Attack Algorithm Research Articles

Probabilistic Jacobian-Based Saliency Maps Attacks

Neural network classifiers (NNCs) are known to be vulnerable to malicious adversarial perturbations of inputs including those modifying a small fraction of the input features named sparse or L0 attacks. Effective and fast L0 attacks, such as the widely used Jacobian-based Saliency Map Attack (JSMA) are practical to fool NNCs but also to improve their robustness. In this paper, we show that penalising saliency maps of JSMA by the output probabilities and the input features of the NNC leads to more powerful attack algorithms that better take into account each input’s characteristics. This leads us to introduce improved versions of JSMA, named Weighted JSMA (WJSMA) and Taylor JSMA (TJSMA), and demonstrate through a variety of white-box and black-box experiments on three different datasets (MNIST, CIFAR-10 and GTSRB), that they are both significantly faster and more efficient than the original targeted and non-targeted versions of JSMA. Experiments also demonstrate, in some cases, very competitive results of our attacks in comparison with the Carlini-Wagner (CW) L0 attack, while remaining, like JSMA, significantly faster (WJSMA and TJSMA are more than 50 times faster than CW L0 on CIFAR-10). Therefore, our new attacks provide good trade-offs between JSMA and CW for L0 real-time adversarial testing on datasets such as the ones previously cited.

Reprogrammable meta-hologram for optical encryption

Meta-holographic encryption is a potentially important technique for information security. Despite rapid progresses in multi-tasked meta-holograms, the number of information channels available in metasurfaces is limited, making meta-holographic encryption vulnerable to some attacking algorithms. Herein, we demonstrate a re-programmable metasurface that can produce arbitrary holographic images for optical encryption. The encrypted information is divided into two matrices. These two matrices are imposed to the incident light and the metasurface, respectively. While the all-dielectric metasurface is static, the phase matrix of incident light provides additional degrees of freedom to precisely control the eventual functions at will. With a single Si metasurface, arbitrary holographic images and videos have been transported and decrypted. We hope that this work paves a more promising way to optical information encryption and authentication.

Vulnerability Assessment of Power Grids Against Cost-Constrained Hybrid Attacks

The frequent occurrences of cascading failures in power grids have been receiving continuous attention in recent years. An urgent task for us is to assess the vulnerability of power grids against various kinds of attacks, which trigger cascading failures. In this brief, we formulate a cost-constrained hybrid attack in power grids, where both nodes and links are targeted with a limited total attack cost. Based on the consequence and cost of removing a component (node or link), we propose an attack centrality metric for components, which can be either local or global depending on the depth of cascading failures. We further propose a greedy hybrid attack and another optimal hybrid attack by applying the attack centrality. Simulation results on IEEE bus test data demonstrate that the optimal attack is more efficient than the greedy one. Furthermore, we find, counterintuitively, that the local centrality based attack algorithms perform better than the global centrality based ones when attack cost is a concern. Our work can help in the robustness optimization of power systems by revealing the worst-case attack vulnerability and most vulnerable components.

Infer user preferences from aggregate measurements: A novel message passing algorithm for privacy attack

Social media platforms, such as Facebook and TikTok, have triggered debates on privacy. The recent transformation of social media into an increasingly centralized service, exemplified by TikTok, only exacerbates the matter. While aggregation has been deemed an effective way to combat privacy infringement, a high degree of centralization can make aggregation ineffective. We present a randomized article-push algorithm and a message-passing reconstruction algorithm that enable social media platforms to infer user preferences from only the publicly available aggregate data of article-reads, without storing any individual users’ actions. Its O(n) complexity allows the reconstruction algorithm to scale to a large population, as is typical of social media platforms. Moreover, the feasibility of the privacy attack depends on the algorithm using as few articles as possible. We determine the minimum number of articles needed for high probability inference. Given the proportion of users, 0<ϵ<1, who prefer a given topic, we design a push algorithm and a reconstruction algorithm that achieve an article-to-user ratio β=ϵ(1−ϵ), at which phase transition occurs. The analysis of the algorithm departs from the classic density evolution due to the lack of monotonicity in the per-iteration error probability, which makes it surprising that phase transition takes place. By formulating the inference problem as a compressed sensing problem, we show that our phase transition threshold ϵ(1−ϵ) is extremely close to that of compressed sensing, even when the latter algorithm is of a worst-case O(n3) complexity and uses a dense Gaussian measurement matrix.

