Average Attack Research Articles

Enhancing adversarial transferability with local transformation

Robust deep learning models have demonstrated significant applicability in real-world scenarios. The utilization of adversarial attacks plays a crucial role in assessing the robustness of these models. Among such attacks, transfer-based attacks, which leverage white-box models to generate adversarial examples, have garnered considerable attention. These transfer-based attacks have demonstrated remarkable efficiency, particularly under the black-box setting. Notably, existing transfer attacks often exploit input transformations to amplify their effectiveness. However, prevailing input transformation-based methods typically modify input images indiscriminately, overlooking regional disparities. To bolster the transferability of adversarial examples, we propose the Local Transformation Attack (LTA) based on forward class activation maps. Specifically, we first obtain future examples through accumulated momentum and compute forward class activation maps. Subsequently, we utilize these maps to identify crucial areas and apply pixel scaling for transformation. Finally, we update the adversarial examples by using the average gradient of the transformed image. Extensive experiments convincingly demonstrate the effectiveness of our proposed LTA. Compared to the current state-of-the-art attack approaches, LTA achieves an increase of 7.9% in black-box attack performance. Particularly, in the case of ensemble attacks, our method achieved an average attack success rate of 98.3%.

Hereditary Angioedema Attacks in Patients Receiving Long-Term Prophylaxis: A Systematic Review.

Long-term prophylaxis (LTP) has been shown to reduce the frequency of hereditary angioedema (HAE) attacks; however, attacks occurring in patients receiving LTP have not been well characterized. The objective of this systematic review was to evaluate the proportion of type I/II HAE (HAE-C1INH) patients who experience attacks while receiving LTP, the characteristics of these attacks, and associated on-demand therapy use. A systematic search was conducted in PubMed to identify studies reporting LTP use with plasma-derived C1 inhibitor (pdC1INH), lanadelumab, berotralstat, androgens, or antifibrinolytics in patients with HAE-C1INH. Forty-five primary studies met the inclusion criteria. In phase 3 trials, attack-free rates were 40% for subcutaneous pdC1INH 60IU/kg twice weekly at 16weeks, and 44% for lanadelumab 300mg every second week at 6months (77% during steady-state [days 70-182]); there was no difference in attack-free rate for berotralstat 150mg versus placebo at 24weeks. Phase 3 studies reported a lower average attack severity with subcutaneous and intravenous pdC1INH versus placebo. With lanadelumab and berotralstat, the prophylactic treatment effect was more pronounced in peripheral attacks than in abdominal and laryngeal attacks. Laryngeal attacks accounted for 2%-7% of all attacks in observational and interventional studies, regardless of the LTP agent received. On-demand therapy was used in 49%-94% of attacks occurring in the presence of LTP. In conclusion, patients receiving LTP experienced attacks in all anatomic locations, including the larynx. Most attacks were treated with on-demand therapy, although outcomes were not reported. Access to on-demand therapy remains essential for all people with HAE-C1INH.

Retrospective analysis of a large-scale cholera outbreak in Sudan

Background: Cholera outbreak is a significant public health threat in some parts of Sudan. In 2023, there was a large-scale outbreak in Gadarif State. Aim: To analyse the 2023 cholera outbreak in Sudan and recommend prevention and control measures for the future. Methods: In this retrospective study we conducted an epidemiological analysis of data from suspected and confirmed cholera cases, aged ≥ 2 years, from 138 health centres in Gadarif State, Sudan. Results: A total of 1997 cholera cases were confirmed using rapid diagnostic test between 25 August and 17 December 2023. Most patients (99.2%) had severe watery diarrhoea, and vomiting was reported in over 73% of cases. Dehydration rates were similar for men and women (≈55–60%), average attack rate was 6.7 per 10 000 population. The attack rate varied by locality but not by gender across all age groups. The outbreak lasted 20 weeks and claimed 46 lives, giving a case fatality ratio of 2.6%. Public misconception about water chlorination substantially hindered control efforts. Conclusion: The prolonged period of the outbreak and the high case fatality ratio highlight the need for better laboratory and epidemiologic surveillance as well as better preparedness and response for future outbreaks, along with educational activities to address myths and misconceptions.

