Adversarial Perturbations Research Articles

Face Database Protection via Beautification with Chaotic Systems

The database of faces containing sensitive information is at risk of being targeted by unauthorized automatic recognition systems, which is a significant concern for privacy. Although there are existing methods that aim to conceal identifiable information by adding adversarial perturbations to faces, they suffer from noticeable distortions that significantly compromise visual perception, and therefore, offer limited protection to privacy. Furthermore, the increasing prevalence of appearance anxiety on social media has led to users preferring to beautify their faces before uploading images. In this paper, we design a novel face database protection scheme via beautification with chaotic systems. Specifically, we construct the adversarial face with better visual perception via beautification for each face in the database. In the training, the face matcher and the beautification discriminator are federated against the generator, prompting it to generate beauty-like perturbations on the face to confuse the face matcher. Namely, the pixel changes produced by face beautification mask the adversarial perturbations. Moreover, we use chaotic systems to disrupt the order of adversarial faces in the database, further mitigating the risk of privacy leakage. Our scheme has been extensively evaluated through experiments, which show that it effectively defends against unauthorized attacks while also yielding good visual results.

Detecting backdoor in deep neural networks via intentional adversarial perturbations

Recent researches show that deep learning model is susceptible to backdoor attacks. Many defenses against backdoor attacks have been proposed. However, existing defense works require high computational overhead or backdoor attack information such as the trigger size. In this paper, we propose a novel backdoor detection method based on intentional adversarial perturbations. The proposed method leverages intentional adversarial perturbation to detect whether an image contains a trigger, which can be applied in both the training stage and the inference stage (sanitize the training set in training stage or detect the backdoor instances in inference stage). Specifically, given an untrusted image, the adversarial perturbation is added to the image intentionally. If the prediction of the model on the perturbed image is consistent with that on the unperturbed image, the input image will be considered as a backdoor instance. Compared with most existing defense works, the proposed method is faster and introduces less computational overhead during backdoor detection process. Moreover, the proposed method maintains the visual quality of the image (as the ℓ2 norm of the added perturbation is as low as 2.8715, 3.0513 and 2.4362 on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively). Experimental results show that, for general backdoor attack, the backdoor detection rate of the proposed defense method is 99.63%, 99.76% and 99.91% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively. For invisible backdoor attack, the backdoor detection rate of the proposed defense method is 99.75% against blended backdoor attack and 98.00% against sample-specific backdoor attack. It is also demonstrated that the proposed method can achieve high defense performance against backdoor attacks under different attack settings (trigger transparency, trigger size and trigger pattern). In addition, the experimental comparison with related work demonstrates that the proposed method has better detection performance and higher detection efficiency.

Generalizing universal adversarial perturbations for deep neural networks

Generalizing universal adversarial perturbations for deep neural networks

Exploring misclassifications of robust neural networks to enhance adversarial attacks

Progress in making neural networks more robust against adversarial attacks is mostly marginal, despite the great efforts of the research community. Moreover, the robustness evaluation is often imprecise, making it challenging to identify promising approaches. We do an observational study on the classification decisions of 19 different state-of-the-art neural networks trained to be robust against adversarial attacks. This analysis gives a new indication of the limits of the robustness of current models on a common benchmark. In addition, our findings suggest that current untargeted adversarial attacks induce misclassification toward only a limited amount of different classes. Similarly, we find that previous attacks under-explore the perturbation space during optimization. This leads to unsuccessful attacks for samples where the initial gradient direction is not a good approximation of the final adversarial perturbation direction. Additionally, we observe that both over- and under-confidence in model predictions result in an inaccurate assessment of model robustness. Based on these observations, we propose a novel loss function for adversarial attacks that consistently improves their efficiency and success rate compared to prior attacks for all 30 analyzed models.

Defending against adversarial examples using perceptual image hashing

Conventional deep neural networks (DNNs) have been shown to be vulnerable to images with adversarial perturbations, referred to as adversarial examples. In this study, we propose a method to protect neural networks against adversarial examples using perceptual image hashing. Because perceptual hashing is robust to adversarial perturbations, we combine hash sequences of input images with the parameters of a neural network in an image-hash processing network. Thus, outputs of the neural network are affected by image hashes, which render the model robust to adversarial examples to some extent. Thus, the proposed approach provides a defense against adversarial examples. The experiment was conducted on the CIFAR-10 dataset, and we used ResNet-18 as our target network. To verify our method, we tested our defense network using several common white-box attacks and black-box attacks. The results show that it achieved a significant improvement in the classification accuracy for adversarial examples.

