Miracle-dz/UniFAR-FTUs huggingface dataset:
Long-term plasticity induces sparse and specific synaptic changes in a biophysically detailed cortical model

Synaptic plasticity underlies the brain’s ability to learn and adapt. While in vitro experiments reveal the mechanisms behind plasticity at the level of individual pairs of neurons, they lack the scale to explain how they are coordinated in microcircuits to achieve learning. Conversely, research at the population level still relies on in silico approaches of limited generalizability. To overcome these limitations, we embedded a calcium-based model of functional plasticity that captures the diversity of excitatory connections in a thoroughly validated large-scale cortical network model and studied how plasticity shapes stimulus representations at the microcircuit level. We then used an openly available electron microscopic reconstruction of cortical tissue to confirm our testable predictions. We found that in an in vivo-like network state, plasticity acted sparsely and specifically, keeping the firing rate stable without additional homeostatic mechanisms. Our results predict that this specificity at the circuit level is governed by co-firing functional assemblies, spatial clustering of synapses on dendrites, and the topology of the whole network’s connectivity. These effects cannot be captured with point neuron models, random connectivity and pairwise rules. In summary, our findings elevate descriptions of plasticity rules to the population level, bridging the scales between plasticity and learning in networks.
Discovery of a Well-Folded Protein Interaction Hub Within the Human Long Non-Coding RNA NORAD

The long non-coding RNA NORAD functions in maintaining genomic stability in humans via sequestering Pumilio proteins from the cytoplasm, and thereby modulating the gene expression of mRNA targets of Pumilio proteins. Despite its role in fundamental cellular pathways including chromosome segregation and DNA damage response, there have been limited structural and biophysical descriptions of NORAD. Here, using an integrative approach combining chemical probing coupled to high throughput sequencing, and RNA-pull downs coupled with mass spectrometry, we discovered a well-folded and structured protein interaction hub within the functional core of NORAD. Our in vitro biochemical reconstitutions using purified recombinant proteins and a NORAD repeat unit region within this hub reveal the assembly of a higher-order multimeric RNA-protein complex.
Genetic characterization of glyoxalase pathway in oral streptococci and its contribution to interbacterial competition

Substantial quantities of Reactive Electrophile Species (RES), including methylglyoxal and glyoxal, are generated by microbes and humans. To understand the impact of RES on oral microbial homeostasis, genetic analyses were performed on the glyoxalase pathway in Streptococcus mutans (SMU) and Streptococcus sanguinis (SSA). Loss of glyoxalase I (LguL), which catalyzes the rate-limiting reaction in RES degradation, reduced methylglyoxal and glyoxal tolerance to a far greater extent in SMU than in SSA, decreasing the competitiveness of SMU over SSA in planktonic cultures. MICs showed an overall greater RES tolerance by SMU than SSA; a finding consistent with the ability of methylglyoxal to induce the expression of lguL in SMU, but not in SSA. Computational analysis identified a novel paralogue of LguL in most streptococci represented by SMU.1112c in SMU. ΔSMU.1112c showed a minor decrease in methylglyoxal tolerance under certain conditions, but a significant growth defect on fructose; a phenotype reversed by the deletion of a fructose-1-phosphate-generating sugar: phosphotransferase system or addition of glutathione (GSH) to the medium. Further, deletion of the glucose-PTS in SMU increased RES tolerance partly through enhanced expression of the pyruvate-dehydrogenase complex. Consistent with the requirement of GSH for methylglyoxal detoxification, deletion of glutathione synthetase (gshAB) in SMU significantly reduced RES resistance. This study reveals the critical roles of RES in fitness and interbacterial competition and the effects of PTS in modulating RES metabolism. The fact that RES may impact the pathogenic potential of the oral microbiome via differential effects on beneficial and pathogenic species warrants further investigation. Importance As highly reactive byproducts of sugar metabolism, very little is known regarding the contribution of methylglyoxal or related aldehyde compounds to oral health. The need to better understand the influence of these reactive electrophile species (RES) to microbial physiology and ecology is made more urgent by the widespread condition of hyperglycemia in humans, which is associated with elevated RES levels. Our study showed a significantly greater ability of a major caries pathobiont, Streptococcus mutans, to tolerate methylglyoxal and glyoxal than many commensal oral streptococci. Genetic analysis of methylglyoxal degradation in the pathobiont and commensals identified significant differences in genetic structure and gene regulation patterns that could contribute to differential fitness by constituents of the dental microbiota and ecologic shift in the presence of RES.
High-Efficiency Transformation and Expression of Genomic Libraries in Yeast

