Adversarial Model Research Articles

Unsupervised generative model for simulating post-operative double eyelid image.

Simulating the outcome of double eyelid surgery is a challenging task. Many existing approaches rely on complex and time-consuming 3D digital models to reconstruct facial features for simulating facial plastic surgery outcomes. Some recent research performed a simple affine transformation approach based on 2D images to simulate double eyelid surgery outcomes. However, these methods have faced challenges, such as generating unnatural simulation outcomes and requiring manual removal of masks from images. To address these issues, we have pioneered the use of an unsupervised generative model to generate post-operative double eyelid images. Firstly, we created a dataset involving pre- and post-operative 2D images of double eyelid surgery. Secondly, we proposed a novel attention-class activation map module, which was embedded in a generative adversarial model to facilitate translating a single eyelid image to a double eyelid image. This innovative module enables the generator to selectively focus on the eyelid region that differentiates between the source and target domain, while enhancing the discriminator's ability to discern differences between real and generated images. Finally, we have adjusted the adversarial consistency loss to guide the generator in preserving essential features from the source image and eliminating any masks when generating the double eyelid image. Experimental results have demonstrated the superiority of our approach over existing state-of-the-art techniques.

DBSF-Net: Infrared Image Colorization Based on the Generative Adversarial Model with Dual-Branch Feature Extraction and Spatial-Frequency-Domain Discrimination

Thermal infrared cameras can image stably in complex scenes such as night, rain, snow, and dense fog. Still, humans are more sensitive to visual colors, so there is an urgent need to convert infrared images into color images in areas such as assisted driving. This paper studies a colorization method for infrared images based on a generative adversarial model. The proposed dual-branch feature extraction network ensures the stability of the content and structure of the generated visible light image; the proposed discrimination strategy combining spatial and frequency domain hybrid constraints effectively improves the problem of undersaturated coloring and the loss of texture details in the edge area of the generated visible light image. The comparative experiment of the public infrared visible light paired data set shows that the algorithm proposed in this paper has achieved the best performance in maintaining the consistency of the content structure of the generated image, restoring the image color distribution, and restoring the image texture details.

A Proactive Decoy Selection Scheme for Cyber Deception using MITRE ATT&CK

Cyber deception allows compensating the late response of defenders countermeasures to the ever evolving tactics, techniques, and procedures (TTPs) of attackers. This proactive defense strategy employs decoys resembling legitimate system components to lure stealthy attackers within the defender environment, slowing and/or denying the accomplishment of their goals. In this regard, the selection of decoys that can expose the techniques used by malicious users plays a central role to incentivize their engagement. However, this is a difficult task to achieve in practice, since it requires an accurate and realistic modeling of the attacker capabilities and his possible targets. In this work, we tackle this challenge and we design a decoy selection scheme that is supported by an adversarial modeling based on empirical observation of real-world attackers. We take advantage of a domain-specific threat modeling language using MITRE ATT&CK© framework as source of attacker TTPs targeting enterprise systems. In detail, we extract the information about the execution preconditions of each technique as well as its possible effects on the environment to generate attack graphs modeling the adversary capabilities. Based on this, we formulate a graph partition problem that minimizes the number of decoys detecting a corresponding number of techniques employed in various attack paths directed to specific targets. We compare our optimization-based decoy selection approach against several benchmark schemes that ignore the preconditions between the various attack steps. Results reveal that the proposed scheme provides the highest interception rate of attack paths using the lowest amount of decoys.

Centralised vs. decentralised federated load forecasting in smart buildings: Who holds the key to adversarial attack robustness?

