analyzes the attack surface of Go packages according to our proposed taxonomy. We evaluate GoSurf on a corpus of widely used, real-world Go packages. Our work provides preliminary insights for securing the open-source software supply chain within the Go ecosystem, allowing developers and security analysts to prioritize code audit efforts and uncover hidden malicious behavior

Generative Adversarial Networks (GANs) significantly advanced image generation but their performance heavily depends on abundant training data. In scenarios with limited data, GANs often struggle with discriminator overfitting and unstable training. Batch Normalization (BN), despite being known for enhancing generalization and training stability, has rarely been used in the discriminator of Data-Efficient GANs. Our work addresses this gap by identifying a critical flaw in BN: the tendency for gradient explosion during the centering and scaling steps. To tackle this issue, we present CHAIN (lipsCHitz continuity constrAIned Normalization), which replaces the conventional centering step with zero-mean regularization and integrates a Lipschitz continuity constraint in the scaling step. CHAIN further enhances GAN training by adaptively interpolating the normalized and unnormalized features, effectively avoiding discriminator overfitting. Our theoretical analyses firmly establishes CHAIN's effectiveness in reducing gradients in latent features and weights, improving stability and generalization in GAN training. Empirical evidence supports our theory. CHAIN achieves state-of-the-art resul

Recent text-to-3D models can render high-quality assets, yet they still stumble on objects with complex attributes. The key obstacles are: (1) existing text-to-3D approaches typically lift text-to-image models to extract semantics via text encoders, while the text encoder exhibits limited comprehension ability for long descriptions, leading to deviated cross-attention focus, subsequently wrong attribute binding in generated results. (2) Occluded object parts demand a disciplined generation order and explicit part disentanglement. Though some works introduce manual efforts to alleviate the above issues, their quality is unstable and highly reliant on manual information. To tackle above problems, we propose a automated method Hierarchical-Chain-of-Generation (HCoG). It leverages a large language model to decompose the long description into blocks representing different object parts, and orders them from inside out according to occlusions, forming a hierarchical chain. Within each block we first coarsely create components, then precisely bind attributes via target-region localization and corresponding 3D Gaussian kernel optimization. Between blocks, we introduce Gaussian Extension and

In this manuscript, we delve into the exploration of the first and second Zagreb connection indices of both polyomino chains and random polyomino chains. Our methodology relies on the utilization of Markov chain theory. Within this framework, the article thoroughly examines precise formulas and investigates extreme values. Leveraging the derived formulas, we further explore and elucidate the long-term behavior exhibited by random polyomino chains.

We define a black hole state in a spin chain by studying thermal correlators in holography. Focusing on the Heisenberg model we investigate the thermal and complexity properties of the black hole state by evaluating its entanglement entropy, emptiness formation probability and Krylov complexity. The entanglement entropy grows logarithmically with effective central charge c=5.2. We find evidence for thermalization at infinite temperature.

Deep neural networks provide Reinforcement Learning (RL) powerful function approximators to address large-scale decision-making problems. However, these approximators introduce challenges due to the non-stationary nature of RL training. One source of the challenges in RL is that output predictions can churn, leading to uncontrolled changes after each batch update for states not included in the batch. Although such a churn phenomenon exists in each step of network training, how churn occurs and impacts RL remains under-explored. In this work, we start by characterizing churn in a view of Generalized Policy Iteration with function approximation, and we discover a chain effect of churn that leads to a cycle where the churns in value estimation and policy improvement compound and bias the learning dynamics throughout the iteration. Further, we concretize the study and focus on the learning issues caused by the chain effect in different settings, including greedy action deviation in value-based methods, trust region violation in proximal policy optimization, and dual bias of policy value in actor-critic methods. We then propose a method to reduce the chain effect across different settin

In the present work the dynamics of a continuous inextensible chain is studied. The chain is regarded as a system of small particles subjected to constraints on their reciprocal distances. It is proposed a treatment of systems of this kind based on a set Langevin equations in which the noise is characterized by a non-gaussian probability distribution. The method is explained in the case of a freely hinged chain. In particular, the generating functional of the correlation functions of the relevant degrees of freedom which describe the conformations of this chain is derived. It is shown that in the continuous limit this generating functional coincides with a model of an inextensible chain previously discussed by one of the authors of this work. Next, the approach developed here is applied to a inextensible chain, called the freely jointed bar chain, in which the basic units are small extended objects. The generating functional of the freely jointed bar chain is constructed. It is shown that it differs profoundly from that of the freely hinged chain. Despite the differences, it is verified that in the continuous limit both generating functionals coincide as it is expected.