Saccharomyces cerevisiae is a powerful system for the expression of genome-wide or combinatorial libraries for diverse types of screening. However, expressing large libraries in yeast requires high-efficiency transformation and controlled expression. Transformation of yeast using electroporation methods is more efficient than chemical methods; however, protocols described for electroporation require large amounts of linearized plasmid DNA and often yield about 106 cfu/µg of plasmid DNA. We optimized the electroporation of yeast cells for the expression of whole-genome libraries to yield up to 108 cfu/µg plasmid DNA. The protocol generates sufficient transformants for 10-100x coverage of diverse genome libraries with small amounts of genomic libraries (0.1µg of DNA per reaction) and provides guidance on calculations to estimate library size coverage and transformation efficiency. It describes the preparation of electrocompetent yeast cells with lithium acetate and dithiothreitol conditioning step and the transformation of cells by electroporation with carrier DNA. We validated the protocol using three yeast surface display libraries and demonstrated using nanopore sequencing that libraries’ size and diversity are preserved. Moreover, expression analysis confirmed library functionality and the method’s efficacy. Hence, this protocol yields a sufficient representation of the genome of interest for downstream screening purposes while limiting the amount of the genomic library required.
Genome-scale quantification and prediction of pathogenic stop codon readthrough by small molecules

Premature termination codons (PTCs) cause ∼10-20% of Mendelian diseases and are the major mechanism of tumor suppressor gene inactivation in cancer. A general strategy to alleviate the effects of PTCs would be to promote translational readthrough. Nonsense suppression by small molecules has proven effective in diverse disease models, but translation into the clinic is hampered by ineffective readthrough of many PTCs. Here we directly tackle the challenge of defining drug efficacy by quantifying readthrough of ∼5,800 human pathogenic stop codons by 8 drugs. We find that different drugs promote readthrough of complementary subsets of PTCs defined by local sequence context. This allows us to build interpretable models that accurately predict drug-induced readthrough genome-wide. Accurate readthrough quantification and prediction will empower clinical trial design and the development of personalized nonsense suppression therapies.
Single-molecule analysis of transcription activation: dynamics of SAGA co-activator recruitment

Transcription activators are said to stimulate gene expression by “recruiting” coactivators to promoters, yet this term fits several different kinetic models. To directly analyze dynamics of activator-coactivator interactions, single-molecule microscopy was used to image promoter DNA, a transcription activator, and the Spt-Ada-Gcn5 Acetyltransferase (SAGA) complex within nuclear extract. SAGA readily, but transiently, binds nucleosome-free DNA without activator, while chromatin template association occurs nearly exclusively when activator is present. On both templates, activator increases SAGA association rates by up to an order of magnitude, and dramatically extends its dwell times. These effects reflect direct interactions with the transactivation domain, as VP16 or Rap1 activation domains produce different SAGA dynamics. Despite multiple bromodomains, acetyl-CoA or histone H3/H4 tail acetylation only modestly improves SAGA binding. Unexpectedly, histone acetylation more strongly affects activator residence. Our studies thus reveal two modes of SAGA interaction with the genome: a short-lived activator-independent interaction with nucleosome-free DNA, and a state tethered to promoter-bound transcription activators that can last up to several minutes.
Dietary diversity and nutritional status of children attending early childhood development centres in Vhembe District, Limpopo province, South Africa