T-Smade: A Two-Stage Smart Detector for Evasive Spectre Attacks Under Various Workloads

Evasive Spectre attacks have used additional nop or memory delay instructions to make effective hardware performance counter based detectors with lower attack detection successful rate. Interestingly, the detection performance gets worse under different workloads. For example, the attack detection successful rate is only 59.8% for realistic applications, while it is much lower 27.52% for memory stress test. Therefore, this paper proposes a two-stage smart detector T-Smade designed for evasive Spectre attacks (e.g., evasive Spectre nop and evasive Spectre memory) under various workloads. T-Smade uses the first-stage detector to identify the type of workloads and then selects the appropriate second-stage detector, which uses four hardware performance counter events to characterize the high cache miss rate and low branch miss rate of Spectre attacks. More importantly, the second stage detector adds one dimension of reusing cache miss rate and branch miss rate to exploit the characteristics of various workloads to detect evasive Spectre attacks effectively. Furthermore, to achieve the good generalization for more unseen evasive Spectre attacks, the proposed classification detector T-Smade is trained by the raw data of Spectre attacks and non-attacks in different workloads using simple Multi-Layer Perception models. The comprehensive results demonstrate that T-Smade makes the average attack detection successful rate of evasive Spectre nop under different workload return from 27.52% to 95.42%, and that of evasive Spectre memory from 59.8% up to 100%.

Adversarial sample attack method based on loss smoothing

Deep neural networks (DNNs) are vulnerable to adversarial examples.Although the existing momentum-based adversarial example generation method can achieve a close 100%white-box attack success rate, it is still not ideal when attacking other models, and the black- box attack success rate is low. To address this, an adversarial example attack method based on loss smoothing is proposed to improve the transferability of adversarial examples. In the iterative process of calculating the gradient at each step, the current gradient is not used directly, but the local average gradient is used to accumulate momentum, so as to suppress the local oscillation phenomenon on the loss function surface, thereby stabilizing the update direction and escaping the local extreme point. A large number of experimental results on the ImageNet dataset show that compared with the existing momentum-based method, the average black-box attack success rate of the proposed method in single model attack experiments is improved by 38.07%and 27.77%, and the average black-box attack success rate in integrated model attack experiments is improved by and.Rising32.50%and28.63%

IUAC: Inaudible Universal Adversarial Attacks Against Smart Speakers

Intelligent voice systems are widely utilized to control smart home applications, which raises significant privacy and security concerns. Recent studies have revealed their vulnerability to adversarial attacks, replay attacks, etc. However, these attacks rely on the victim’s voice data. In our work, we investigate a stealthy and command-independent attack that does not necessitate collecting victims’ voices. Our proposed attack, IUAC, misleads the voice system to go against the victim’s will, regardless of the commands delivered. Our core concept is to train highly robust attack commands through the construction of diverse data, rendering the user’s commands negligible. To achieve stealthy attacks, we leverage a high-frequency carrier to construct an inaudible universal adversarial command. Extensive experiments conducted with real-world datasets demonstrate that our attack system attains an average attack success rate of 96% while resisting environmental interference. Moreover, our attack success rate against real-world voice systems is 4.52 × higher than the state-of-the-art. Finally, we propose an effective defense mechanism and provide experimental tests to validate its efficacy.

Dispersal of optimal foragers in a patchy environment: Simulations with a mathematical model and tests of predictions in field experiments

