Adversarial Detection Research Articles

Multi Attribute Trust Aware Routing for Adversary Detection in Wireless Sensor Networks

Security attacks has become major obstacles in Wireless Sensor Networks (WSN) and Trust Aware Routing is second line of defense. With an aim to improve on the existing routing mechanisms, in this paper, we propose Interactive, Onlooker and Capability Trust Aware Routing (IOC-TAR), a multi-trust attribute framework for trust management in WSNs. IOC-TAR employs three trust features to establish a trustworthy relationship between sensor nodes for their cooperation. Interactive trust uses communication interactions, onlooker trust uses neighbor node’s opinions and capability trust uses stability and fault tolerance for trust assessment. For, each node, one composite trust factor is formulated and decides its trustworthiness. Extensive simulation experiments are conducted to evaluate the effectiveness and efficiency of proposed IOC-TAR in the identification of malicious nodes and the provision of attack resilience. The results declare that the IOC-TAR enhances the attack resilience by improving Malicious Detection rate and reducing False Positive Rate.

Secure distributed estimation via an average diffusion LMS and average likelihood ratio test

Secure distributed estimation algorithms are designed to protect against a spectrum of attacks by exploring different attack models and implementing strategies to enhance the resilience of the algorithm. These models encompass diverse scenarios such as measurement sensor attacks and communication link attacks, which have been extensively investigated in existing literature. This paper, however, focuses on a specific type of attack: the multiplicative sensor attack model. To counter this, the paper introduces the Average diffusion least mean square (ADLMS) algorithm as a viable solution. Furthermore, the paper introduces the Average Likelihood Ratio Test (ALRT) detector, which provides a straightforward detection criterion. In the presence of communication link attacks, the paper considers the manipulation attack model and presents an ALRT adversary detector. The analysis extends to these ALRT detectors, encompassing the calculation of adversary detection probability and false alarm probability, both achieved in closed form. The paper also provides the mean convergence analysis of the proposed ADLMS algorithm. Simulation results reveal that the proposed algorithms exhibit enhanced performance compared to the DLMS algorithm, while the incremental complexity remains only marginally higher than that of the DLMS algorithm.

An AI-driven solution to prevent adversarial attacks on mobile Vehicle-to-Microgrid services

With the increasing integration of Artificial Intelligence (AI) in microgrid control systems, there is a risk that malicious actors may exploit vulnerabilities in machine learning algorithms to disrupt power generation and distribution. In this work, we study the potential impacts of adversarial attacks on Vehicle-to-Microgrid (V2M), and discuss potential defensive countermeasures to prevent these risks. Our analysis shows that the decentralized and adaptive nature of microgrids makes them particularly vulnerable to adversarial attacks, and highlights the need for robust security measures to protect against such threats. We propose a framework to detect and prevent adversarial attacks on V2M services using Generative Adversarial Network (GAN) model and a Machine Learning (ML) classifier. We focus on two adversarial attacks, namely inference and evasion attacks. We test our proposed framework under three attack scenarios to ensure the robustness of our solution. As the adversary’s knowledge of a system determines the success of the executed attacks, we study four gray-box cases where the adversary has access to different percentages of the victim’s training dataset. Moreover, we compare our proposed detection method against four benchmark detectors. Furthermore, we evaluate the effectiveness of our proposed method to detect three benchmark evasion attack. Through simulations, we show that all benchmark detectors fail to successfully detect adversarial attacks, particularly when the attacks are intelligently augmented, obtaining an Adversarial Detection Rate (ADR) of up to 60.4%. On the other hand, our proposed framework outperforms the other detectors and achieves an ADR of 92.5%.

Enhancing security for smart healthcare in wireless body area networks using a novel adversarial detection using ACR BiLSTM with multi-batch stochastic gradient descent

Enhancing security for smart healthcare in wireless body area networks using a novel adversarial detection using ACR BiLSTM with multi-batch stochastic gradient descent