Abstract The present study assessed dietary diversity and anthropometric status of children attending early development centres in South Africa. In the Vhembe District of Limpopo province, South Africa, 273 children were conveniently chosen from 8 randomly selected early childhood development centres for a cross-sectional study. Data were gathered via a questionnaire administered by the interviewer in June 2021. Height, body weight and mid-upper arm circumference were measured to assess anthropometric status. A 24-h dietary recall was obtained to provide information on dietary diversity. The prevalence of underweight, wasting and stunting was 9, 4 and 26 %, respectively. More than half of the children had a low dietary diversity score, according to the Food and Agriculture Organization scoring system for children. Grains, roots, tubers, dairy products, other fruits and vegetables, and flesh-based foods were the highest consumed food groups. The lowest consumption was for eggs, vitamin A-rich fruits and vegetables, legumes and nuts. Height for age and weight for age were significantly associated with dietary diversity score, but not weight for height. Children who did not meet the reference value of greater than 4 for dietary diversity had a significant risk of being underweight (AOR 0⋅25, 95 % CI 0⋅08, 0⋅75) and stunted (AOR 0⋅32, 95 % CI 0⋅14, 0⋅74). The nutritional status of the children was impacted by a lack of adequate dietary diversity. Young children in rural areas need to receive a wide range of food to promote greater diversification of diets in order to diminish the risk of undernutrition.
Proof Complexity of Propositional Model Counting

Recently, the proof system MICE for the model counting problem #SAT was introduced by Fichte, Hecher and Roland (SAT’22). As demonstrated by Fichte et al., the system MICE can be used for proof logging for state-of-the-art #SAT solvers. We perform a proof-complexity study of MICE . For this we first simplify the rules of MICE and obtain a calculus MICE ′ that is polynomially equivalent to MICE . Our main result establishes an exponential lower bound for the number of proof steps in MICE ′ (and hence also in MICE ) for a specific family of CNFs.
DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing

Concurrency use-after-free (UAF) vulnerabilities account for a large portion of UAF vulnerabilities in Linux drivers. Many solutions have been proposed to find either concurrency bugs or UAF vulnerabilities, but few of them can be directly applied to efficiently find concurrency UAF vulnerabilities. In this paper, we propose the first concurrency directed greybox fuzzing solution DDRace to discover concurrency UAF vulnerabilities efficiently in Linux drivers. First, we identify candidate use-after-free locations as target sites and extract the relevant concurrency elements to reduce the exploration space of directed fuzzing. Second, we design a novel vulnerability-related distance metric and an interleaving priority scheme to guide the fuzzer to better explore UAF vulnerabilities and thread interleavings. Lastly, to make test cases reproducible, we design an adaptive kernel state migration scheme to assist continuous fuzzing. We have implemented a prototype of DDRace, and evaluated it on upstream Linux drivers. Results show that DDRace is effective at discovering concurrency use-after-free vulnerabilities. It finds 4 unknown vulnerabilities and 8 known ones, which is more effective than other state-of-the-art solutions.
Sherlock on Specs: Building LTE Conformance Tests through Automated Reasoning

Conformance tests are critical for finding security weaknesses in carrier network systems. However, building a conformance test procedure from specifications is challenging, as indicated by the slow progress made by the 3GPP, particularly in developing security-related tests, even with a large amount of resources already committed. A unique challenge in building the procedure is that a testing system often cannot directly invoke the condition event in a security requirement or directly observe the occurrence of the operation expected to be triggered by the event. Addressing this issue requires an event chain to be found, which once initiated leads to a chain reaction so the testing system can either indirectly triggers the target event or indirectly observe the occurrence of the expected event. To find a solution to this problem and make progress towards a fully automated conformance test generation, we developed a new approach called Contester , which utilizes natural language processing and machine learning to build an event dependency graph from a 3GPP specification, and further perform automated reasoning on the graph to discover the event chains for a given security requirement. Such event chains are further converted by Contester into a conformance test procedure, which is then executed by a testing system to evaluate the compliance of user equipment (UE) with the security requirement. Our evaluation shows that given 22 security requirements from the LTE NAS specification, Contester successfully generated over a hundred test procedures in just 25 minutes. After running these procedures on 22 popular UEs including iPhone 13, Pixel 5a and IoT
Credit Karma: Understanding Security Implications of Exposed Cloud Services through Automated Capability Inference

