Adversarial Objective Research Articles

Advancing Photorealism Enhancement Using Convolutional Neural Networks (CNNs)

Photorealism has been the defining goal of computer graphics for half a century. A look at even the most sophisticated real-time games will quickly reveal that photorealism has not been achieved. An ineffable difference in the appearance of simulation and reality remains. In recent years, a complementary set of techniques has been developed in computer vision and machine learning. These techniques, based on deep learning, convolutional networks, and adversarial training, bypass physical modeling of geometric layout, material appearance, and light transport. Instead, images are synthesized by convolutional networks trained on large datasets. These techniques have been used to synthesize representative images from a given domain to convert semantic label maps to photographic images and to attempt to bridge the appearance gap between synthetic and real images. The images are enhanced by a convolutional network that leverages intermediate representations produced by conventional rendering pipelines. The network is trained via a novel adversarial objective, which provides strong supervision at multiple perceptual levels.

FAGD-Net: Feature-Augmented Grasp Detection Network Based on Efficient Multi-Scale Attention and Fusion Mechanisms

Grasping robots always confront challenges such as uncertainties in object size, orientation, and type, necessitating effective feature augmentation to improve grasping detection performance. However, many prior studies inadequately emphasize grasp-related features, resulting in suboptimal grasping performance. To address this limitation, this paper proposes a new grasping approach termed the Feature-Augmented Grasp Detection Network (FAGD-Net). The proposed network incorporates two modules designed to enhance spatial information features and multi-scale features. Firstly, we introduce the Residual Efficient Multi-Scale Attention (Res-EMA) module, which effectively adjusts the importance of feature channels while preserving precise spatial information within those channels. Additionally, we present a Feature Fusion Pyramidal Module (FFPM) that serves as an intermediary between the encoder and decoder, effectively addressing potential oversights or losses of grasp-related features as the encoder network deepens. As a result, FAGD-Net achieved advanced levels of grasping accuracy, with 98.9% and 96.5% on the Cornell and Jacquard datasets, respectively. The grasp detection model was deployed on a physical robot for real-world grasping experiments, where we conducted a series of trials in diverse scenarios. In these experiments, we randomly selected various unknown household items and adversarial objects. Remarkably, we achieved high success rates, with a 95.0% success rate for single-object household items, 93.3% for multi-object scenarios, and 91.0% for cluttered scenes.

Visual Adversarial Examples Jailbreak Aligned Large Language Models

Warning: this paper contains data, prompts, and model outputs that are offensive in nature. Recently, there has been a surge of interest in integrating vision into Large Language Models (LLMs), exemplified by Visual Language Models (VLMs) such as Flamingo and GPT-4. This paper sheds light on the security and safety implications of this trend. First, we underscore that the continuous and high-dimensional nature of the visual input makes it a weak link against adversarial attacks, representing an expanded attack surface of vision-integrated LLMs. Second, we highlight that the versatility of LLMs also presents visual attackers with a wider array of achievable adversarial objectives, extending the implications of security failures beyond mere misclassification. As an illustration, we present a case study in which we exploit visual adversarial examples to circumvent the safety guardrail of aligned LLMs with integrated vision. Intriguingly, we discover that a single visual adversarial example can universally jailbreak an aligned LLM, compelling it to heed a wide range of harmful instructions (that it otherwise would not) and generate harmful content that transcends the narrow scope of a `few-shot' derogatory corpus initially employed to optimize the adversarial example. Our study underscores the escalating adversarial risks associated with the pursuit of multimodality. Our findings also connect the long-studied adversarial vulnerabilities of neural networks to the nascent field of AI alignment. The presented attack suggests a fundamental adversarial challenge for AI alignment, especially in light of the emerging trend toward multimodality in frontier foundation models.

Water depth prediction in combined sewer networks, application of generative adversarial networks

This paper addresses the pressing issue of combined sewer overflows (CSOs) in urban areas, which pose significant environmental and public health threats. CSOs occur when combined sewer systems become overwhelmed during heavy rainfall, leading to untreated sewage and stormwater being discharged into nearby water bodies. To effectively manage and mitigate CSO effects, accurate predictions of CSOs are crucial for real-time control measures. This study introduces an innovative approach that utilizes Generative Adversarial Networks (GANs) to augment data and improve the accuracy of data-driven models for predicting water depth in combined sewer systems. Apart from data augmentation, the paper addresses scenarios where rare patterns, such as extreme events, are infrequently observed regardless of dataset size. It proposes a specialized generative model based on GANs designed to augment datasets targeting these rare patterns. This innovation involves adding a tail-focused loss function to the adversarial objective of the GAN training pipeline. The research is exemplified through a case study in Kaiserslautern, Germany. The results indicate an improvement in water depth predictions. Also, it was found that the model trained solely with synthetic data is comparable to that trained with real data.Graphical