Edge server enhanced secure and privacy preserving federated learning

Federated learning (FL) has been smoothly embedded into current IoT edge computing architecture, and hatching advanced IoT-FL applications. While so, sensitive messages generated on terminal sides brings privacy issues; and vulnerable terminal devices are easy targets for Byzantine adversaries, they inject malicious data to manipulate the IoT-FL system. Now an inherent dilemma is, the privacy preserving requires anonymous indistinguishable individual characteristics, while the malicious adversary detection requires transparent distinguishable results. Existing fragmented schemes are not able to handle both problems coherently. This time, inherit our previous study, based on the IoT edge computing architecture, we utilize Homomorphic Encryption (HE) and Threshold Secret Sharing (SS) methods, propose a joint scheme (namely, Sec-IoTFL) for anonymous adversary detection. Specifically, we batch encode the clients’ training result vectors (message) as polynomials, and split them as secret pieces with a unified SS key set; then edge server and cloud server joint deal with these secret pieces in a specialized flow, where Byzantine adversaries will be filtered out. The theoretical analysis and solid experimental results suggest, in our scheme, local sensitive data is well preserved, and malicious behavior is precisely screened. Comparing with traditional methods, our Sec-IoTFL scheme shows the superiority in accuracy and efficiency.

Adversarial sample detection for EEG-based brain-computer interfaces

Deep neural networks (DNNs) play a pivotal role within the domain of brain-computer interfaces (BCIs). Nevertheless, DNNs are demonstrated to exhibit susceptibility to adversarial attacks. In BCIs, researchers have been concerned about the security of DNNs and have devised various adversarial defense methods to resist adversarial attacks. However, most defense methods encounter performance degradation when dealing with normal samples due to changes in the original model. As an alternative strategy, adversarial detection aims to devise additional modules or use statistical properties to identify potentially adversarial samples without changing the original model. Hence, the present study provides a comprehensive evaluation of several typical adversarial detection methods applied to EEG datasets. The experiments indicate that the detection method based on the kernel density estimation (KDE) shows the best performance under various adversarial attacks.

A secure data interaction method based on edge computing

Deep learning achieves an outstanding success in the edge scene due to the appearance of lightweight neural network. However, a number of works show that these networks are vulnerable for adversarial examples, bringing security risks. The classical adversarial detection methods are used in white-box setting and show weak performances in black-box setting, like the edge scene. Inspired by the experimental results that different models give various predictions for the same adversarial example with a high probability, we propose a novel adversarial detection method called Ensemble-model Adversarial Detection Method (EADM). EADM defenses the prospective adversarial attack on edge devices by cloud monitoring, which deploys ensemble-model in the cloud and give the most possible label for each input copy received in the edge. The comparison experiment in the assumed edge scene with baseline methods demonstrates the effect of EADM, with a higher defense success rate and a lower false positive rate by an ensemble-model consisted of five pretrained models. The additional ablation experiment explores the influence of different model combinations and adversarial trained models. Besides, the possibility about transfering our method to other fields is discussed, showing the transferability of our method across domains.

Enhancing Generalization in Few-Shot Learning for Detecting Unknown Adversarial Examples

Deep neural networks, particularly convolutional neural networks, are vulnerable to adversarial examples, undermining their reliability in visual recognition tasks. Adversarial example detection is a crucial defense mechanism against such attacks but often relies on empirical observations and specialized metrics, posing challenges in terms of data efficiency, generalization to unknown attacks, and scalability to high-resolution datasets like ImageNet. To address these issues, we propose a prototypical network-based method using a deep residual network as the backbone architecture. This approach is capable of extracting discriminative features of adversarial and normal examples from various known adversarial examples by constructing few-shot adversarial detection tasks. Then the optimal mapping matrix is computed using the Sinkhorn algorithm from optimal transport theory, and the class centers are iteratively updated, enabling the detection of unknown adversarial examples across scenarios. Experimental results show that the proposed approach outperforms existing methods in the cross-adversary benchmark and achieves enhanced generalization on a subset of ImageNet in detecting both new adversarial attacks and adaptive white-box attacks. The proposed approach offers a promising solution for improving the safety of deep neural networks in practical applications.