The integration of AI and ML into energy forecasting is crucial for modern energy management. Federated Learning (FL) is particularly noteworthy because it enhances data privacy and facilitates collaboration among distributed energy resources. It enables model training across multiple locations while minimizing reliance on centralized servers and data transfers. However, FL faces significant security challenges, particularly from adversarial attacks that can undermine the models' integrity and reliability. This paper addresses these security concerns by evaluating the effectiveness of Centralized Federated Learning (CFL) and Decentralized Federated Learning (DFL) in distributed load forecasting. We conducted a comparative analysis using two publicly available datasets, household data and smart grid data, for short-term load forecasting. Our study finds that DFL is more robust against adversarial attacks and artificial noise compared to CFL. Specifically, adversarial model poisoning attacks impact only the targeted client in DFL, while CFL is more broadly affected. For instance, in the presence of attacks, CFL's average client Mean Absolute Error (MAE) increased from 0.084 to 0.78 kWh for Dataset 1 and from 0.475 to 11.159 MW for Dataset 2, whereas DFL maintained relatively low error rates. Conversely, artificial noise had a less pronounced effect on CFL compared to DFL. Additionally, we introduce Decentralized Random Layer Aggregation (DRLA) to enhance DFL's robustness, offering further insights into improving FL methodologies in the energy sector. Our findings also indicate that only a single layer of the neural network is required for local updates during the aggregation process in DFL.

Aerosol optical depth retrieval using scaled digital number (DN) values of multi-spectral satellite and a generating adversarial model based on deep learning application

ABSTRACT The current quantitative retrieval of Aerosol Optical Depth (AOD) typically uses Top-of-atmosphere (TOA) reflectance data obtained by the scale and offset terms of radiometric calibration. Errors can be introduced during the conversion of Digital Number (DN) values to TOA reflectance, restraining the accurate retrieval of AOD. Particularly when surface reflectance is high, conversion errors can significantly distort the retrieval of Aerosol Optical Depth (AOD), given the minimal impact of aerosols on the radiation detected by satellite sensors. To counteract this, we introduce an innovative retrieval algorithm that harnesses a Generative Adversarial Network (GANN), a deep learning (DL) model, to accurately derive AOD from the scaled digital number (DN) values of multi-spectral satellite imagery. The DL technology enables the use of scaled DN values for AOD retrieval, bypassing the conversion errors associated with TOA reflectance since it relies on a sample learning approach instead of radiative transfer calculations. To ensure the number and representativeness of training samples, a total of 37,103 samples from different underlying surfaces from 2014 to 2018 were obtained using a space-time matching strategy. Our K-cross validation demonstrates that employing DN values for AOD retrieval promises to yield higher accuracy compared to using TOA reflectance. Independent 2019 data were used to estimate GANN, MCD19A2 and MOD04_3K aerosol products. Our model showed superior performance compared to the other products in terms of a higher correlation (R = 0.8184) with AERONET AOD and obtaining more reliable retrievals (7601). The sensitivity experiment suggests that GANN exhibits limitations in areas characterized by high aerosol loads and heterogeneity. Our study can give a novel insight into AOD retrieval based on multi-spectral satellite and DL models.

A Benchmark Proposal for Non‐Generative Fair Adversarial Learning Strategies Using a Fairness‐Utility Trade‐off Metric

ABSTRACTAI systems for decision‐making have become increasingly popular in several areas. However, it is possible to identify biased decisions in many applications, which have become a concern for the computer science, artificial intelligence, and law communities. Therefore, researchers are proposing solutions to mitigate bias and discrimination among decision‐makers. Some explored strategies are based on GANs to generate fair data. Others are based on adversarial learning to achieve fairness by encoding fairness constraints through an adversarial model. Moreover, it is usual for each proposal to assess its model with a specific metric, making comparing current approaches a complex task. Therefore, this work proposes a systematical benchmark procedure to assess the fair machine learning models. The proposed procedure comprises a fairness‐utility trade‐off metric (), the utility and fairness metrics to compose this assessment, the used datasets and preparation, and the statistical test. A previous work presents some of these definitions. The present work enriches the procedure by increasing the applied datasets and statistical guarantees when comparing the models' results. We performed this benchmark evaluation for the non‐generative adversarial models, analyzing the literature models from the same metric perspective. This assessment could not indicate a single model which better performs for all datasets. However, we built an understanding of how each model performs on each dataset with statistical confidence.

