The multi-university and industry research team led by computer scientists at University of California San Diego will present their work at the 2024 ACM ASPLOS Conference that begins tomorrow. The paper, “Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor,” is based on findings from scientists from UC San Diego, Purdue University, Georgia Tech, the University of North Carolina Chapel Hill and Google.

They discover a unique attack that is the first to target a feature in the branch predictor called the Path History Register, which tracks both branch order and branch addresses. As a result, more information with more precision is exposed than with prior attacks that lacked insight into the exact structure of the branch predictor.

Their research has resulted in Intel and Advanced Micro Devices (AMD) addressing the concerns raised by the researchers and advising users about the security issues. Today, Intel is set to issue a Security Announcement, while AMD will release a Security Bulletin.

In software, frequent branching occurs as programs navigate different paths based on varying data values. The direction of these branches, whether “taken” or “not taken,” provides crucial insights into the executed program data. Given the significant impact of branches on modern processor performance, a crucial optimization known as the “branch predictor” is employed. This predictor anticipates future branch outcomes by referencing past histories stored within prediction tables. Previous attacks have exploited this mechanism by analyzing entries in these tables to discern recent branch tendencies at specific addresses.

In this new study, researchers leverage modern predictors’ utilization of a Path History Register (PHR) to index prediction tables. The PHR records the addresses and precise order of the last 194 taken branches in recent Intel architectures. With innovative techniques for capturing the PHR, the researchers demonstrate the ability to not only capture the most recent outcomes but also every branch outcome in sequential order. Remarkably, they uncover the global ordering of all branches. Despite the PHR typically retaining the most recent 194 branches, the researchers present an advanced technique to recover a significantly longer history.

“We successfully captured sequences of tens of thousands of branches in precise order, utilizing this method to leak secret images during processing by the widely used image library, libjpeg,” said Hosein Yavarzadeh, a UC San Diego Computer Science and Engineering Department PhD student and lead author of the paper.

The researchers also introduce an exceptionally precise Spectre-style poisoning attack, enabling attackers to induce intricate patterns of branch mispredictions within victim code. “This manipulation leads the victim to execute unintended code paths, inadvertently exposing its confidential data,” said UC San Diego computer science Professor Dean Tullsen.

“While prior attacks could misdirect a single branch or the first instance of a branch executed multiple times, we now have such precise control that we could misdirect the 732nd instance of a branch taken thousands of times,” said Tullsen.

The team presents a proof-of-concept where they force an encryption algorithm to transiently exit earlier, resulting in the exposure of reduced-round ciphertext. Through this demonstration, they illustrate the ability to extract the secret AES encryption key.

“Pathfinder can reveal the outcome of almost any branch in almost any victim program, making it the most precise and powerful microarchitectural control-flow extraction attack that we have seen so far,” said Kazem Taram, an assistant professor of computer science at Purdue University and a UC San Diego computer science PhD graduate.

In addition to Dean Tullsen and Hosein Yavarzadeh, other UC San Diego coauthors are. Archit Agarwal and Deian Stefan. Other coauthors include Christina Garman and Kazem Taram, Purdue University; Daniel Moghimi, Google; Daniel Genkin, Georgia Tech; Max Christman and Andrew Kwong, University of North Carolina Chapel Hill.

This work was partially supported by the Air Force Office of Scientific Research (FA9550- 20-1-0425); the Defense Advanced Research Projects Agency (W912CG-23-C-0022 and HR00112390029); the National Science Foundation (CNS-2155235, CNS-1954712, and CAREER CNS-2048262); the Alfred P. Sloan Research Fellowship; and gifts from Intel, Qualcomm, and Cisco.

Led by Dr. Jean Seely, this study published in the Canadian Association of Radiologists Journal reviewed breast cancer cases over 35 years to shed light on trends in breast cancer detection in Canada.

“Breast cancer in younger women tends to be diagnosed at later stages and is often more aggressive,” said Dr. Seely, Head of Breast Imaging at The Ottawa Hospital and Professor in the Department of Radiology at the University of Ottawa. “It’s alarming to see rising rates among women in their Twenties and Thirties because they are not regularly screened for breast cancer.”

Risk increases with age

Using data from the National Cancer Incidence Reporting System (1984-1991) and the Canadian Cancer Registry (1992-2019) at Statistics Canada, the research team, which included Larry Ellison from Statistics Canada and Dr. Anna Wilkinson, an Associate Professor in the Faculty of Medicine, looked at all women aged 20 to 54 who were diagnosed with breast cancer.