Model-agnostic adversarial example detection via high-frequency amplification

Image classification based on Deep Neural Networks (DNNs) is vulnerable to adversarial examples, which make the classifier output incorrect predictions. One approach to defending against this attack is to detect whether the input is an adversarial example. Unfortunately, existing adversarial example detection methods heavily rely on the underlying classifier and may fail when the classifier is upgraded. In this paper, we propose a model-agnostic detection method that leverages high-frequency signals from adversarial noises in adversarial examples and does not need interactions with the underlying classifier. We amplify redundant high-frequency signals brought by adversarial noises and represent object boundaries with these signals in an image. Our key insight is that the boundaries extracted by redundant high-frequency signals have a strong correlation with the boundaries of images in adversarial examples, while this correlation does not exist in clean images. Furthermore, adversarial examples of large images have more high-frequency signals and make adversarial detection easier on large image datasets. Experimental results show that our method has good transferability and can accurately detect various adversarial examples on different datasets.

Trust-Based Distributed Secure State Estimation Against Malicious Agents via Two-Hop Communication

This paper studies the distributed secure state estimation problem in unreliable multiagent networks through adversary detection. The agents are endowed with the capacity for detecting malicious neighbors and aim to collaboratively estimate the state variables of a dynamic system in the presence of malicious agents. A trust mechanism is first introduced to characterize the reliability of the information received from in-neighbors and identify the reliable information of two-hop in-neighbors. With the help of the trust mechanism and two-hop communication, two distributed secure state estimation schemes with adversary detection algorithms are developed under different resource requirements and adversary models. Necessary and sufficient conditions on the graph connectivity and joint detectability are established to guarantee that all the regular agents can detect the malicious in-neighbors and generate accurate estimates. An example is given to show the effectiveness of the proposed methods.

Adapting Image Classification Adversarial Detection Methods for Traffic Sign Classification in Autonomous Vehicles: A Comparative Study

Adapting Image Classification Adversarial Detection Methods for Traffic Sign Classification in Autonomous Vehicles: A Comparative Study

ADDITION: Detecting Adversarial Examples With Image-Dependent Noise Reduction

Notwithstanding the tremendous success of deep neural networks in a range of realms, previous studies have shown that these learning models are exposed to an inherent hazard called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">adversarial example</i> — images to which an elaborate perturbation is maliciously added could deceive a network, which entails the study of countermeasures urgently. However, existing solutions suffer from some weaknesses, e.g. parameters are usually determined empirically in some processing-based detection methods might result in a sub-optimal effect, and the directly performed processing on images might affect the classification of benign samples, leading to increment of false positive. In this paper, we propose a novel imAge-DepenDent noIse reducTION (ADDITION) model based on deep learning for adversarial detection. The ADDITION model can adaptively convert the adversarial perturbation in each image to approximate Gaussian noise by injecting image-dependent additional noise, then perform noise reduction to eliminate the adversarial perturbation, and finally detect adversarial examples by examining the classification inconsistency between the input image and its denoised version. The ADDITION model is trained end-to-end on benign samples without any prior knowledge of adversarial attacks, and thus avoid time-consuming task of generating adversarial examples in practical use. We generate more than 220,000 adversarial examples based on six attack algorithms for evaluation and present state-of-the-art comparisons on three real-word datasets. Extensive experiments demonstrate that our proposed method achieves improved performance in both detection accuracy rate and false positive rate.

Dual-Branch Sparse Self-Learning With Instance Binding Augmentation for Adversarial Detection in Remote Sensing Images

Dual-Branch Sparse Self-Learning With Instance Binding Augmentation for Adversarial Detection in Remote Sensing Images

A service-categorized security scheme with physical unclonable functions for internet of vehicles

In smart cities, communication and information exchange for the Internet of Vehicles rely on open and closed infrastructures along the roadside. Secure communications rely on the sender and receiver devices having self-sustaining authentication methods. The perquisites of the authentication methods are to grip communication without being falsified by an adversary or unidentified third parties. This article introduces the Service-Categorized Security Scheme (SCSS) with a physically unclonable function (PUF) for handling sensitive guidance/communication information. The vehicle-side authentication, access control, and service demands are governed using service-based PUF factors such as digital signatures, passwords, etc. To prevent anonymous third parties and adversaries, the PUF operates over compromised and uncompromised communication devices. Device-specific keys generated by PUFs based on intrinsic physical variances help identify between compromised and uncompromised devices, while keys generated by uncompromised devices conform to their expected profiles In the service-sharing process, mutual authentication using synchronized keys is used for security and service verification. The synchronized keys are integrated with the PUF for monitoring de-synchronization and individual operation. This decision is made using federated learning from the external service provider and the communicator of the vehicle. Through the learning process, a de-synchronization occurrence at the service provider and vehicle is identified as the reason for disconnecting the session. As a result, any suspicious activity that contradicts service security is identified, and the information of the communicating vehicle is secured. The proposed scheme is analyzed using the metrics authentication time, adversary detection ratio, complexity, de-synchronization time, and successful sessions.