TAN: A Transferable Adversarial Network for DNN-Based UAV SAR Automatic Target Recognition Models

Recently, the unmanned aerial vehicle (UAV) synthetic aperture radar (SAR) has become a highly sought-after topic for its wide applications in target recognition, detection, and tracking. However, SAR automatic target recognition (ATR) models based on deep neural networks (DNN) are suffering from adversarial examples. Generally, non-cooperators rarely disclose any SAR-ATR model information, making adversarial attacks challenging. To tackle this issue, we propose a novel attack method called Transferable Adversarial Network (TAN). It can craft highly transferable adversarial examples in real time and attack SAR-ATR models without any prior knowledge, which is of great significance for real-world black-box attacks. The proposed method improves the transferability via a two-player game, in which we simultaneously train two encoder–decoder models: a generator that crafts malicious samples through a one-step forward mapping from original data, and an attenuator that weakens the effectiveness of malicious samples by capturing the most harmful deformations. Particularly, compared to traditional iterative methods, the encoder–decoder model can one-step map original samples to adversarial examples, thus enabling real-time attacks. Experimental results indicate that our approach achieves state-of-the-art transferability with acceptable adversarial perturbations and minimum time costs compared to existing attack methods, making real-time black-box attacks without any prior knowledge a reality.

An efficient method to fool and enhance object tracking with adversarial perturbations

An efficient method to fool and enhance object tracking with adversarial perturbations

Gaussian class-conditional simplex loss for accurate, adversarially robust deep classifier training

In this work, we present the Gaussian Class-Conditional Simplex (GCCS) loss: a novel approach for training deep robust multiclass classifiers that improves over the state-of-the-art in terms of classification accuracy and adversarial robustness, with little extra cost for network training. The proposed method learns a mapping of the input classes onto Gaussian target distributions in a latent space such that a hyperplane can be used as the optimal decision surface. Instead of maximizing the likelihood of target labels for individual samples, our loss function pushes the network to produce feature distributions yielding high inter-class separation and low intra-class separation. The mean values of the learned distributions are centered on the vertices of a simplex such that each class is at the same distance from every other class. We show that the regularization of the latent space based on our approach yields excellent classification accuracy. Moreover, GCCS provides improved robustness against adversarial perturbations, outperforming models trained with conventional adversarial training (AT). In particular, our model learns a decision space that minimizes the presence of short paths toward neighboring decision regions. We provide a comprehensive empirical evaluation that shows how GCCS outperforms state-of-the-art approaches over challenging datasets for targeted and untargeted gradient-based, as well as gradient-free adversarial attacks, both in terms of classification accuracy and adversarial robustness.

AWEncoder: Adversarial Watermarking Pre-Trained Encoders in Contrastive Learning

As a self-supervised learning paradigm, contrastive learning has been widely used to pre-train a powerful encoder as an effective feature extractor for various downstream tasks. This process requires numerous unlabeled training data and computational resources, which makes the pre-trained encoder become the valuable intellectual property of the owner. However, the lack of a priori knowledge of downstream tasks makes it non-trivial to protect the intellectual property of the pre-trained encoder by applying conventional watermarking methods. To deal with this problem, in this paper, we introduce AWEncoder, an adversarial method for watermarking the pre-trained encoder in contrastive learning. First, as an adversarial perturbation, the watermark is generated by enforcing the training samples to be marked to deviate respective location and surround a randomly selected key image in the embedding space. Then, the watermark is embedded into the pre-trained encoder by further optimizing a joint loss function. As a result, the watermarked encoder not only performs very well for downstream tasks, but also enables us to verify its ownership by analyzing the discrepancy of output provided using the encoder as the backbone under both white-box and black-box conditions. Extensive experiments demonstrate that the proposed work enjoys quite good effectiveness and robustness on different contrastive learning algorithms and downstream tasks, which has verified the superiority and applicability of the proposed work.

Consistent attack: Universal adversarial perturbation on embodied vision navigation

Embodied agents in vision navigation coupled with deep neural networks have attracted increasing attention. However, deep neural networks have been shown vulnerable to malicious adversarial noises, which may potentially cause catastrophic failures in Embodied Vision Navigation. Among different adversarial noises, universal adversarial perturbations (UAP), i.e., a constant image-agnostic perturbation applied on every input frame of the agent, play a critical role in Embodied Vision Navigation since they are computation-efficient and application-practical during the attack. However, existing UAP methods ignore the system dynamics of Embodied Vision Navigation and might be sub-optimal. In order to extend UAP to the sequential decision setting, we formulate the disturbed environment under the universal noise δ, as a δ-disturbed Markov Decision Process (δ-MDP). Based on the formulation, we analyze the properties of δ-MDP and propose two novel Consistent Attack methods, named Reward UAP and Trajectory UAP, for attacking Embodied agents, which consider the dynamic of the MDP and calculate universal noises by estimating the disturbed distribution and the disturbed Q function. For various victim models, our Consistent Attack can cause a significant drop in their performance in the PointGoal task in Habitat with different datasets and different scenes. Extensive experimental results indicate that there exist serious potential risks for applying Embodied Vision Navigation methods to the real world.