Their findings included:

• For women in their Twenties, there were 3.9 cases per 100,000 people between 1984 and 1988, compared to 5.7 cases per 100,000 between 2015 and 2019 for a 45.5% increase.
• For women in their Thirties, there were 37.7 cases per 100,000 people between 1984 and 1988, compared to 42.4 cases per 100,000 between 2015 and 2019 for a 12.5% increase.
• For women in their Forties, there were 127.8 cases per 100,000 people between 1984 and 1988, compared to 139.4 cases per 100,000 between 2015 and 2019 for a 9.1% increase.

The study’s results show the importance of targeting younger women in breast cancer awareness campaigns and screening programs. Most public health efforts focus on women over 50, but these findings suggest that younger women are increasingly at risk and may benefit from earlier and more frequent screenings.

Personal experience

Chelsea Bland is one of those women.

Hearing about a death from breast cancer at age 33 led Chelsea — then 28 — to conduct her own self-examination, where she discovered a lump. This led to screenings which ultimately led to a breast cancer diagnosis and subsequent treatment. While she is two years cancer free, she remains on hormone therapy today. The entire experience led Chelsea to help establish a local group that provides peer support for younger women — the average ages range between 28 to 40.

“I hope that by bringing awareness to this study it makes people think twice about saying that being in your twenties, thirties and forties is too young to have breast cancer. In my support group, I have heard the same story over and over again,” Chelsea says. “Young women are not being taken seriously after they find a lump because they are told they are too young for breast cancer. This has ultimately led to delays in being diagnosed and being diagnosed at a more advanced stage. We are not too young for this and this is happening to women who do not have any high-risk genetic markers for breast cancer, myself included.”

Improving awareness

The investigators say more research is needed to understand the root cause of rising breast cancer rates among younger women, information that could be used to develop targeted intervention strategies.

“We’re calling for increased awareness among health-care professionals and the public regarding the rising incidence of breast cancer in younger women,” said Dr. Seely, who alongside Dr. Wilkinson have long documented the benefits of early detection with screening for women in their forties. “We need to adapt our strategies and policies to reflect these changing trends, ensuring that all women, regardless of age, have access to the information and resources they need to detect and combat this disease.”

Technological advances have enabled recent identification of the proteins involved in these systems, but scientists are still digging deeper into what those proteins do.

In a new study, a team from The Ohio State University has reported on the molecular assembly of one of the most common anti-phage systems — from the family of proteins called Gabija — that is estimated to be used by at least 8.5%, and up to 18%, of all bacteria species on Earth.

Researchers found that one protein appears to have the power to fend off a phage, but when it binds to a partner protein, the resulting complex is highly adept at snipping the genome of an invading phage to render it unable to replicate.

“We think the two proteins need to form the complex to play a role in phage prevention, but we also believe one protein alone does have some anti-phage function,” said Zhangfei Shen, co-lead author of the study and a postdoctoral scholar in biological chemistry and pharmacology at Ohio State’s College of Medicine. “The full role of the second protein needs to be further studied.”

The findings add to scientific understanding of microorganisms’ evolutionary strategies and could one day be translated into biomedical applications, researchers say.

Shen and co-lead author Xiaoyuan Yang, a PhD student, work in the lab of senior author Tianmin Fu, assistant professor of biological chemistry and pharmacology at Ohio State.

The study was published April 16 in Nature Structural & Molecular Biology.

The two proteins that make up this defense system are called Gabija A and Gabija B, or GajA and GajB for short.

Researchers used cryo-electron microscopy to determine the biochemical structures of GajA and GajB individually and of what is called a supramolecular complex, GajAB, created when the two bind to form a cluster consisting of four molecules from each protein.

In experiments using Bacillus cereus bacteria as a model, researchers observed the activity of the complex in the presence of phages to gain insight into how the defense system works.

Though GajA alone showed signs of activity that could disable a phage’s DNA, the complex it formed with GajB was much more effective at ensuring phages would not be able take over the bacterial cell.

“That’s the mysterious part,” Yang said. “GajA alone is sufficient to cleave the phage nucleus, but it also does form the complex with GajB when we incubate them together. Our hypothesis is that GajA recognizes the phage’s genomic sequence, but GajB enhances that recognition and helps to cut the phage DNA.”

The large size and elongated configuration of the complex made it difficult to get the full picture of GajB’s functional contributions when bound to GajA, Shen said, leaving the team to make some assumptions about protein roles that have yet to be confirmed.

“We only know GajB helps enhance GajA activity, but we don’t yet know how it works because we only see about 50% of it on the complex,” Shen said.

One of their hypotheses is that GajB may influence the concentration level of an energy source, the nucleotide ATP (adenosine triphosphate), in the cellular environment — specifically, by driving ATP down upon detection of the phage’s presence. That would have the dual effect of expanding GajA’s phage DNA-disabling activity and stealing energy that a phage would need to start replicating, Yang said.