Adversarial Detection from Derived Models

Deep Neural Networks (DNNs) can be easily fooled by inputs that are crafted by adversaries. For example, an adversarial image can be forged by adding to an image a tiny perturbation which is often unnoticeable by human eyes, though the semantic interpretations of the original image and the adversarial image, which are represented as outputs of a DNN, may be drastically different. This weakness can potentially lead to serious consequences in security-critical applications such as medical diagnostic tests and self-driving vehicles. Most existing approaches for adversarial detection only have satisfactory performance for specific types of attacks. These methods do not generalize their performances when applied to a broad range of attacks, models or datasets. In this work, we propose a new adversarial detection method called Adversarial Detection from Derived Models (ADDM), which applies derived models to “simulate” the functionality of a DNN, and analyzes the distribution for the neuron activation values in the derived models as indicators for adversarial inputs. In order to further enhance performance, we propose a heuristic that selects neurons from the derived models that are sensitive to perturbations. We compare our approach with six existing adversarial detection approaches of different methodologies, and the experimental result confirms that the proposed approach has generally better performance regarding stability over different types of adversarial attacks on a variety of tested DNN models and datasets.

Robust and Refined Salient Object Detection Based on Diffusion Model

Salient object detection (SOD) networks are vulnerable to adversarial attacks. As adversarial training is computationally expensive for SOD, existing defense methods instead adopt a noise-against-noise strategy that disrupts adversarial perturbation and restores the image either in input or feature space. However, their limited learning capacity and the need for network modifications limit their applicability. In recent years, the popular diffusion model coincides with the existing defense idea and exhibits excellent purification performance, but there still remains an accuracy gap between the saliency results generated from the purified images and the benign images. In this paper, we propose a Robust and Refined (RoRe) SOD defense framework based on the diffusion model to simultaneously achieve adversarial robustness as well as improved accuracy for benign and purified images. Our proposed RoRe defense consists of three modules: purification, adversarial detection, and refinement. The purification module leverages the powerful generation capability of the diffusion model to purify perturbed input images to achieve robustness. The adversarial detection module utilizes the guidance classifier in the diffusion model for multi-step voting classification. By combining this classifier with a similarity condition, precise adversarial detection can be achieved, providing the possibility of regaining the original accuracy for benign images. The refinement module uses a simple and effective UNet to enhance the accuracy of purified images. The experiments demonstrate that RoRe achieves superior robustness over state-of-the-art methods while maintaining high accuracy for benign images. Moreover, RoRe shows good results against backward pass differentiable approximation (BPDA) attacks.

A lightweight unsupervised adversarial detector based on autoencoder and isolation forest

Although deep neural networks (DNNs) have performed well on many perceptual tasks, they are vulnerable to adversarial examples that are generated by adding slight but maliciously crafted perturbations to benign images. Adversarial detection is an important technique for identifying adversarial examples before they are entered into target DNNs. Previous studies that were performed to detect adversarial examples either targeted specific attacks or required expensive computation. Designing a lightweight unsupervised detector is still a challenging problem. In this paper, we propose an AutoEncoder-based Adversarial Examples (AEAE) detector that can guard DNN models by detecting adversarial examples with low computation in an unsupervised manner. The AEAE includes only a shallow autoencoder that performs two roles. First, a well-trained autoencoder has learned the manifold of benign examples. This autoencoder can produce a large reconstruction error for adversarial images with large perturbations, so we can detect significantly perturbed adversarial examples based on the reconstruction error. Second, the autoencoder can filter out small noises and change the DNN’s prediction on adversarial examples with small perturbations. It helps to detect slightly perturbed adversarial examples based on the prediction distance. To cover these two cases, we utilize the reconstruction error and prediction distance from benign images to construct a two-tuple feature set and train an adversarial detector using the isolation forest algorithm. We show empirically that AEAE is an unsupervised and inexpensive detector against most state-of-the-art attacks. Through the detection in these two cases, there is nowhere to hide adversarial examples.

