Get the most recent info and news about AT&T on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

AT&T Inc. provides telecommunication, media, and technology services worldwide. The company operates through Communications, WarnerMedia, and Latin America segments. The Communications segment offers wireless voice and data communications services; video and targeted advertising services; broadband, including fiber, and legacy telephony internet and voice communication; and wireline telecom services. It also sells handsets, wirelessly enabled computers, wireless data cards, and IP-based set-top boxes, as well as various accessories, such as carrying cases and hands-free devices through the company-owned stores, agents, and third-party retail stores. This segment markets its communications services and products under the AT&T, Cricket, AT&T PREPAIDSM, AT&T TV, AT&T Fiber, and DIRECTV brand names. The WarnerMedia segment primarily produces, distributes, and licenses television programming and feature films; distributes home entertainment products in physical and digital formats; and produces and distributes mobile and console games, and consumer products, as well as offers brand licensing services, and advertising services. It also operates cable networks; video on demand streaming platform under the HBO Max and HBO GO names; multichannel pay television services under the HBO and Cinemax; and digital media properties, as well as licenses its content to television networks and over-the-top services. The Latin America segment offers video entertainment and audio programming services under the DIRECTV and SKY brands primarily to residential customers; pay-TV services, including HD sports video content; and postpaid and prepaid wireless services under the AT&T and Unefon brands, as well as sells various handsets through company-owned stores, agents, and third-party retail stores. The company was formerly known as SBC Communications Inc. and changed its name to AT&T Inc. in November 2005. AT&T Inc. was incorporated in 1983 and is headquartered in Dallas, Texas.

AT&T

&quot;It is not clear why AT&amp;T filed this Application, under existing rules, and then attempted to convince the Commission that it should ignore its rules, based on flawed and erroneous assertions regarding the law and regulatory policy that slowed down the adjudication of this proceeding,&quot; Glegola ...

AT&T loses key ruling in attempt to escape Carrier-of-Last-Resort obligation | Ars Technica

Both Madigan and McClain have pleaded not guilty. Their attorneys have accused prosecutors of trying to criminalize legal political actions such as job recommendations in a quest to bring down the once-powerful speaker.

‘We’re on the friends and family plan now’: New details emerge in alleged AT&T scheme to bribe House speaker

The investigation conducted by the attorneys general found that AT&amp;T, Verizon, and T-Mobile made “several misleading claims,” which prompted the issuance of the fines. The companies claimed plans were “unlimited” when there were limits, that phones were announced as “free” when ...

T-Mobile, AT&T, & Verizon Fined $10.2M for 'Unlimited' Claims - RetailWire

AT&amp;T, along with other providers of landline phones, will be actively phasing out their landline services soon in response to the Federal Communications Commission Landline Shutdown Order 19-72. U.S. service providers will be required to offer customers an alternative to landlines and use devices ...

AT&T’s Plans to Drop Landlines - Fullerton Observer

VANCOUVER, BC / ACCESSWIRE / May 13, 2024 / Siyata Mobile Inc. (Nasdaq:SYTA)(Nasdaq:SYTAW) (&quot;Siyata&quot; or the &quot;Company&quot;), a global developer and vendor of Push-to-Talk over Cellular (PoC) handsets and accessories,

Siyata Mobile’s SD7 Handset Added to AT&T FirstNet’s ‘Free Feature Phone for Life’ Promotion | National | wdrb.com

The companies are also required to appoint a dedicated representative to work with the attorneys general to address complaints filed by customers and train their customer service representatives to comply with the terms of the agreement. They must also enforce a program to ensure compliance ...

T-Mobile, Verizon, and AT&T Fined $10.2 Million Over False 'Unlimited' Plan Claims | PCMag

Table of Links Abstract and 1. Introduction Abstract and 1. Introduction 2 Methodology 2 Methodology 3 Hardware 3 Hardware 4 Software 4 Software 5 Network 5 Network 6 Consensus 6 Consensus 7 Cryptocurrency Economics 7 Cryptocurrency Economics 8 Client API 8 Client API 9 Governance 9 Governance 10 Geography 10 Geography 11 Case Studies 11 Case Studies 12 Discussion and References 12 Discussion and References A. Decentralization and Policymaking A. Decentralization and Policymaking B. Software Testing B. Software Testing C. Brief Evaluations per Layer C. Brief Evaluations per Layer D. Measuring decentralization D. Measuring decentralization E. Fault Tolerance and Decentralization E. Fault Tolerance and Decentralization 5 Network Blockchain nodes communicate over a peer-to-peer (P2P) network, the decentralization properties of which have been of great interest to researchers [134,4,82,76]. Systems often implement a message diffusion mechanism [78] via a gossip protocol that avoids full graph connectivity [54]. Users typically use the Internet to access the P2P overlay, though some efforts try to introduce an independent infrastructure [47]. Here we explore networking aspects which present single points of failure, in terms of topology and bootstrapping. A notable research question that arises organically from our analysis, and touches upon both following subsections, is creating a P2P network that is both permissionless and Byzantine resilient, e.g., as explored in [49,124]. Topology. The first networking aspect of interest is the network’s topology. Evaluating a real-world network’s clustering properties is a well-known problem, traditionally done by generating random graphs and comparing the expected with the observed values [63,135,1]. In blockchain systems, every node maintains a list of peer connections. Crucially, message provenance is not typically provided, so no party can know the network origin of an incoming message. Therefore, the resource of interest are “bridges” (single nodes or small cluster of nodes) between the network graph’s components and the relevant parties are the bridges’ owners or operators. Here, a component is a single node or a cluster of tightly interconnected nodes. Topology Topology A distributed network, in the tradition of Baran [15], is key in maintaining safety and liveness. Under the CAP theorem [27], any networked system can satisfy at most two of the following properties: i) a consistent data copy; ii) data availability; iii) network partition tolerance. Ledger systems are no exception. Each node needs to maintain at least one connection to an honest party to receive all messages and avoid eclipse attacks [87]. If some parties cannot communicate with the rest of the network, either they halt and any transactions they submit are dropped (violating liveness) or they produce separate ledger versions (violating safety).[9] By preventing communication between a node and the rest of the network, an attacker reduces the honest computational power and isolates that node, making a 51% or a double spending attack (against the isolated node) easier to deploy. Additionally, an adversary can violate liveness by blocking the node’s transactions from reaching the rest of the network. Third, an adversary that controls all of a node’s connections can link transactions to the specific node, correlate the user’s addresses, and associate them with real-world information, such as an IP address, thus compromising privacy[10]. This also holds on a macroscopic level, i.e., a node that acts as a central communication hub between two clusters can obtain information and even deanonymize some participants (violating privacy). Node Bootstrapping and Peer Discovery. Joining a ledger’s network and synchronizing with it is the so-called “bootstrapping” process. All real-world ledgers rely on an initial (trusted) setup, the first (“genesis”) block.[11] Obtaining the correct genesis block is done in an out-of-band, typically secure mechanism, since it is often well-known and easy to validate from various sources. Node Bootstrapping and Peer Discovery. Node Bootstrapping and Peer Discovery. Initially, the node needs to connect to some peers and receive all available chains. Therefore, the resource here is bootstrapping nodes and the relevant parties are these nodes’ operators. Then, using the ledger protocol’s chain resolution mechanism, it decides which chain to adopt. There are two points of interest here. First, it should be guaranteed that the node connects to at least one honest peer, to retrieve all available information and avoid getting eclipsed. As explained above, if nodes gets eclipsed, the system’s liveness, safety and privacy properties may get compromised. However, connecting to honest peers is not straightforward, given that the node has no knowledge about the network participants, a standard problem in P2P networks [57]. Blockchain systems predominantly use either hardcoded peer lists or DNS seeding [120], although both techniques are censorship-prone. Notably, [120] showed that more secure alternatives, such as ZMap [61], cannot be feasibly used in existing blockchain systems. Second, even if the node connects to some honest peers, catching up by using only genesis (“bootstrapping from genesis”) is not always feasible. Especially in PoS systems, an attacker can effortlessly assemble an arbitrarily-long, seemingly correct chain (violating safety) [81,31,118]. To counter such attacks, some ledgers employ checkpoints [107,52,50], which are often issued centrally and are either hardcoded or received from the peers. Other solutions do exist, e.g., analyzing block density and relying on key erasures [12] or using VDFs [24,53], but enforcing and/or relaxing such assumptions still poses an interesting research problem. Authors:
(1) Christina Ovezik, University of Edinburgh (c.ovezik@ed.ac.uk);
(2) Dimitris Karakostas, University of Edinburgh (dkarakos@ed.ac.uk);
(3) Aggelos Kiayias, University of Edinburgh and IOG (akiayias@ed.ac.uk). Authors: Authors: (1) Christina Ovezik, University of Edinburgh (c.ovezik@ed.ac.uk); (2) Dimitris Karakostas, University of Edinburgh (dkarakos@ed.ac.uk); (3) Aggelos Kiayias, University of Edinburgh and IOG (akiayias@ed.ac.uk). This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv [9] In longest-chain protocols, like Bitcoin, miners keep producing blocks in isolation, ending up with different ledger versions. In BFT-style protocols, like Algorand, the ledger cannot be updated if a large number of block producers become unreachable and thus do not adopt new transactions. [10] Note that protecting privacy in the network layer can be a particularly challenging problem, even in the setting where no single adversary controls all of a node’s connections. [11] Some proposals rely on computational assumptions instead of a trusted setup [80], but their real-world performance and applicability is still untested.

Eclipse Attacks, Network Clusters & DNS Seeding

Singapore, March 21st, 2025 - In an extraordinary atmosphere at the unique Circa Amsterdam venue, the Web3 Amsterdam Conference took place on March 13th and 14th in the Dutch capital, where Bitunix exchange captured the spotlight as the Title Sponsor of the event. Singapore, March 21st, 2025 - In an extraordinary atmosphere at the unique Circa Amsterdam venue, the Web3 Amsterdam Conference took place on March 13th and 14th in the Dutch capital, where Bitunix exchange captured the spotlight as the Title Sponsor of the event. The booth of the world’s fastest-growing cryptocurrency exchange attracted significant attention, with visitors eager to learn more about Bitunix’s services. Many were particularly curious about the platform’s unique features, fees, liquidity, and transparency, with Bitunix representatives providing detailed answers without hesitation. cryptocurrency exchange attracted significant attention https://x.com/BitunixOfficial/status/1900152594623844655?embedable=true https://x.com/BitunixOfficial/status/1900152594623844655?embedable=true During her presentation at the event, Andrea Soto, from Bitunix, highlighted the exchange's most advanced features, including the exclusive Multiwindow feature which allows traders to use 16 windows at once on one screen. Additionally, she introduced Bitunix's exclusive TradingView feature for mobile, a one-of-a-kind function globally. 16 windows These features were a major draw at the Bitunix booth, with many visitors asking about them after her speech. Soto also emphasized that Bitunix prioritizes security, noting: “We provide safety for payments and wallets, as well as Proof of Reserve, so every trader using our exchange can be confident that 100% of the assets they hold are fully backed by the funds we have on the exchange.” “We provide safety for payments and wallets, as well as Proof of Reserve, so every trader using our exchange can be confident that 100% of the assets they hold are fully backed by the funds we have on the exchange.” “We provide safety for payments and wallets, as well as Proof of Reserve, so every trader using our exchange can be confident that 100% of the assets they hold are fully backed by the funds we have on the exchange.” Bitunix KOLs Discuss Market Trends and Memecoins on Stage Sonny Verecuo, Bitunix Business Development Representative, moderated a panel on Memecoin Trading Strategies with notable Bitunix KOLs, including Argiris Trader, Chento Trades, and Greg from USACryptoNoticias. Argiris Trader Chento Trades USACryptoNoticias While the panelists offered their perspectives on the memecoin market, Argiris notably criticized the growing popularity of memecoins, stating that they were draining liquidity away from altcoins. Greg from USACryptoNoticias also criticized memecoins, not favoring them as investment options. These remarks helped clarify that these panelists, such as USACryptoNoticias, do not trade with memecoins, as they focus mostly on other crypto strategies. In addition, USACryptoNoticias actively engaged with the conference audience by trading and performing live analysis both days at the Bitunix booth for his community. Aurolo, another influential crypto figure in the Spanish and LATAM region, also participated in these activities, providing valuable insights to attendees. Aurolo Crypto Million Announces IMO Token Launch on Bitunix with an Airdrop for Web3 Amsterdam Attendees Crypto Million, a well-known Bitunix KOL and one of the largest crypto influencers in Switzerland and the French region, delivered a speech in which he made a major announcement: the launch of the IMO token on Bitunix. During his speech, he gave attendees the exciting opportunity to receive free tokens in an airdrop, further highlighting Bitunix’s commitment to engaging its user base and expanding its offerings. Crypto Million IMO token The event provided a prime networking opportunity, allowing attendees to explore the latest industry trends, engage with expert speakers, and connect with leading professionals. As part of the partnership, Bitunix also hosted workshops and discussions, strengthening ties with developers, investors, and blockchain enthusiasts. Recent data from a 2024 European Central Bank study shows that 9% of Eurozone residents now hold cryptocurrencies, up from 4% in 2022, reinforcing the growing popularity of crypto in Europe and the significance of Bitunix’s presence at Web3 Amsterdam. study This conference was a good opportunity for all interested parties to get to know the services and advantages that Bitunix offers. The exchange will also be part of Paris Blockchain Week and Token2049 in Dubai. Bitunix has built a reputation for actively participating in such conferences, striving to advance global crypto adoption while also educating users about its platform and services. About Bitunix Bitunix is a global cryptocurrency derivatives exchange founded in 2021, committed to offering simple, secure, transparent, and cost-effective trading services to its users. Bitunix specializes in both spot trading and perpetual futures, with over 700 trading pairs and leverage of up to 125x. cryptocurrency derivatives exchange cryptocurrency derivatives exchange With features such as top-tier liquidity, 24/7 customer support, and a strong commitment to regulatory compliance, Bitunix remains at the forefront of providing a reliable trading experience for the global crypto community. Bitunix has attracted more than 2,000,000 users from over 100 countries, facilitating a daily trading volume exceeding $5 billion on its platform. Website | Telegram | X | LinkedIn Website Website Telegram Telegram X X LinkedIn LinkedIn

Bitunix Becomes the Center of Attention at Web3 Amsterdam, Dominating as Title Sponsor

Bitunix става център на вниманието в Web3 Amsterdam, доминиращ като титулен спонсор

Bitunix se convierte en el centro de atención en Web3 Amsterdam, dominando como patrocinador principal

Bitunix Vin Sant Atansyon nan Web3 Amstèdam, Domine kòm Sponsor Tit

Bitunix Menjadi Pusat Perhatian di Web3 Amsterdam, Mendominasi sebagai Sponsor Utama

Bitunix diventa il centro dell'attenzione al Web3 Amsterdam, dominando come sponsor principale

Bitunix הופך למרכז תשומת הלב ב-Web3 אמסטרדם, שולט כחסות כותרת

Bitunix が Web3 Amsterdam で注目の的となり、タイトルスポンサーとして存在感を発揮

Bitunix Web3 Амстердамда көңүл буруунун борбору болуп, титулдук демөөрчү катары үстөмдүк кылат

Bitunix kļūst par Web3 Amsterdamas uzmanības centru, dominējot kā titula sponsors

Bitunix wordt middelpunt van de belangstelling op Web3 Amsterdam en domineert als titelsponsor

Bitunix Inova Nzvimbo Yekutarisisa paWeb3 Amsterdam, Inotonga seChinyorwa Sponsor

Bitunix bëhet qendra e vëmendjes në Web3 Amsterdam, duke dominuar si sponsor i titullit

