Box Attack Research Articles

Adversarial sample attack method based on loss smoothing

Deep neural networks (DNNs) are vulnerable to adversarial examples.Although the existing momentum-based adversarial example generation method can achieve a close 100%white-box attack success rate, it is still not ideal when attacking other models, and the black- box attack success rate is low. To address this, an adversarial example attack method based on loss smoothing is proposed to improve the transferability of adversarial examples. In the iterative process of calculating the gradient at each step, the current gradient is not used directly, but the local average gradient is used to accumulate momentum, so as to suppress the local oscillation phenomenon on the loss function surface, thereby stabilizing the update direction and escaping the local extreme point. A large number of experimental results on the ImageNet dataset show that compared with the existing momentum-based method, the average black-box attack success rate of the proposed method in single model attack experiments is improved by 38.07%and 27.77%, and the average black-box attack success rate in integrated model attack experiments is improved by and.Rising32.50%and28.63%

A knowledge distillation strategy for enhancing the adversarial robustness of lightweight automatic modulation classification models

AbstractAutomatic modulation classification models based on deep learning models are at risk of being interfered by adversarial attacks. In an adversarial attack, the attacker causes the classification model to misclassify the received signal by adding carefully crafted adversarial interference to the transmitted signal. Based on the requirements of efficient computing and edge deployment, a lightweight automatic modulation classification model is proposed. Considering that the lightweight automatic modulation classification model is more susceptible to interference from adversarial attacks and that adversarial training of the lightweight auto‐modulation classification model fails to achieve the desired results, an adversarial attack defense system for the lightweight automatic modulation classification model is further proposed, which can enhance the robustness when subjected to adversarial attacks. The defense method aims to transfer the adversarial robustness from a trained large automatic modulation classification model to a lightweight model through the technique of adversarial robust distillation. The proposed method exhibits better adversarial robustness than current defense techniques in feature fusion based automatic modulation classification models in white box attack scenarios.

Sliced Wasserstein adversarial training for improving adversarial robustness

Recently, deep-learning-based models have achieved impressive performance on tasks that were previously considered to be extremely challenging. However, recent works have shown that various deep learning models are susceptible to adversarial data samples. In this paper, we propose the sliced Wasserstein adversarial training method to encourage the logit distributions of clean and adversarial data to be similar to each other. We capture the dissimilarity between two distributions using the Wasserstein metric and then align distributions using an end-to-end training process. We present the theoretical background of the motivation for our study by providing generalization error bounds for adversarial data samples. We performed experiments on three standard datasets and the results demonstrate that our method is more robust against white box attacks compared to previous methods.

Facial soft-biometrics obfuscation through adversarial attacks

Sharing facial pictures through online services, especially on social networks, has become a common habit for thousands of users. This practice hides a possible threat to privacy: the owners of such services, as well as malicious users, could automatically extract information from faces using modern and effective neural networks. In this paper, we propose the harmless use of adversarial attacks, i.e. variations of images that are almost imperceptible to the human eye and that are typically generated with the malicious purpose to mislead Convolutional Neural Networks (CNNs). Such attacks have been instead adopted to (i) obfuscate soft biometrics (gender, age, ethnicity) but (ii) without degrading the quality of the face images posted online. We achieve the above mentioned two conflicting goals by modifying the implementations of four of the most popular adversarial attacks, namely FGSM, PGD, DeepFool and C&W, in order to constrain the average amount of noise they generate on the image and the maximum perturbation they add on the single pixel. We demonstrate, in an experimental framework including three popular CNNs, namely VGG16, SENet and MobileNetV3, that the considered obfuscation method, which requires at most four seconds for each image, is effective not only when we have a complete knowledge of the neural network that extracts the soft biometrics (white box attacks), but also when the adversarial attacks are generated in a more realistic black box scenario. Finally, we prove that an opponent can implement defense techniques to partially reduce the effect of the obfuscation, but substantially paying in terms of accuracy over clean images; this result, confirmed by the experiments carried out with three popular defense methods, namely adversarial training, denoising autoencoder and Kullback-Leibler autoencoder, shows that it is not convenient for the opponent to defend himself and that the proposed approach is robust to defenses.