Provable Security for the Onion Routing and Mix Network Packet Format Sphinx

Onion routing and mix networks are fundamental concepts to provide users with anonymous access to the Internet. Various corresponding solutions rely on the Sphinx packet format. However, flaws in Sphinx's underlying proof strategy were found recently. It is thus currently unclear which guarantees Sphinx actually provides, and, even worse, there is no suitable proof strategy available. In this paper, we restore the security foundation for all these works by building an analytical framework for Sphinx. We discover that the previously-used Decisional Diffie-Hellman (DDH) assumption is insufficient for a security proof and show that the Gap Diffie-Hellman (GDH) assumption is required instead. We apply it to prove that a slightly adapted version of the Sphinx packet format is secure under the GDH assumption. We are thus, to the best of our knowledge, the first to provide a detailed, in-depth security proof for Sphinx that holds. Our adaptations to Sphinx are necessary, as we demonstrate with an attack on sender privacy that would otherwise be possible in Sphinx's adversary model.

Single-Query Quantum Hidden Shift Attacks

Quantum attacks using superposition queries are known to break many classically secure modes of operation. While these attacks do not necessarily threaten the security of the modes themselves, since they rely on a strong adversary model, they help us to draw limits on their provable security.Typically these attacks use the structure of the mode (stream cipher, MAC or authenticated encryption scheme) to embed a period-finding problem, which can be solved with a dedicated quantum algorithm. The hidden period can be recovered with a few superposition queries (e.g., O(n) for Simon’s algorithm), leading to state or key-recovery attacks. However, this strategy breaks down if the period changes at each query, e.g., if it depends on a nonce.In this paper, we focus on this case and give dedicated state-recovery attacks on the authenticated encryption schemes Rocca, Rocca-S, Tiaoxin-346 and AEGIS- 128L. These attacks rely on a procedure to find a Boolean hidden shift with a single superposition query, which overcomes the change of nonce at each query. This approach has the drawback of a lower success probability, meaning multiple independent (and parallelizable) runs are needed.We stress that these attacks do not break any security claim of the authors, and do not threaten the schemes if the adversary only makes classical queries.

An efficient certificateless blockchain-enabled authentication scheme to secure producer mobility in named data networks

Named Data Networking (NDN) aims to establish an efficient content delivery architecture. In NDN, secure and effective identity authentication schemes ensure secure communication between producers and routers. Currently, there is no feasible solution to perform identity authentication of mobile producers in NDNs. Identity authentication schemes in other networks are either weak in security or performance, such as privacy leakage, difficulty to establish cross-domain trust, and long handover delays, and are not fully adaptable to the security requirements of NDNs. Additionally, the mobility of producers was not fully considered in the initial design of NDNs. This paper first revises the structure of packets and routers to support the identity authentication and mobility of producers. On this basis, this paper proposes a secure and efficient certificateless ECC-based producer identity authentication scheme (CL-BPA), which includes initial authentication and re-authentication, aimed at achieving rapid switch authentication and integrating blockchain to solve single-point failure issues. Using the Canetti and Krawczyk (CK) adversarial model and informal security analysis, the proposed CL-BPA scheme is demonstrated to be resistant to anonymity attacks, identity forgery attacks, and man-in-the-middle attacks. The performance analysis demonstrates that the proposed CL-BPA scheme exhibits excellent capabilities in terms of computation delay, communication cost, smart contract execution time, average response delay, and throughput.

Matrix hypercontractivity, streaming algorithms and LDCs: the large alphabet case

We prove a hypercontractive inequality for matrix-valued functions defined over large alphabets. In order to do so, we prove a generalization of the powerful 2-uniform convexity inequality for trace norms of Ball, Carlen, Lieb (Inventiones Mathematicae’94). Using our hypercontractive inequality, we present upper and lower bounds for the communication complexity of the Hidden Hypermatching problem defined over large alphabets. We then consider streaming algorithms for approximating the value of Unique Games on a hypergraph with t -size hyperedges. By using our communication lower bound, we show that every streaming algorithm in the adversarial model achieving an ( r − ε)-approximation of this value requires Ω ( n 1 − 2/ t ) quantum space, where r is the alphabet size. We next present a lower bound for locally decodable codes ( \(\mathsf {LDC} \) ) \(\mathbb {Z}_r^n\rightarrow \mathbb {Z}_r^N \) over large alphabets with recoverability probability at least 1/ r + ε. Using hypercontractivity, we give an exponential lower bound \(N= 2^{\Omega (\varepsilon ^4 n/r^4)} \) for 2-query (possibly non-linear) \(\mathsf {LDC} \) s over \(\mathbb {Z}_r \) and using the non-commutative Khintchine inequality we prove an improved lower bound of \(N= 2^{\Omega (\varepsilon ^2 n/r^2)} \) .