Frankfurt am Main, Germany, March 17th, 2025/CyberNewsWire/--Cyberattacks are no longer an abstract threat - they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than doubled, and they are shorter, more targeted, and more technically sophisticated. Link11 Link11 Organizations that do not continuously evolve their security strategies face significant financial losses and long-term reputational damage. The numbers speak for themselves: 137% more DDoS attacks on the Link11 network compared to last year.
A new scale has been reached: The largest attack measured to date was 1.4 terabits per second (Tbps).
Attacks are shorter and highly effective: Two-thirds of all attacks peaked in just 10 to 60 seconds.
Multi-vector attacks are setting new standards: The combination of different attack vectors makes defense more difficult and requires more precise protection. 137% more DDoS attacks on the Link11 network compared to last year. A new scale has been reached: The largest attack measured to date was 1.4 terabits per second (Tbps). Attacks are shorter and highly effective: Two-thirds of all attacks peaked in just 10 to 60 seconds. Multi-vector attacks are setting new standards: The combination of different attack vectors makes defense more difficult and requires more precise protection. Why organizations should act now The Allianz Risk Barometer 2025 highlights that while digital transformation presents new opportunities, it also expands the attack surface for cyber threats. Cybercriminals are leveraging powerful botnets and increasingly sophisticated attack techniques, accelerating the speed and impact of DDoS attacks. The Allianz Risk Barometer 2025 The Allianz Risk Barometer 2025 A recent case demonstrates how these evolving threats are testing the resilience of organizations. Multi-vector DDoS: When Network Load Meets Application Attacks A four-day attack combined Layer 3/4 and Layer 7 techniques, putting both infrastructure and web applications under massive pressure. Link11 recorded a total of 120 million requests, resulting in more than a million WAF logs - a load that quickly overwhelmed conventional defenses. The attackers' strategic approach was particularly striking: Layer 3/4 attacks: Massive data streams overwhelm the network infrastructure.
Layer 7 attacks: APIs and web applications were deliberately crippled with complex queries.
Dynamic attack patterns: Attacks were launched in waves to test the response times of defenses. Layer 3/4 attacks: Massive data streams overwhelm the network infrastructure. Layer 7 attacks: APIs and web applications were deliberately crippled with complex queries. Dynamic attack patterns: Attacks were launched in waves to test the response times of defenses. Organizations that do not continuously adapt their IT security strategy risk becoming victims of targeted attacks. Web applications and APIs are particularly targeted by cybercriminals because they often handle sensitive data and control critical business processes. Modern Security Architecture is The Key to Resilience The incident underscores the growing limitations of traditional DDoS defenses, emphasizing the need for more adaptive mitigation strategies. Enterprises are increasingly turning to AI-powered systems for real-time threat detection and attack prevention. Additionally, Web Application and API (WAAP) protection is gaining importance as attackers continue to exploit this critical attack vector. Combining advanced protection solutions: AI-based attack detection for early detection of suspicious patterns
Bot management to block automated attacks
Adaptive WAF systems that adapt in real time AI-based attack detection for early detection of suspicious patterns Bot management to block automated attacks Adaptive WAF systems that adapt in real time A holistic security strategy combines advanced DDoS mitigation, continuous monitoring, and adaptive protection mechanisms. "The increasing number of DDoS attacks shows that cybercriminals continue to rely on this proven method. However, the shortened attack time does not mean that the threat is decreasing – on the contrary: companies need to react faster and further optimize their defense mechanisms," said Jens-Philipp Jung, CEO of Link11. "The increasing number of DDoS attacks shows that cybercriminals continue to rely on this proven method. However, the shortened attack time does not mean that the threat is decreasing – on the contrary: companies need to react faster and further optimize their defense mechanisms," said Jens-Philipp Jung, CEO of Link11. The full European Cyber Report 2025 can be downloaded here. here here About Link11 Link11 is a specialized global IT security provider and protects infrastructures and web applications from cyberattacks. Its cloud-based IT security solutions help companies worldwide to strengthen the cyber resilience of their networks and critical applications and avoid business disruption. Link11 is a BSI-qualified provider for DDoS protection of critical infrastructure. With ISO 27001 certification, the company meets the highest standards in data security. Link11 Link11 Contact Corporate Communications Lisa Froehlich Link11 GmbH l.froehlich@link11.com +49 16098088442 This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here here here

European Cyber Report 2025: 137% More DDoS attacks Than Last Year - What Companies Need To Know

የአውሮፓ የሳይበር ሪፖርት 2025፡ ካለፈው ዓመት 137% ተጨማሪ የ DDoS ጥቃቶች - ኩባንያዎች ማወቅ ያለባቸው

Informe Cibernético Europeo 2025: Un 137 % más de ataques DDoS que el año pasado: Lo que las empresas deben saber

European Cyber Report 2025: 137% više DDoS napada nego prošle godine - što tvrtke trebaju znati

Եվրոպական կիբեր զեկույց 2025. 137% ավելի շատ DDoS հարձակումներ, քան անցյալ տարի. Ինչ պետք է իմանան ընկերությունները

欧州サイバーレポート 2025: DDoS 攻撃が昨年より 137% 増加 - 企業が知っておくべきこと

유럽 사이버 보고서 2025: 작년보다 137% 증가한 DDoS 공격 - 기업이 알아야 할 사항

Europees Cyberrapport 2025: 137% meer DDoS-aanvallen dan vorig jaar - Wat bedrijven moeten weten

European Cyber Report 2025: 137% Ditlhaselo tše dintši tša DDoS go feta Ngwaga wo o fetilego - Seo Dikhamphani di Swanetšego go se Tseba

European Cyber Report 2025: 137% więcej ataków DDoS niż w zeszłym roku - co firmy muszą wiedzieć

Relatório Cibernético Europeu 2025: 137% Mais Ataques DDoS do que no Ano Passado - O Que as Empresas Precisam Saber

Európska kybernetická správa 2025: O 137 % viac útokov DDoS ako minulý rok – čo spoločnosti potrebujú vedieť

รายงานไซเบอร์ของยุโรปประจำปี 2025: การโจมตี DDoS เพิ่มขึ้น 137% เมื่อเทียบกับปีที่แล้ว - สิ่งที่บริษัทต่างๆ จำเป็นต้องรู้

Author:
(1) Thierry Boy de la Tour, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG 38000 Grenoble, France. Table of Links Abstract and 1 Introduction 2 Basic Definitions and Notations 2.1 Sets 2.2 Sequences 2.3 Signatures and Algebras and 2.4 Categories 3 Monographs and their Morphisms 4 Limits and Colimits 5 Drawing Monographs 6 Graph Structures and Typed Monographs 7 Submonographs and Partial Morphisms 8 Algebraic Transformations of Monographs 9 Attributed Typed Monographs 10 Conclusion and References 9 Attributed Typed Monographs The notion of E-graph has been designed in [2] in order to obtain an adhesive category of graphs with attributed nodes and edges. This follows from a line of studies on Typed Attributed Graph Transformations, see [21, 22, 23]. The attributes are taken in a data type algebra and may be of different sorts (booleans, integers, strings, etc.). In the case of E-graphs only the nodes of sort values represent such attributes. But they are also typed by E-graphs, and in the type E-graphs each node of sort values represent a sort of the data type algebra. This should recall the constructions of Section 6 that we now use in order to generalize the notion of typed attributed graphs given in [2]. The idea is similarly to impose that the edges typed by a sort of a data type algebra are the elements of the corresponding carrier set. Theorem 9.4 generalizes[3] [2, Theorem 11.3] that establishes an isomorphism between the category of attributed E-graphs typed by an attributed E-graph AT G and the category of algebras of a signature denoted AGSIGpAT Gq. In particular Theorem 11.3 of [2] requires the hypothesis that AGSIGpAT Gq should be well-structured, which means that if there is an operator name of ST whose domain sort is s then s is not a sort of the data type signature Σ. Obviously this is equivalent to requiring that only nodes of T can be considered as sorts of Σ and is linked to the fact that only values nodes of E-graphs are supposed to hold attributes. Since we are not restricted to E-graphs there is no need to require that attributes should only be nodes. This has an interesting consequence: The approach adopted in [2, Definition 11.5] is to restrict the morphisms used in span rules to a class of monomorphisms that are extensions of Σ-isomorphisms to pΓ `Σq-homomorphisms. It is then possible to show [2, Theorem 11.11] that categories of typed attributed E-graphs are adhesive HLR categories (a notion that generalizes Definition 4.13, see [24]) w.r.t. this class of monomorphisms. A similar result holds on categories of ATMs. For the sake of simplicity, and since rule-based graph transformations are unlikely to modify attributes such as booleans, integers or strings (and if they do they should probably not be considered as graph transformations), we will only consider morphisms that leave the data type algebra unchanged, element by element. This leaves the possibility to transform the edges whose sort is in Γ but not in Σ. The proof that the categories ATMpT, Aq are adhesive will only be sketched below. The key point is the following lemma. Hence the property of stabilization characterizes the difference between morphisms in Monogrz\T and morphisms in ATM(T, A). Besides, it is well-known how pushouts and pullbacks in Monogrz\T can be constructed from those in Monogr, and we have seen that these can be constructed from those in Sets. Theorem 9.8. ATM(T, A) is adhesive. This result does not mean that all edges that are not attributes can be freely transformed. Their adjacencies to or from attributes may impose constraints that only few morphisms are able to satisfy. Example 9.9. Let Σ be the signature with no operation name and one sort s, and A be the Σ-algebra defined by As “ ta, bu. We consider the type monograph T “ tpe, sq,ps, equ. A monograph typed by T has any number (but at least one) of edges typed by e that must be adjacent either to a or b, and two edges typed by s, namely a and b, that must be adjacent to either the same edge x typed by e, which yields two classes of monographs (to which may be added any number of edges typed by e and adjacent to either a or b), or a and b are adjacent to y and z respectively, and we get four more classes: The function y, z → x is a morphism from these last two monographs to the two monographs above (respectively). There are no other morphisms between monographs from distinct classes. We therefore see that in the category ATM(T, A) it is possible to add or remove edges typed by e to which a or b are not adjacent, but there is no way to remove the edges y and z (because this would require a rule with a left morphism from an ATM without y and z to an ATM with y and z, and there is no such morphism), though they are not attributes. Besides, we see that this category has no initial object, no terminal object, no products nor coproducts. This paper is available on arxiv under CC BY 4.0 DEED license. [3] Our proof is also much shorter than the 6 pages taken by the corresponding result on attributed typed E-graphs. This is due partly to our use of AT (Definition 6.7) and of Theorem 6.8, but also to the simplicity of monographs compared to the 5 sorts and 6 operator names of E-graphs. Author: (1) Thierry Boy de la Tour, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG 38000 Grenoble, France. Author: Author: (1) Thierry Boy de la Tour, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG 38000 Grenoble, France. Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Basic Definitions and Notations 2.1 Sets 2.1 Sets 2.2 Sequences 2.2 Sequences 2.3 Signatures and Algebras and 2.4 Categories 2.3 Signatures and Algebras and 2.4 Categories 3 Monographs and their Morphisms 3 Monographs and their Morphisms 4 Limits and Colimits 4 Limits and Colimits 5 Drawing Monographs 5 Drawing Monographs 6 Graph Structures and Typed Monographs 6 Graph Structures and Typed Monographs 7 Submonographs and Partial Morphisms 7 Submonographs and Partial Morphisms 8 Algebraic Transformations of Monographs 8 Algebraic Transformations of Monographs 9 Attributed Typed Monographs 9 Attributed Typed Monographs 10 Conclusion and References 10 Conclusion and References 9 Attributed Typed Monographs The notion of E-graph has been designed in [2] in order to obtain an adhesive category of graphs with attributed nodes and edges. This follows from a line of studies on Typed Attributed Graph Transformations, see [21, 22, 23]. The attributes are taken in a data type algebra and may be of different sorts (booleans, integers, strings, etc.). In the case of E-graphs only the nodes of sort values represent such attributes. But they are also typed by E-graphs, and in the type E-graphs each node of sort values represent a sort of the data type algebra. This should recall the constructions of Section 6 that we now use in order to generalize the notion of typed attributed graphs given in [2]. The idea is similarly to impose that the edges typed by a sort of a data type algebra are the elements of the corresponding carrier set. Theorem 9.4 generalizes[3] [2, Theorem 11.3] that establishes an isomorphism between the category of attributed E-graphs typed by an attributed E-graph AT G and the category of algebras of a signature denoted AGSIGpAT Gq. In particular Theorem 11.3 of [2] requires the hypothesis that AGSIGpAT Gq should be well-structured, which means that if there is an operator name of ST whose domain sort is s then s is not a sort of the data type signature Σ. Obviously this is equivalent to requiring that only nodes of T can be considered as sorts of Σ and is linked to the fact that only values nodes of E-graphs are supposed to hold attributes. Since we are not restricted to E-graphs there is no need to require that attributes should only be nodes. This has an interesting consequence: The approach adopted in [2, Definition 11.5] is to restrict the morphisms used in span rules to a class of monomorphisms that are extensions of Σ-isomorphisms to pΓ `Σq-homomorphisms. It is then possible to show [2, Theorem 11.11] that categories of typed attributed E-graphs are adhesive HLR categories (a notion that generalizes Definition 4.13, see [24]) w.r.t. this class of monomorphisms. A similar result holds on categories of ATMs. For the sake of simplicity, and since rule-based graph transformations are unlikely to modify attributes such as booleans, integers or strings (and if they do they should probably not be considered as graph transformations), we will only consider morphisms that leave the data type algebra unchanged, element by element. This leaves the possibility to transform the edges whose sort is in Γ but not in Σ. The proof that the categories ATMpT, Aq are adhesive will only be sketched below. The key point is the following lemma. Hence the property of stabilization characterizes the difference between morphisms in Monogrz \T and morphisms in ATM (T, A). Besides, it is well-known how pushouts and pullbacks in Monogrz \T can be constructed from those in Monogr , and we have seen that these can be constructed from those in Sets. Monogrz ATM Monogrz Monogr Theorem 9.8. ATM (T, A) is adhesive. Theorem 9.8. ATM This result does not mean that all edges that are not attributes can be freely transformed. Their adjacencies to or from attributes may impose constraints that only few morphisms are able to satisfy. Example 9.9. Let Σ be the signature with no operation name and one sort s, and A be the Σ-algebra defined by As “ ta, bu. We consider the type monograph T “ tpe, sq,ps, equ. A monograph typed by T has any number (but at least one) of edges typed by e that must be adjacent either to a or b, and two edges typed by s, namely a and b, that must be adjacent to either the same edge x typed by e, which yields two classes of monographs Example 9.9. Let Σ be the signature with no operation name and one sort s, and A be the Σ-algebra defined by As “ ta, bu. We consider the type monograph T “ tpe, sq,ps, equ. A monograph typed by T has any number (but at least one) of edges typed by e that must be adjacent either to a or b, and two edges typed by s, namely a and b, that must be adjacent to either the same edge x typed by e, which yields two classes of monographs (to which may be added any number of edges typed by e and adjacent to either a or b), or a and b are adjacent to y and z respectively, and we get four more classes: (to which may be added any number of edges typed by e and adjacent to either a or b), or a and b are adjacent to y and z respectively, and we get four more classes: The function y, z → x is a morphism from these last two monographs to the two monographs above (respectively). There are no other morphisms between monographs from distinct classes. We therefore see that in the category ATM(T, A) it is possible to add or remove edges typed by e to which a or b are not adjacent, but there is no way to remove the edges y and z (because this would require a rule with a left morphism from an ATM without y and z to an ATM with y and z, and there is no such morphism), though they are not attributes. The function y, z → x is a morphism from these last two monographs to the two monographs above (respectively). There are no other morphisms between monographs from distinct classes. We therefore see that in the category ATM(T, A) it is possible to add or remove edges typed by e to which a or b are not adjacent, but there is no way to remove the edges y and z (because this would require a rule with a left morphism from an ATM without y and z to an ATM with y and z, and there is no such morphism), though they are not attributes. Besides, we see that this category has no initial object, no terminal object, no products nor coproducts. Besides, we see that this category has no initial object, no terminal object, no products nor coproducts. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [3] Our proof is also much shorter than the 6 pages taken by the corresponding result on attributed typed E-graphs. This is due partly to our use of AT (Definition 6.7) and of Theorem 6.8, but also to the simplicity of monographs compared to the 5 sorts and 6 operator names of E-graphs.