Adversarial co-training for semantic segmentation over medical images

Background and objective:Abundant labeled data drives the model training for better performance, but collecting sufficient labels is still challenging. To alleviate the pressure of label collection, semi-supervised learning merges unlabeled data into training process. However, the joining of unlabeled data (e.g., data from different hospitals with different acquisition parameters) will change the original distribution. Such a distribution shift leads to a perturbation in the training process, potentially leading to a confirmation bias. In this paper, we investigate distribution shift and develop methods to increase the robustness of our models, with the goal of improving performance in semi-supervised semantic segmentation of medical images. We study distribution shift and increase model robustness to it, for improving practical performance in semi-supervised segmentation over medical images. Methods:To alleviate the issue of distribution shift, we introduce adversarial training into the co-training process. We simulate perturbations caused by the distribution shift via adversarial perturbations and introduce the adversarial perturbation to attack the supervised training to improve the robustness against the distribution shift. Benefiting from label guidance, supervised training does not collapse under adversarial attacks. For co-training, two sub-models are trained from two views (over two disjoint subsets of the dataset) to extract different kinds of knowledge independently. Co-training outperforms single-model by integrating both views of knowledge to avoid confirmation bias. Results:For practicality, we conduct extensive experiments on challenging medical datasets. Experimental results show desirable improvements to state-of-the-art counterparts (Yu and Wang, 2019; Peng et al., 2020; Perone et al., 2019). We achieve a DSC score of 87.37% with only 20% of labels on the ACDC dataset, almost same to using 100% of labels. On the SCGM dataset with more distribution shift, we achieve a DSC score of 78.65% with 6.5% of labels, surpassing 10.30% over Peng et al. (2020). Our evaluative results show superior robustness against distribution shifts in medical scenarios. Conclusion:Empirical results show the effectiveness of our work for handling distribution shift in medical scenarios.

Comparing Detection Schemes for Adversarial Images against Deep Learning Models for Cancer Imaging.

Deep learning (DL) models have demonstrated state-of-the-art performance in the classification of diagnostic imaging in oncology. However, DL models for medical images can be compromised by adversarial images, where pixel values of input images are manipulated to deceive the DL model. To address this limitation, our study investigates the detectability of adversarial images in oncology using multiple detection schemes. Experiments were conducted on thoracic computed tomography (CT) scans, mammography, and brain magnetic resonance imaging (MRI). For each dataset we trained a convolutional neural network to classify the presence or absence of malignancy. We trained five DL and machine learning (ML)-based detection models and tested their performance in detecting adversarial images. Adversarial images generated using projected gradient descent (PGD) with a perturbation size of 0.004 were detected by the ResNet detection model with an accuracy of 100% for CT, 100% for mammogram, and 90.0% for MRI. Overall, adversarial images were detected with high accuracy in settings where adversarial perturbation was above set thresholds. Adversarial detection should be considered alongside adversarial training as a defense technique to protect DL models for cancer imaging classification from the threat of adversarial images.

Adversarial liveness detector: Leveraging adversarial perturbations in fingerprint liveness detection

AbstractThe widespread use of fingerprint authentication systems (FASs) in consumer electronics opens for the development of advanced presentation attacks, that is, procedures designed to bypass a FAS using a forged fingerprint. As a consequence, FAS are often equipped with a fingerprint presentation attack detection (FPAD) module, to recognise live fingerprints from fake replicas. In this work, a novel FPAD approach based on Convolutional Neural Networks (CNNs) and on an ad hoc adversarial data augmentation strategy designed to iteratively increase the considered detector robustness is proposed. In particular, the concept of adversarial fingerprint, that is, fake fingerprints disguised by using ad hoc fingerprint adversarial perturbation algorithms was leveraged to help the detector focus only on salient portions of the fingerprints. The procedure can be adapted to different CNNs, adversarial fingerprint algorithms and fingerprint scanners, making the proposed approach versatile and easily customisable todifferent working scenarios. To test the effectiveness of the proposed approach, the authors took part in the LivDet 2021 competition, an international challenge gathering experts to compete on fingerprint liveness detection under different scanners and fake replica generation approach, achieving first place out of 23 participants in the ‘Liveness Detection in Action track’.

