The layered MnBi2nTe3n+1 family represents the first intrinsic antiferromagnetic topological insulator (AFM TI, protected by a combination symmetry S ) ever discovered, providing an ideal platform to explore novel physics such as quantum anomalous Hall effect at elevated temperature and axion electrodynamics. Recent angle-resolved photoemission spectroscopy (ARPES) experiments on this family have revealed that all terminations exhibit (nearly) gapless topological surface states (TSSs) within the AFM state, violating the definition of the AFM TI, as the surfaces being studied should be S -breaking and opening a gap. Here we explain this curious paradox using a surface-bulk band hybridization picture. Combining ARPES and first-principles calculations, we prove that only an apparent gap is opened by hybridization between TSSs and bulk bands. The observed (nearly) gapless features are consistently reproduced by tight-binding simulations where TSSs are coupled to a Rashba-split bulk band. The Dirac-cone-like spectral features are actually of bulk origin, thus not sensitive to the S -breaking at the AFM surfaces. This picture explains the (nearly) gapless behaviour found in both Bi2Te3-and MnBi2Te4-terminated surfaces and is applicable to all terminations of MnBi2nTe3n+1 family. Our findings highlight the role of band hybridization, superior to magnetism in this case, in shaping the general surface band structure in magnetic topological materials for the first time.

With its huge real-world demands, large-scale confidential computing still cannot be supported by today's Trusted Execution Environment (TEE), due to the lack of scalable and effective protection of high-throughput accelerators like GPUs, FPGAs, and TPUs etc. Although attempts have been made recently to extend the CPU-like enclave to GPUs, these solutions require change to the CPU or GPU chips, may introduce new security risks due to the side-channel leaks in CPU-GPU communication and are still under the resource constraint of today's CPU TEE.To address these problems, we present the first Heterogeneous TEE design that can truly support large-scale compute or data intensive (CDI) computing, without any chip-level change. Our approach, called HETEE, is a device for centralized management of all computing units (e.g., GPUs and other accelerators) of a server rack. It is uniquely designed to work with today's data centres and clouds, leveraging modern resource pooling technologies to dynamically compartmentalize computing tasks, and enforce strong isolation and reduce TCB through hardware support. More specifically, HETEE utilizes the PCIe ExpressFabric to allocate its accelerators to the server node on the same rack for a non-sensitive CDI task, and move them back into a secure enclave in response to the demand for confidential computing. Our design runs a thin TCB stack for security management on a security controller (SC), while leaving a large set of software (e.g., AI runtime, GPU driver, etc.) to the integrated microservers that operate enclaves. An enclaves is physically isolated from others through hardware and verified by the SC at its inception. Its microserver and computing units are restored to a secure state upon termination.We implemented HETEE on a real hardware system, and evaluated it with popular neural network inference and training tasks. Our evaluations show that HETEE can easily support the CDI tasks on the real-world scale and incurred a maximal throughput overhead of 2.17% for inference and 0.95% for training on ResNet152.Recent years have seen attempts to support the heterogeneous TEE. Examples include Graviton [15] and HIX [16]. However, all these approaches require changes to CPU and (or) GPU chips, which prevents the use of existing hardware, and also incurs a long and expensive development cycle to chip manufacturers and therefore may not happen in the near 1450 2020 IEEE Symposium on Security and Privacy

Recent studies show that Deep Neural Networks (DNN) are vulnerable to adversarial samples that are generated by perturbing correctly classified inputs to cause the misclassification of DNN models. This can potentially lead to disastrous consequences, especially in security-sensitive applications such as unmanned vehicles, finance and healthcare. Existing adversarial defense methods require a variety of computing units to effectively detect the adversarial samples. However, deploying adversary sample defense methods in existing DNN accelerators leads to many key issues in terms of cost, computational efficiency and information security. Moreover, existing DNN accelerators cannot provide effective support for special computation required in the defense methods.To address these new challenges, this paper proposes DNN-Guard, an elastic heterogeneous DNN accelerator architecture that can efficiently orchestrate the simultaneous execution of original (target) DNN networks and the detect algorithm or network that detects adversary sample attacks. The

No abstract