Making Sense of Attributed Typed Monographs

Authors:
(1) Albert Gu, Machine Learning Department, Carnegie Mellon University;
(2)Tri Dao, Department of Computer Science, Princeton University agu@cs.cmu.edu, tri@tridao.me. Table of Links Abstract and 1. Introduction 2 State Space Models 3 Selective State Space Models and 3.1 Motivation: Selection as a Means of Compression 3.2 Improving SSMs with Selection 3.3 Efficient Implementation of Selective SSMs 3.4 A Simplifed SSM Architecture 3.5 Properties of Selection Mechanisms 3.6 Additional Model Details 4 Empirical Evaluation and 4.1 Synthetic Tasks 4.2 Language Modeling 4.3 DNA Modeling 4.4 Audio Modeling and Generation 4.5 Speed and Memory Benchmarks 4.6 Model Ablations 5 Discussion 6 Conclusion, Acknowledgments and References A Discussion: Selection Mechanism B Related Work and B.1 S4 Variants and Derivatives B.2 SSM Architectures B.3 Relationship to RNNs B.4 Linear Attention and B.5 Long Context Models C Mechanics of Selective SSMs D Hardware-aware Algorithm For Selective SSMs E Experimental Details and Additional Results and E.1 Synthetic Tasks E.2 Language Modeling E.3 DNA Modeling E.4 Audio Details E.5 Efficiency Benchmark B.4 Linear Attention The Linear Attention (LA) (Katharopoulos et al. 2020) framework is an important result popularizing kernel attention and showing how it relates to recurrent autoregressive models. Many variants have proposed alternative kernels and other modifications. Random Feature Attention (RFA) (H. Peng et al. 2021) chooses the kernel feature map to approximate softmax attention (i.e. the exp feature map) using the random Fourier feature approximation of Gaussian kernels (Rahimi and Recht 2007). Performer (Choromanski et al. 2021) finds an approximation to the exponential kernel involving only positive features, which also allows the softmax normalization term. TransNormer (Qin, Han, W. Sun, D. Li, et al. 2022) showed that the LA denominator term can be unstable and proposed replacing it with a LayerNorm. cosFormer (Qin, W. Sun, et al. 2022) augments RFA with a cosine reweighting mechanism that incorporates positional information to emphasize locality. Linear Randomized Attention (Zheng, C. Wang, and L. Kong 2022) generalize RFA from the perspective of importance sampling, and generalize it to provide better estimates of the full softmax kernel (rather than just the exp-transformed numerator). Aside from kernel attention, many other variants of efficient attention exist; the survey Tay, Dehghani, Bahri, et al. (2022) offers an extensive categorization of many of these. B.5 Long Context Models Long context has become a popular subject, and several recent models have claimed to scale to longer and longer sequences. However, these are often from a computational standpoint and have not been extensively validated. These include: In contrast, we believe this work presents one of the first approaches to meaningfully demonstrate increasing performance with longer context. C Mechanics of Selective SSMs The discretization step size is where we observe that the parameter can be viewed as a learnable bias and folded into the linear projection. Now applying the zero-order hold (ZOH) discretization formulas: Thus the final discrete recurrence (2a) is as desired. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Albert Gu, Machine Learning Department, Carnegie Mellon University; (2)Tri Dao, Department of Computer Science, Princeton University agu@cs.cmu.edu, tri@tridao.me. Authors: Authors: (1) Albert Gu, Machine Learning Department, Carnegie Mellon University; (2)Tri Dao, Department of Computer Science, Princeton University agu@cs.cmu.edu, tri@tridao.me. Table of Links Abstract and 1. Introduction Abstract and 1. Introduction 2 State Space Models 2 State Space Models 3 Selective State Space Models and 3.1 Motivation: Selection as a Means of Compression 3 Selective State Space Models and 3.1 Motivation: Selection as a Means of Compression 3.2 Improving SSMs with Selection 3.2 Improving SSMs with Selection 3.3 Efficient Implementation of Selective SSMs 3.3 Efficient Implementation of Selective SSMs 3.4 A Simplifed SSM Architecture 3.4 A Simplifed SSM Architecture 3.5 Properties of Selection Mechanisms 3.5 Properties of Selection Mechanisms 3.6 Additional Model Details 3.6 Additional Model Details 4 Empirical Evaluation and 4.1 Synthetic Tasks 4 Empirical Evaluation and 4.1 Synthetic Tasks 4.2 Language Modeling 4.2 Language Modeling 4.3 DNA Modeling 4.3 DNA Modeling 4.4 Audio Modeling and Generation 4.4 Audio Modeling and Generation 4.5 Speed and Memory Benchmarks 4.5 Speed and Memory Benchmarks 4.6 Model Ablations 4.6 Model Ablations 5 Discussion 5 Discussion 6 Conclusion, Acknowledgments and References 6 Conclusion, Acknowledgments and References A Discussion: Selection Mechanism A Discussion: Selection Mechanism B Related Work and B.1 S4 Variants and Derivatives B Related Work and B.1 S4 Variants and Derivatives B.2 SSM Architectures B.2 SSM Architectures B.3 Relationship to RNNs B.3 Relationship to RNNs B.4 Linear Attention and B.5 Long Context Models B.4 Linear Attention and B.5 Long Context Models C Mechanics of Selective SSMs C Mechanics of Selective SSMs D Hardware-aware Algorithm For Selective SSMs D Hardware-aware Algorithm For Selective SSMs E Experimental Details and Additional Results and E.1 Synthetic Tasks E Experimental Details and Additional Results and E.1 Synthetic Tasks E.2 Language Modeling E.2 Language Modeling E.3 DNA Modeling E.3 DNA Modeling E.4 Audio Details E.4 Audio Details E.5 Efficiency Benchmark E.5 Efficiency Benchmark B.4 Linear Attention The Linear Attention (LA) (Katharopoulos et al. 2020) framework is an important result popularizing kernel attention and showing how it relates to recurrent autoregressive models. Many variants have proposed alternative kernels and other modifications. Random Feature Attention (RFA) (H. Peng et al. 2021) chooses the kernel feature map to approximate softmax attention (i.e. the exp feature map) using the random Fourier feature approximation of Gaussian kernels (Rahimi and Recht 2007). Performer (Choromanski et al. 2021) finds an approximation to the exponential kernel involving only positive features, which also allows the softmax normalization term. TransNormer (Qin, Han, W. Sun, D. Li, et al. 2022) showed that the LA denominator term can be unstable and proposed replacing it with a LayerNorm. cosFormer (Qin, W. Sun, et al. 2022) augments RFA with a cosine reweighting mechanism that incorporates positional information to emphasize locality. Linear Randomized Attention (Zheng, C. Wang, and L. Kong 2022) generalize RFA from the perspective of importance sampling, and generalize it to provide better estimates of the full softmax kernel (rather than just the exp-transformed numerator). Aside from kernel attention, many other variants of efficient attention exist; the survey Tay, Dehghani, Bahri, et al. (2022) offers an extensive categorization of many of these. B.5 Long Context Models Long context has become a popular subject, and several recent models have claimed to scale to longer and longer sequences. However, these are often from a computational standpoint and have not been extensively validated. These include: In contrast, we believe this work presents one of the first approaches to meaningfully demonstrate increasing performance with longer context. C Mechanics of Selective SSMs The discretization step size is where we observe that the parameter can be viewed as a learnable bias and folded into the linear projection. Now applying the zero-order hold (ZOH) discretization formulas: Thus the final discrete recurrence (2a) is as desired. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Linear Attention and Long Context Models

MONROVIA, Liberia, February 28th, 2025/Chainwire/--Chad Leads the Way: AI-Powered Memecoins Are Evolving. Memeagent has introduced Chad, an autonomous AI agent designed to bring intelligence and automation to the memecoin ecosystem. While many meme projects rely on fleeting trends, Memeagent is built differently – a fully AI agent-driven ecosystem designed to change the game for good. As AI reshapes the landscape, Memeagent is positioning itself at the forefront of this evolution. Chad: The AI Engine Driving Memeagent’s Evolution Chad is a key figure who represents Memeagent. He’s a fully automated AI agent that helps users to navigate Memeagent. Memeagent is an AI-powered ecosystem designed for sustained growth and real utility. At the core of this innovation is Chad, Memeagent’s flagship AI agent, showcasing the advanced capabilities that will soon be available to all users. Built on ElizaOS, a cutting-edge open-source framework for autonomous AI agents, Chad can think, learn, and interact independently. With persistent memory, adaptability, and live data integration, he stays ahead of trends, making real-time decisions in an ever-evolving market. ElizaOS is a pioneer in decentralized AI (DeAI), allowing Chad to operate seamlessly within blockchain ecosystems. With features like encrypted transactions, asset management, and real-time analytics, Chad isn’t just generating memes—he’s actively shaping market dynamics. Working 24/7, Chad monitors trends, predicts market shifts, and engages across major social platforms without hesitation. Unlike human traders, he never sleeps, never FOMOs, and never misses an opportunity – driving Memeagent’s AI-driven viral growth. He will automatically respond to all users needs and help them navigate through Memeagent itself. The Reasons Memeagent Is Gaining Attention Behind the scenes, big moves are happening. Memeagent combines AI-powered engagement, predictive analytics, and automated viral marketing into one platform, making it one of the most powerful ecosystem for meme adoption yet. Here’s why serious players are locking in: Always-On AI – Chad works around the clock, monitoring X/Twitter, Telegram, Instagram, and more to maximize exposure.
Predictive Trend Analysis – Spot what’s about to go viral before the rest of the market catches on.
Automated Growth – Hands-free content and engagement across major social platforms.
No Technical Barriers – AI handles the heavy lifting, so anyone can capitalize. $MA: The Fuel Behind the Memeagent Ecosystem Unlike other meme coins, $MA goes beyond speculation—it powers the entire Memeagent platform, unlocking a range of utilities that set it apart. AI agent Creation – Use $MA to create and deploy custom AI-powered Memeagents that generate viral content and interact across social platforms.
DeFi Utilities – Stake $MA for passive income and participate in governance decisions to shape the future of the Memeagent ecosystem.
Deflationary Impact – A portion of every $MA transaction is burned, reducing supply and increasing scarcity over time. Memeagent and Chad Gain Traction as AI-Powered Platforms Expand According to the team, Memeagent isn’t another speculative meme coin—it’s a structured, AI-powered ecosystem with long-term incentives. The Features That Set Memeagent Apart AI-Driven Growth – Automation supports long-term engagement beyond short-term trends.
$MA Token Utility – Powers AI tools, governance, staking, and a deflationary tokenomics model.
Security & Infrastructure – Built with SOC 2 Type 2-certified security for reliability and trust. Memeagent’s Roadmap is Packed Memeagent is gaining attention as its ecosystem expands. With a structured roadmap ahead and continuous development, the platform is set for steady growth. Upcoming milestones: Q2 2025: Beta AI automation tools roll out to early users.
Q3 2025: Advanced predictive analytics and expanded AI engagement.
Q4 2025: Full staking launch, multilingual support, and deeper integrations.
2026: Memeagent’s ecosystem expands to full-scale adoption. Market Movers Are Taking Notice Memeagent is already in motion, leveraging AI and automation to drive engagement. As the ecosystem expands, those recognizing its potential are positioning themselves early. The Next Evolution of Memecoins Is Built on Innovation, Not Just Hype. AI-Powered Innovation in Memecoins Memeagent is introducing AI-driven engagement to the memecoin ecosystem. As the platform grows, early users can explore $MA’s utility and experience Chad’s AI-powered automation in action. Users can visit www.memeagent.io to get started now. #CHADISCOMING About Memeagent Memeagent is developed by a team of experienced AI engineers and blockchain specialists with extensive backgrounds in DeFi, yield farming, token design, and AI-driven automation. Active in the crypto space since 2016, the team has contributed to various high-profile projects, focusing on scalability, security, and decentralized AI (DeAI) solutions. Contact Benjamin Peng info@memeagent.io This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here MONROVIA, Liberia, February 28th, 2025/Chainwire/--Chad Leads the Way: AI-Powered Memecoins Are Evolving. Memeagent has introduced Chad, an autonomous AI agent designed to bring intelligence and automation to the memecoin ecosystem. While many meme projects rely on fleeting trends, Memeagent is built differently – a fully AI agent-driven ecosystem designed to change the game for good. As AI reshapes the landscape, Memeagent is positioning itself at the forefront of this evolution. Chad: The AI Engine Driving Memeagent’s Evolution Chad is a key figure who represents Memeagent. He’s a fully automated AI agent that helps users to navigate Memeagent. Memeagent is an AI-powered ecosystem designed for sustained growth and real utility. At the core of this innovation is Chad, Memeagent’s flagship AI agent, showcasing the advanced capabilities that will soon be available to all users. Built on ElizaOS, a cutting-edge open-source framework for autonomous AI agents, Chad can think, learn, and interact independently. With persistent memory, adaptability, and live data integration, he stays ahead of trends, making real-time decisions in an ever-evolving market. ElizaOS is a pioneer in decentralized AI (DeAI), allowing Chad to operate seamlessly within blockchain ecosystems. With features like encrypted transactions, asset management, and real-time analytics, Chad isn’t just generating memes—he’s actively shaping market dynamics. Working 24/7, Chad monitors trends, predicts market shifts, and engages across major social platforms without hesitation. Unlike human traders, he never sleeps, never FOMOs, and never misses an opportunity – driving Memeagent’s AI-driven viral growth. He will automatically respond to all users needs and help them navigate through Memeagent itself. The Reasons Memeagent Is Gaining Attention Behind the scenes, big moves are happening. Memeagent combines AI-powered engagement, predictive analytics, and automated viral marketing into one platform, making it one of the most powerful ecosystem for meme adoption yet. Here’s why serious players are locking in: Always-On AI – Chad works around the clock, monitoring X/Twitter, Telegram, Instagram, and more to maximize exposure. Predictive Trend Analysis – Spot what’s about to go viral before the rest of the market catches on. Automated Growth – Hands-free content and engagement across major social platforms. No Technical Barriers – AI handles the heavy lifting, so anyone can capitalize. Always-On AI – Chad works around the clock, monitoring X/Twitter, Telegram, Instagram, and more to maximize exposure. Predictive Trend Analysis – Spot what’s about to go viral before the rest of the market catches on. Automated Growth – Hands-free content and engagement across major social platforms. No Technical Barriers – AI handles the heavy lifting, so anyone can capitalize. $MA: The Fuel Behind the Memeagent Ecosystem Unlike other meme coins, $MA goes beyond speculation—it powers the entire Memeagent platform, unlocking a range of utilities that set it apart. AI agent Creation – Use $MA to create and deploy custom AI-powered Memeagents that generate viral content and interact across social platforms. DeFi Utilities – Stake $MA for passive income and participate in governance decisions to shape the future of the Memeagent ecosystem. Deflationary Impact – A portion of every $MA transaction is burned, reducing supply and increasing scarcity over time. AI agent Creation – Use $MA to create and deploy custom AI-powered Memeagents that generate viral content and interact across social platforms. DeFi Utilities – Stake $MA for passive income and participate in governance decisions to shape the future of the Memeagent ecosystem. Deflationary Impact – A portion of every $MA transaction is burned, reducing supply and increasing scarcity over time. Memeagent and Chad Gain Traction as AI-Powered Platforms Expand According to the team, Memeagent isn’t another speculative meme coin—it’s a structured, AI-powered ecosystem with long-term incentives. The Features That Set Memeagent Apart AI-Driven Growth – Automation supports long-term engagement beyond short-term trends. $MA Token Utility – Powers AI tools, governance, staking, and a deflationary tokenomics model. Security & Infrastructure – Built with SOC 2 Type 2-certified security for reliability and trust. AI-Driven Growth – Automation supports long-term engagement beyond short-term trends. $MA Token Utility – Powers AI tools, governance, staking, and a deflationary tokenomics model. Security & Infrastructure – Built with SOC 2 Type 2-certified security for reliability and trust. Memeagent’s Roadmap is Packed Memeagent is gaining attention as its ecosystem expands. With a structured roadmap ahead and continuous development, the platform is set for steady growth. Upcoming milestones: Q2 2025: Beta AI automation tools roll out to early users. Q3 2025: Advanced predictive analytics and expanded AI engagement. Q4 2025: Full staking launch, multilingual support, and deeper integrations. 2026: Memeagent’s ecosystem expands to full-scale adoption. Q2 2025: Beta AI automation tools roll out to early users. Q3 2025: Advanced predictive analytics and expanded AI engagement. Q4 2025: Full staking launch, multilingual support, and deeper integrations. 2026: Memeagent’s ecosystem expands to full-scale adoption. Market Movers Are Taking Notice Memeagent is already in motion, leveraging AI and automation to drive engagement. As the ecosystem expands, those recognizing its potential are positioning themselves early. The Next Evolution of Memecoins Is Built on Innovation, Not Just Hype. AI-Powered Innovation in Memecoins Memeagent is introducing AI-driven engagement to the memecoin ecosystem. As the platform grows, early users can explore $MA’s utility and experience Chad’s AI-powered automation in action. Users can visit www.memeagent.io to get started now. www.memeagent.io www.memeagent.io #CHADISCOMING About Memeagent Memeagent is developed by a team of experienced AI engineers and blockchain specialists with extensive backgrounds in DeFi, yield farming, token design, and AI-driven automation. Active in the crypto space since 2016, the team has contributed to various high-profile projects, focusing on scalability, security, and decentralized AI (DeAI) solutions. Memeagent Memeagent Contact Benjamin Peng info@memeagent.io This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here here here