To predict the effect of density on the dispersal of foraging parasitoids, we developed a spatially explicit individual-based model in which parasitoids move among host patches at random but use an optimal decision-rule about when to leave these patches. We used a simple decision rule where an individual forager exploits a patch as long as the instantaneous attack rate is higher than the average attack rate it has experienced in the environment. Such a rule implies that foragers compute and remember attack rates as they forage. Simulations with different combinations of patch distribution, host density, mutual interference, and parasitoid density predicted that dispersal distance should increase with parasitoid density. To test this prediction, we used data from two field experiments in which we released either few or many adults of the aphid parasitoid Aphelinus asychis in replicated sites, and subsequently assessed dispersal from the spatial distribution of parasitoid offspring. In the first experiment, we did not to detect a relation between the number released and dispersal distance, but in the second experiment, dispersal distance increased with initial density, as predicted by our model. We propose two hypotheses to explain the discrepancy between the experiments. Different levels of environmental variability among experiments, resulting from differences in experimental designs, could cause differences in statistical conclusions. However, there could be a threshold density below which dispersal is not density-dependent, and this threshold may have been exceeded in the second experiment where large releases involved many more individuals than in the first experiment. In any case, our approach linked individual behavior and spatial distribution, and our results show that the insect distributions in the field can be predicted, qualitatively, from theory about individual behavior.

Towards universal and transferable adversarial attacks against network traffic classification

In recent years, deep learning technology has shown astonishing potential in many fields, but at the same time, it also hides serious vulnerabilities. In the field of network traffic classification, attackers exploit this vulnerability to add designed perturbations to normal traffic, causing incorrect network traffic classification to implement adversarial attacks. The existing network traffic adversarial attack methods mainly target specific models or sample application scenarios, which have many problems such as poor transferability, high time cost, and low practicality. Therefore, this article proposes a method towards universal and transferable adversarial attacks against network traffic classification, which can not only perform universal adversarial attacks on all samples in the network traffic dataset, but also achieve cross data and cross model transferable adversarial attacks, that is, it has transferable attack effects at both the network traffic data and classification model levels. This method utilizes the geometric characteristics of the network model to design the target loss function and optimize the generation of universal perturbations, resulting in biased learning of features at each layer of the network model, leading to incorrect classification results. Meanwhile, this article conducted universality and transferability adversarial attack verification experiments on standard network traffic datasets of three different classification applications, USTC-TFC2016, ISCX2016, and CICIoT2023, as well as five common network models such as LeNet5. The results show that the proposed method performs universal adversarial attacks on five network models on three datasets, USTC-TFC2016, ISCX2016, and CICIoT2023, with an average attack success rate of over 80 %, 85 %, and 88 %, respectively, and an average time cost of about 0–0.3 ms; And the method proposed in this article has shown good transferable attack performance between five network models and on three network traffic datasets, with transferable attack rates approaching 100 % across different models and datasets, which is more closely related to practical applications.

Predicting the Path of Insurgency: Data-Driven Strategies to Counter Boko Haram in Nigeria

Background While Boko Haram insurgency’s dangers are well documented, existing research lacks methods for effective monitoring and prediction, of their activities. This study addresses this gap by analyzing data from Nigerian Security Tracker website (https://www.cfr.org/nigeria/nigeria-security-tracker/p29483) from year 2011 to 2023 and geolocated information on Boko Haram activity. Methods The research employs a mixed-methods approach. It uses descriptive statistics to understand attack trends and time series models (ARIMA/SARIMA) to forecast future attacks. Additionally, control charts identify periods of heightened insurgency. Results The findings confirm the Northeast region, as the epicenter of Boko Haram activities. The average monthly attack rate was 18 incidents, leading to 682 deaths over 12 years. 2014 and 2015 witnessed the peak of the insurgency. The forecasting models suggest a potential decrease in attack frequency in the coming years, with an average of nine attacks per month. This predicted decline might be linked to intervention efforts. Control charts reveal periods where attacks surpassed expected levels, highlighting critical moments for intensified counter-insurgency measures. These periods include July 2012-May 2014 and June 2014-August 2015, with a period of regained control. Conclusion This research provides valuable insights for stakeholders working to fight against Boko Haram’s insurgency. It offers forecasting capabilities and identifies critical periods, potentially informing targeted interventions and improving overall counter-insurgency strategies.