Haptic Search With the Smart Suction Cup on Adversarial Objects

Haptic Search With the Smart Suction Cup on Adversarial Objects

ATZSL: Defensive Zero-Shot Recognition in the Presence of Adversaries

Zero-shot learning (ZSL) has received extensive attention recently especially in areas of fine-grained object recognition, retrieval, and image captioning. Due to the complete lack of training samples and high requirement of defense transferability, the ZSL model learned is particularly vulnerable against adversarial attacks. Recent work also showed adversarially robust generalization requires more data. This may significantly affect the robustness of ZSL. However, very few efforts have been devoted towards this direction. In this paper, we take an initial attempt, and propose a generic formulation to provide a systematical solution (named ATZSL) for learning a defensive ZSL model. It is capable of achieving better generalization on various adversarial objects recognition while only losing a negligible performance on clean images for unseen classes, by casting ZSL into a min-max optimization problem. To address it, we design a defensive relation prediction network, which can bridge the seen and unseen class domains via attributes to generalize prediction and defense strategy. Additionally, our framework can be extended to deal with the poisoned scenario of unseen class attributes. An extensive group of experiments are then presented, demonstrating that ATZSL obtains remarkably more favorable trade-off between model transferability and robustness, over currently available alternatives under various settings.

Advancing Cyber Resilience: Bridging the Divide Between Cyber Security and Cyber Defense

The field of cyber security is characterized by its diverse range of techniques, tools, and concepts, and it is closely interconnected with the security of information and operational technology. The distinguishing characteristic of cyber security is in the adoption of offensive information technology strategies with the intention of achieving adversarial objectives. Nevertheless, the broad and unrestricted utilization of the word "cyber security," frequently used interchangeably with information security or IT security, has the potential to create misunderstandings among both consumers and professionals in the security field. The merging of these disciplines obscures important differences between them, notwithstanding their interconnectedness. This paper advocates for a significant suggestion aimed at security leaders: to limit the usage of the word "cyber security" to refer specifically to security practices that are closely intertwined with and dependent on information technology and operational technology environments and systems, solely for defensive objectives. In the context of computer network security, cyber defense plays a crucial role as a mechanism that addresses adversary acts, protects key infrastructure, and ensures information assurance for a wide range of enterprises, government agencies, and interconnected networks [3]. This study primarily examines the interplay between cyber security and cyber defense, emphasizing the development of the notion of cyber resilience. This paper presents a new conceptual framework for understanding cyber resilience, shedding light on the complex interplay between these several domains. Furthermore, in this model, the authors critically examine the tactics and measures necessary to enhance the resilience of cyber security and cyber defense in the face of escalating cyber threats. The article examines CRRT and MACS history, purpose, and future directions. At EU level, through the policy of innovation there is opportunity for more robust resilience and joint defense against ever-changing landscape of threat.

Towards Fair Credit Risk Assessment: Developing Mathematical Models with Equity and Accuracy

Credit default risk is an important factor in determining whether a person can apply for a credit card and continue to use it. Hothis studyver, the assessment of credit default risk should be fair and unbiased, especially as credit cards become an increasingly popular payment method. In this paper, this study analyze how to assess a users credit default risk while emphasizing the importance of machine learning fairness. this study propose using principal component analysis (PCA) to extract key factors for judging credit default risk and a BP neural network to evaluate and analyze these factors. this study also propose adversarial representation learning which is aim to address discrimination against different minority group people. Our main purpose is to train the main network to generate features that the discriminator cannot use to accurately predict the sensitive attribute. By doing so, the learned features become fairer and do not contain discriminatory information. Therefore, adversarial representation learning is aimed at reducing discrimination against minority groups in machine learning models. Our approach serves as a natural method for ensuring that these parties act fairly and various adversarial objectives. this study demonstrate that selecting the appropriate objective is essential for achieving fair prediction. Through our approach, this study aim to ensure that our credit default risk assessment is fair and equitable for all users of different gender, race, and education.

DRCM: a disentangled representation network based on coordinate and multimodal attention for medical image fusion.