A lightweight anonymity protocol at terabit speeds on programmable switches

Anonymous communication protocols are integral tools for people to exercise the right to privacy in their online activities. Such tools are urged to offer maximum protection against various classes of adversaries, including rogue criminals, exploitative companies, and authoritarian or paternalistic regimes, while respecting the diversity of users’ activities, from e-mail and web browsing to file transfer and video streaming. In such a context, lightweight anonymity protocols are a promising solution to provide well-balanced anonymity and performance for daily use against a class of adversaries with a relaxed but realistic assumption of their capability. However, as the existing instantiations of these protocols solely target software implementation, they did not fully exhibit their advantages in performance by the relaxation of the adversarial model. This paper presents P5HI, a novel instantiation and implementation of a lightweight anonymity protocol on hardware programmable switches. Its realization requires a rethinking of all aspects of the system, beginning with the realization of bit-rotation on the switch, through the construction of a cryptographic scheme and attack prevention, to hardware-friendly procedures during path setup and data transmission. We deploy the full-fledged design of the lightweight anonymity protocol on an actual programmable switch, and our prototype demonstrates its operation at a speed of over 3.0 Tbps.

Mitigating MEV attacks with a two-tiered architecture utilizing verifiable decryption

A distributed ledger is a shared and synchronized database across multiple designated nodes, often referred to as miners, validators, or peers. These nodes record, distribute, and access data to ensure security and transparency. However, these nodes can be compromised and manipulated by selectively choosing which user transactions to include, exclude, or reorder, thereby gaining an unfair advantage. This is known as a miner/maximal extractable value (MEV) attack. Existing solutions can be classified into various categories, such as MEV auction platforms and time-based ordering properties, which rely on private transaction Mempools. In this paper, we first identify some architectural weaknesses inherent in the latest proposals that divide the block creation and execution roles into separate functions: block builders and block executors. The existing schemes mainly suffer from the verifiability of the decryption process, where a corrupted builder or executor can simply deny the inclusion of specific targeted transactions by exploiting the fact that all transactions are in plain format. To address this, we propose an enhanced version that incorporates a verifiable decryption process. On a very high level, within our proposal, whenever an Executor or a Builder performs a decryption, the decrypted values must be broadcasted. This enables any entity in the network to publicly verify whether the decryption was executed correctly, thus preventing malicious behavior by either party from going undetected. We also define a new adversary model for MEV and conduct a comprehensive security analysis of our protocol against all kinds of potential adversaries related to MEV. Finally, we present the performance analysis of the proposed solution.

Endo-atmospheric maneuver penetration strategy based on generative adversarial reinforcement learning

An intelligent endo-atmospheric penetration strategy based on generative adversarial reinforcement learning is proposed in this manuscript. Firstly, attack and defense adversarial models are established, and missile maneuver penetration problem is transformed into an optimal control problem, considering penetration, handover position and mid-terminal guidance velocity constraints. Then, Radau Pseudospectral method is adopted to generate data samples considering random perturbations. Furthermore, Generative Adversarial Imitation Learning Combined with Deep Deterministic Policy Gradient method (GAIL-DDPG) is designed, with internal process reward signals constructed to tackle long-term sparse reward in missile manuver penetration problem. Finally, penetration strategy is trained and verified. Simulation shows that using generative adversarial reinforcement learning, with sample library to learn expert experience in training early stage, the proposed method can quickly converge. Also, performance is further optimized with reinforcement learning exploration strategy in the later stage of training. Simulation shows that the proposed method has better engineering application ability compared with traditional reinforcement learning method.