Adversarial Detection and Fusion Method for Multispectral Palmprint Recognition

As a kind of promising biometric technology, multispectral palmprint recognition methods have attracted increasing attention in security due to their high recognition accuracy and ease of use. It is worth noting that although multispectral palmprint data contains rich complementary information, multispectral palmprint recognition methods are still vulnerable to adversarial attacks. Even if only one image of a spectrum is attacked, it can have a catastrophic impact on the recognition results. Therefore, we propose a robustness-enhanced multispectral palmprint recognition method, including a model interpretability-based adversarial detection module and a robust multispectral fusion module. Inspired by the model interpretation technology, we found there is a large difference between clean palmprint and adversarial examples after CAM visualization. Using visualized images to build an adversarial detector can lead to better detection results. Finally, the weights of clean images and adversarial examples in the fusion layer are dynamically adjusted to obtain the correct recognition results. Experiments have shown that our method can make full use of the image features that are not attacked and can effectively improve the robustness of the model.

Robust explanations for graph neural network with neuron explanation component

Graph neural networks (GNNs) have been successfully applied to a variety of graph-structure analysis tasks. Besides their outstanding performance, the explanation for GNNs' predictions is also an inextricable problem, which hinders trust in GNNs under practical scenarios. Consequently, great efforts have been made for interpreters of GNNs to understand their behavior. However, the existing works are still suffering two main problems: (i) explanation-shifting in normal explanation - the explanations provided by the interpreters are insufficient to precisely explain the behavior of the GNNs; (ii) gullibility failure in adversarial detection - the interpreters are easily bypassed by well-designed adversarial perturbations, resulting in the omission of anomalies. To address these issues, we propose a robust interpreter for GNN, named Neuron Explanation Component (NEC), from the perspective of the model neuron activation pattern. It measures the difference in GNNs' neuron path distribution between subgraphs and the original graph to generate explanations for the model's prediction. NEC outperforms previous works in explanation accuracy, robustness against adversarial attacks and transferability among different GNN's interpreters. Extensive evaluations are conducted on 4 benchmarks, 6 interpreters and 2 scenarios (i.e., normal explanation and adversarial detection). Significant improvements in explanation ability and adversarial detection performance demonstrate NEC's superior performance.

Adversarial Deep Learning based Dampster–Shafer data fusion model for intelligent transportation system

Intelligent Transportation Systems (ITS) have revolutionized transportation by incorporating advanced technologies for efficient and safe mobility. However, these systems face challenges ensuring security and resilience against adversarial attacks. This research addresses these challenges and introduces a novel Dampster–Shafer data fusion-based Adversarial Deep Learning (DS-ADL) Model for ITS in fog cloud environments. Our proposed model focuses on three levels of adversarial attacks: original image level, feature level, and decision level. Adversarial examples are generated at each level to evaluate the system’s vulnerability comprehensively. To enhance the system’s capabilities, we leverage the power of several vital components. Firstly, we employ Dempster–Shafer-based Multimodal Sensor Fusion, enabling the fusion of information from multiple sensors for improved scene understanding. This fusion approach enhances the system’s perception and decision-making abilities. For feature extraction and classification, we utilize ResNet 101, a deep learning architecture known for its effectiveness in computer vision tasks. We introduced a novel Monomodal Multidimensional Gaussian Model (MMGM-DD) based Adversarial Detection approach to detect adversarial examples. This detection mechanism enhances the system’s ability to identify and mitigate adversarial attacks in real-time. Additionally, we incorporate the Defensive Distillation method for adversarial training, which trains the model to be robust against attacks by exposing it to adversarial examples during the training process. To evaluate the performance of our proposed model, we utilize two datasets: Google Speech Command version 0.01 and the German Traffic Sign Recognition Benchmark (GTSRB). Evaluation metrics include latency delay and computation time (fog–cloud), accuracy, MSE, loss, and F-score for attack detection and defense. The results and discussions demonstrate the effectiveness of our Dampster–Shafer data fusion-based Adversarial Deep Learning Model in enhancing the robustness and security of ITS in fog–cloud environments. The model’s ability to detect and defend against adversarial attacks while maintaining low-latency fog–cloud operations highlights its potential for real-world deployment in ITS.