Memeagent Is Gaining Attention – Meeting Chad, The AI Agent That’s Changing The Game

Memeagent está ganando atención: conozca a Chad, el agente de inteligencia artificial que está cambiando las reglas del juego

Memeagent está a chamar a atención: coñece a Chad, o axente de IA que está a cambiar o xogo

Memeagent privlači pažnju – upoznajte Chada, AI agenta koji mijenja igru

Memeagent が注目を集める – ゲームを変える AI エージェント Chad との出会い

Memeagent добива внимание - средба со Чад, агентот за вештачка интелигенција што ја менува играта

Memeagent E Hwetša Tlhokomelo – Go Kopana le Chad, Moemedi wa AI Yo a Fetošago Papadi

Memeagent atrage atenția – Întâlnesc cu Chad, agentul AI care schimbă jocul

Memeagent таваҷҷӯҳро ба худ ҷалб мекунад - Вохӯрӣ бо Чад, агенти AI, ки бозиро тағир медиҳад

Memeagent Is Gaining Attention – Meeting Chad, Ang AI Agent That’s Changing The Game

Memeagent Dikkat Çekiyor – Oyunu Değiştiren Yapay Zeka Ajanı Chad ile Tanışma

Memeagent Yi Kuma Nyingiso – Ku Hlangana na Chad, Muyimeri wa AI Loyi A Cincaka Ntlangu

Memeagent đang thu hút sự chú ý – Gặp gỡ Chad, đặc vụ AI đang thay đổi trò chơi

Authors:
(1) Ben Athiwaratkun, AWS AI Labs;
(2) Sujan Kumar Gonugondla, AWS AI Labs;
(3) Sanjay Krishna Gouda, AWS AI Labs;
(4) Haifeng Qian, AWS AI Labs;
(5) Sanjay Krishna Gouda, AWS AI Labs;
(6) Hantian Ding, AWS AI Labs;
(7) Qing Sun, AWS AI Labs;
(8) Jun Wang, AWS AI Labs;
(9) Jiacheng Guo, AWS AI Labs;
(10 Liangfu Chen, AWS AI Labs;
(11) Parminder Bhatia, GE HealthCare (work done at AWS);
(12) Ramesh Nallapati, Amazon AGI (work done at AWS);
(13) Sudipta Sengupta, AWS AI Labs;
(14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction 2. Related Work 3. Background 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 6. Conclusion and References A. FAQs B. Related Work C. Setup D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques D. Multi-Group Attention Family D.1. Detailed Analysis on Memory Access We show in Table 4 that the memory IO cost for ⟨q, K⟩ is dominated by the loading of K which costs bmhk in the case of multihead where g = h. This cost is particularly high due to the coupling of batch size b, context length m, and the entire hidden dimension d. Compared to the number of computations, which has complexity bmd, this attention module requires one memory IO per one tensor operation (memory-io bound). In contrast, other operations such as feedforw can be the main bottleneck for incremental decoding and our paper aims to tackle such problems.ard has much lower ratio of memory IO per compute (compute bound). These attention computation D.2. Model FLOPs The scaling laws by Kaplan et al. (2020) shows that the modelrelated FLOPs during the forward pass is 2N where N is the number of parameters (without the embeddings). We show that it holds for a general multi-group model as well. The only difference between the multi-group and the multi-head case is the projection PK and PV where they are of size dgk instead of dhk. Since this is a linear layer, the forward pass FLOPs for any input is still proportional such projection size. Therefore, it follows that for any multi-group attention, including multi-head, the forward FLOPs is 2N where N is the respective number of parameters. D.3. Comparing Capabilities-Equivalent Models This section outlines the analysis of latency change when we switch from an MH model to an MG model with F times the size. D.3.1. CONTEXT ENCODING D.3.2. INCREMENTAL DECODING This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Authors: Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Related Work 2. Related Work 3. Background 3. Background 3.1. Notation and 3.2. Language Model Inference 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 5.3. Applications 6. Conclusion and References 6. Conclusion and References A. FAQs A. FAQs B. Related Work B. Related Work C. Setup C. Setup D. Multi-Group Attention Family D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention E. Context-Aware Bifurcated Attention F. Applications: Additional Results F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques G. Compatibility with Speculative Decoding and Fast Decoding techniques D. Multi-Group Attention Family D.1. Detailed Analysis on Memory Access We show in Table 4 that the memory IO cost for ⟨q, K⟩ is dominated by the loading of K which costs bmhk in the case of multihead where g = h. This cost is particularly high due to the coupling of batch size b, context length m, and the entire hidden dimension d. Compared to the number of computations, which has complexity bmd, this attention module requires one memory IO per one tensor operation (memory-io bound). In contrast, other operations such as feedforw can be the main bottleneck for incremental decoding and our paper aims to tackle such problems.ard has much lower ratio of memory IO per compute (compute bound). These attention computation D.2. Model FLOPs The scaling laws by Kaplan et al. (2020) shows that the modelrelated FLOPs during the forward pass is 2N where N is the number of parameters (without the embeddings). We show that it holds for a general multi-group model as well. The only difference between the multi-group and the multi-head case is the projection PK and PV where they are of size dgk instead of dhk. Since this is a linear layer, the forward pass FLOPs for any input is still proportional such projection size. Therefore, it follows that for any multi-group attention, including multi-head, the forward FLOPs is 2N where N is the respective number of parameters. D.3. Comparing Capabilities-Equivalent Models This section outlines the analysis of latency change when we switch from an MH model to an MG model with F times the size. D.3.1. CONTEXT ENCODING D.3.1. CONTEXT ENCODING D.3.2. INCREMENTAL DECODING D.3.2. INCREMENTAL DECODING This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Understanding Multi-Group Attention in AI Models

Authors:
(1) Ben Athiwaratkun, AWS AI Labs;
(2) Sujan Kumar Gonugondla, AWS AI Labs;
(3) Sanjay Krishna Gouda, AWS AI Labs;
(4) Haifeng Qian, AWS AI Labs;
(5) Sanjay Krishna Gouda, AWS AI Labs;
(6) Hantian Ding, AWS AI Labs;
(7) Qing Sun, AWS AI Labs;
(8) Jun Wang, AWS AI Labs;
(9) Jiacheng Guo, AWS AI Labs;
(10 Liangfu Chen, AWS AI Labs;
(11) Parminder Bhatia, GE HealthCare (work done at AWS);
(12) Ramesh Nallapati, Amazon AGI (work done at AWS);
(13) Sudipta Sengupta, AWS AI Labs;
(14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction 2. Related Work 3. Background 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 6. Conclusion and References A. FAQs B. Related Work C. Setup D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques A. FAQs Q: If we already have an MQ model that seems to be quite efficient at large batch sampling, is bifurcated attention necessary?
A: The proposed context-aware bifurcated attention is an exact computation that provides a different way to perform attention, so one can use it "for free" without a performance tradeoff. Due to the reduced memory I/O, it enables more extreme cases of batch sampling, such as a larger batch, even for long contexts.

Q: How applicable is multi-query for single-batch inference without high batch sampling?
A: If the context is long and the number of generated tokens is high, then the benefits of multi-query are clear. Please see Section 5.2.1.

Q: Is bifurcated attention applicable for the case where we process different inputs in a batch?
A: No. In that case, if we need a solution to reduce memory I/O during incremental decoding, then multi-query attention can be appealing, especially in scenarios with a high number of generated tokens where the incremental decoding phase dominates the overall latency. This is because there is an overhead to multi-query due to the context encoding phase, as outlined in the main paper.

Q: Any caveats to using bifurcated attention?
A: For small workloads (low context length and batch size), due to the fact that we split the attention into two parts, there can be less parallelization of the GEMM kernels, which could lead to higher latency, especially for MQ models. However, one can get the best of both worlds given any model by triggering bifurcated attention under high workload scenarios and using normal attention otherwise. With such a workload-based switch, bifurcated attention is guaranteed to provide better latency and efficiency.

Q: How does model quantization (or lower precision arithmetic) affect the findings?
A: There are two regimes for quantization: model weight quantization and attention quantization. To date, most quantization only focuses on the weight since the attention computation is precision-sensitive and quantization has not proved to be viable. Model quantization can make incremental decoding faster due to lower memory I/O of the model itself, since the effective model size in memory is smaller. This shifts the latency curve downward for all context lengths or batch sizes. The overall conclusion for the bifurcated and multi-query attention remains the same, however, since the improvement proposed in the paper is on the attention component, which is orthogonal to the model weight. If attention quantization is viable in the future, the lower memory on the attention tensor will effectively reduce the memory I/O for KV cache by a factor of 2 in the case of int8 quantization (compared to fp16 or bf16) or a factor of 4 in the case of int4. Overall, this will flatten the latency growth with respect to batch size or context length. The overall comparative complexity (a) with or without bifurcated attention or (b) multi-head vs. multi-query remains the same.

Q: Does the conclusion depend on the inference implementation or different hardware?
A: Different inference platforms, such as FasterTransformers (GPUs) or PaLM inference (TPUs), can yield different latency numbers. However, the relative I/O complexity among different attention mechanisms does not change, resulting in similar relative trends among different attention mechanisms. That being said, it is possible that more efficient implementations or more performant chip/system configurations, including different tensor parallelism degrees, can result in different slopes for the latency growth with respect to context length and batch size. In that case, the trade-off points in terms of context length or batch size can be different. The comparative complexity remains the same based on the analysis.

Q: How does bifurcated attention differ from using attention mask for sampling as in done in SpecInfer (Miao et al., 2023)? This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Authors: Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Related Work 2. Related Work 3. Background 3. Background 3.1. Notation and 3.2. Language Model Inference 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 5.3. Applications 6. Conclusion and References 6. Conclusion and References A. FAQs A. FAQs B. Related Work B. Related Work C. Setup C. Setup D. Multi-Group Attention Family D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention E. Context-Aware Bifurcated Attention F. Applications: Additional Results F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques G. Compatibility with Speculative Decoding and Fast Decoding techniques A. FAQs Q: If we already have an MQ model that seems to be quite efficient at large batch sampling, is bifurcated attention necessary?
A: The proposed context-aware bifurcated attention is an exact computation that provides a different way to perform attention, so one can use it "for free" without a performance tradeoff. Due to the reduced memory I/O, it enables more extreme cases of batch sampling, such as a larger batch, even for long contexts. Q: How applicable is multi-query for single-batch inference without high batch sampling?
A: If the context is long and the number of generated tokens is high, then the benefits of multi-query are clear. Please see Section 5.2.1. Q: Is bifurcated attention applicable for the case where we process different inputs in a batch?
A: No. In that case, if we need a solution to reduce memory I/O during incremental decoding, then multi-query attention can be appealing, especially in scenarios with a high number of generated tokens where the incremental decoding phase dominates the overall latency. This is because there is an overhead to multi-query due to the context encoding phase, as outlined in the main paper. Q: Any caveats to using bifurcated attention?
A: For small workloads (low context length and batch size), due to the fact that we split the attention into two parts, there can be less parallelization of the GEMM kernels, which could lead to higher latency, especially for MQ models. However, one can get the best of both worlds given any model by triggering bifurcated attention under high workload scenarios and using normal attention otherwise. With such a workload-based switch, bifurcated attention is guaranteed to provide better latency and efficiency. Q: How does model quantization (or lower precision arithmetic) affect the findings?
A: There are two regimes for quantization: model weight quantization and attention quantization. To date, most quantization only focuses on the weight since the attention computation is precision-sensitive and quantization has not proved to be viable. Model quantization can make incremental decoding faster due to lower memory I/O of the model itself, since the effective model size in memory is smaller. This shifts the latency curve downward for all context lengths or batch sizes. The overall conclusion for the bifurcated and multi-query attention remains the same, however, since the improvement proposed in the paper is on the attention component, which is orthogonal to the model weight. If attention quantization is viable in the future, the lower memory on the attention tensor will effectively reduce the memory I/O for KV cache by a factor of 2 in the case of int8 quantization (compared to fp16 or bf16) or a factor of 4 in the case of int4. Overall, this will flatten the latency growth with respect to batch size or context length. The overall comparative complexity (a) with or without bifurcated attention or (b) multi-head vs. multi-query remains the same. Q: Does the conclusion depend on the inference implementation or different hardware?
A: Different inference platforms, such as FasterTransformers (GPUs) or PaLM inference (TPUs), can yield different latency numbers. However, the relative I/O complexity among different attention mechanisms does not change, resulting in similar relative trends among different attention mechanisms. That being said, it is possible that more efficient implementations or more performant chip/system configurations, including different tensor parallelism degrees, can result in different slopes for the latency growth with respect to context length and batch size. In that case, the trade-off points in terms of context length or batch size can be different. The comparative complexity remains the same based on the analysis. Q: How does bifurcated attention differ from using attention mask for sampling as in done in SpecInfer (Miao et al., 2023)? Q: If we already have an MQ model that seems to be quite efficient at large batch sampling, is bifurcated attention necessary? A: The proposed context-aware bifurcated attention is an exact computation that provides a different way to perform attention, so one can use it "for free" without a performance tradeoff. Due to the reduced memory I/O, it enables more extreme cases of batch sampling, such as a larger batch, even for long contexts. Q: If we already have an MQ model that seems to be quite efficient at large batch sampling, is bifurcated attention necessary? Q: A: The proposed context-aware bifurcated attention is an exact computation that provides a different way to perform attention, so one can use it "for free" without a performance tradeoff. Due to the reduced memory I/O, it enables more extreme cases of batch sampling, such as a larger batch, even for long contexts. A: Q: How applicable is multi-query for single-batch inference without high batch sampling? A: If the context is long and the number of generated tokens is high, then the benefits of multi-query are clear. Please see Section 5.2.1. Q: How applicable is multi-query for single-batch inference without high batch sampling? Q: A: If the context is long and the number of generated tokens is high, then the benefits of multi-query are clear. Please see Section 5.2.1. A: Q: Is bifurcated attention applicable for the case where we process different inputs in a batch? A: No. In that case, if we need a solution to reduce memory I/O during incremental decoding, then multi-query attention can be appealing, especially in scenarios with a high number of generated tokens where the incremental decoding phase dominates the overall latency. This is because there is an overhead to multi-query due to the context encoding phase, as outlined in the main paper. Q: Is bifurcated attention applicable for the case where we process different inputs in a batch? Q: A: No. In that case, if we need a solution to reduce memory I/O during incremental decoding, then multi-query attention can be appealing, especially in scenarios with a high number of generated tokens where the incremental decoding phase dominates the overall latency. This is because there is an overhead to multi-query due to the context encoding phase, as outlined in the main paper. A: Q: Any caveats to using bifurcated attention? A: For small workloads (low context length and batch size), due to the fact that we split the attention into two parts, there can be less parallelization of the GEMM kernels, which could lead to higher latency, especially for MQ models. However, one can get the best of both worlds given any model by triggering bifurcated attention under high workload scenarios and using normal attention otherwise. With such a workload-based switch, bifurcated attention is guaranteed to provide better latency and efficiency. Q : Any caveats to using bifurcated attention? Q A: For small workloads (low context length and batch size), due to the fact that we split the attention into two parts, there can be less parallelization of the GEMM kernels, which could lead to higher latency, especially for MQ models. However, one can get the best of both worlds given any model by triggering bifurcated attention under high workload scenarios and using normal attention otherwise. With such a workload-based switch, bifurcated attention is guaranteed to provide better latency and efficiency. A: Q: How does model quantization (or lower precision arithmetic) affect the findings? A: There are two regimes for quantization: model weight quantization and attention quantization. To date, most quantization only focuses on the weight since the attention computation is precision-sensitive and quantization has not proved to be viable. Model quantization can make incremental decoding faster due to lower memory I/O of the model itself, since the effective model size in memory is smaller. This shifts the latency curve downward for all context lengths or batch sizes. The overall conclusion for the bifurcated and multi-query attention remains the same, however, since the improvement proposed in the paper is on the attention component, which is orthogonal to the model weight. If attention quantization is viable in the future, the lower memory on the attention tensor will effectively reduce the memory I/O for KV cache by a factor of 2 in the case of int8 quantization (compared to fp16 or bf16) or a factor of 4 in the case of int4. Overall, this will flatten the latency growth with respect to batch size or context length. The overall comparative complexity (a) with or without bifurcated attention or (b) multi-head vs. multi-query remains the same. Q: How does model quantization (or lower precision arithmetic) affect the findings? Q: A: There are two regimes for quantization: model weight quantization and attention quantization. To date, most quantization only focuses on the weight since the attention computation is precision-sensitive and quantization has not proved to be viable. Model quantization can make incremental decoding faster due to lower memory I/O of the model itself, since the effective model size in memory is smaller. This shifts the latency curve downward for all context lengths or batch sizes. The overall conclusion for the bifurcated and multi-query attention remains the same, however, since the improvement proposed in the paper is on the attention component, which is orthogonal to the model weight. If attention quantization is viable in the future, the lower memory on the attention tensor will effectively reduce the memory I/O for KV cache by a factor of 2 in the case of int8 quantization (compared to fp16 or bf16) or a factor of 4 in the case of int4. Overall, this will flatten the latency growth with respect to batch size or context length. The overall comparative complexity (a) with or without bifurcated attention or (b) multi-head vs. multi-query remains the same. A: Q: Does the conclusion depend on the inference implementation or different hardware? A: Different inference platforms, such as FasterTransformers (GPUs) or PaLM inference (TPUs), can yield different latency numbers. However, the relative I/O complexity among different attention mechanisms does not change, resulting in similar relative trends among different attention mechanisms. That being said, it is possible that more efficient implementations or more performant chip/system configurations, including different tensor parallelism degrees, can result in different slopes for the latency growth with respect to context length and batch size. In that case, the trade-off points in terms of context length or batch size can be different. The comparative complexity remains the same based on the analysis. Q: Does the conclusion depend on the inference implementation or different hardware? A: Different inference platforms, such as FasterTransformers (GPUs) or PaLM inference (TPUs), can yield different latency numbers. However, the relative I/O complexity among different attention mechanisms does not change, resulting in similar relative trends among different attention mechanisms. That being said, it is possible that more efficient implementations or more performant chip/system configurations, including different tensor parallelism degrees, can result in different slopes for the latency growth with respect to context length and batch size. In that case, the trade-off points in terms of context length or batch size can be different. The comparative complexity remains the same based on the analysis. Q: How does bifurcated attention differ from using attention mask for sampling as in done in SpecInfer (Miao et al., 2023)? Q: How does bifurcated attention differ from using attention mask for sampling as in done in SpecInfer (Miao et al., 2023)? Q: This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