A powerful adversary model and corresponding OTP time slot allocation scheme in RIS-assisted physical layer key generation

Physical layer key generation (PLKG) is a technique of information-theoretic security to tackle the problem of key distribution between resource-constrained legitimate users and is a promising candidate for the one time pad (OTP) technique. However, in quasi-static, the key rate is greatly limited due to low entropy. Reconfigurable intelligent surface (RIS) is introduced to adaptively reconfigure the radio environment. However, how to allocate time slots in the OTP to counter the increasingly powerful adversary model is an urgent problem to be solved. In this paper, we propose a very powerful adversary model and give an attack strategy called eavesdropping channel search, which allows Eve to use its search and eavesdropping capabilities to maximize the probability of successful attacks. Meanwhile, we propose a time slot allocation algorithm in the OTP to ensure the security of the key. Simulations validate that our proposed attack strategy is more powerful than any existing adversary model and our proposed time slot allocation algorithm does not have any security loss.

Quantum-Resistance Meets White-Box Cryptography: How to Implement Hash-Based Signatures against White-Box Attackers?

The adversary model of white-box cryptography includes an extreme case where the adversary, sitting at the endpoint, has full access to a cryptographic scheme. Motivating by the fact that most existing white-box implementations focus on symmetric encryption, we present implementations for hash-based signatures so that the security against white-box attackers (who have read-only access to data with a size bounded by a space-hardness parameter M) depends on the availability of a white-box secure cipher (in addition to a general one-way function). We also introduce parameters and key-generation complexity results for white-box secure instantiation of stateless hash-based signature scheme SPHINCS+, one of the NIST selections for quantum-resistant digital signature algorithms, and its older version SPHINCS. We also present a hash tree-based solution for one-time passwords secure in a white-box attacker context. We implement the proposed solutions and share our performance results.

Adversarial Models and Game Theoretic Logic Related to Online Security

Adversarial Models and Game Theoretic Logic Related to Online Security

A secure authentication protocol for remote patient monitoring in an internet‐of‐medical‐things environment

AbstractInternet of Medical Things (IoMT) enable users to avail healthcare services remotely. In IoMT, sensor nodes (SNs), like blood pressure sensors and temperature sensors, collect health data from patients and communicate it to Health Workers (HWs) such as doctors, nurses, and so on. The HWs cater to the patients remotely, known as remote patient monitoring (RPM), by using data obtained from SNs. The communicated health data between SNs and HWs are sensitive in nature. Leakage and modification of such data leads to huge consequences, particularly patient death during medical emergencies. Hence, ensuring mutual authentication along with data integrity and privacy is of utmost important in the healthcare domain. In the literature, many authentication protocols are presented for healthcare applications specific to IoMT‐RPM. But, most of the existing approaches fail to provide adequate security against well‐known attacks includes impersonation and man‐in‐the‐middle attacks. In this paper, we propose a privacy preserving authentication protocol for IoMT‐RPM which is secure against various known attacks. We present a rigorous formal security analysis of our protocol under the extended Canetti‐Krawczyk (eCK) adversary model. In addition, we also perform formal verification using Tamarin Prover, a symbolic formal analysis tool. The results show that the proposed protocol is secure under eCK‐adversary model. We then present the comparative performance analysis to show the efficiency of the proposed protocol over the existing protocols. As a result, the proposed protocol provides high security without compromising the performance over the existing protocols, and therefore, our protocol is very much suitable for real‐time applications.