Preface

The 6th International Conference on Electrical, Mechanical and Computer Engineering (ICEMCE 2022) was successfully held on October 28th-30th, 2022 in Xi’an China (virtual conference). ICEMCE 2022 created an ideal platform for experts, scholars and researchers engaged in Electrical, Mechanical and Computer Engineering to share views and experiences, promoting the application and development of theories and technologies and establishing business or research contacts for all the participants.In the conference, we were greatly honored to have Prof. Songgang Qiu from West Virginia University, USA a to serve as our Conference Chair. The conference covered keynote speeches, oral presentations and online Q&A discussion, attracting more than 160 delegates from all over the world. Firstly, the keynote speakers were each allocated 30-45 minutes to address their speeches. Then in the oral presentations, the excellent papers we had selected were presented by their authors one by one.Four sophisticated professors were invited to hold keynote speeches during the conference. Among them, Prof. Yang Xiao from Southwest Petroleum University, China performed a keynote speech on the title: Development of Key Technologies of Virtual Reality and Augmented Reality and Their Application. Focusing on the development trend of virtual reality and augmented reality technology, this study summarized the technical characteristics, the development status of key technologies, and the wide application of virtual reality and augmented reality, aiming at laying a more solid foundation for the continuous development and application of virtual reality augmented reality technology. Moreover, Prof. Yanjiao Chen from Zhejiang University, China made a report on Blackbox Enrollment-Phase Attacks on Smart Speaker Recognition Systems. In this presentation, we explored a new attack surface of SRSs by presenting an enrollment-phase attack paradigm, designed carefully continuous adversarial perturbations into innocent-sounding ambient sound, and optimized over adversarial segments with content desensitization and physical realization, reveals the vulnerability of SRSs during the enrollment phase, which may spur future research in improving the security of SRSs. Their dramatic speeches had triggered heated discussion. And every participant praised this conference for disseminating insightful knowledge.We are glad to share with you that we’ve selected a bunch of high-quality papers from the submissions and compiled them into the proceedings after rigorously reviewing them. These papers feature but are not limited to the following topics: Computer Simulation, Smart Grid, Electric Energy Processing, Mechanical Dynamics, etc. All the papers have been checked through rigorous review and processes to meet the requirements of publication.We would like to acknowledge all of those who supported ICEMCE 2022 and made it a great success. Particularly, we would like to thank the Journal of Physics: Conference Series, for the efforts of all its colleagues in publishing this paper volume. We truly believe that all the attendees have had fruitful discussions and gained valuable knowledge, and will enjoy the opportunity for future collaborations.The Committee of ICEMCE 2022List of Committee member is available in this Pdf.

A robust adversarial attack against speech recognition with UAP

Speech recognition (SR) systems based on deep neural networks are increasingly widespread in smart devices. However, they are vulnerable to human-imperceptible adversarial attacks, which cause the SR to generate incorrect or targeted adversarial commands. Meanwhile, audio adversarial attacks are particularly susceptible to various factors, e.g., ambient noise, after applying them to a real-world attack. To circumvent this issue, we develop a universal adversarial perturbation (UAP) generation method to construct robust real-world UAP by integrating ambient noise into the generation process. The proposed UAP can work well in the case of input-agnostic and independent sources. We validate the effectiveness of our method on two different SRs in different real-world scenarios and parameters, the results demonstrate that our method yields state-of-the-art performance, i.e. given any audio waveform, the word error rate can be up to 80%. Extensive experiments investigate the impact of different parameters (e.g, signal-to-noise ratio, distance, and attack angle) on the attack success rate.

A unified speech enhancement approach to mitigate both background noises and adversarial perturbations

Deep learning has been vastly applied in classification systems of speech signals. However, adversarial examples crafted by adding small perturbations to input speech signals can make those classification systems produce incorrect results. Beyond detecting and discarding adversarial examples when securing the classification systems, we consider to purify the input adversarial examples to normal ones in this paper. Speech enhancement is a technique known as removing background noises to enhance voice quality. By treating adversarial perturbations as noises, we hereby propose a unified speech enhancement approach to mitigate both background noises and adversarial perturbations. The approach is named by Speech Enhancement and Adversarial Defense Network (SEADNet), which performs model-level fusion of conventional speech enhancement and adversarial defenses. In SEADNet, a learnable noise-adding module is firstly created to adaptively putting noises to the input speech to destroy the functions of adversarial perturbations. Subsequently, a speech enhancement network is deployed to reconstruct clean speech from noisy inputs. Finally, an adversarial example detection module is designed as a discriminator to guide the reconstructed speech in the previous speech enhancement network to mitigate adversarial perturbations. The overall network is optimized by minimizing a joint loss function. Experiments are conducted on the tasks of speech enhancement and automatic speaker verification with benchmark datasets. The proposed SEADNet performs well on both tasks of conventional noise mitigation and adversarial defenses compared to the related competitive baselines.