Recent studies on medical image fusion based on deep learning have made remarkable progress, but the common and exclusive features of different modalities, especially their subsequent feature enhancement, are ignored. Since medical images of different modalities have unique information, special learning of exclusive features should be designed to express the unique information of different modalities so as to obtain a medical fusion image with more information and details. Therefore, we propose an attention mechanism-based disentangled representation network for medical image fusion, which designs coordinate attention and multimodal attention to extract and strengthen common and exclusive features. First, the common and exclusive features of each modality were obtained by the cross mutual information and adversarial objective methods, respectively. Then, coordinate attention is focused on the enhancement of the common and exclusive features of different modalities, and the exclusive features are weighted by multimodal attention. Finally, these two kinds of features are fused. The effectiveness of the three innovation modules is verified by ablation experiments. Furthermore, eight comparison methods are selected for qualitative analysis, and four metrics are used for quantitative comparison. The values of the four metrics demonstrate the effect of the DRCM. Furthermore, the DRCM achieved better results on SCD, Nabf, and MS-SSIM metrics, which indicates that the DRCM achieved the goal of further improving the visual quality of the fused image with more information from source images and less noise. Through the comprehensive comparison and analysis of the experimental results, it was found that the DRCM outperforms the comparison method.

Token-level disentanglement for unsupervised text style transfer

Text style transfer is the task of altering the style of a source text to a desired style while preserving the style-independent content. A common approach involves disentangling a given sentence into a style-agnostic content representation within the latent space and then generating the text in the desired style, guided by a separate style embedding. However, previous methods have a limitation in that they assume the input sentence is encoded by a fix-sized latent vector at the sentence level, making it challenging to capture rich semantic information at the token level, especially when dealing with longer texts. Consequently, this leads to suboptimal preservation of non-stylistic semantic content. In this paper, we address this challenge, and propose TED, a fine-grained model for disentangling content and style representation at the token level to enhance content preservation. Specifically, TED use tf–idfs to estimate the pivot tokens for different styles and incorporates multi-task and adversarial objectives to disentangle the content and style information of each token within the latent space. Experimental results on two popular text style transfer datasets show that our proposed model significantly outperforms state-of-the-art baselines, particularly in terms of content preservation. Moreover, the quantitative and qualitative experiments demonstrate the effectiveness of our model in achieving token-level disentanglement within the latent space.

Generative Adversarial Shaders for Real‐Time Realism Enhancement

AbstractApplication of realism enhancement methods, particularly in real‐time and resource‐constrained settings, has been frustrated by the expense of existing methods. These achieve high quality results only at the cost of long runtimes and high bandwidth, memory, and power requirements. We present an efficient alternative: a high‐performance, generative shader‐based approach that adapts machine learning techniques to real‐time applications, even in resource‐constrained settings such as embedded and mobile GPUs. The proposed learnable shader pipeline comprises differentiable functions that can be trained in an end‐to‐end manner using an adversarial objective, allowing for faithful reproduction of the appearance of a target image set without manual tuning. The shader pipeline is optimized for highly efficient execution on the target device, providing temporally stable, faster‐than‐real time results with quality competitive with many neural network‐based methods.

3D Domain Adaptive Instance Segmentation via Cyclic Segmentation GANs.

3D instance segmentation for unlabeled imaging modalities is a challenging but essential task as collecting expert annotation can be expensive and time-consuming. Existing works segment a new modality by either deploying pre-trained models optimized on diverse training data or sequentially conducting image translation and segmentation with two relatively independent networks. In this work, we propose a novel Cyclic Segmentation Generative Adversarial Network (CySGAN) that conducts image translation and instance segmentation simultaneously using a unified network with weight sharing. Since the image translation layer can be removed at inference time, our proposed model does not introduce additional computational cost upon a standard segmentation model. For optimizing CySGAN, besides the CycleGAN losses for image translation and supervised losses for the annotated source domain, we also utilize self-supervised and segmentation-based adversarial objectives to enhance the model performance by leveraging unlabeled target domain images. We benchmark our approach on the task of 3D neuronal nuclei segmentation with annotated electron microscopy (EM) images and unlabeled expansion microscopy (ExM) data. The proposed CySGAN outperforms pre-trained generalist models, feature-level domain adaptation models, and the baselines that conduct image translation and segmentation sequentially. Our implementation and the newly collected, densely annotated ExM zebrafish brain nuclei dataset, named NucExM, are publicly available at https://connectomics-bazaar.github.io/proj/CySGAN/index.html.