Patient-specific placental vessel segmentation with limited data

A major obstacle in applying machine learning for medical fields is the disparity between the data distribution of the training images and the data encountered in clinics. This phenomenon can be explained by inconsistent acquisition techniques and large variations across the patient spectrum. The result is poor translation of the trained models to the clinic, which limits their implementation in medical practice. Patient-specific trained networks could provide a potential solution. Although patient-specific approaches are usually infeasible because of the expenses associated with on-the-fly labeling, the use of generative adversarial networks enables this approach. This study proposes a patient-specific approach based on generative adversarial networks. In the presented training pipeline, the user trains a patient-specific segmentation network with extremely limited data which is supplemented with artificial samples generated by generative adversarial models. This approach is demonstrated in endoscopic video data captured during fetoscopic laser coagulation, a procedure used for treating twin-to-twin transfusion syndrome by ablating the placental blood vessels. Compared to a standard deep learning segmentation approach, the pipeline was able to achieve an intersection over union score of 0.60 using only 20 annotated images compared to 100 images using a standard approach. Furthermore, training with 20 annotated images without the use of the pipeline achieves an intersection over union score of 0.30, which, therefore, corresponds to a 100% increase in performance when incorporating the pipeline. A pipeline using GANs was used to generate artificial data which supplements the real data, this allows patient-specific training of a segmentation network. We show that artificial images generated using GANs significantly improve performance in vessel segmentation and that training patient-specific models can be a viable solution to bring automated vessel segmentation to the clinic.

MOVES: Movable and moving LiDAR scene segmentation in label-free settings using static reconstruction

Accurate static structure reconstruction and segmentation of non-stationary objects is of vital importance for autonomous navigation applications. These applications assume a LiDAR scan to consist of only static structures. In the real world however, LiDAR scans consist of non-stationary dynamic structures — moving and movable objects. Current solutions use segmentation information to isolate and remove moving structures from LiDAR scan. This strategy fails in several important use-cases where segmentation information is not available. In such scenarios, moving objects and objects with high uncertainty in their motion i.e. movable objects, may escape detection. This violates the above assumption. We present MOVES, a novel GAN based adversarial model that segments out moving as well as movable objects in the absence of segmentation information. We achieve this by accurately transforming a dynamic LiDAR scan to its corresponding static scan. This is obtained by replacing dynamic objects and corresponding occlusions with static structures which were occluded by dynamic objects. We leverage corresponding static-dynamic LiDAR pairs. We design a novel discriminator, coupled with a contrastive loss on a smartly selected LiDAR scan triplet. For datasets lacking paired information, we propose MOVES-MMD that integrates Unsupervised Domain Adaptation into the network. We perform rigorous experiments to demonstrate state of the art dynamic to static translation performance on a sparse real world industrial dataset, an urban and a simulated dataset. MOVES also segments out movable and moving objects without using segmentation information. Without utilizing segmentation labels, MOVES performs better than segmentation based navigation baseline in highly dynamic and long LiDAR sequences. The code is available here.

Assessing the Efficacy of Synthetic Optic Disc Images for Detecting Glaucomatous Optic Neuropathy Using Deep Learning.

Deep learning architectures can automatically learn complex features and patterns associated with glaucomatous optic neuropathy (GON). However, developing robust algorithms requires a large number of data sets. We sought to train an adversarial model for generating high-quality optic disc images from a large, diverse data set and then assessed the performance of models on generated synthetic images for detecting GON. A total of 17,060 (6874 glaucomatous and 10,186 healthy) fundus images were used to train deep convolutional generative adversarial networks (DCGANs) for synthesizing disc images for both classes. We then trained two models to detect GON, one solely on these synthetic images and another on a mixed data set (synthetic and real clinical images). Both the models were externally validated on a data set not used for training. The multiple classification metrics were evaluated with 95% confidence intervals. Models' decision-making processes were assessed using gradient-weighted class activation mapping (Grad-CAM) techniques. Following receiver operating characteristic curve analysis, an optimal cup-to-disc ratio threshold for detecting GON from the training data was found to be 0.619. DCGANs generated high-quality synthetic disc images for healthy and glaucomatous eyes. When trained on a mixed data set, the model's area under the receiver operating characteristic curve attained 99.85% on internal validation and 86.45% on external validation. Grad-CAM saliency maps were primarily centered on the optic nerve head, indicating a more precise and clinically relevant attention area of the fundus image. Although our model performed well on synthetic data, training on a mixed data set demonstrated better performance and generalization. Integrating synthetic and real clinical images can optimize the performance of a deep learning model in glaucoma detection. Optimizing deep learning models for glaucoma detection through integrating DCGAN-generated synthetic and real-world clinical data can be improved and generalized in clinical practice.