The increasing popularity of mobile applications (apps) has led to a rapid increase in demand for backend services, such as notifications, data storage, authentication, etc., hosted in cloud platforms. This has induced the attackers to consistently target such cloud services,resulting in a rise in data security incidents. In this paper, we focus on one of the main reasons why cloud services become increasingly vulnerable: (over-)privileges in cloud credentials. We propose a systematic approach to recover cloud credentials from apps, infer their capabilities in cloud, and verify if the capabilities exceed the legitimate needs of the apps. We further look into the security implications of the leaked capabilities, demonstrating how seemingly benev-olent, unprivileged capabilities, when combined, can lead to unexpected, severe security problems. A large-scale study of ∼ 1.3 million apps overtwo types ofcloudservices,notification and storage, on three popular cloud platforms, AWS, Azure, and Alibaba Cloud, shows that ∼ 27.3% of apps that use cloud services expose over-privileged cloud credentials. Moreover, a majority of over-privileged cloud credentials ( ∼ 64.8%) potentially lead to data attacks. During the study, we also uncover new types of attacks enabled by regular cloud credentials, such as spear-phishing through push notification and targeted user data pollution. We have made responsible disclosures to both app vendors and cloud providers and start seeing the impact—over 300 app vendors already fixed the problems.
Hidden Reality: Caution, Your Hand Gesture Inputs in the Immersive Virtual World are Visible to All!

Text entry is an inevitable task while using Virtual Reality (VR) devices in a wide range of applications such as remote learning, gaming, and virtual meeting. VR users enter pass-words/pins to log in to their user accounts in various applications and type regular text to compose emails or browse the internet. The typing activity on VR devices is believed to be resistant to direct observation attacks as the virtual screen in an immersive environment is not directly visible to others present in physical proximity. This paper presents a video-based side-channel attack, Hidden Reality (HR) , that shows – although the virtual screen in VR devices is not in direct sight of adversaries, the indirect observations might get exploited to steal the user’s private information. The Hidden Reality (HR) attack utilizes video clips of the user’s hand gestures while they type on the virtual screen to decipher the typed text in various key entry scenarios on VR devices including typed pins and passwords. Experimental analysis performed on a large corpus of 368 video clips show that the Hidden Reality model can successfully decipher an average of over 75% of the text inputs. The high success rate of our attack model led us to conduct a user study to understand the user’s behavior and perception of security in virtual reality. The analysis showed that over 95% of users were not aware of any security threats on VR devices and believed the immersive environments to be secure from digital attacks. Our attack model challenges users’ false sense of security in immersive environments and emphasizes the need for more stringent security
InfinityGauntlet: Expose Smartphone Fingerprint Authentication to Brute-force Attack