Like teacher, like pupil: Transferring backdoors via feature-based knowledge distillation

With the widespread adoption of edge computing, compressing deep neural networks (DNNs) via knowledge distillation (KD) has emerged as a popular technique for resource-limited scenarios. Among various KD methods, feature-based KD, which leverages the feature representations from intermediate layers of the teacher model to supervise the training of the student model, has shown superior performance and enjoyed wide application. However, users often overlook potential backdoor threats when using knowledge distillation (KD) to extract knowledge. To address the issue, this paper mainly contributes to three aspects: (1) we try the first step of exploring the security risks in feature-based KD, where implanted backdoors in teacher models can survive and transfer to student models. (2) We propose a backdoor attack method targeting feature distillation, achieved by encoding backdoor knowledge into specific neuron activation layers. Specifically, we optimize triggers to induce consistent feature map values in the teacher model and transfer the backdoor knowledge to student models through these features. We also design an adaptive defense method against this attack. (3) Extensive experiments on four common datasets and six sets of different teacher and student models validate that our attack outperforms the state-of-the-art (SOTA) baselines, with an average attack success rate of (∼×1.5). Additionally, we discuss effective defense methods against such backdoor attacks.

Stabilization of Networked Switched Systems Under DoS Attacks.

This article studies the stability issue of networked switched systems (NSSs) under denial-of-service (DoS) attacks. To address this issue, the derived limitations imposed on both the frequency of DoS attacks on each subsystem and the upper limit of attack duration that each subsystem can tolerate are mode-dependent, which is more efficient and flexible than the current results for NSSs. Moreover, we reveal the relationship between the upper bound of the average maximum tolerable attack duration associated with the corresponding subsystem and the actual mode-dependent average dwell time. Furthermore, we identify that the total tolerable DoS attack duration as a percentage of the system runtime in this article can be higher than existing results. Finally, an example is given to demonstrate the effectiveness of our work.

A Clean-Label Graph Backdoor Attack Method in Node Classification Task

Backdoor attacks in the traditional graph neural networks (GNNs) field are easily detectable due to the dilemma of confusing labels. To explore the backdoor vulnerability of GNNs and create a more stealthy backdoor attack method, a clean-label graph backdoor attack method(CGBA) in the node classification task is proposed in this paper. Differently from existing backdoor attack methods, CGBA requires neither modification of node labels nor graph structure. Specifically, to solve the problem of inconsistency between the contents and labels of the samples, CGBA selects poisoning samples in a specific target class and uses the samples’ own label as the target label (i.e., clean-label) after injecting triggers into the target samples. To guarantee the similarity of neighboring nodes, the raw features of the nodes are elaborately picked as triggers to further improve the concealment of the triggers. Extensive experiments results show the effectiveness of our method. When the poisoning rate is 0.04, CGBA can achieve an average attack success rate of 87.8%, 98.9%, 89.1%, and 98.5%, respectively.

Boosting the transferability of adversarial attacks with global momentum initialization

Deep Neural Networks (DNNs) are vulnerable to adversarial examples, which are crafted by adding human-imperceptible perturbations to the benign inputs. Simultaneously, adversarial examples exhibit transferability across models, enabling practical black-box attacks. However, existing methods are still incapable of achieving the desired transfer attack performance. In this work, focusing on gradient optimization and consistency, we analyze the gradient elimination phenomenon as well as the local momentum optimum dilemma. To tackle these challenges, we introduce Global Momentum Initialization (GI), providing global momentum knowledge to mitigate gradient elimination. Specifically, we perform gradient pre-convergence before the attack and a global search during this stage. GI seamlessly integrates with existing transfer methods, significantly improving the success rate of transfer attacks by an average of 6.4% under various advanced defense mechanisms compared to the state-of-the-art method. Ultimately, GI demonstrates strong transferability in both image and video attack domains. Particularly, when attacking advanced defense methods in the image domain, it achieves an average attack success rate of 95.4%. The code is available at https://github.com/Omenzychen/Global-Momentum-Initialization.