Adaptive local adversarial attacks on 3D point clouds

Modern artificial intelligence systems rely heavily on deep learning techniques. However, deep neural networks are easily disturbed by adversarial objects. Adversarial examples are beneficial to improve the robustness of the 3D neural network model and enhance the stability of the artificial intelligence system. At present, most 3D adversarial attack methods perturb the entire point cloud to generate adversarial examples, which results in high perturbation costs and low operability in the physical world. In this paper, we propose an adaptive local adversarial attack method (AL-Adv) on 3D point clouds to generate adversarial point clouds. First, we analyze the vulnerability of the 3D network model and extract the salient regions of the input point cloud, namely the vulnerable regions. Second, we propose an adaptive gradient attack algorithm that targets salient regions. The proposed attack algorithm adaptively assigns different disturbances in different directions of the three-dimensional coordinates of the point cloud. Experimental results show that our proposed AL-Adv method achieves a higher attack success rate than the global attack method. Specifically, the adversarial examples generated by AL-Adv demonstrate good imperceptibility and small generation costs.

Privacy Threats in Facial Recognition-Based Identity Verification

Facial recognition technology has gained significant prominence in identity verification systems, providing convenience and security in various domains. However, the widespread adoption of this technology also raises significant concerns regarding privacy threats. This paper presents a comprehensive privacy threat model specifically designed for identity verification based on facial recognition. The model encompasses potential adversary objectives, such as unauthorized access, identity theft, and profiling, and identifies specific privacy threats, including unauthorized data access, biometric data misuse, tracking and surveillance, re-identification attacks, discrimination and bias, and data retention and sharing. To mitigate these threats, the paper proposes several mitigation measures, such as informed consent, transparent data handling, secure data storage and transmission, minimization of data collection, regular audits and assessments, and ethical considerations. By providing a holistic view of privacy threats in facial recognition-based identity verification, this model aims to guide researchers, practitioners, and policymakers in developing and implementing effective privacy protection mechanisms in this rapidly evolving technological landscape

Feature-Space Bayesian Adversarial Learning Improved Malware Detector Robustness

We present a new algorithm to train a robust malware detector. Malware is a prolific problem and malware detectors are a front-line defense. Modern detectors rely on machine learning algorithms. Now, the adversarial objective is to devise alterations to the malware code to decrease the chance of being detected whilst preserving the functionality and realism of the malware. Adversarial learning is effective in improving robustness but generating functional and realistic adversarial malware samples is non-trivial. Because: i) in contrast to tasks capable of using gradient-based feedback, adversarial learning in a domain without a differentiable mapping function from the problem space (malware code inputs) to the feature space is hard; and ii) it is difficult to ensure the adversarial malware is realistic and functional. This presents a challenge for developing scalable adversarial machine learning algorithms for large datasets at a production or commercial scale to realize robust malware detectors. We propose an alternative; perform adversarial learning in the feature space in contrast to the problem space. We prove the projection of perturbed, yet valid malware, in the problem space into feature space will always be a subset of adversarials generated in the feature space. Hence, by generating a robust network against feature-space adversarial examples, we inherently achieve robustness against problem-space adversarial examples. We formulate a Bayesian adversarial learning objective that captures the distribution of models for improved robustness. To explain the robustness of the Bayesian adversarial learning algorithm, we prove that our learning method bounds the difference between the adversarial risk and empirical risk and improves robustness. We show that Bayesian neural networks (BNNs) achieve state-of-the-art results; especially in the False Positive Rate (FPR) regime. Adversarially trained BNNs achieve state-of-the-art robustness. Notably, adversarially trained BNNs are robust against stronger attacks with larger attack budgets by a margin of up to 15% on a recent production-scale malware dataset of more than 20 million samples. Importantly, our efforts create a benchmark for future defenses in the malware domain.

Defending from Physically-Realizable Adversarial Attacks through Internal Over-Activation Analysis

This work presents Z-Mask, an effective and deterministic strategy to improve the adversarial robustness of convolutional networks against physically-realizable adversarial attacks. The presented defense relies on specific Z-score analysis performed on the internal network features to detect and mask the pixels corresponding to adversarial objects in the input image. To this end, spatially contiguous activations are examined in shallow and deep layers to suggest potential adversarial regions. Such proposals are then aggregated through a multi-thresholding mechanism. The effectiveness of Z-Mask is evaluated with an extensive set of experiments carried out on models for semantic segmentation and object detection. The evaluation is performed with both digital patches added to the input images and printed patches in the real world. The results confirm that Z-Mask outperforms the state-of-the-art methods in terms of detection accuracy and overall performance of the networks under attack. Furthermore, Z-Mask preserves its robustness against defense-aware attacks, making it suitable for safe and secure AI applications.

