In this paper, we aim to build an adversarially robust zero-shot image classifier that can accurately and efficiently classify unseen examples while defending against unforeseen adversarial attacks, addressing critical challenges in real-world safety-sensitive scenarios. To achieve this, we focus on two key challenges: zero-shot classification and defense against unforeseen attacks. We ground our work on CLIP, a vision-language pre-trained model to perform zero-shot classification. To defend against unforeseen attacks, we adopt a purification approach, as it is independent of specific attack types. We then define a purification risk as the KL divergence between the joint distributions of the purification and attack process. The derived lower bound of purification risk inspires us to explore purification in CLIP's multi-modal latent space. We propose a CLIP-based purification method called CLIPure, which has two variants: _CLIPure-Diff_, which models image likelihood with a generative process of its latent vector, and _CLIPure-Cos_, which models the likelihood based on the similarity between embeddings of the image and a blank template. As far as we know, CLIPure is the first purification method in latent space and _CLIPure-Cos_ is the first purification method not relying on generative models, substantially improving defense efficiency. Extensive experimental results show that the robustness achieved by CLIPure is within a small gap of clean accuracy, outperforming SOTA robustness by a large margin, e.g., from 71.7\% to **91.1\%** on CIFAR10, from 59.6\% to **72.6\%** on ImageNet, and **108\%** relative improvements of average robustness on the 13 datasets over previous SOTA, with only 14\% extra inference cost and no additional training.

Online group discussions play an important role in education reform by facilitating collaborative learning and knowledge sharing among participants. However, instructors face significant challenges in monitoring discussion progress, tracking student performance and understanding interaction dynamics due to overlapping conversations, time-varying participant behaviors, and hidden interaction patterns. To address these challenges, we propose GroupTrackVis, an interactive visual analytics system that incorporates both advanced algorithms and novel visualization designs, to help instructors analyze group discussions mainly from three perspectives: topic evolution, student performance, and interaction. GroupTrackVis proposes an enhanced topic segmentation algorithm by incorporating word vector weighting and reply relationship analysis, effectively disentangling overlapping discussions. It also extracts six key behavioral attributes from multimodal educational data, offering a comprehensive view of student performance and providing insights into the key factors driving learning outcomes. Additionally, a multi-layer tree network with edge bundling techniques is implemented to clearly visualize the dynamic evolution of student interactions. The integration of algorithms with interactive visualizations enables instructors to explore discussions quickly and dynamically adjust their analysis as the discussion evolves. The effectiveness of GroupTrackVis is demonstrated through two case studies, a user study, and expert interviews, highlighting its ability to support instructors in identifying engaged and disengaged students, and tracking discussion dynamics.

Neural ranking models (NRMs) have shown great success in information retrieval (IR). But their predictions can easily be manipulated using adversarial examples, which are crafted by adding imperceptible perturbations to legitimate documents. This vulnerability raises significant concerns about their reliability and hinders the widespread deployment of NRMs. By incorporating adversarial examples into training data, adversarial training has become the de facto defense approach to adversarial attacks against NRMs. However, this defense mechanism is subject to a trade-off between effectiveness and adversarial robustness. In this study, we establish theoretical guarantees regarding the effectiveness-robustness trade-off in NRMs. We decompose the robust ranking error into two components, i.e., a natural ranking error for effectiveness evaluation and a boundary ranking error for assessing adversarial robustness. Then, we define the perturbation invariance of a ranking model and prove it to be a differentiable upper bound on the boundary ranking error for attainable computation. Informed by our theoretical analysis, we design a novel perturbation-invariant adversarial training (PIAT) method for ranking models to achieve a better effectiveness-robustness trade-off. We design a regularized surrogate loss, in which one term encourages the effectiveness to be maximized while the regularization term encourages the output to be smooth, so as to improve adversarial robustness. Experimental results on several ranking models demonstrate the superiority of PITA compared to existing adversarial defenses.

Adversarial purification is one of the promising approaches to defend neural networks against adversarial attacks. Recently, methods utilizing diffusion probabilistic models have achieved great success for adversarial purification in image classification tasks. However, such methods fall into the dilemma of balancing the needs for noise removal and information preservation. This paper points out that existing adversarial purification methods based on diffusion models gradually lose sample information during the core denoising process, causing occasional label shift in subsequent classification tasks. As a remedy, we suggest to suppress such information loss by introducing guidance from the classifier confidence. Specifically, we propose Classifier-cOnfidence gUided Purification (COUP) algorithm, which purifies adversarial examples while keeping away from the classifier decision boundary. Experimental results show that COUP can achieve better adversarial robustness under strong attack methods.