Enhancing Transferability with Intra-Class Transformations and Inter-Class Nonlinear Fusion on SAR Images

Recent research has revealed that the deep neural network (DNN)-based synthetic-aperture radar (SAR) automatic target recognition (ATR) techniques are vulnerable to adversarial examples, which poses significant security risks for their deployment in real-world systems. At the same time, the adversarial examples often exhibit transferability across DNN models, whereby when they are generated on the surrogate model they can also attack other target models. As the significant property in black-box scenarios, transferability has been enhanced by various methods, among which input transformations have demonstrated excellent effectiveness. However, we find that existing transformations suffer from limited enhancement of transferability due to the unique imaging mechanism and scattering characteristics of SAR images. To overcome this issue, we propose a novel method called intra-class transformations and inter-class nonlinear fusion attack (ITINFA). It enhances transferability from two perspectives: intra-class single image transformations and inter-class multiple images fusion. The intra-class transformations module utilizes a series of diverse transformations that align with the intrinsic characteristics of SAR images to obtain a more stable gradient update direction and prevent the adversarial examples from overfitting the surrogate model. The inter-class fusion strategy incorporates the information from other categories in a nonlinear manner, effectively enhances the feature fusion effect, and guides the misclassification of adversarial examples. Extensive experiments on the MSTAR dataset and SEN1-2 dataset demonstrate that ITINFA exhibits significantly better transferability than the existing transfer-based methods, with the average transfer attack success rate increases exceeding 8% for single models and over 4% for ensemble models.

Ketahanan Varietas Padi terhadap Hama Penggerek Batang (Scirpophaga sp.) di Kampung Telaga Sari Kabupaten Merauke

The rice stem borer (Scirpophaga sp.) is a significant pest of rice plants, causing substantial yield losses. This study aimed to assess the growth response of seven rice varieties to stem borer (Scirpophaga sp.) infestation. The research was conducted in Kampung Telaga Sari, Kurik District, Merauke Regency, from October 2022 to January 2023. The experiment followed a Randomized Complete Block Design (RCBD) with seven varieties and three replications per trial. The varieties tested were Inpari 32, Inpari 42, Cakrabuana, Siam-siam, CL 220, Sertani, and Mekongga. Each treatment was replicated three times, resulting in 21 experimental plots, each measuring 3 x 3 m² with a planting distance of 20 x 20 cm, comprising 50 plants per plot. The research findings indicated significant differences in stem borer damage intensity at the 0.01 level of significance. The highest average attack intensity was observed in the Inpari 32 variety (5.44%), while the lowest average attack intensity was found in the Cakrabuana variety (2%).

Adversarial Infrared Curves: An attack on infrared pedestrian detectors in the physical world

Deep neural network security is a persistent concern, with considerable research on visible light physical attacks but limited exploration in the infrared domain. Existing approaches, like white-box infrared attacks using bulb boards and QR suits, lack realism and stealthiness. Meanwhile, black-box methods with cold and hot patches often struggle to ensure robustness. To bridge these gaps, we propose Adversarial Infrared Curves (AdvIC). Using Particle Swarm Optimization, we optimize two Bezier curves and employ cold patches in the physical realm to introduce perturbations, creating infrared curve patterns for physical sample generation. Our extensive experiments confirm AdvIC’s effectiveness, achieving 94.8% and 67.2% attack success rates for digital and physical attacks, respectively. Stealthiness is demonstrated through a comparative analysis, and robustness assessments reveal AdvIC’s superiority over baseline methods. When deployed against diverse advanced detectors, AdvIC achieves an average attack success rate of 76.2%, emphasizing its robust nature. We conduct thorough experimental analyses, including ablation experiments, transfer attacks, adversarial defense investigations, etc. Given AdvIC’s substantial security implications for real-world vision-based applications, urgent attention and mitigation efforts are warranted.

Boosting the Transferability of Ensemble Adversarial Attack via Stochastic Average Variance Descent

Adversarial examples have the property of transferring across models, which has created a great threat for deep learning models. To reveal the shortcomings in the existing deep learning models, the method of the ensemble has been introduced to the generating of transferable adversarial examples. However, most of the model ensemble attacks directly combine the different models’ output but ignore the large differences in optimization direction of them, which severely limits the transfer attack ability. In this work, we propose a new kind of ensemble attack method called stochastic average ensemble attack. Unlike the existing approach of averaging the outputs of each model as an integrated output, we continuously optimize the ensemble gradient in an internal loop using the model history gradient and the average gradient of different models. In this way, the adversarial examples can be updated in a more appropriate direction and make the crafted adversarial examples more transferable. Experimental results on ImageNet show that our method generates highly transferable adversarial examples and outperforms existing methods.