We consider a derivation $\mathsf{D}$ on the ring $Λ$ of symmetric functions and investigate its combinatorial, algebraic and geometric properties. More precisely, we show that $\mathsf{D}$ restricts to a quasi-isometry, with respect to the Hall product, on the graded component of $Λ$ of each positive degree and provide a chain-rule formula with respect to the plethysm operation. Furthermore, we relate the geometry of the Schur functions supporting $\mathsf{D}(f)$, where $f\in Λ$ is an homogeneous symmetric function, to that of $f$.

Large Language Models (LLMs) have recently enabled natural language interfaces that translate user queries into executable SQL, offering a powerful solution for non-technical stakeholders to access structured data. However, one of the limitation that LLMs do not natively express uncertainty makes it difficult to assess the reliability of their generated queries. This paper presents a case study that evaluates multiple approaches to estimate confidence scores for LLM-generated SQL in supply chain data retrieval. We investigated three strategies: (1) translation-based consistency checks; (2) embedding-based semantic similarity between user questions and generated SQL; and (3) self-reported confidence scores directly produced by the LLM. Our findings reveal that LLMs are often overconfident in their own outputs, which limits the effectiveness of self-reported confidence. In contrast, embedding-based similarity methods demonstrate strong discriminative power in identifying inaccurate SQL.

Layered superconductors in tilted magnetic field have a very rich spectrum of vortex lattice configurations. In the presence of in-plane magnetic field, a small c-axis field penetrates in the form of isolated vortex chains. The structure of a single chain is mainly determined by the ratio of the London [$λ$] and Josephson [$λ_{J}$] lengths, $α= λ/λ_{J}$. At large $α$ the chain is composed of tilted vortices [tilted chains] and at small $α$ it consists of a crossing array of Josephson vortices and pancake stacks [crossing chains]. We studied the chain structures at intermediate $α$'s and found two types of behavior. (I) In the range $0.4 < α< 0.5$ a c-axis field first penetrates in the form of pancake-stack chains located on Josephson vortices. Due to attractive coupling between deformed stacks, their density jumps from zero to a finite value. With further increase of the c-axis field the chain structure smoothly evolves into modulated tilted vortices and then transforms via a second-order phase transition, into the tilted straight vortices. (II) In the range $0.5 < α< 0.65$ a c-axis field first penetrates in the form of kinks creating kinked tilted vortices. With increa

Conditional question answering (CQA) is an important task that aims to find probable answers and identify missing conditions. Existing approaches struggle with CQA due to two challenges: (1) precisely identifying necessary conditions and the logical relationship, and (2) verifying conditions to detect any that are missing. In this paper, we propose a novel prompting approach, Chain of condition, by first identifying all conditions and constructing their logical relationships explicitly according to the document, then verifying whether these conditions are satisfied, finally solving the logical expression to indicate any missing conditions and generating the answer accordingly. Experiments on two CQA benchmark datasets show our chain of condition outperforms existing prompting baselines, establishing a new state of the art. Furthermore, with only a few examples, our method can facilitate GPT-3.5-Turbo or GPT-4 to outperform all existing supervised models.

Vision language models (VLMs) have achieved impressive performance across a variety of computer vision tasks. However, the multimodal reasoning capability has not been fully explored in existing models. In this paper, we propose a Chain-of-Focus (CoF) method that allows VLMs to perform adaptive focusing and zooming in on key image regions based on obtained visual cues and the given questions, achieving efficient multimodal reasoning. To enable this CoF capability, we present a two-stage training pipeline, including supervised fine-tuning (SFT) and reinforcement learning (RL). In the SFT stage, we construct the MM-CoF dataset, comprising 3K samples derived from a visual agent designed to adaptively identify key regions to solve visual tasks with different image resolutions and questions. We use MM-CoF to fine-tune the Qwen2.5-VL model for cold start. In the RL stage, we leverage the outcome accuracies and formats as rewards to update the Qwen2.5-VL model, enabling further refining the search and reasoning strategy of models without human priors. Our model achieves significant improvements on multiple benchmarks. On the V* benchmark that requires strong visual reasoning capability, o