DDSG-GAN: Generative Adversarial Network with Dual Discriminators and Single Generator for Black-Box Attacks

As one of the top ten security threats faced by artificial intelligence, the adversarial attack has caused scholars to think deeply from theory to practice. However, in the black-box attack scenario, how to raise the visual quality of an adversarial example (AE) and perform a more efficient query should be further explored. This study aims to use the architecture of GAN combined with the model-stealing attack to train surrogate models and generate high-quality AE. This study proposes an image AE generation method based on the generative adversarial networks with dual discriminators and a single generator (DDSG-GAN) and designs the corresponding loss function for each model. The generator can generate adversarial perturbation, and two discriminators constrain the perturbation, respectively, to ensure the visual quality and attack effect of the generated AE. We extensively experiment on MNIST, CIFAR10, and Tiny-ImageNet datasets. The experimental results illustrate that our method can effectively use query feedback to generate an AE, which significantly reduces the number of queries on the target model and can implement effective attacks.

Secure Gait Recognition-Based Smart Surveillance Systems Against Universal Adversarial Attacks

Currently, the internet of everything (IoE) enabled smart surveillance systems are widely used in various fields to prevent various forms of abnormal behaviors. The authors assess the vulnerability of surveillance systems based on human gait and suggest a defense strategy to secure them. Human gait recognition is a promising biometric technology, but one significantly hindered because of universal adversarial perturbation (UAP) that may trigger system failure. More specifically, in this research study, the authors emphasize on sample convolutional neural network (CNN) model design for gait recognition and assess its susceptibility to UAPs. The authors compute the perturbation as non-targeted UAPs, which trigger a model failure and lead to an inaccurate label to the input sample of a given subject. The findings show that a smart surveillance system based on human gait analysis is susceptible to UAPs, even if the norm of the generated noise is substantially less than the average norm of the images. Later, in the next stage, the authors illustrate a defense mechanism to design a secure surveillance system based on human gait.

Defending against adversarial attacks on graph neural networks via similarity property

Graph Neural Networks (GNNs) are powerful tools in graph application areas. However, recent studies indicate that GNNs are vulnerable to adversarial attacks, which can lead GNNs to easily make wrong predictions for downstream tasks. A number of works aim to solve this problem but what criteria we should follow to clean the perturbed graph is still a challenge. In this paper, we propose GSP-GNN, a general framework to defend against massive poisoning attacks that can perturb graphs. The vital principle of GSP-GNN is to explore the similarity property to mitigate negative effects on graphs. Specifically, this method prunes adversarial edges by the similarity of node feature and graph structure to eliminate adversarial perturbations. In order to stabilize and enhance GNNs training process, previous layer information is adopted in case a large number of edges are pruned in one layer. Extensive experiments on three real-world graphs demonstrate that GSP-GNN achieves significantly better performance compared with the representative baselines and has favorable generalization ability simultaneously.

Improving transferable adversarial attack via feature-momentum

Transferable adversarial attackusing adversarial perturbations made on known models to attack unknown modelshas made significant progress in recent years. The feature-level adversarial approach, in particular, is one of the most common solutions and can improve transferability by disrupting intermediate features, regardless of the task-specific loss objectives. Once the intermediate features are disrupted, the subsequent prediction will naturally go wrong. To accomplish this, the existing methods often start an attack by creating a guidance map on features that shows the importance level of each feature element, and then they use an iterative strategy to disrupt the features based on the guidance map. However, the drawback of existing methods is that the guidance map is always fixed in iterations, which can not consistently reflect the importance of feature elements, limiting the performance of the attack consequently. In this paper, we describe a new method called Feature-Momentum Adversarial Attack (FMAA) to enhance transferability. The key idea is that we estimate a guidance map dynamically at each iteration using a momentum-style approach to effectively disturb the features. Extensive experiments demonstrate that our method significantly outperforms other state-of-the-art methods by a large margin on different target models.