DCVAE-adv: A Universal Adversarial Example Generation Method for White and Black Box Attacks

DCVAE-adv: A Universal Adversarial Example Generation Method for White and Black Box Attacks

Enhancing cybersecurity in smart grids: Deep black box adversarial attacks and quantum voting ensemble models for blockchain privacy-preserving storage

Smart grids are getting important in today’s power management, so with that, smart grid technologies are increasingly important too. There have been a lot of concerns about smart grid technologies being hacked, and as a result, some deep black box adversarial attacks have been conducted and presented. We propose a new experimental methodology for benchmarking smart grid security with black box attacks. Additionally, concerning the type of smart grids, Smart Power Grids, deep black box adversarial attacks which can be crafted using virtually no knowledge about the target due to the inherent complexity of content available in cryptographic libraries like SecLib or Bouncy Castle how it affects security of cyber-physical power systems. We identify potential impacts of deep black box attacks on Smart Power Grids as implemented by the Department of Energy in 1996, we evaluate existing protection methods, and we find out the pitfalls thereof. With the aim of overcoming the aforementioned drawbacks, we initiate a study on deep black box adversarial attacks against Smart Power Grids showing that statistically significant effects against a national Smart Power Grid are achievable with absolute security. We also probe detection of cyber security attacks on Smart Power Grids. We illustrate landscape of smart grids with numerous cyber threats and demonstrate the limitations of traditional security practices. We show the importance of machine learning to detect attacks and the unlikelihood of identification of dependable and efficient detection schemes. We describe quantum voting ensemble models as one of the most powerful techniques in the detection of cyber security attacks. Finally, we propose an experimental setup and evaluation criteria to detect cyber security attacks in smart grids using quantum voting ensemble models. Then, we talk about private data storage in blockchain based smart grid infrastructure. We give an introduction of block chain and its essentiality in smart grids. We discuss privacy issues in block chain based smart grids. We acknowledge the strength of privacy safeguards, but on the same wavelength, we realize their weaknesses. Next, we propose a quantum resistant encryption technique that enhances the privacy of smart grids. We propose quantum voting ensemble models as one of the most promising techniques to address the issue of private data storage in block chains. As a result, we provide a comparison between the proposed models and traditional approaches to privacy protection in smart grids based on an experimental performance review. Then, we propose a unified strategy to improve smart grid cyber security by incorporating deep black box attacks with quantum voting ensemble models. Finally, we disclose several benefits of such integration and perform an experimental evaluation to investigate the effectiveness of the unified approach. The results of our study identify security gaps in smart grids and propose state-of-the-art mechanisms to address them. The challenges of smart grids system require the amalgamation of blockchain, quantum voting ensemble models and deep black box adversarial attacks. We achieve this objective proposing a unified strategy. The results of this study will equally be helpful for future research and smart grid cyber security implementations.

F-NIDS — A Network Intrusion Detection System based on federated learning

The rise of IoT networks has presented fresh challenges in terms of scalability and security for distributed Network Intrusion Detection Systems (NIDS) due to privacy concerns. While some progress has been made in addressing these challenges, there are still unanswered questions regarding how to achieve a balance between performance and robustness to ensure privacy in a distributed manner. Additionally, there is a need to develop a reliable and scalable architecture for distributed NIDS that can be effectively deployed in various IoT scenarios. These questions about robustness relied mainly on choosing privacy-secured and distributed Machine Learning techniques. In this work, we propose the F-NIDS, an intrusion detector that utilizes federated artificial intelligence and asynchronous communication techniques between system entities to provide horizontal scalability, along with differential privacy techniques to address data confidentiality concerns. The architecture of F-NIDS is designed to be adaptable for usage in IoT networks, suited to be used in cloud or fog-based environments. Results from our experiments have shown that the confidential detection model employed in F-NIDS – considering multi-class accuracy, binary accuracy, precision, and recall metrics – was capable of predicting and determining the nature of attacks when they occur. In order to determine optimal parameters that strike a balance between data privacy and classification performance, three strategies were employed, each evaluated for its corresponding robustness performance. Firstly, models were trained with varying Gaussian noise values, and subjected to membership inference black box rule-based attacks. Secondly, regular membership inference black box attacks were performed, utilizing different stolen samples with varying sizes to determine the maximum amount of data that could be securely stored on the detection agents for training tasks. Lastly, the robustness of the trained models was evaluated against a model inversion attack, and the results were compared through graphical comparisons. Based on these evaluations, Gaussian noise level and sample size values of 21 were obtained for each detection agent in the system, with sample sizes ranging from 10K to 25K.