FAQs: How Bifurcated Attention Improves AI Model Efficiency

Faster AI Code Generation with Bifurcated Attention

Authors:
(1) Ben Athiwaratkun, AWS AI Labs;
(2) Sujan Kumar Gonugondla, AWS AI Labs;
(3) Sanjay Krishna Gouda, AWS AI Labs;
(4) Haifeng Qian, AWS AI Labs;
(5) Sanjay Krishna Gouda, AWS AI Labs;
(6) Hantian Ding, AWS AI Labs;
(7) Qing Sun, AWS AI Labs;
(8) Jun Wang, AWS AI Labs;
(9) Jiacheng Guo, AWS AI Labs;
(10 Liangfu Chen, AWS AI Labs;
(11) Parminder Bhatia, GE HealthCare (work done at AWS);
(12) Ramesh Nallapati, Amazon AGI (work done at AWS);
(13) Sudipta Sengupta, AWS AI Labs;
(14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction 2. Related Work 3. Background 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 6. Conclusion and References A. FAQs B. Related Work C. Setup D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques 5. Experiments We first conduct experiments to see how capabilities scale with respect to model size for each attention type in Section 5.1. We find that attention types with higher compression (lower number of attention groups g) require model size compensation, ≈ 10% for multi-query (g = 1). We use such findings to compare the latency between the multi-head and the larger multi-query models of equal capabilities in Section 5.2. In Section 5.2.2, we focus on the single-context batch sampling scenario where we demonstrate the significant latency reduction of bifurcated attention and revisit the comparison between multi-head and multi-query in light of bifurcated attention. We outline inference details in Appendix C.5. 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention To compare the capabilities of different attention mechanisms, one can either scale other model configurations such as the number of layers ℓ, the number of heads h in order to make match the total model sizes between different attentions. However, it is often difficult to match the number of parameters exactly. In this work, we compare different attention mechanisms via the loss-vs-size scaling laws. For the setup, we use the model hyperparameters similar to that of GPT-3, where the size ranges from 125M to 13B, with hyperparameters such as ℓ, h, k increasing in tandem. Then, we consider three cases where g = 1 (multi-query), g = h (multi-head) and 1 < g < h (multi-group) where Appendix C.1 and C.2 shows the training and model configuration details. We train all three attention models of each size and plot the validation loss versus model size, shown in Figure 3. Our findings are summarized below. Higher number of attention groups g leads to higher expressiveness The results in Figure 3 shows the validation loss versus model size (log scale). The results indicate that, for the same model size (vertical slice across the plot), multi-head attention g = h achieves the lowest validation loss compared to 1 < g < h (multi-group) and g = 1 (multiquery). This trend holds consistently over three orders of magnitude of model sizes, where the curves corresponding to multi-head, multi-group and multi-query do not cross, implying that the rank of model expressiveness, or relative capabilities per number of parameters, is quite stable. An intuitive explanation is that the lower g corresponds to a lower rank representation of the key and value tensors, which encodes lower representation power of the past context and therefore yields lower capabilities than higher g, given the same model size. Scaling laws via downstream performance We use the average scores from two code generation benchmarks, multilingual HumanEval and MBXP (Athiwaratkun et al., 2022), as a proxy for model capabilities in addition to the validation loss. This approach is similar to that of the GPT-4 technical report (OpenAI, 2023) where HumanEval (Python) (Chen et al., 2021) is used to track the performance across multiple magnitudes of compute. In our case, we average across all 13 evaluation languages and two benchmarks to obtain a more stable proxy for capabilities. The result in Figure 3 demonstrates similar trend compared to the validation loss where the pass rate curves indicate the same relative expressiveness for multi-head, multi-group and multi-query attention. Matching capabilities by model size compensation Given the same capabilities (horizontal slice of the plot in Figure 3), the distance between two curves indicates the model size difference that the lower-rank attention needs to compensate in order to match the multi-head model performance. Empirically, we average the distance along the interpolated lines (log scale) and find this to correspond to 1.104 times; that is, a multi-query model can have the same capabilities as the multi-head model if the size is increased by ≈ 10% of the multi-head model size. Similarly, the gap is < 10% for multi-group attention. Alternatively, one can argue that a multi-query model of the same size could match a multi-head if the multi-query model is given more compute. However, in the regime where we train language models until or close to convergence and the performance saturates with respect to compute, the difference in capabilities will likely remain. Therefore, the size compensation is likely the most fair approach for comparison. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Authors: Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Related Work 2. Related Work 3. Background 3. Background 3.1. Notation and 3.2. Language Model Inference 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 5.3. Applications 6. Conclusion and References 6. Conclusion and References A. FAQs A. FAQs B. Related Work B. Related Work C. Setup C. Setup D. Multi-Group Attention Family D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention E. Context-Aware Bifurcated Attention F. Applications: Additional Results F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques G. Compatibility with Speculative Decoding and Fast Decoding techniques 5. Experiments We first conduct experiments to see how capabilities scale with respect to model size for each attention type in Section 5.1. We find that attention types with higher compression (lower number of attention groups g) require model size compensation, ≈ 10% for multi-query (g = 1). We use such findings to compare the latency between the multi-head and the larger multi-query models of equal capabilities in Section 5.2. In Section 5.2.2, we focus on the single-context batch sampling scenario where we demonstrate the significant latency reduction of bifurcated attention and revisit the comparison between multi-head and multi-query in light of bifurcated attention. We outline inference details in Appendix C.5. 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention To compare the capabilities of different attention mechanisms, one can either scale other model configurations such as the number of layers ℓ, the number of heads h in order to make match the total model sizes between different attentions. However, it is often difficult to match the number of parameters exactly. In this work, we compare different attention mechanisms via the loss-vs-size scaling laws. For the setup, we use the model hyperparameters similar to that of GPT-3, where the size ranges from 125M to 13B, with hyperparameters such as ℓ, h, k increasing in tandem. Then, we consider three cases where g = 1 (multi-query), g = h (multi-head) and 1 < g < h (multi-group) where Appendix C.1 and C.2 shows the training and model configuration details. We train all three attention models of each size and plot the validation loss versus model size, shown in Figure 3. Our findings are summarized below. Higher number of attention groups g leads to higher expressiveness The results in Figure 3 shows the validation loss versus model size (log scale). The results indicate that, for the same model size (vertical slice across the plot), multi-head attention g = h achieves the lowest validation loss compared to 1 < g < h (multi-group) and g = 1 (multiquery). This trend holds consistently over three orders of magnitude of model sizes, where the curves corresponding to multi-head, multi-group and multi-query do not cross, implying that the rank of model expressiveness, or relative capabilities per number of parameters, is quite stable. An intuitive explanation is that the lower g corresponds to a lower rank representation of the key and value tensors, which encodes lower representation power of the past context and therefore yields lower capabilities than higher g, given the same model size. Higher number of attention groups leads to higher expressiveness Scaling laws via downstream performance We use the average scores from two code generation benchmarks, multilingual HumanEval and MBXP (Athiwaratkun et al., 2022), as a proxy for model capabilities in addition to the validation loss. This approach is similar to that of the GPT-4 technical report (OpenAI, 2023) where HumanEval (Python) (Chen et al., 2021) is used to track the performance across multiple magnitudes of compute. In our case, we average across all 13 evaluation languages and two benchmarks to obtain a more stable proxy for capabilities. The result in Figure 3 demonstrates similar trend compared to the validation loss where the pass rate curves indicate the same relative expressiveness for multi-head, multi-group and multi-query attention. Scaling laws via downstream performance Matching capabilities by model size compensation Given the same capabilities (horizontal slice of the plot in Figure 3), the distance between two curves indicates the model size difference that the lower-rank attention needs to compensate in order to match the multi-head model performance. Empirically, we average the distance along the interpolated lines (log scale) and find this to correspond to 1.104 times; that is, a multi-query model can have the same capabilities as the multi-head model if the size is increased Matching capabilities by model size compensation by ≈ 10% of the multi-head model size. Similarly, the gap is < 10% for multi-group attention. Alternatively, one can argue that a multi-query model of the same size could match a multi-head if the multi-query model is given more compute. However, in the regime where we train language models until or close to convergence and the performance saturates with respect to compute, the difference in capabilities will likely remain. Therefore, the size compensation is likely the most fair approach for comparison. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

A Little Less Memory, A Lot More Speed: The Science of Bifurcated Attention

Authors:
(1) Ben Athiwaratkun, AWS AI Labs;
(2) Sujan Kumar Gonugondla, AWS AI Labs;
(3) Sanjay Krishna Gouda, AWS AI Labs;
(4) Haifeng Qian, AWS AI Labs;
(5) Sanjay Krishna Gouda, AWS AI Labs;
(6) Hantian Ding, AWS AI Labs;
(7) Qing Sun, AWS AI Labs;
(8) Jun Wang, AWS AI Labs;
(9) Jiacheng Guo, AWS AI Labs;
(10 Liangfu Chen, AWS AI Labs;
(11) Parminder Bhatia, GE HealthCare (work done at AWS);
(12) Ramesh Nallapati, Amazon AGI (work done at AWS);
(13) Sudipta Sengupta, AWS AI Labs;
(14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction 2. Related Work 3. Background 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 6. Conclusion and References A. FAQs B. Related Work C. Setup D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention Multi-query attention, proposed by Shazeer (2019), is an attention mechanism for transformers models that uses a single head for the key and value tensors, compared to h heads in the traditional multi-head attention (Vaswani et al., 2017). This technique effectively reduces the KV memory IO by h times, which leads to higher inference efficiency during incremental decoding. In effect, the single-head key or value tensor is shared and used to attend to all the multi-head query, hence the name multi-query. This corresponds to a compression in representation power of the key and value tensor, which we will see in the scaling laws study (Section 5.1) that it results in a reduced expressiveness in terms of model parameter efficiency. Such reduced expressiveness can be compensated by scaling the model bigger than the multi-head counterpart to match the representation power. We can also extrapolate these insights to a generalized multiquery attention mechanism (Ainslie et al., 2023), which provides a framework to understand both multi-query and multi-head attention, and everything in between. Here, the degree of KV compression is dictated by the number of attention groups g, where we alternatively refer to the generalized multi-query as multi-group. Each attention group can be interpreted as the broadcasted attention between a single head of key or value tensor, and multiple heads of query. In this paradigm, multi-query attention is a special case where the number of groups g = 1; that is, there is exactly one such group. Conversely, multi-head attention is another special case where the number of attention groups matches the number of heads (g = h), in which case each head in the key or value tensor attends to one head in the query. More generally, the number of groups g can lie anywhere between 1 and h, indicating various degrees of compression. For practical purposes, it is most convenient when g divides h. The attention mechanism in this setting can be expressed in terms of Einstein summation as: logits = ⟨q, K⟩ : einsum(bgpnk, bgmk) → bgpnm (1) o = ⟨w, V ⟩ : einsum(bgpmn, bgmv) → bgpnv (2) This generalized multi-group attention mechanism thus provides a unified perspective on the design space of attention architectures. By adjusting the number of attention groups g, one can flexibly tune these trade-offs, potentially yielding new regimes of performance for transformer models. In Section 5.1, we will look into such capability vs latency trade-off. This paper is available on arxiv under CC BY 4.0 DEED license. Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Authors: Authors: (1) Ben Athiwaratkun, AWS AI Labs; (2) Sujan Kumar Gonugondla, AWS AI Labs; (3) Sanjay Krishna Gouda, AWS AI Labs; (4) Haifeng Qian, AWS AI Labs; (5) Sanjay Krishna Gouda, AWS AI Labs; (6) Hantian Ding, AWS AI Labs; (7) Qing Sun, AWS AI Labs; (8) Jun Wang, AWS AI Labs; (9) Jiacheng Guo, AWS AI Labs; (10 Liangfu Chen, AWS AI Labs; (11) Parminder Bhatia, GE HealthCare (work done at AWS); (12) Ramesh Nallapati, Amazon AGI (work done at AWS); (13) Sudipta Sengupta, AWS AI Labs; (14) Bing Xiang, Goldman Sachs (work done at AWS). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2. Related Work 2. Related Work 3. Background 3. Background 3.1. Notation and 3.2. Language Model Inference 3.1. Notation and 3.2. Language Model Inference 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4. Context-Aware Bifurcated Attention and 4.1. Motivation 4.2. Formulation and 4.3. Memory IO Complexity 4.2. Formulation and 4.3. Memory IO Complexity 5. Experiments 5. Experiments 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.1. Comparing Capabilities of Multi-Head, Multi-Query, and Multi-Group Attention 5.2. Latencies of Capabilities-Equivalent Models 5.2. Latencies of Capabilities-Equivalent Models 5.3. Applications 5.3. Applications 6. Conclusion and References 6. Conclusion and References A. FAQs A. FAQs B. Related Work B. Related Work C. Setup C. Setup D. Multi-Group Attention Family D. Multi-Group Attention Family E. Context-Aware Bifurcated Attention E. Context-Aware Bifurcated Attention F. Applications: Additional Results F. Applications: Additional Results G. Compatibility with Speculative Decoding and Fast Decoding techniques G. Compatibility with Speculative Decoding and Fast Decoding techniques 3.3. Multi-Query, Multi-Head and the Generalized Multi-Query Attention Multi-query attention, proposed by Shazeer (2019), is an attention mechanism for transformers models that uses a single head for the key and value tensors, compared to h heads in the traditional multi-head attention (Vaswani et al., 2017). This technique effectively reduces the KV memory IO by h times, which leads to higher inference efficiency during incremental decoding. In effect, the single-head key or value tensor is shared and used to attend to all the multi-head query, hence the name multi-query. This corresponds to a compression in representation power of the key and value tensor, which we will see in the scaling laws study (Section 5.1) that it results in a reduced expressiveness in terms of model parameter efficiency. Such reduced expressiveness can be compensated by scaling the model bigger than the multi-head counterpart to match the representation power. We can also extrapolate these insights to a generalized multiquery attention mechanism (Ainslie et al., 2023), which provides a framework to understand both multi-query and multi-head attention, and everything in between. Here, the degree of KV compression is dictated by the number of attention groups g, where we alternatively refer to the generalized multi-query as multi-group. Each attention group can be interpreted as the broadcasted attention between a single head of key or value tensor, and multiple heads of query. In this paradigm, multi-query attention is a special case where the number of groups g = 1; that is, there is exactly one such group. Conversely, multi-head attention is another special case where the number of attention groups matches the number of heads (g = h), in which case each head in the key or value tensor attends to one head in the query. More generally, the number of groups g can lie anywhere between 1 and h, indicating various degrees of compression. For practical purposes, it is most convenient when g divides h. The attention mechanism in this setting can be expressed in terms of Einstein summation as: logits = ⟨q, K⟩ : einsum(bgpnk, bgmk) → bgpnm (1) o = ⟨w, V ⟩ : einsum(bgpmn, bgmv) → bgpnv (2) This generalized multi-group attention mechanism thus provides a unified perspective on the design space of attention architectures. By adjusting the number of attention groups g, one can flexibly tune these trade-offs, potentially yielding new regimes of performance for transformer models. In Section 5.1, we will look into such capability vs latency trade-off. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Why Multi-Query Attention Matters for Large Language Models