Despite ongoing efforts to defend neural classifiers from adversarial attacks, they remain vulnerable, especially to unseen attacks. In contrast, humans are difficult to be cheated by subtle manipulations, since we make judgments only based on essential factors. Inspired by this observation, we attempt to model label generation with essential label-causative factors and incorporate label-non-causative factors to assist data generation. For an adversarial example, we aim to discriminate the perturbations as non-causative factors and make predictions only based on the label-causative factors. Concretely, we propose a casual diffusion model (CausalDiff) that adapts diffusion models for conditional data generation and disentangles the two types of casual factors by learning towards a novel casual information bottleneck objective. Empirically, CausalDiff has significantly outperformed state-of-the-art defense methods on various unseen attacks, achieving an average robustness of 86.39\% (+4.01\%) on CIFAR-10, 56.25\% (+3.13\%) on CIFAR-100, and 82.62\% (+4.93\%) on GTSRB (German Traffic Sign Recognition Benchmark). The code is available athttps://github.com/CAS-AISafetyBasicResearchGroup/CausalDiff.

Recently, vehicle platooning has demonstrated its potential for improving traffic efficiency and enhancing the driving experience. When the onboard sensors of follower vehicles are unavailable, the leader vehicle typically needs to maintain the safety of platooning system through vehicle-to-vehicle (V2V) communications. Increasing communication resource utilization, such as transmission power, can enhance communication accuracy and ensure platooning safety but induce more communication costs. Balancing communication costs and system safety poses challenges in this dynamic system. In this paper, we propose a joint optimization method for transmission power control and system stability maintenance based on deep reinforcement learning (DRL), which can minimize the total transmission power of the leader vehicle over a period of time while maintaining the stability of the platooning system. To achieve this, we implement two advanced DRL algorithms, namely Deep Q-Network (DQN) and Actor-Critic, to derive task-oriented power control strategies for platooning stability. Experimental results show that the proposed strategy outperforms the conventional power control strategy. The transmission power gradually increases as the follower vehicle approaches the boundary of the safe distance range, indicating that the proposed strategy can adaptively adjust the transmission power to meet the requirements of the task.

Full-waveform inversion (FWI), as a high-precision model building method, plays an invaluable role in seismic exploration. The accuracy of conventional FWI is universally reduced by the cycle skipping, which can be improved by the optimal transport distance (OTD) objective function. However, the OTD-based FWI cannot converge to meaningful results with an inaccurately estimated source wavelet. To solve this dilemma, we construct a novel convolutional Wasserstein distance (CW) objective function by applying the OTD objective function to convolved seismograms. Before the standard non-negative and normalization preprocessing of OTD, we first convolve the observed data with a reference trace selected from simulated seismograms and convolve the simulated data with a trace selected from the observed data. The both convolved data sets are naturally regarded as with an identical source, so the data difference caused by the inaccurately estimated source wavelet is eliminated. The adjoint source corresponding to the new objective function is derived. The velocity model can be updated by using a quasi-Newton method according to the gradient of the objective function generated by the adjoint-state method. We investigate the effectiveness of our objective function by one-dimensional signals and several FWI examples. Furthermore, this new objective function still delivers an excellent performance in releasing the local minimum problem and resisting noise when the wavelet used in FWI is inaccurate.

Reverse-time migration (RTM) has the particular capacity for complex geological structure imaging. However, massive storage and high computational costs caused by conventional cross-correlation imaging conditions restrict the large-scale application of RTM. The excitation amplitude imaging condition (EAIC) has the cheapest imaging cost, but inadequate wavefield information causes less tolerance for noise. To alleviate these limitations, we introduce a local Nyquist cross-correlation imaging condition, which serves as a transition between the conventional cross-correlation imaging conditions and the EAIC. Instead of using the full wavefields or only the excitation amplitude to construct imaging, the local cross-correlation imaging condition (LCIC) utilizes the wavefields around the corresponding time of the maximum amplitude at each grid during the source wavefield simulation. Moreover, considering the possible oversampling situations in the LCIC, the Nyquist sampling theorem is flexibly embedded into the local cross-correlation scheme to further reduce the storage costs and improve the efficiency of RTM. Compared with the cross-correlation imaging conditions, the proposed strategy can obtain the similar results and reduce the storage requirement and time costs significantly. In the meantime, it maintains better adaptability to the complex imaging environments than the EAIC. Migration tests of synthetic and field datasets demonstrate that the local Nyquist cross-correlation scheme features good feasibility, efficiency, and practicability in RTM. As a consequence, the proposed local Nyquist cross-correlation imaging condition can effectively save storage and time costs and provide a reliable migrated image even from noisy observed data.