There is more to learn about bacterial anti-phage defense systems, but this team has already shown that blocking virus replication isn’t the only weapon in the bacterial arsenal. In a previous study, Fu, Shen, Yang and colleagues described a different defense strategy: bacteria programming their own death rather than letting phages take over a community.

This work was supported by the National Institute of General Medical Sciences.

Additional co-authors are Jiale Xie, Jacelyn Greenwald, Ila Marathe, Qingpeng Lin and Vicki Wysocki of Ohio State, and Wenjun Xie of the University of Florida.

Rochester Institute of Technology Ph.D. student Kamal Rana (imaging science) was a lead author on a paper recently published in Nature Communications announcing the research, along with co-author Nishant Malik, assistant professor in RIT’s School of Mathematics and Statistics. Kushanav Bhuyan, from the University of Padova and Machine Intelligence and Slope Stability Laboratory, was also a lead co-author.

Current predictive models rely on databases that do not generally include information on the type of failure of mapped landslides. By using the aerial view and elevation data of landslide sites combined with machine learning, the researchers were able to achieve 80-94 percent accuracy in identifying landslide movements in diverse locations around the world. Specifically, the study introduces a method of examining slides, flows, and fails, finding distinct patterns.

Researchers studied landslides around the world, like the 2008 disaster in Beichuan, China, to develop a new paradigm to understand their movements and failure types.

“Our algorithm is not predicting landslides,” explained Malik. “But the people who are in the business of predicting landslides need to know more information about them, like what caused them and what mechanisms they were.”

Various locations were studied, including Italy, the United States, Denmark, Turkey, and China. The wide array of countries helped confirm the strength of the findings, since they can be successfully utilized in diverse regions and climates.

“It was quite exhilarating when we saw the success numbers,” said Bhuyan. “We got the results, which are really good, but we need to be able to connect this to reality.”

The real-world application of this research has a personal impact for Rana, who is from the Himalayan region of India.

“I have seen so many cases when landslides have occurred,” said Rana. “The roads are blocked for two or three weeks. There is no communication from the cities to the villages. It blocks people from going to their jobs or students going to school.”

The hope is that this deeper understanding of failure movements will help those who work to predict deadly events and enhance the accuracy and reliability of hazard and risk assessment models, which will help save lives and reduce damage.

Along with Rana, Bhuyan, and Malik, co-authors of the paper include Joaquin V. Ferrer, Fabrice Cotton, and Ugur Ozturk from the University of Potsdam, and Filippo Catani from the University of Padova.

Changes in data, from wildlife population to anxiety levels, can be an early warning signal that a system is reaching a critical threshold, known as a tipping point, in which those changes may accelerate or even become irreversible.

But which data points matter most? And which are simply just noise?

A new algorithm developed by University at Buffalo researchers can identify the most predictive data points that a tipping point is near. Detailed in Nature Communications, this theoretical framework uses the power of stochastic differential equations to observe the fluctuation of data points, or nodes, and then determine which should be used to calculate an early warning signal.

Simulations confirmed this method was more accurate at predicting theoretical tipping points than randomly selecting nodes.

“Every node is somewhat noisy — in other words, it changes over time — but some may change earlier and more drastically than others when a tipping point is near. Selecting the right set of nodes may improve the quality of the early warning signal, as well as help us avoid wasting resources observing uninformative nodes,” says the study’s lead author, Naoki Masuda, PhD, professor and director of graduate studies in the UB Department of Mathematics, within the College of Arts and Sciences.

The study was co-authored by Neil Maclaren, a postdoctoral research associate in the Department of Mathematics, and Kazuyuki Aihara, executive director of the International Research Center for Neurointelligence at the University of Tokyo.

The work was supported by the National Science Foundation and the Japan Science and Technology Agency.

Warning signals connected via networks

The algorithm is unique in that it fully incorporates network science into the process. While early warning signals have been applied to ecology and psychology for the last two decades, little research has focused on how those signals are connected within a network, Masuda says.

Consider depression. Recent research has considered it and other mental disorders as a network of symptoms influencing each other by creating feedback loops. A loss of appetite could mean the onset of five other symptoms in the near future, depending on how close those symptoms are on the network.

“As a network scientist, I felt network science could offer a unique or perhaps even improved approach to early warning signals,” Masuda says.

By thoroughly considering systems as networks, researchers found that simply selecting the nodes with highest fluctuations was not the best strategy. That’s because some selected nodes may be too closely related to other selected nodes.

“Even if we combine two nodes with nice early warning signals, we don’t necessarily get a more accurate signal. Sometimes combining a node with a good signal and another node with a mid-quality signal actually gives us a better signal,” Masuda says.

While the team validated the algorithm with numerical simulations, they say it can readily be applied to actual data because it does not require information about the network structure itself; it only requires two different states of the networked system to determine an optimal set of nodes.