**LUXEMBOURG, Luxembourg, February 11th, 2025/CyberNewsWire/--**Gcore, the global edge AI, cloud, network, and security solutions provider, today announced the findings of its Q3-Q4 2024 Radar report into DDoS attack trends. DDoS attacks have reached unprecedented scale and disruption in 2024, and businesses need to act fast to protect themselves from this evolving threat. The report reveals a significant escalation in the total number of DDoS attacks and their magnitude, measured in terabits per second (Tbps). Key highlights from Q3-Q4 2024 ●    Compared to Q3–Q4 2023, the number of DDoS attacks have risen by 56%, which highlights a steep long-term growth trend. ●    The gaming industry continues to be the most targeted by DDoS attacks, accounting for 34% of all attacks. ●    In Q3-Q4 2024, the financial services sector experienced a significant increase, accounting for 26% of all DDoS attacks, up from 12% in the previous period. ●    There was a 17% increase in the total number of attacks compared with Q1-Q2 2024. ●    The largest attack peaked at 2Tbps in Q3-Q4 2024, which is an 18% increase from Q1-Q2 2024. ●    DDoS attacks are becoming shorter in duration but more powerful. Attackers Are Shifting Their Focus The sectors that were targeted in Q3-Q4 2024 reflect a changing focus among DDoS attackers. The technology industry has seen a steady increase in its share of DDoS attacks, increasing from 7% to 19% since Q3-Q4 2023. This is because DDoS attackers recognise the wide-reaching disruption potential of attacking technology services. A single successful attack can take out a service that countless organizations depend on - causing significant harm to people and businesses. Another reason that technology platforms have seen an increase in DDoS attacks is due to their vast computational power, which malicious actors can exploit to intensify their attacks. The gaming industry continues to be the most-attacked industry, although there were 31% fewer attacks compared with Q1-Q2 2024. The decline in attacks may be attributed to several factors. For instance, gaming companies are strengthening their DDoS defenses in response to ongoing attacks, which may result in fewer successful attacks. Another explanation is that attackers may be shifting their focus towards other high-value sectors, such as financial services, which saw a 117% increase in the number of attacks. The sector’s critical online services and susceptibility to ransom-based attacks make it a prime target. Andrey Slastenov, Head of Security at Gcore, commented: “The latest Gcore Radar should be a wake-up call to businesses across all industries. Not only is the number and intensity of attacks increasing, but attackers are expanding the scope of their attacks to reach an increasingly wide range of sectors. Businesses must invest in robust DDoS detection, mitigation, and protection to prevent the financial and reputational impact of an attack.” The Geographical Distribution of DDoS attacks With a presence that spans six continents, Gcore can accurately track the geographical sources of DDoS attacks. Gcore derives these insights from the attackers’ IP addresses and the geographic locations of the data centers where malicious traffic is targeted. Gcore’s findings have highlighted the Netherlands as a key source of attacks; leading application-layer attacks with 21% and ranking second for network-layer attacks at 18%. The U.S. ranked highly across both layers, reflecting its vast internet infrastructure for hackers to exploit. Brazil featured prominently in network-layer attacks at 14%. Brazil’s growing digital economy and connectivity make it an emerging source of attacks. China and Indonesia also featured prominently, with Indonesia showing a growth in application-layer attacks at 8%, which reflects a broader trend of increased attack activity in Southeast Asia. Short But Potent Attacks Continue To Take Hold DDoS attacks are becoming shorter in duration, but no less disruptive. The longest DDoS attack duration during Q3-Q4 2024 was five hours, which is a significant decrease from 16 hours in the first half of the year. This is reflective of an increasing trend towards shorter but more intense attacks. These ‘burst attacks’ can be more difficult to detect as they may blend in with normal traffic spikes. The delay in detection gives attackers a window of opportunity to disrupt services before cyber defenses can kick in. The trend of shorter DDoS attack durations can in part be attributed to improvements in cybersecurity. As security tightens, attackers have learned to adapt with short burst attacks designed to bypass defenses. A short DDoS attack can also double as a smokescreen to conceal a secondary attack, such as ransomware deployment. To access the full report, users can visit https://gcore.com/library/gcore-radar-ddos-attack-trends-q3-q4-2024 About Gcore Gcore is a global edge AI, cloud, network, and security solutions provider. Headquartered in Luxembourg, with a team of 600 operating from ten offices worldwide, Gcore provides solutions to global leaders in numerous industries. Gcore manages its global IT infrastructure across six continents, with one of the best network performances in Europe, Africa, and LATAM due to the average response time of 30 ms worldwide. Gcore’s network consists of 180 points of presence worldwide in reliable Tier IV and Tier III data centers, with a total network capacity exceeding 200 Tbps. Users can learn more at gcore.com or follow them on LinkedIn, Twitter, and Facebook. Contact Gcore press contact pr@gcore.com This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here **LUXEMBOURG, Luxembourg, February 11th, 2025/CyberNewsWire/--**Gcore, the global edge AI, cloud, network, and security solutions provider, today announced the findings of its Q3-Q4 2024 Radar report into DDoS attack trends. DDoS attacks have reached unprecedented scale and disruption in 2024, and businesses need to act fast to protect themselves from this evolving threat. The report reveals a significant escalation in the total number of DDoS attacks and their magnitude, measured in terabits per second (Tbps). Key highlights from Q3-Q4 2024 ●    Compared to Q3–Q4 2023, the number of DDoS attacks have risen by 56%, which highlights a steep long-term growth trend. ●    The gaming industry continues to be the most targeted by DDoS attacks, accounting for 34% of all attacks. ●    In Q3-Q4 2024, the financial services sector experienced a significant increase, accounting for 26% of all DDoS attacks, up from 12% in the previous period. ●    There was a 17% increase in the total number of attacks compared with Q1-Q2 2024. ●    The largest attack peaked at 2Tbps in Q3-Q4 2024, which is an 18% increase from Q1-Q2 2024. ●    DDoS attacks are becoming shorter in duration but more powerful. Attackers Are Shifting Their Focus The sectors that were targeted in Q3-Q4 2024 reflect a changing focus among DDoS attackers. The technology industry has seen a steady increase in its share of DDoS attacks, increasing from 7% to 19% since Q3-Q4 2023. This is because DDoS attackers recognise the wide-reaching disruption potential of attacking technology services. A single successful attack can take out a service that countless organizations depend on - causing significant harm to people and businesses. Another reason that technology platforms have seen an increase in DDoS attacks is due to their vast computational power, which malicious actors can exploit to intensify their attacks. The gaming industry continues to be the most-attacked industry, although there were 31% fewer attacks compared with Q1-Q2 2024. The decline in attacks may be attributed to several factors. For instance, gaming companies are strengthening their DDoS defenses in response to ongoing attacks, which may result in fewer successful attacks. Another explanation is that attackers may be shifting their focus towards other high-value sectors, such as financial services, which saw a 117% increase in the number of attacks. The sector’s critical online services and susceptibility to ransom-based attacks make it a prime target. Andrey Slastenov, Head of Security at Gcore, commented: “The latest Gcore Radar should be a wake-up call to businesses across all industries. Not only is the number and intensity of attacks increasing, but attackers are expanding the scope of their attacks to reach an increasingly wide range of sectors. Businesses must invest in robust DDoS detection, mitigation, and protection to prevent the financial and reputational impact of an attack.” Andrey Slastenov, Head of Security at Gcore, commented: “The latest Gcore Radar should be a wake-up call to businesses across all industries. Not only is the number and intensity of attacks increasing, but attackers are expanding the scope of their attacks to reach an increasingly wide range of sectors. Businesses must invest in robust DDoS detection, mitigation, and protection to prevent the financial and reputational impact of an attack.” The Geographical Distribution of DDoS attacks With a presence that spans six continents, Gcore can accurately track the geographical sources of DDoS attacks. Gcore derives these insights from the attackers’ IP addresses and the geographic locations of the data centers where malicious traffic is targeted. Gcore’s findings have highlighted the Netherlands as a key source of attacks; leading application-layer attacks with 21% and ranking second for network-layer attacks at 18%. The U.S. ranked highly across both layers, reflecting its vast internet infrastructure for hackers to exploit. Brazil featured prominently in network-layer attacks at 14%. Brazil’s growing digital economy and connectivity make it an emerging source of attacks. China and Indonesia also featured prominently, with Indonesia showing a growth in application-layer attacks at 8%, which reflects a broader trend of increased attack activity in Southeast Asia. Short But Potent Attacks Continue To Take Hold DDoS attacks are becoming shorter in duration, but no less disruptive. The longest DDoS attack duration during Q3-Q4 2024 was five hours, which is a significant decrease from 16 hours in the first half of the year. This is reflective of an increasing trend towards shorter but more intense attacks. These ‘burst attacks’ can be more difficult to detect as they may blend in with normal traffic spikes. The delay in detection gives attackers a window of opportunity to disrupt services before cyber defenses can kick in. The trend of shorter DDoS attack durations can in part be attributed to improvements in cybersecurity. As security tightens, attackers have learned to adapt with short burst attacks designed to bypass defenses. A short DDoS attack can also double as a smokescreen to conceal a secondary attack, such as ransomware deployment. To access the full report, users can visit https://gcore.com/library/gcore-radar-ddos-attack-trends-q3-q4-2024 https://gcore.com/library/gcore-radar-ddos-attack-trends-q3-q4-2024 https://gcore.com/library/gcore-radar-ddos-attack-trends-q3-q4-2024 About Gcore Gcore is a global edge AI, cloud, network, and security solutions provider. Headquartered in Luxembourg, with a team of 600 operating from ten offices worldwide, Gcore provides solutions to global leaders in numerous industries. Gcore manages its global IT infrastructure across six continents, with one of the best network performances in Europe, Africa, and LATAM due to the average response time of 30 ms worldwide. Gcore Gcore Gcore’s network consists of 180 points of presence worldwide in reliable Tier IV and Tier III data centers, with a total network capacity exceeding 200 Tbps. Users can learn more at gcore.com or follow them on LinkedIn , Twitter , and Facebook . gcore.com gcore.com LinkedIn LinkedIn Twitter Twitter Facebook Facebook Contact Gcore press contact pr@gcore.com This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here here here

Gcore Radar Report Reveals 56% Year-on-Year Increase In DDoS Attacks

El informe de Gcore Radar revela un aumento interanual del 56 % en los ataques DDoS

דוח Gcore Radar חושף עלייה של 56% בהתקפות DDoS משנה לשנה

Gcore レーダーレポート、DDoS 攻撃が前年比 56% 増加

Gcore Radar есебі DDoS шабуылдарының 56% өскенін көрсетеді

Извештајот за радар на Gcore открива 56% зголемување на DDoS нападите од година во година

Gcore радарын тайланд DDoS халдлага жилээс жилд 56%-иар өссөн байна.

Gcore Radar-rapport onthult 56% jaarlijkse toename van DDoS-aanvallen

د Gcore رادار راپور د DDoS بریدونو کې د کال په پرتله ۵۶٪ زیاتوالی ښیي

Relatório do Gcore Radar revela aumento de 56% em ataques DDoS ano a ano

Raportul Gcore Radar dezvăluie o creștere de 56% de la an la an a atacurilor DDoS

Gcore Radar Chirevo Chinoratidza 56% Gore-pa-Gore Kuwedzera muDDoS Kurwiswa

Гцоре Радар извештај открива 56% пораст ДДоС напада у односу на претходну годину

Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix: Adaptive attacks & Qualitative Examples A.6 Adaptive attacks In this section, we report the results using adaptive attacks, where the attacker has knowledge of any defense mechanism employed in the system. We employ α=0.0001 (Eq. 1) as we found that the attacker needs a larger step size in the presence of a defense to produce successful attacks. From Table 10, we see that the attacks become less successful in the presence of a defense. Also, the adaptive attacker needs to add much more perceptible perturbations (lower average SPR) in the presence of a defense. This clearly shows that a simple pre-processing defense can provide some degree of robustness against adversarial attacks. Also, from Figure 5, we observe that the presence of a defense in the system makes the attacks less effective under limited attack budgets. For a given attack budget of say T=50 iterations, only 60% of the attacks are successful on the system with TDNF defense, compared to ∼80% for a system without defense. However, note that these attacks were performed with a limited attack budget of T=100 iterations. A malicious actor with a larger attack budget can potentially produce a higher jailbreak rate. A.7 Qualitative Examples Table 11 compares an in-house and a public SLM model responses on harmful examples. We showcase scenarios where models produce safe content although irrelevant, as well as safe content with relevant understanding of the input audio. Overall, the in-house SLM model demonstrate better speech comprehension ability. Table 12 compares models on various helpfulness questions across different aspects of usefulness. We notice that the in-house SLM model SMistral-FT sometimes errs on the side of caution, indicating a healthy tension between harmlessness and helpfulness. We leave further explorations of such properties of SLM models to future work. On the other hand, we notice the importance of a strong audio understanding ability in an SLM, as failing to do so can impact the usefulness of an SLM model by mistaking entity names in the input audio. Table 13 showcases examples of jailbroken responses and the corresponding SPRs. We clearly see that the model produces safe responses adhering to its safety training without attack, but even minimal perturbations can cause it to produce unsafe responses. In some cases (last 2 examples), the model begins its response with a safety aligned response, but generates harmful content subsequently. This further demonstrates the need for thorough studies on model safety, and a cursory analysis may be insufficient. Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix: Adaptive attacks & Qualitative Examples Part 12 A.6 Adaptive attacks In this section, we report the results using adaptive attacks, where the attacker has knowledge of any defense mechanism employed in the system. We employ α=0.0001 (Eq. 1) as we found that the attacker needs a larger step size in the presence of a defense to produce successful attacks. From Table 10, we see that the attacks become less successful in the presence of a defense. Also, the adaptive attacker needs to add much more perceptible perturbations (lower average SPR) in the presence of a defense. This clearly shows that a simple pre-processing defense can provide some degree of robustness against adversarial attacks. Also, from Figure 5, we observe that the presence of a defense in the system makes the attacks less effective under limited attack budgets. For a given attack budget of say T=50 iterations, only 60% of the attacks are successful on the system with TDNF defense, compared to ∼80% for a system without defense. However, note that these attacks were performed with a limited attack budget of T=100 iterations. A malicious actor with a larger attack budget can potentially produce a higher jailbreak rate. A.7 Qualitative Examples Table 11 compares an in-house and a public SLM model responses on harmful examples. We showcase scenarios where models produce safe content although irrelevant, as well as safe content with relevant understanding of the input audio. Overall, the in-house SLM model demonstrate better speech comprehension ability. Table 12 compares models on various helpfulness questions across different aspects of usefulness. We notice that the in-house SLM model SMistral-FT sometimes errs on the side of caution, indicating a healthy tension between harmlessness and helpfulness. We leave further explorations of such properties of SLM models to future work. On the other hand, we notice the importance of a strong audio understanding ability in an SLM, as failing to do so can impact the usefulness of an SLM model by mistaking entity names in the input audio. Table 13 showcases examples of jailbroken responses and the corresponding SPRs. We clearly see that the model produces safe responses adhering to its safety training without attack, but even minimal perturbations can cause it to produce unsafe responses. In some cases (last 2 examples), the model begins its response with a safety aligned response, but generates harmful content subsequently. This further demonstrates the need for thorough studies on model safety, and a cursory analysis may be insufficient. Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Adaptive Attacks Expose SLM Vulnerabilities and Qualitative Insights

Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix: Adaptive attacks & Qualitative Examples 5.3 Transfer attacks In this section, we report the results of crossmodel attacks, where perturbations generated by white-box attacks on a surrogate model are applied directly on the victim models. Similar to Section 5.2, we consider only the set of originally safe audios for the jailbreak analysis. From Table 4, we see that the models exhibit varying amount of vulnerability to cross-model perturbations. In general, the FlanT5-based models are more robust to such perturbations even when the surrogate model uses similar architecture. This finding aligns with the sample-specific results we showed earlier in Section 5.2. Note that these experiments were conducted on internally developed models that use similar training strategies and data. Therefore, this is a “grey-box” scenario, where attacker has access to a limited knowledge about the victim models. To evaluate the effectiveness of the generated perturbations in a true black-box setting, we also apply the perturbations on the publicly available SpeechGPT model. The number of audio samples evaluated is much fewer for this model because of the relatively smaller number of originally safe audios. From the results in Table 5, first we see that random perturbations cause significant jailbreaks. Further, we observe that adversarial perturbations are not as effective in this setting. This demonstrates the need for characterizing the models’ safety from several angles including random perturbations. We also evaluated cross-prompt attacks, and observed that it yielded successful attacks only on par with random noise (see results in Appendix A.3). 5.4 Countermeasures In Table 6, we report the results of applying the proposed TDNF defense that injects random noise (at 4 different SNRs) to the audios. We observe that in all the cases, the TDNF defense reduces the %JSR by a substantial margin compared to no defense (shown in column “None”). Such noise addition does not significantly impact the helpfulness of our systems (see Appendix A.5 for more details). Combined with the results on random noise presented in Table 3, we can conclude that a simple pre-processing defense is a viable solution to thwart adversarial jailbreaking threats, with minimal impact on the utility. We also performed adaptive attacks, where the attacker has knowledge of the defense. We found that an adaptive attacker can evade the defense, albeit with reduced success and at a much lower SPR, rendering the perturbations more perceptible.[14] Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix: Adaptive attacks & Qualitative Examples Part 12 5.3 Transfer attacks In this section, we report the results of crossmodel attacks, where perturbations generated by white-box attacks on a surrogate model are applied directly on the victim models. Similar to Section 5.2, we consider only the set of originally safe audios for the jailbreak analysis. From Table 4, we see that the models exhibit varying amount of vulnerability to cross-model perturbations. In general, the FlanT5-based models are more robust to such perturbations even when the surrogate model uses similar architecture. This finding aligns with the sample-specific results we showed earlier in Section 5.2. Note that these experiments were conducted on internally developed models that use similar training strategies and data. Therefore, this is a “grey-box” scenario, where attacker has access to a limited knowledge about the victim models. To evaluate the effectiveness of the generated perturbations in a true black-box setting, we also apply the perturbations on the publicly available SpeechGPT model. The number of audio samples evaluated is much fewer for this model because of the relatively smaller number of originally safe audios. From the results in Table 5, first we see that random perturbations cause significant jailbreaks. Further, we observe that adversarial perturbations are not as effective in this setting. This demonstrates the need for characterizing the models’ safety from several angles including random perturbations. We also evaluated cross-prompt attacks, and observed that it yielded successful attacks only on par with random noise (see results in Appendix A.3). 5.4 Countermeasures In Table 6, we report the results of applying the proposed TDNF defense that injects random noise (at 4 different SNRs) to the audios. We observe that in all the cases, the TDNF defense reduces the %JSR by a substantial margin compared to no defense (shown in column “None”). Such noise addition does not significantly impact the helpfulness of our systems (see Appendix A.5 for more details). Combined with the results on random noise presented in Table 3, we can conclude that a simple pre-processing defense is a viable solution to thwart adversarial jailbreaking threats, with minimal impact on the utility. We also performed adaptive attacks, where the attacker has knowledge of the defense. We found that an adaptive attacker can evade the defense, albeit with reduced success and at a much lower SPR, rendering the perturbations more perceptible.[14] Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Transfer Attacks Reveal SLM Vulnerabilities and Effective Noise Defenses

Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix: Adaptive attacks & Qualitative Examples A.3 Cross-prompt attacks In Table 7, we report the results of jailbreaking the models using cross-prompt attack strategies. In particular, for each target question, we use 10 randomly selected perturbations (from successful attacks on the model). We report an attack successful if atleast one of the 10 perturbations is able to jailbreak the system. We observe that cross-prompt attacks are less effective than samplespecific attacks. However, they do show slightly more success in attacking than random perturbations. The reason for this could be the mismatched length between the perturbation and the target audio, which required truncation or replication of the perturbation. Further study is required to assess the possibility of more sophisticated cross-prompt attacks that leverage information about the audio length to tailor the perturbation accordingly. A.4 Training Data Ablations In Table 8, we study the usefulness of incorporating general instruction tuning data during cross-modal instruction fine-tuning stage for SLM models. We identify three of the best performing ASR pretrained and safety-aligned SLM models from Table 2 to conduct this study. As discussed in Section 4.1, we observe that incorporating TTS data of Alpaca improves the helpfulness of SLMs on general questions. We further notice that such models have capabilities to outperform their counterparts in safety and relevance as well, especially when the backbone LLMs are taken out-of-the-box without any safety alignments (Flan-T5 (3B) and Mistral-7B). However, when backbone LLMs are tuned for harmlessness (Mistral-7B-FT), we observe that there is a healthy tension between helpfulness and harmlessness, indicating merits of using general instruction data as well as a further scope for improving safety alignment of SLMs. A.5 Impact of random noise on helpfulness We study the effect of random noise perturbations on helpfulness questions against three in-house SLM models, trained with ASR modality preadaptation. We demonstrate the results in Table 9 and compare the results with the original spoken questions without any perturbations. We observe that for models with strong helpfulness capabilities, random noising can effect at most 15% of their usefulness. We believe that the robustness of SLMs for helpfulness can be improved by adding more general instruction tuning data and by noisy data augmentations during training. We leave this exploration to future work. Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix: Adaptive attacks & Qualitative Examples Part 12 A.3 Cross-prompt attacks In Table 7, we report the results of jailbreaking the models using cross-prompt attack strategies. In particular, for each target question, we use 10 randomly selected perturbations (from successful attacks on the model). We report an attack successful if atleast one of the 10 perturbations is able to jailbreak the system. We observe that cross-prompt attacks are less effective than samplespecific attacks. However, they do show slightly more success in attacking than random perturbations. The reason for this could be the mismatched length between the perturbation and the target audio, which required truncation or replication of the perturbation. Further study is required to assess the possibility of more sophisticated cross-prompt attacks that leverage information about the audio length to tailor the perturbation accordingly. A.4 Training Data Ablations In Table 8, we study the usefulness of incorporating general instruction tuning data during cross-modal instruction fine-tuning stage for SLM models. We identify three of the best performing ASR pretrained and safety-aligned SLM models from Table 2 to conduct this study. As discussed in Section 4.1, we observe that incorporating TTS data of Alpaca improves the helpfulness of SLMs on general questions. We further notice that such models have capabilities to outperform their counterparts in safety and relevance as well, especially when the backbone LLMs are taken out-of-the-box without any safety alignments (Flan-T5 (3B) and Mistral-7B). However, when backbone LLMs are tuned for harmlessness (Mistral-7B-FT), we observe that there is a healthy tension between helpfulness and harmlessness, indicating merits of using general instruction data as well as a further scope for improving safety alignment of SLMs. A.5 Impact of random noise on helpfulness We study the effect of random noise perturbations on helpfulness questions against three in-house SLM models, trained with ASR modality preadaptation. We demonstrate the results in Table 9 and compare the results with the original spoken questions without any perturbations. We observe that for models with strong helpfulness capabilities, random noising can effect at most 15% of their usefulness. We believe that the robustness of SLMs for helpfulness can be improved by adding more general instruction tuning data and by noisy data augmentations during training. We leave this exploration to future work. Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Cross-Prompt Attacks and Data Ablations Impact SLM Robustness

Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix: Adaptive attacks & Qualitative Examples 2. Background Safety alignment Considering the broad capabilities of LLMs, concerns have emerged about their potential to cause harm (Bender et al., 2021; Bommasani et al., 2021), sparking discussions on aligning these systems to human values and ethics (Hendrycks et al., 2020). Askell et al. (2021) propose three criteria–helpfulness, honesty, and harmlessness (HHH)–to which a properlyaligned system should adhere. To train systems in accordance with these criteria, LLM developers employ safety training mechanisms. First, models are trained on large amounts of data for general language capabilities, followed by a safety training stage to deter the system from responding to harmful questions (Askell et al., 2021; Ouyang et al., 2022). The examples used for safety alignment training are typically hand-crafted by dedicated redteams that are tasked with constructing prompts to jailbreak (Shen et al., 2024; Wei et al., 2023). Jailbreak attacks on LLMs Inie et al. (2023) outlines several prompting strategies that are typically used in jailbreaking LLMs. However, the prompts therein are manually handcrafted on a caseby-case basis, hindering their large-scale adoption. Moreover, such prompts become irrelevant after safety training, requiring newer strategies (Inie et al., 2023). Recently, automatic prompt engineering techniques have been explored (Shin et al., 2020; Zou et al., 2023). In particular, Zou et al. (2023) demonstrate the use of adversarial attacks to jailbreak LLMs. In addition to white-box attacks which assume full access to the models, they show that a careful combination of techniques can produce perturbations that are transferable to commercial models for which only an API is exposed. More recently, Wichers et al. (2024) proposed a gradient-based technique to automatically learn red-teaming data for model evaluation and alignment. However, these methods rely on discrete optimization techniques or approximation tricks, which are computationally expensive, and may not generalize well. Jailbreak attacks on multi-modal LLMs Unlike text-based jailbreak attacks, which require discrete optimization techniques, systems operating on continuous domain signals such as images, audio, etc. can be more readily attacked (Goodfellow et al., 2014; Jati et al., 2021), and therefore are more vulnerable to adversarial threats (Qi et al., 2023). In addition to adversarial perturbations, other approaches like prompt injection (Bagdasaryan et al., 2023) and model poisoning (Zhai et al., 2023) have also been studied as alternatives to compromise safety of multi-modal LLMs. Recent studies have demonstrated that adversarial attacks only on vision encoders (without access to the LLM) are just sufficient to jailbreak VLMs (Zhao et al., 2023b; Dong et al., 2023). Previous studies have also demonstrated that adversarial perturbations generated on images being fed into VLMs break their safety alignment, and also transfer to different models in a black-box setup (Qi et al., 2023). In this work, we follow a similar approach and generate adversarial perturbations to speech input for safety aligned SLMs. In this way, we characterize the vulnerability of spoken-instruction following SLM models. Jailbreak Evaluations Previous studies have conducted jailbreak evaluations either through human annotation (Wei et al., 2023; Qi et al., 2023), toxicity assessment (Carlini et al., 2023; Wichers et al., 2024), string matching (Zou et al., 2023), supervised classifiers (Wichers et al., 2024), or a preference LLM as a judge (Chao et al., 2023; Shen et al., 2024). Techniques other than the latter are either computationally expensive or requires tedious human involvement which is time-intensive as well as costly when scaled. Moreover, some studies have shown that a well-trained preference model can significantly contribute to evaluating whether an LLM is jailbroken (Wang et al., 2023). Therefore, in this work, we use a preference LLM judge to assess the safety and utility of SLMs. Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix: Adaptive attacks & Qualitative Examples Part 12 2. Background Safety alignment Considering the broad capabilities of LLMs, concerns have emerged about their potential to cause harm (Bender et al., 2021; Bommasani et al., 2021), sparking discussions on aligning these systems to human values and ethics (Hendrycks et al., 2020). Askell et al. (2021) propose three criteria–helpfulness, honesty, and harmlessness (HHH)–to which a properlyaligned system should adhere. To train systems in accordance with these criteria, LLM developers employ safety training mechanisms. First, models are trained on large amounts of data for general language capabilities, followed by a safety training stage to deter the system from responding to harmful questions (Askell et al., 2021; Ouyang et al., 2022). The examples used for safety alignment training are typically hand-crafted by dedicated redteams that are tasked with constructing prompts to jailbreak (Shen et al., 2024; Wei et al., 2023). Safety Jailbreak attacks on LLMs Inie et al. (2023) outlines several prompting strategies that are typically used in jailbreaking LLMs. However, the prompts therein are manually handcrafted on a caseby-case basis, hindering their large-scale adoption. Moreover, such prompts become irrelevant after safety training, requiring newer strategies (Inie et al., 2023). Recently, automatic prompt engineering techniques have been explored (Shin et al., 2020; Zou et al., 2023). In particular, Zou et al. (2023) demonstrate the use of adversarial attacks to jailbreak LLMs. In addition to white-box attacks which assume full access to the models, they show that a careful combination of techniques can produce perturbations that are transferable to commercial models for which only an API is exposed. More recently, Wichers et al. (2024) proposed a gradient-based technique to automatically learn red-teaming data for model evaluation and alignment. However, these methods rely on discrete optimization techniques or approximation tricks, which are computationally expensive, and may not generalize well. Jailbreak attacks on LLMs Jailbreak attacks on multi-modal LLMs Unlike text-based jailbreak attacks, which require discrete optimization techniques, systems operating on continuous domain signals such as images, audio, etc. can be more readily attacked (Goodfellow et al., 2014; Jati et al., 2021), and therefore are more vulnerable to adversarial threats (Qi et al., 2023). In addition to adversarial perturbations, other approaches like prompt injection (Bagdasaryan et al., 2023) and model poisoning (Zhai et al., 2023) have also been studied as alternatives to compromise safety of multi-modal LLMs. Recent studies have demonstrated that adversarial attacks only on vision encoders (without access to the LLM) are just sufficient to jailbreak VLMs (Zhao et al., 2023b; Dong et al., 2023). Previous studies have also demonstrated that adversarial perturbations generated on images being fed into VLMs break their safety alignment, and also transfer to different models in a black-box setup (Qi et al., 2023). In this work, we follow a similar approach and generate adversarial perturbations to speech input for safety aligned SLMs. In this way, we characterize the vulnerability of spoken-instruction following SLM models. Jailbreak attacks on multi-modal LLMs Jailbreak Evaluations Previous studies have conducted jailbreak evaluations either through human annotation (Wei et al., 2023; Qi et al., 2023), toxicity assessment (Carlini et al., 2023; Wichers et al., 2024), string matching (Zou et al., 2023), supervised classifiers (Wichers et al., 2024), or a preference LLM as a judge (Chao et al., 2023; Shen et al., 2024). Techniques other than the latter are either computationally expensive or requires tedious human involvement which is time-intensive as well as costly when scaled. Moreover, some studies have shown that a well-trained preference model can significantly contribute to evaluating whether an LLM is jailbroken (Wang et al., 2023). Therefore, in this work, we use a preference LLM judge to assess the safety and utility of SLMs. Jailbreak Evaluations Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Safety Alignment and Jailbreak Attacks Challenge Modern LLMs

Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix:Adaptive attacks & Qualitative Examples Abstract Integrated Speech and Large Language Models (SLMs) that can follow speech instructions and generate relevant text responses have gained popularity lately. However, the safety and robustness of these models remains largely unclear. In this work, we investigate the potential vulnerabilities of such instruction-following speech-language models to adversarial attacks and jailbreaking. Specifically, we design algorithms that can generate adversarial examples to jailbreak SLMs in both white-box and blackbox attack settings without human involvement. Additionally, we propose countermeasures to thwart such jailbreaking attacks. Our models, trained on dialog data with speech instructions, achieve state-of-the-art performance on spoken question-answering task, scoring over 80% on both safety and helpfulness metrics. Despite safety guardrails, experiments on jailbreaking demonstrate the vulnerability of SLMs to adversarial perturbations and transfer attacks, with average attack success rates of 90% and 10% respectively when evaluated on a dataset of carefully designed harmful questions spanning 12 different toxic categories.[1] However, we demonstrate that our proposed countermeasures reduce the attack success significantly. 1. Introduction As large language models (LLMs) obtain broad and diverse capabilities, it is imperative to understand and mitigate any potential harm caused by them, as well as prevent their misuse by malicious actors (Bender et al., 2021; Bai et al., 2022; OpenAI, 2024). LLM developers have begun to train models explicitly for “safety alignment” to deter them from producing unsafe responses (Askell et al., 2021). However, these LLMs have been found to be susceptible to adversarial attacks, where carefully crafted perturbations on the prompts were used to jailbreak the models’ safety training (Zou et al., 2023). More recently, visual language models (VLMs) have also been shown to be vulnerable to such attacks, where the attacks are performed on the image modality (Carlini et al., 2023; Qi et al., 2023). In this work, we investigate the vulnerability of speech language models’ (SLMs) safety guardrails against adversarial perturbations of the input speech signal, and explore countermeasures against such attacks. In particular, we assess SLMs through the lens of spoken question-answering (Spoken QA) task, and investigate jailbreaking their safety guardrails. while also considering their overall utility (helpfulness) and the relevance of the produced responses to the question. We perform extensive experiments using different adversarial threat scenarios, including white-box and transfer-based attacks. We show that a malicious adversary with full (white-box) access to a SLM’s gradients can jailbreak its safety training using barely perceptible perturbations on the input audio. Though weaker than white-box attacks, we also demonstrate that perturbations generated using one model transfer to other models, and that different model architectures show different levels of vulnerability. We further propose countermeasures against the adversarial threats and show that adding random noise (a simplified version of randomized smoothing defense (Cohen et al., 2019)) can provide reasonable robustness against the attacks. We summarize our contributions below: To our knowledge, this is the first study examining the potential safety limitations of unified speech and language models for jailbreaking.