Billions of smartphone fingerprint authentications (SFA) occur daily for unlocking, privacy and payment. Existing threats to SFA include presentation attacks (PA) and some case-by-case vulnerabilities. The former need to know the victim’s fingerprint information (e.g., latent fingerprints) and can be mitigated by liveness detection and security policies. The latter require additional conditions (e.g., third-party screen protector, root permission) and are only exploitable for individual smartphone models. In this paper, we conduct the first investigation on the general zero-knowledge attack towards SFA where no knowledge about the victim is needed. We propose a novelty fingerprint brute-force attack on off-the-shelf smartphones, named I N - FINITY G AUNTLET . Firstly, we discover design vulnerabilities in SFA systems across various manufacturers, operating systems, and fingerprint types to achieve unlimited authentication attempts. Then, we use SPI MITM to bypass liveness detection and make automatic attempts. Finally, we customize a synthetic fingerprint generator to get a valid brute-force fingerprint dictionary. We design and implement low-cost equipment to launch I NFINITY G AUNTLET . A proof-of-concept case study demonstrates that I NFINITY G AUNTLET can brute-force attack successfully in less than an hour without any knowledge of the victim. Additionally, empirical analysis on representative smartphones shows the scalability of our work.
It's all in your head(set): Side-channel attacks on AR/VR systems

With the increasing adoption of Augmented Reality/Virtual Reality (AR/VR) systems, security and privacy concerns attract attention from both academia and industry. This paper demonstrates that AR/VR systems are vulnerable to side-channel attacks launched from software; a malicious application without any special permissions can infer private information about user interactions, other concurrent applications, or even the surrounding world. We develop a number of side-channel attacks targeting different types of private information. Specifically, we demonstrate three attacks on the victim’s interactions, successfully recovering hand gestures, voice commands made by victims, and keystrokes on a virtual keyboard, with accuracy exceeding 90%. We also demonstrate an application fingerprinting attack where the spy is able to identify an application being launched by the victim. The final attack demonstrates that the adversary can perceive a bystander in the real-world environment and estimate the bystander’s distance with Mean Absolute Error (MAE) of 10.3 cm. We believe the threats presented by our attacks are pressing; they expand our understanding of the threat model faced by these emerging systems and inform the development of new AR/VR systems that are resistant to these threats.
ARI: Attestation of Real-time Mission Execution Integrity

With the proliferation of autonomous safety-critical cyber-physical systems (CPS) in our daily life, their security is becoming ever more important. Remote attestation is a powerful mechanism to enable remote veriﬁcation of system integrity. While recent developments have made it possible to efﬁciently attest IoT operations, autonomous systems that are built on top of real-time cyber-physical control loops and execute missions independently present new unique challenges. In this paper, we formulate a new security property, Real-time Mission Execution Integrity (RMEI) to provide proof of correct and timely execution of the missions. While it is an attractive property, measuring it can incur prohibitive overhead for the real-time autonomous system. To tackle this challenge, we propose policy-based attestation of compartments to enable a trade-off between the level of details in measurement and runtime overhead. To further minimize the impact on real-time responsiveness, multiple techniques were developed to improve the performance, including customized software instrumentation and timing recovery through re-execution. We implemented a prototype of ARI and evaluated its performance on ﬁve CPS platforms. A user study involving 21 developers with different skill sets was conducted to understand the usability of our solution.
(M)WAIT for It: Bridging the Gap between Microarchitectural and Architectural Side Channels

In the last years, there has been a rapid increase in microarchitectural attacks, exploiting side effects of various parts of the CPU. Most of them have in common that they rely on timing differences, requiring an architectural high-resolution timer to make microarchitectural states visible to an attacker. In this paper, we present a new primitive that converts microarchitectural states into architectural states without relying on time measurements. We exploit the unprivileged idle-loop optimization instructions umonitor and umwait introduced with the new Intel microarchitectures (Tremont and Alder Lake). Although not documented, these instructions provide architectural feedback about the transient usage of a speciﬁed memory region. In three case studies, we show the versatility of our primitive. First, with Spectral, we present a way of enabling transient-execution attacks to leak bits architecturally with up to 200 kbit / s without requiring any architectural timer. Second, we show traditional side-channel attacks without relying on an architectural timer. Finally, we demonstrate that when augmented with a coarse-grained timer, we can also mount interrupt-timing attacks, allowing us to, e.g., detect which website a user opens. Our case studies highlight that the boundary between architecture and microarchitecture becomes more and more blurry, leading to new attack variants and complicating effective countermeasures.