Exploiting Behavioral Side Channels in Observation Resilient Cognitive Authentication Schemes

Observation Resilient Authentication Schemes (ORAS) are a class of shared secret challenge–response identification schemes where a user mentally computes the response via a cognitive function to authenticate herself such that eavesdroppers cannot readily extract the secret. Security evaluation of ORAS generally involves quantifying information leaked via observed challenge–response pairs. However, little work has evaluated information leaked via human behavior while interacting with these schemes. A common way to achieve observation resilience is by including a modulus operation in the cognitive function. This minimizes the information leaked about the secret due to the many-to-one map from the set of possible secrets to a given response. In this work, we show that user behavior can be used as a side channel to obtain the secret in such ORAS. Specifically, the user’s eye-movement patterns and associated timing information can deduce whether a modulus operation was performed (a fundamental design element) to leak information about the secret. We further show that the secret can still be retrieved if the deduction is erroneous, a more likely case in practice. We treat the vulnerability analytically and propose a generic attack algorithm that iteratively obtains the secret despite the “faulty” modulus information. We demonstrate the attack on five ORAS and show that the secret can be retrieved with considerably less challenge–response pairs than non-side-channel attacks (e.g., algebraic/statistical attacks). In particular, our attack is applicable on Mod10, a one-time-pad-based scheme, for which no non-side-channel attack exists. We field test our attack with a small-scale eye-tracking user study.

Detection and Prevention Algorithm of DDoS Attack Over the IOT Networks

One of the most notorious security issues in the IoT is the Distributed Denial of Service (DDoS) attack. Using a large number of agents, DDoS attack floods the host server with a huge number of requests causing interrupting and blocking the legitimate user requests. This paper proposes a detection and prevention algorithm for DDoS attacks. It is divided into two parts, one for detecting the DDoS attack in the IoT end devices and the other for mitigating the impact of the attack placed on the border router. Also, it has the ability to differentiate the High-rate from the Lowrate DDoS attack accurately and defend against these two types of attacks. It is implemented and tested against different scenarios to dissect their efficiency in detecting and mitigating the DDoS attack.

Cryptanalysis of the Ivanov-Kabatiansky-Krouk-Rumenko Cryptosystems

Recently, Ivanov, Kabatiansky, Krouk, and Rumenko (IKKR) proposed three new variants of the McEliece cryptosystem (CBCrypto 2020, affiliated with Eurocrypt 2020). In this letter, it is shown that one of the IKKR cryptosystems is equal to the McEliece cryptosystem. Furthermore, a polynomial-time attack algorithm for the other two IKKR cryptosystems is proposed. The proposed attack algorithm utilizes the linearity of IKKR cryptosystems. Also, an implementation of the IKKR cryptosystems and the proposed attack is given. The proposed attack algorithm finds the plaintext within 0.2 sec that is faster than the elapsed time for legitimate decryption.

Aggregation-based location privacy: An information theoretic approach

We explore the problem of quantifying and protecting aggregation-based location privacy and study the privacy-utility tradeoff, which are essential to protect user’s location privacy when releasing aggregate statistics. Existing works on Aggregation-based Location Privacy Protection Mechanisms (ALPPMs) are mainly based on differential privacy, and metrics for evaluating information leakage introduced by releasing aggregates are normally built on adversary’s estimation error. However, there lacks privacy metrics for measuring the fundamental leakage on individual user’s data that is independent of specific data instances or attack algorithms. In this paper, we aim to solve this problem using an information-theoretic approach. We first propose a privacy metric based on the mutual information between the individual user’s location profile and the released location aggregates, and formulate the optimal location aggregate release problem that minimizes the mutual information given a utility constraint for each user. Since solving this optimization problem causes exponential complexity, we turn to prove and evaluate an upper bound, i.e., the mutual information between the original and the perturbed location aggregates, and propose a Blahut-Arimoto based algorithm to solve the optimization problem minimizing the mutual information to derive an ALPPM. We validate the actual leakage of our ALPPM and compare it to a differentially private mechanism through experiments over both synthetic and real-world location datasets. Results show the advantage of the proposed ALPPM in terms of privacy-utility tradeoff, which is enhanced when users’ location prior distributions are more skewed.