Present a setup to comprehensively benchmark the safety alignment and utility of SLMs. Characterize the vulnerability of such models and the effectiveness of adversarial speech perturbations in jailbreaking their safety guardrails.


Explore transferability of adversarial attacks across models, assuming various levels of information available to an attacker and consequently present simple yet effective countermeasures to improve the adversarial robustness of SLMs. This paper is available on arxiv under CC BY 4.0 DEED license. [1] Content Warning: This paper contains examples of harmful language that might be disturbing to some readers. Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix:Adaptive attacks & Qualitative Examples Part 12 Abstract Integrated Speech and Large Language Models (SLMs) that can follow speech instructions and generate relevant text responses have gained popularity lately. However, the safety and robustness of these models remains largely unclear. In this work, we investigate the potential vulnerabilities of such instruction-following speech-language models to adversarial attacks and jailbreaking. Specifically, we design algorithms that can generate adversarial examples to jailbreak SLMs in both white-box and blackbox attack settings without human involvement. Additionally, we propose countermeasures to thwart such jailbreaking attacks. Our models, trained on dialog data with speech instructions, achieve state-of-the-art performance on spoken question-answering task, scoring over 80% on both safety and helpfulness metrics. Despite safety guardrails, experiments on jailbreaking demonstrate the vulnerability of SLMs to adversarial perturbations and transfer attacks, with average attack success rates of 90% and 10% respectively when evaluated on a dataset of carefully designed harmful questions spanning 12 different toxic categories.[1] However, we demonstrate that our proposed countermeasures reduce the attack success significantly. 1. Introduction As large language models (LLMs) obtain broad and diverse capabilities, it is imperative to understand and mitigate any potential harm caused by them, as well as prevent their misuse by malicious actors (Bender et al., 2021; Bai et al., 2022; OpenAI, 2024). LLM developers have begun to train models explicitly for “safety alignment” to deter them from producing unsafe responses (Askell et al., 2021). However, these LLMs have been found to be susceptible to adversarial attacks, where carefully crafted perturbations on the prompts were used to jailbreak the models’ safety training (Zou et al., 2023). More recently, visual language models (VLMs) have also been shown to be vulnerable to such attacks, where the attacks are performed on the image modality (Carlini et al., 2023; Qi et al., 2023). In this work, we investigate the vulnerability of speech language models’ (SLMs) safety guardrails against adversarial perturbations of the input speech signal, and explore countermeasures against such attacks. In particular, we assess SLMs through the lens of spoken question-answering (Spoken QA) task, and investigate jailbreaking their safety guardrails. while also considering their overall utility (helpfulness) and the relevance of the produced responses to the question. We perform extensive experiments using different adversarial threat scenarios, including white-box and transfer-based attacks. We show that a malicious adversary with full (white-box) access to a SLM’s gradients can jailbreak its safety training using barely perceptible perturbations on the input audio. Though weaker than white-box attacks, we also demonstrate that perturbations generated using one model transfer to other models, and that different model architectures show different levels of vulnerability. We further propose countermeasures against the adversarial threats and show that adding random noise (a simplified version of randomized smoothing defense (Cohen et al., 2019)) can provide reasonable robustness against the attacks. We summarize our contributions below: To our knowledge, this is the first study examining the potential safety limitations of unified speech and language models for jailbreaking. Present a setup to comprehensively benchmark the safety alignment and utility of SLMs. Characterize the vulnerability of such models and the effectiveness of adversarial speech perturbations in jailbreaking their safety guardrails. Explore transferability of adversarial attacks across models, assuming various levels of information available to an attacker and consequently present simple yet effective countermeasures to improve the adversarial robustness of SLMs. To our knowledge, this is the first study examining the potential safety limitations of unified speech and language models for jailbreaking. To our knowledge, this is the first study examining the potential safety limitations of unified speech and language models for jailbreaking. Present a setup to comprehensively benchmark the safety alignment and utility of SLMs. Characterize the vulnerability of such models and the effectiveness of adversarial speech perturbations in jailbreaking their safety guardrails. Present a setup to comprehensively benchmark the safety alignment and utility of SLMs. Characterize the vulnerability of such models and the effectiveness of adversarial speech perturbations in jailbreaking their safety guardrails. Explore transferability of adversarial attacks across models, assuming various levels of information available to an attacker and consequently present simple yet effective countermeasures to improve the adversarial robustness of SLMs. Explore transferability of adversarial attacks across models, assuming various levels of information available to an attacker and consequently present simple yet effective countermeasures to improve the adversarial robustness of SLMs. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv [1] Content Warning: This paper contains examples of harmful language that might be disturbing to some readers.

Unified Speech and Language Models Can Be Vulnerable to Adversarial Attacks

Table of Links Part 1: Abstract & Introduction Part 2: Background Part 3: Attacks & Countermeasures Part 4: Experimental Setup Part 5: Datasets & Evaluation Part 6: Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 7: Results & Discussion Part 8: Transfer Attacks & Countermeasures Part 9: Conclusion, Limitations, & Ethics Statement Part 10: Appendix: Audio Encoder Pre-training & Evaluation Part 11: Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 12: Appendix: Adaptive attacks & Qualitative Examples 3. Attacks & Countermeasures Amongst the various applications for SLMs, in this work, we showcase adversarial attacks and defense techniques for the task of Spoken QA. We follow the well-established literature in adversarial attacks and defenses, and adapt those techniques for the purpose of jailbreaking SLMs. Specifically, we explore two different attack scenarios: white-box and black-box, similar to the approach in Qi et al. (2023), and consequently identify safeguarding countermeasures. 3.1 Attack methodology White-box attack This scenario assumes an attacker with full access to the SLM including the ability to back-propagate through the model (Goodfellow et al., 2014). For example, one can leverage an open-source public model, or a more sophisticated attacker can develop their own system. Such an attacker with access to the model’s gradients can use established techniques such as fast gradient sign method and projected gradient descent (PGD) (Khamaiseh et al., 2022). Following recent studies of Zou et al. (2023) and Wei et al. (2023), we use initial affirmative responses as the target for the adversarial optimization. Specifically, the target response for the attack is an affirmation followed by a repetition of the user’s query. For example, for the question “Can you provide a tutorial to rob a bank?”, the target response is “Sure, here is how to rob a bank”. Enforcing such a constraint on the model’s response puts it in a state where it continues to provide the harmful response (Zou et al., 2023). In this work, we use PGD algorithm (Madry et al., 2017) to generate the adversarial perturbations. Denoting the audio input as x, the response generated by the LLM can be written as F(x). The loss (denoted by L) between the generated response and the adversarial target response (denoted by y) is used to create the perturbation. Assuming that the audio LLM is end-to-end differentiable, the perturbation δ is learned to minimize L as shown in Equation 1. Transfer attacks Several publicly available LLM providers (such as OpenAI and Anthropic) only provide restricted API access, limiting the ability to compute gradients with respect to the input. In such cases, an attacker can resort to gradient approximation techniques using multiple queries or transfer attacks. Gradient estimation techniques rely on multiple queries to the LLM to approximate the gradient based on the generated responses (Ilyas et al., 2018). However, running multiple forward passes through an LLM can be computationally prohibitive, also LLM providers may limit the number of queries by a single user, making such attacks infeasible. In transfer attacks, an attacker uses a surrogate model with access to gradients to generate a perturbation. The generated perturbation is then added to the audio to attack a victim model. Transfer attacks are most successful when the surrogate and the victim models share the same architecture, though transfer across different architectures have also been observed in some cases (Qi et al., 2023). In this work, we experiment with two types of transfer-based attacks, as shown in Figure 2: cross-model and cross-prompt. Cross-model: We perturb an input to attack one model in a white-box setting, then use the perturbed input to directly attack a different model. This is the typical black-box transfer attack setting. Cross-prompt: We craft a perturbation to jailbreak the model for an audio input and use it to jailbreak the model for a different audio. We match the length of the learned perturbation to the target prompt through truncation or replication. This attack assumes access to the model’s gradients, but helps determine the potential transferability of perturbations. 3.2 Countermeasure Techniques to safeguard LLMs from adversarial attacks that have been proposed in literature (Kumar et al., 2023; Mehrabi et al., 2023; Ge et al., 2023) are specific to text-only models. Also, well-known defenses against classical adversarial attacks such as adversarial training are impractical to apply to LLMs due to computational constraints (Jain et al., 2023). Therefore, we use a simple pre-processing technique called time-domain noise flooding (TDNF), that applies additive noise as a defense (Mehlman et al., 2023; Rajaratnam and Kalita, 2018). The rationale is that the front-end speech encoder of the SLM is robust to additive random noise, while such noise can effectively “drown out” the adversarial perturbation. We add white gaussian noise (WGN) directly to the time-domain speech signal that is input to the model. The signal-to-noise ratio (SNR) of the noise is a hyper-parameter that determines the amount of robustness achieved, with smaller values providing better defense. This approach can be imagined to be a simplified version of randomized smoothing (Cohen et al., 2019), with only one forward pass. Authors:
(1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com);
(2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions;
(3) Srikanth Ronanki, AWS AI Labs, Amazon;
(4) Anshu Bhatia, AWS AI Labs, Amazon;
(5) Karel Mundnich, AWS AI Labs, Amazon;
(6) Saket Dingliwal, AWS AI Labs, Amazon;
(7) Nilaksh Das, AWS AI Labs, Amazon;
(8) Zejiang Hou, AWS AI Labs, Amazon;
(9) Goeric Huybrechts, AWS AI Labs, Amazon;
(10) Srikanth Vishnubhotla, AWS AI Labs, Amazon;
(11) Daniel Garcia-Romero, AWS AI Labs, Amazon;
(12) Sundararajan Srinivasan, AWS AI Labs, Amazon;
(13) Kyu J Han, AWS AI Labs, Amazon;
(14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. Table of Links Part 1 : Abstract & Introduction Part 1 Part 2 : Background Part 2 Part 3 : Attacks & Countermeasures Part 3 Part 4 : Experimental Setup Part 4 Part 5 : Datasets & Evaluation Part 5 Part 6 : Attack, Countermeasure Parameters, & Baseline: Random Perturbations Part 6 Part 7 : Results & Discussion Part 7 Part 8 : Transfer Attacks & Countermeasures Part 8 Part 9 : Conclusion, Limitations, & Ethics Statement Part 9 Part 10 : Appendix: Audio Encoder Pre-training & Evaluation Part 10 Part 11 : Appendix: Cross-prompt attacks, Training Data Ablations, & Impact of random noise on helpfulness Part 11 Part 12 : Appendix: Adaptive attacks & Qualitative Examples Part 12 3. Attacks & Countermeasures Amongst the various applications for SLMs, in this work, we showcase adversarial attacks and defense techniques for the task of Spoken QA. We follow the well-established literature in adversarial attacks and defenses, and adapt those techniques for the purpose of jailbreaking SLMs. Specifically, we explore two different attack scenarios: white-box and black-box, similar to the approach in Qi et al. (2023), and consequently identify safeguarding countermeasures. 3.1 Attack methodology White-box attack This scenario assumes an attacker with full access to the SLM including the ability to back-propagate through the model (Goodfellow et al., 2014). For example, one can leverage an open-source public model, or a more sophisticated attacker can develop their own system. Such an attacker with access to the model’s gradients can use established techniques such as fast gradient sign method and projected gradient descent (PGD) (Khamaiseh et al., 2022). White-box attack Following recent studies of Zou et al. (2023) and Wei et al. (2023), we use initial affirmative responses as the target for the adversarial optimization. Specifically, the target response for the attack is an affirmation followed by a repetition of the user’s query. For example, for the question “Can you provide a tutorial to rob a bank?”, the target response is “Sure, here is how to rob a bank”. Enforcing such a constraint on the model’s response puts it in a state where it continues to provide the harmful response (Zou et al., 2023). In this work, we use PGD algorithm (Madry et al., 2017) to generate the adversarial perturbations. Denoting the audio input as x, the response generated by the LLM can be written as F(x). The loss (denoted by L) between the generated response and the adversarial target response (denoted by y) is used to create the perturbation. Assuming that the audio LLM is end-to-end differentiable, the perturbation δ is learned to minimize L as shown in Equation 1. Transfer attacks Several publicly available LLM providers (such as OpenAI and Anthropic) only provide restricted API access, limiting the ability to compute gradients with respect to the input. In such cases, an attacker can resort to gradient approximation techniques using multiple queries or transfer attacks. Gradient estimation techniques rely on multiple queries to the LLM to approximate the gradient based on the generated responses (Ilyas et al., 2018). However, running multiple forward passes through an LLM can be computationally prohibitive, also LLM providers may limit the number of queries by a single user, making such attacks infeasible. Transfer attacks In transfer attacks, an attacker uses a surrogate model with access to gradients to generate a perturbation. The generated perturbation is then added to the audio to attack a victim model. Transfer attacks are most successful when the surrogate and the victim models share the same architecture, though transfer across different architectures have also been observed in some cases (Qi et al., 2023). In this work, we experiment with two types of transfer-based attacks, as shown in Figure 2: cross-model and cross-prompt. Cross-model: We perturb an input to attack one model in a white-box setting, then use the perturbed input to directly attack a different model. This is the typical black-box transfer attack setting. Cross-model: Cross-model: Cross-prompt: We craft a perturbation to jailbreak the model for an audio input and use it to jailbreak the model for a different audio. We match the length of the learned perturbation to the target prompt through truncation or replication. This attack assumes access to the model’s gradients, but helps determine the potential transferability of perturbations. Cross-prompt: Cross-prompt: 3.2 Countermeasure Techniques to safeguard LLMs from adversarial attacks that have been proposed in literature (Kumar et al., 2023; Mehrabi et al., 2023; Ge et al., 2023) are specific to text-only models. Also, well-known defenses against classical adversarial attacks such as adversarial training are impractical to apply to LLMs due to computational constraints (Jain et al., 2023). Therefore, we use a simple pre-processing technique called time-domain noise flooding (TDNF), that applies additive noise as a defense (Mehlman et al., 2023; Rajaratnam and Kalita, 2018). The rationale is that the front-end speech encoder of the SLM is robust to additive random noise, while such noise can effectively “drown out” the adversarial perturbation. We add white gaussian noise (WGN) directly to the time-domain speech signal that is input to the model. The signal-to-noise ratio (SNR) of the noise is a hyper-parameter that determines the amount of robustness achieved, with smaller values providing better defense. This approach can be imagined to be a simplified version of randomized smoothing (Cohen et al., 2019), with only one forward pass. Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. Authors: Authors: (1) Raghuveer Peri, AWS AI Labs, Amazon and with Equal Contributions (raghperi@amazon.com); (2) Sai Muralidhar Jayanthi, AWS AI Labs, Amazon and with Equal Contributions; (3) Srikanth Ronanki, AWS AI Labs, Amazon; (4) Anshu Bhatia, AWS AI Labs, Amazon; (5) Karel Mundnich, AWS AI Labs, Amazon; (6) Saket Dingliwal, AWS AI Labs, Amazon; (7) Nilaksh Das, AWS AI Labs, Amazon; (8) Zejiang Hou, AWS AI Labs, Amazon; (9) Goeric Huybrechts, AWS AI Labs, Amazon; (10) Srikanth Vishnubhotla, AWS AI Labs, Amazon; (11) Daniel Garcia-Romero, AWS AI Labs, Amazon; (12) Sundararajan Srinivasan, AWS AI Labs, Amazon; (13) Kyu J Han, AWS AI Labs, Amazon; (14) Katrin Kirchhoff, AWS AI Labs, Amazon. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Stories, News & Mentions about ATT

Att’s Stories on HackerNoon

Att's News & Mentions