Comparison of greater occipital nerve blockade with radiofrequency and steroid in chronic migraine

ObjectivesThe study aims to retrospectively compare steroid and radiofrequency treatments for the greater occipital nerve(GON) under ultrasound guidance in chronic migraine. MethodsMonthly average headache attack frequency, attack duration, visual analog scale(VAS) and the number of days analgesics were taken were recorded. Under ultrasound guidance, GON block was administered once a week for a total of four sessions. In the final session, 4 mg of dexamethasone was added to the local anesthetic for the steroid group (n:26). Pulsed radiofrequency (RF) treatment was applied to the RF group (n:25) just before the last session of the GON block. The pain course in the week following the procedure monthly average headache attack frequency, attack duration, VAS and the number of days analgesics were taken in a month were compared for both groups at 1–3–6 months. ResultsIn the first month, a statistically significant decrease in attack frequency was observed in the RF group. However, no statistically significant differences were found between the groups in other findings at different time intervals. A significant decrease headache attack duration,VAS, and the number of days analgesics were taken in a month was observed in both treatment groups. Both treatments were found to be effective, but the effect size of the treatment was higher in the RF group compared to the steroid group. ConclusionAlthough the results were better in the group receiving pulsed RF treatment, except for the attack frequency in the first month, no statistically significant superiority of one treatment method over the other was determined.

TraceEvader: Making DeepFakes More Untraceable via Evading the Forgery Model Attribution

In recent few years, DeepFakes are posing serve threats and concerns to both individuals and celebrities, as realistic DeepFakes facilitate the spread of disinformation. Model attribution techniques aim at attributing the adopted forgery models of DeepFakes for provenance purposes and providing explainable results to DeepFake forensics. However, the existing model attribution techniques rely on the trace left in the DeepFake creation, which can become futile if such traces were disrupted. Motivated by our observation that certain traces served for model attribution appeared in both the high-frequency and low-frequency domains and play a divergent role in model attribution. In this work, for the first time, we propose a novel training-free evasion attack, TraceEvader, in the most practical non-box setting. Specifically, TraceEvader injects a universal imitated traces learned from wild DeepFakes into the high-frequency component and introduces adversarial blur into the domain of the low-frequency component, where the added distortion confuses the extraction of certain traces for model attribution. The comprehensive evaluation on 4 state-of-the-art (SOTA) model attribution techniques and fake images generated by 8 generative models including generative adversarial networks (GANs) and diffusion models (DMs) demonstrates the effectiveness of our method. Overall, our TraceEvader achieves the highest average attack success rate of 79% and is robust against image transformations and dedicated denoising techniques as well where the average attack success rate is still around 75%. Our TraceEvader confirms the limitations of current model attribution techniques and calls the attention of DeepFake researchers and practitioners for more robust-purpose model attribution techniques.

Evasion Attacks on Deep Learning-Based Helicopter Recognition Systems

Identifying objects in surveillance and reconnaissance systems with the human eye can be challenging, underscoring the growing importance of employing deep learning models for the recognition of enemy weapon systems. These systems, leveraging deep neural networks known for their strong performance in image recognition and classification, are currently under extensive research. However, it is crucial to acknowledge that surveillance and reconnaissance systems utilizing deep neural networks are susceptible to vulnerabilities posed by adversarial examples. While prior adversarial example research has mainly utilized publicly available internet data, there has been a significant absence of studies concerning adversarial attacks on data and models specific to real military scenarios. In this paper, we introduce an adversarial example designed for a binary classifier tasked with recognizing helicopters. Our approach generates an adversarial example that is misclassified by the model, despite appearing unproblematic to the human eye. To conduct our experiments, we gathered real attack and transport helicopters and employed TensorFlow as the machine learning library of choice. Our experimental findings demonstrate that the average attack success rate of the proposed method is 81.9%. Additionally, when epsilon is 0.4, the attack success rate is 90.1%. Before epsilon reaches 0.4, the attack success rate increases rapidly, and then we can see that epsilon increases little by little thereafter.