Improved Two Stage Generative Adversarial Networks for Adversarial Example Generation with Real Exposure

Introduction: Deep neural networks due to their linear nature are sensitive to adversarial examples. They can easily be broken just by a small disturbance to the input data. Some of the existing methods to perform these kinds of attacks are pixel-level perturbation and spatial transformation of images. Method: These methods generate adversarial examples that can be fed to the network for wrong predictions. The drawback that comes with these methods is that they are really slow and computationally expensive. This research work performed a black box attack on the target model classifier by using the generative adversarial networks (GAN) to generate adversarial examples that can fool a classifier model to classify the images as wrong classes. The proposed method used a biased dataset that does not contain any data of the target label to train the first generator Gnorm of the first stage GAN, and after the first training has finished, the second stage generator Gadv, which is a new generator model that does not take random noise as input but the output of the first generator Gnorm. Result: The generated examples have been superimposed with the Gnorm output with a small constant, and then the superimposed data have been fed to the target model classifier to calculate the loss. Some additional losses have been included to constrain the generation from generating target examples. Conclusion: The proposed model has shown a better fidelity score, as evaluated using Fretchet inception distance score (FID), which was up to 42.43 in the first stage and up to 105.65 in the second stage with the attack success rate of up to 99.13%.

Robust transformer with locality inductive bias and feature normalization

Vision transformers have been demonstrated to yield state-of-the-art results on a variety of computer vision tasks using attention-based networks. However, research works in transformers mostly do not investigate robustness/accuracy trade-off, and they still struggle to handle adversarial perturbations. In this paper, we explore the robustness of vision transformers against adversarial perturbations and try to enhance their robustness/accuracy trade-off in white box attack settings. To this end, we propose Locality iN Locality (LNL) transformer model. We prove that the locality introduction to LNL contributes to the robustness performance since it aggregates local information such as lines, edges, shapes, and even objects. In addition, to further improve the robustness performance, we encourage LNL to extract training signal from the moments (a.k.a., mean and standard deviation) and the normalized features. We validate the effectiveness and generality of LNL by achieving state-of-the-art results in terms of accuracy and robustness metrics on German Traffic Sign Recognition Benchmark (GTSRB) and Canadian Institute for Advanced Research (CIFAR-10). More specifically, for traffic sign classification, the proposed LNL yields gains of 1.1% and 35% in terms of clean and robustness accuracy compared to the state-of-the-art studies.

On Adversarial Vulnerability of Activation Functions in Automatic Speaker verification System

Automatic Speaker verification (ASV) is the task of authenticating the claimed identity of a speaker from his/her voice characteristics. Even though deep neural network (DNN) based ASV systems achieved improved performance, recent investigations revealed that they are vulnerable to adversarial attacks. Several defense strategies have been proposed in the literature, which operates either at data augmentation or network architecture levels. Activation functions with local competition and stochasticity were proposed to improve the adversarial robustness of the DNN models. This work critically analyzes the adversarial vulnerability of the winner takes all (WTA), and its stochastic counterpart stochastic local winner takes all (SLWTA) activation functions. It is observed that while the SLWTA activation function offers improved robustness to the white box attacks, it is equally vulnerable to transferable black box attacks. We show that the adversarial robustness of SLWTA activation to white-box attacks can be attributed to its inability to generate effective adversarial examples rather than built-in robustness against adversarial attacks.

Exploring the Effect of Randomness on Transferability of Adversarial Samples Against Deep Neural Networks

We investigate the transferability of adversarial attacks against deep neural networks (DNNs)—the contagion effect of adversarial attacks that, once deceiving one DNN model, can easily deceive other DNN models built on similar data. We demonstrate that introducing randomness to DNN models can break the curse of the transferability of adversarial attacks, given that the adversary does not have an unlimited attack budget. Two randomization schemes are explored: 1.) a random selection—single or ensemble—from a set of DNNs is surprisingly more robust against the strongest form of complete-knowledge attacks (a.k.a, white box attacks); 2.) after a small Gaussian random noise is added to its learned weights, a DNN model can potentially increase its resilience to adversarial attacks by as much as 74.2%. We compare the two randomization techniques to the Ensemble Adversarial Training technique and show that our randomization techniques are superior under different attack budget constraints. Furthermore, we explore the relationship between attack severity and decision boundary robustness in the version space. Finally, we connect the dots between the effectiveness of randomization to prevent attack transferability and the variability of DNN models through analyzing the differential entropy of sample hypotheses in the hypothesis space.