An Adversarial Approach for Intrusion Detection Systems Using Jacobian Saliency Map Attacks (JSMA) Algorithm

In today’s digital world, the information systems are revolutionizing the way we connect. As the people are trying to adopt and integrate intelligent systems into daily lives, the risks around cyberattacks on user-specific information have significantly grown. To ensure safe communication, the Intrusion Detection Systems (IDS) were developed often by using machine learning (ML) algorithms that have the unique ability to detect malware against network security violations. Recently, it was reported that the IDS are prone to carefully crafted perturbations known as adversaries. With the aim to understand the impact of such attacks, in this paper, we have proposed a novel random neural network-based adversarial intrusion detection system (RNN-ADV). The NSL-KDD dataset is utilized for training. For adversarial attack crafting, the Jacobian Saliency Map Attack (JSMA) algorithm is used, which identifies the feature which can cause maximum change to the benign samples with minimum added perturbation. To check the effectiveness of the proposed adversarial scheme, the results are compared with a deep neural network which indicates that RNN-ADV performs better in terms of accuracy, precision, recall, F1 score and training epochs.

Mitigation measures of collusive interest flooding attacks in named data networking

Collusive interest flooding attack (CIFA) is a new type of denial of service (DoS) attack against named data networking (NDN). It evolved on the basis of interest flooding attack (IFA), which has a great adverse effect on network traffic. With the help of the collusive producer, CIFA attack can evade existing detection and defense mechanisms through low-rate attack mode. By analyzing the impact of CIFA attacks on network traffic and related attributes of PIT entries, the detection scheme based on combination of rolling time window algorithm and confidence interval is proposed. The scheme detects the network status in real time by dynamically adjusting the normal network baseline. It can solve the problems of low detection rate and high false alarm rate of the existing detection algorithms for CIFA attacks. Finally, the malicious impact of the CIFA attack on the network is reduced through the management of the PIT space. Experimental results show that this approach can effectively improve the number of data packets received by legitimate users and the overall service quality of the network in a short time.

A quantum related-key attack based on the Bernstein–Vazirani algorithm

Due to the powerful computing capability of quantum computers, cryptographic researchers have applied quantum algorithms to cryptanalysis and obtained many interesting results in recent years. In this paper, we study related-key attack in the quantum setting and propose a specific related-key attack, which can recover the key of block ciphers efficiently as long as the attacked block ciphers satisfy certain condition. The attack algorithm employs the Bernstein–Vazirani algorithm as a subroutine and requires the attacker to query the encryption oracle with quantum superpositions. We give a condition under which the attack will succeed and prove that any block cipher either satisfies the condition or has a distinguishing attack. As a specific example of its application, we use the attack algorithm to extract the private key of the Even–Mansour cipher. The results of this study show the power of related-key attack when combined with quantum algorithms and provide guidance for the design of quantum-secure block ciphers.

Countering Acoustic Adversarial Attacks in Microphone-equipped Smart Home Devices

Deep neural networks (DNNs) continue to demonstrate superior generalization performance in an increasing range of applications, including speech recognition and image understanding. Recent innovations in compression algorithms, design of efficient architectures and hardware accelerators have prompted a rapid growth in deploying DNNs on mobile and IoT devices to redefine user experiences. Relying on the superior inference quality of DNNs, various voice-enabled devices have started to pervade our everyday lives and are increasingly used for, e.g., opening and closing doors, starting or stopping washing machines, ordering products online, and authenticating monetary transactions. As the popularity of these voice-enabled services increases, so does their risk of being attacked. Recently, DNNs have been shown to be extremely brittle under adversarial attacks and people with malicious intentions can potentially exploit this vulnerability to compromise DNN-based voice-enabled systems. Although some existing work already highlights the vulnerability of audio models, very little is known of the behaviour of compressed on-device audio models under adversarial attacks. This paper bridges this gap by investigating thoroughly the vulnerabilities of compressed audio DNNs and makes a stride towards making compressed models robust. In particular, we propose a stochastic compression technique that generates compressed models with greater robustness to adversarial attacks. We present an extensive set of evaluations on adversarial vulnerability and robustness of DNNs in two diverse audio recognition tasks, while considering two popular attack algorithms: FGSM and PGD. We found that error rates of conventionally trained audio DNNs under attack can be as high as 100%. Under both white- and black-box attacks, our proposed approach is found to decrease the error rate of DNNs under attack by a large margin.