Reactive Symbolic Planning and Control in Dynamic Adversarial Environments

Satisfying both safety and reachability requirements in dynamic adversarial environments is very challenging, particularly when little or no information about the dynamics and intentions of the adversarial objects is available. Therefore, this paper addresses the problem of path planning and control of autonomous vehicles in a dynamic adversarial reach-avoid scenario with two non-cooperative vehicles and their competitive objectives: &#x201C;reaching a target and avoiding the other vehicle&#x201D; for one of them, called attacker, and &#x201C;protecting the target and capturing the opponent vehicle&#x201D; for the other one, called defender. In the proposed solution, first, a discrete version of the problem is formulated and solved using Linear Temporal Logic, temporal games, and <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula>-calculus to construct winning discrete strategies that guarantee safety and reachability. A comprehensive discussion on the existence, correctness, and complexity analysis of the solution is also provided. Finally, a novel correct-by-design hybrid controller is designed to generate smooth control signals that preserve the satisfaction of safety and reachability.

Modality-Specific Segmentation Network for Lung Tumor Segmentation in PET-CT Images.

Lung tumor segmentation in PET-CT images plays an important role to assist physicians in clinical application to accurately diagnose and treat lung cancer. However, it is still a challenging task in medical image processing field. Due to respiration and movement, the lung tumor varies largely in PET images and CT images. Even the two images are almost simultaneously collected and registered, the shape and size of lung tumors in PET-CT images are different from each other. To address these issues, a modality-specific segmentation network (MoSNet) is proposed for lung tumor segmentation in PET-CT images. MoSNet can simultaneously segment the modality-specific lung tumor in PET images and CT images. MoSNet learns a modality-specific representation to describe the inconsistency between PET images and CT images and a modality-fused representation to encode the common feature of lung tumor in PET images and CT images. An adversarial method is proposed to minimize an approximate modality discrepancy through an adversarial objective with respect to a modality discriminator and reserve modality-common representation. This improves the representation power of the network for modality-specific lung tumor segmentation in PET images and CT images. The novelty of MoSNet is its ability to produce a modality-specific map that explicitly quantifies the modality-specific weights for the features in each modality. To demonstrate the superiority of our method, MoSNet is validated in 126 PET-CT images with NSCLC. Experimental results show that MoSNet outperforms state-of-the-art lung tumor segmentation methods.

Enhancing Photorealism Enhancement.

We present an approach to enhancing the realism of synthetic images. The images are enhanced by a convolutional network that leverages intermediate representations produced by conventional rendering pipelines. The network is trained via a novel adversarial objective, which provides strong supervision at multiple perceptual levels. We analyze scene layout distributions in commonly used datasets and find that they differ in important ways. We hypothesize that this is one of the causes of strong artifacts that can be observed in the results of many prior methods. To address this we propose a new strategy for sampling image patches during training. We also introduce multiple architectural improvements in the deep network modules used for photorealism enhancement. We confirm the benefits of our contributions in controlled experiments and report substantial gains in stability and realism in comparison to recent image-to-image translation methods and a variety of other baselines.

ParamCrop: Parametric Cubic Cropping for Video Contrastive Learning

The central idea of contrastive learning is to discriminate between different instances and force different views from the same instance to share the same representation. To avoid trivial solutions, augmentation plays an important role in generating different views, among which random cropping is shown to be effective for the model to learn a generalized and robust representation. Commonly used random crop operation keeps the distribution of the difference between two views unchanged along the training process. In this work, we show that adaptively controlling the disparity between two augmented views along the training process enhances the quality of the learned representations. Specifically, we present a parametric cubic cropping operation, ParamCrop, for video contrastive learning, which automatically crops a 3D cubic by differentiable 3D affine transformations. ParamCrop is trained simultaneously with the video backbone using an adversarial objective, so that it learns to increase the contrastive loss and thus gradually reduces the shared contents between two cropped views. Experiments show that this adaptive and gradual increase in the disparity yielded by ParamCrop is beneficial to learning a strong and generalized representation for downstream tasks, which is shown to be effective on multiple contrastive learning frameworks and video backbones.