“The next steps will be to collaborate with domain experts such as ecologists, climate scientists and medical doctors to further develop and test the algorithm with their empirical data and get insights into their problems,” Masuda says.

As the COVID-19 pandemic confined humans indoors and hushed bustling cities, reports of wildlife wandering the streets flooded the internet. To ecologists and sustainability researchers, this was a unique opportunity to understand human-wildlife interactions, afforded by the most tragic of circumstances. Scientists, including some of the authors of the commentary, quickly joined hands to form the COVID-19 Bio-Logging Initiative.

“Our global consortium has been investigating wildlife responses to sudden reductions in human mobility during pandemic lockdowns, using tracking data from animal-attached devices,” says senior author Christian Rutz, of University of St Andrews, UK, who is the chair of the COVID-19 Bio-Logging Initiative. “Such analyses of human-wildlife interactions would benefit tremendously from improved access to human-mobility data.”

“What we very quickly realized is that we had a wealth of data on what animals were doing, but gaining access to data on what humans were doing was a major challenge,” says first author Ruth Oliver of the University of California, Santa Barbara. “Generally, human-mobility data are held by private companies and sold for corporate interests. There are financial and logistical barriers for researchers to access the data to understand sustainability challenges.”

To address this issue, the authors propose that governments and international organizations work together with companies on finding ways to make human-mobility data freely available for research. Drawing on lessons learned from the precedent of government-facilitated access to satellite remote sensing data for public good, the researchers believe human-mobility data hold similar potential, if access barriers were addressed.

Unlike human-mobility data for commercial purposes, which comprise detailed time-stamped movement trajectories of individual users, potentially posing privacy concerns when shared, what the researchers call for is much simpler. The researchers envision aggregated datasets, stripped of personal identifiers, counting the number of devices in an area over a defined time period. About three out of every four people aged 10 or older — roughly 5.9 billion individuals globally — own a cellular phone. This wealth of data can help address how the health of humans, animals, and ecosystems are connected. For example, analyses could help pinpoint hotspots where wildlife and humans interact frequently, informing zoonotic disease prevention and invasive species management.

“Because the aggregated datasets we’re advocating for are very different from what’s needed for commercial applications, making them accessible to researchers wouldn’t harm the market for more detailed data,” says Oliver.

In fact, Oliver and her colleagues say that making human-mobility data available to researchers can also benefit private companies. Sharing aggregated data may generate further demand for bespoke, detailed data products and grow the global user base. With movements towards corporate digital responsibility, sharing data for conservation and sustainability research can also be a way to mitigate impact and contribute to societal good.

“Our vision is to have this movement be a community-driven, collaborative effort. We want to understand the companies’ concerns and collaborate on finding win-win solutions. Because privacy policies around human mobility-data vary around the world, government bodies’ facilitation will be crucial,” says Oliver. “More broadly, we feel it’s crucial to empower individuals to think about how they want their data used.”

Flocking birds, swarming bacteria, cellular flows. These are all examples of active matter, a state in which individual agents, such as birds, bacteria, or cells, self-organize. The agents change from a disordered to an ordered state in what is called a “phase transition.” As a result, they move together in an organized fashion without an external controller.

“Previous studies have shown that the concept of active matter can apply to a wide range of scales, from nanometers (biomolecules) to meters (animals),” says Takasan, the first author. “However, it has not been known whether the physics of active matter can be applied usefully in the quantum regime. We wanted to fill in that gap.”

To fill the gap, the researchers needed to demonstrate a possible mechanism that could induce and maintain an ordered state in a quantum system. It was a collaborative work between physics and biophysics. The researchers took inspiration from the phenomena of flocking birds because, due to the activity of each agent, the ordered state is more easily achieved than in other types of active matter. They created a theoretical model in which atoms were essentially mimicking the behavior of birds. In this model, when they increased the motility of the atoms, the repulsive forces between atoms rearranged them into an ordered state called ferromagnetism. In the ferromagnetic state, spins, the angular momentum of subatomic particles and nuclei, align in one direction, just like how flocking birds face the same direction while flying.

“It was surprising at first to find that the ordering can appear without elaborate interactions between the agents in the quantum model,” Takasan reflects on the finding. “It was different from what was expected based on biophysical models.”

The researcher took a multi-faceted approach to ensure their finding was not a fluke. Thankfully, the results of computer simulations, mean-field theory, a statistical theory of particles, and mathematical proofs based on linear algebra were all consistent. This strengthened the reliability of their finding, the first step in a new line of research.

“The extension of active matter to the quantum world has only recently begun, and many aspects are still open,” says Takasan. “We would like to further develop the theory of quantum active matter and reveal its universal properties.”