Vulnerability Assessment of Power Grids Against Link-Based Attacks

In modern power grids, a local failure or attack can trigger catastrophic cascading failures, which makes it challenging to assess the attack vulnerability of power grids. In this brief, we define the optimal $K$ -link attack problem and study the attack vulnerability of power grids in cascading failures. We propose a link centrality measure based on both topological and electrical properties for power grids. According to this centrality measure, we propose a greedy attack algorithm and an optimal attack algorithm. Simulation results based on standard IEEE bus test data show that the optimal attack is better than the greedy attack and the traditional PSO-based attack in fracturing power grids. Moreover, the greedy attack has an adequate attack efficiency with a smaller computational cost. This brief aids in understanding the vulnerability of power grids and provides clues for securing power grids.

Adversarial examples detection through the sensitivity in space mappings

Adversarial examples (AEs) against deep neural networks (DNNs) raise wide concerns about the robustness of DNNs. Existing detection mechanisms are often limited to a given attack algorithm. Therefore, it is highly desirable to develop a robust detection approach that remains effective for a large group of attack algorithms. In addition, most of the existing defences only perform well for small images (e.g. MNIST and Canadian institute for advanced research (CIFAR)) rather than large images (e.g. ImageNet). In this paper, the authors propose a robust and effective defence method for analysing the sensitivity of various AEs, especially in a much harder case (large images). Their method first creates a feature map from the input space to the new feature space, by utilising 19 different feature mapping methods. Then, a detector is learned with the machine-learning algorithm to recognise the unique distribution of AEs. Their extensive evaluations on their proposed detector show that their detector can achieve: (i) low false-positive rate (<1%), (ii) high true-positive rate (higher than 98%), (iii) low overhead (<0.1 s per input), and (iv) good robustness (work well across different learning models, attack algorithms, and parameters), which demonstrate the efficacy of the proposed detector in practise.

TextTricker: Loss-based and gradient-based adversarial attacks on text classification models

Adversarial examples are generated by adding infinitesimal perturbations to legitimate inputs so that incorrect predictions can be induced into deep learning models. They have received increasing attention recently due to their significant values in evaluating and improving the robustness of neural networks. While adversarial attack algorithms have achieved notable advancements in the continuous data of images, they cannot be directly applied for discrete symbols such as text, where all the semantic and syntactic constraints in languages are expected to be satisfied. In this paper, we propose a white-box adversarial attack algorithm, TextTricker, which supports both targeted and non-targeted attacks on text classification models. Our algorithm can be implemented in either a loss-based way, where word perturbations are performed according to the change in loss, or a gradient-based way, where the expected gradients are computed in the continuous embedding space to restrict the perturbations towards a certain direction. We perform extensive experiments on two publicly available datasets and three state-of-the-art text classification models to evaluate our algorithm. The empirical results demonstrate that TextTricker performs notably better than baselines in attack success rate. Moreover, we discuss various aspects of TextTricker in details to provide a deep investigation and offer suggestions for its practical use.

Quantum algorithms for hash preimage attacks

Quantum algorithms for hash preimage attacks

Adversarial example generation with adaptive gradient search for single and ensemble deep neural network

Deep Neural Networks (DNNs) have achieved remarkable success in specific domains, such as computer vision, audio processing, and natural language processing. However, researches indicate that deep neural networks are facing many security issues (e.g., adversarial attack, information forgery). In the field of image classification, adversarial samples generated by specific adversarial attack strategies can easily fool deep neural classification models into making unreliable predictions. We find that such adversarial attack algorithms induce large-scale pixel modifications in crafted images to maintain the effectiveness of the adversarial attack. Massive pixel modifications change the inherent characteristics of generated examples and cause large image distortion. To address the mentioned issues, we introduce an adaptive gradient-based adversarial attack method named Adaptive Iteration Fast Gradient Method (AI-FGM), which focuses on seeking the input’s preceding gradient and adjusts the accumulation of perturbed entity adaptively for performing adversarial attacks. By maximizing the specific loss for generating adaptive gradient-based entities, AI-FGM calls for several gradient-based operators on the clean input to map crafted sample with the corresponding prediction directly. AI-FGM helps to reduce unnecessary gradient-based entity accumulation when processing adversary by adaptive gradient-based seeking strategy. Experimental results show that AI-FGM outperforms other gradient-based adversarial attackers in attacking deep neural classification models with fewer pixel modifications (AMP is 0.0017 with L2 norm in fooling Inception-v3) and higher success rate of invasion on deep neural classification networks in white-box and black-box attack strategy on public image datasets with different resolution.

A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks

Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. However, they tend to generate adversarial examples near or upon the boundary of the perturbation set, resulting in large distortion. Furthermore, their corresponding black-box attack algorithms also suffer from high query complexities, thereby limiting their practical usefulness. In this paper, we focus on the problem of developing efficient and effective optimization-based adversarial attack algorithms. In particular, we propose a novel adversarial attack framework for both white-box and black-box settings based on a variant of Frank-Wolfe algorithm. We show in theory that the proposed attack algorithms are efficient with an O(1/√T) convergence rate. The empirical results of attacking the ImageNet and MNIST datasets also verify the efficiency and effectiveness of the proposed algorithms. More specifically, our proposed algorithms attain the best attack performances in both white-box and black-box attacks among all baselines, and are more time and query efficient than the state-of-the-art.

Spatiotemporally Constrained Action Space Attacks on Deep Reinforcement Learning Agents

Robustness of Deep Reinforcement Learning (DRL) algorithms towards adversarial attacks in real world applications such as those deployed in cyber-physical systems (CPS) are of increasing concern. Numerous studies have investigated the mechanisms of attacks on the RL agent's state space. Nonetheless, attacks on the RL agent's action space (corresponding to actuators in engineering systems) are equally perverse, but such attacks are relatively less studied in the ML literature. In this work, we first frame the problem as an optimization problem of minimizing the cumulative reward of an RL agent with decoupled constraints as the budget of attack. We propose the white-box Myopic Action Space (MAS) attack algorithm that distributes the attacks across the action space dimensions. Next, we reformulate the optimization problem above with the same objective function, but with a temporally coupled constraint on the attack budget to take into account the approximated dynamics of the agent. This leads to the white-box Look-ahead Action Space (LAS) attack algorithm that distributes the attacks across the action and temporal dimensions. Our results showed that using the same amount of resources, the LAS attack deteriorates the agent's performance significantly more than the MAS attack. This reveals the possibility that with limited resource, an adversary can utilize the agent's dynamics to malevolently craft attacks that causes the agent to fail. Additionally, we leverage these attack strategies as a possible tool to gain insights on the potential vulnerabilities of DRL agents.

Adversary for Social Good: Protecting Familial Privacy through Joint Adversarial Attacks

Social media has been widely used among billions of people with dramatical participation of new users every day. Among them, social networks maintain the basic social characters and host huge amount of personal data. While protecting user sensitive data is obvious and demanding, information leakage due to adversarial attacks is somehow unavoidable, yet hard to detect. For example, implicit social relation such as family information may be simply exposed by network structure and hosted face images through off-the-shelf graph neural networks (GNN), which will be empirically proved in this paper. To address this issue, in this paper, we propose a novel adversarial attack algorithm for social good. First, we start from conventional visual family understanding problem, and demonstrate that familial information can easily be exposed to attackers by connecting sneak shots to social networks. Second, to protect family privacy on social networks, we propose a novel adversarial attack algorithm that produces both adversarial features and graph under a given budget. Specifically, both features on the node and edges between nodes will be perturbed gradually such that the probe images and its family information can not be identified correctly through conventional GNN. Extensive experiments on a popular visual social dataset have demonstrated that our defense strategy can significantly mitigate the impacts of family information leakage.