AES Based White Box Cryptography in Digital Signature Verification

According to the standard paradigm, white box cryptographic primitives are used to block black box attacks and protect sensitive information. This is performed to safeguard the protected information and keys against black box assaults. An adversary in such a setting is aware of the method and can analyze many system inputs and outputs, but is blind to the specifics of how a critical instantiation primitive is implemented. This is the focus of white-box solutions, which are designed to withstand attacks that come from the execution environment. This is significant because an attacker may obtain unrestricted access to the program's execution in this environment. The purpose of this article is to assess the efficiency of white-box implementations in terms of security. Our contribution is twofold: first, we explore the practical implementations of white-box approaches, and second, we analyze the theoretical foundations upon which these implementations are built. First, a research proposal is crafted that details white-box applications of DES and AES encryption algorithms. To begin, this preparation is necessary. The research effort planned for this project also includes cryptanalysis of these techniques. Once the general cryptanalysis results have been examined, the white-box design approaches will be covered. We have decided to launch an investigation into creating a theoretical model for white box, since no prior formal definitions have been offered, and suggested implementations have not been accompanied by any assurance of security. This is due to the fact that no formal definition of "white box" has ever been provided. In this way lies the explanation for why this is the situation. We define WBC to encompass the security requirements of WBC specified over a white box cryptography technology and a security concept by studying formal models of obfuscation and shown security. This definition is the product of extensive investigation. This state-of-the-art theoretical model provides a setting in which to investigate the security of white-box implementations, leading to a wide range of positive and negative conclusions. As a result, this paper includes the results of a Digital Signature Algorithm (DSA) study which may be put to use in the real world with signature verification. Possible future applications of White Box Cryptography (WBC) research findings are discussed in light of these purposes and areas of investigation.

On Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbars

Applications based on deep neural networks (DNNs) have grown exponentially in the past decade. To match their increasing computational needs, several nonvolatile memory (NVM) crossbar-based accelerators have been proposed. Recently, researchers have shown that apart from improved energy efficiency and performance, such approximate hardware also possess intrinsic robustness for defense against adversarial attacks. Prior works have focused on quantifying this intrinsic robustness for vanilla networks, that is DNNs trained on unperturbed inputs. However, adversarial training of DNNs, i.e., training with adversarially perturbed images, is the benchmark technique for robustness, and sole reliance on intrinsic robustness of the hardware may not be sufficient. In this work, we explore the design of robust DNNs through the amalgamation of adversarial training and the intrinsic robustness offered by NVM crossbar-based analog hardware. First, we study the noise stability of such networks on unperturbed inputs and observe that internal activations of adversarially trained networks have lower signal-to-noise ratio (SNR), and are sensitive to noise compared to vanilla networks. As a result, they suffer significantly higher performance degradation due to the approximate computations on analog hardware; on an average <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2\times $ </tex-math></inline-formula> accuracy drop. Noise stability analyses clearly show the instability of adversarially trained DNNs. On the other hand, for adversarial images generated using Square Black Box attacks, ResNet-10/20 adversarially trained on CIFAR-10/100 display a robustness improvement of 20%–30% under high <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\epsilon _{\mathrm{ attack}}$ </tex-math></inline-formula> (degree of input perturbation). For adversarial images generated using projected-gradient-descent (PGD) White-Box attacks, the adversarially trained DNNs present a 5%–10% gain in robust accuracy due to the underlying NVM crossbar when <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\epsilon _{\mathrm{ attack}}$ </tex-math></inline-formula> is greater than the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">epsilon</i> of the adversarial training ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\epsilon _{\mathrm{ train}}$ </tex-math></inline-formula> ). Our results indicate that implementing adversarially trained networks on analog hardware requires careful calibration between hardware nonidealities and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\epsilon _{\mathrm{ train}}$ </tex-math></inline-formula> to achieve optimum robustness and performance.

Context-Free Word Importance Scores for Attacking Neural Networks

Leave-One-Out (LOO) scores provide estimates of feature importance in neural networks, for adversarial attacks. In this work, we present context-free word scores as a query-efficient alternative. Experiments show that these approximations are quite effective for black box attacks on neural networks trained for text classification, particularly for CNNs. The model query count for this method scales as 0(vocan_size * model_input_length). It is independent of the number of examples and features to be perturbed.

Black box attack and network intrusion detection using machine learning for malicious traffic

Network intrusion detection systems (NIDS) play an important role in maintaining network security. In recent years, machine learning (ML) technology has been increasingly used in NIDS, increasing detection accuracy and aggravating network evasion risk. In order to detect the robustness of existing anomaly detection algorithms based on ML, we design and implement a black box attack method to evade network intrusion detection in this paper. The method includes two parts: first, we apply the Generative Adversarial Network (GAN) features to generate adversarial samples to generate data packets that can evade anomaly detection. Then, we insert the forged data packets into the original malicious traffic so that the anomaly detectors cannot detect the malicious traffic. We test on the latest intrusion detection datasets. Experimental results show that this method has a good evasion effect on all tested anomaly detectors, and the evasion rate of half of the anomaly detectors exceeds 90%. Through experiments, we find that the feature extraction of the existing anomaly detection algorithm has a loophole, so we propose a new defense model to make up for this loophole. Experiments confirm that the model can significantly reduce the evasion rate.

Breaking Cuckoo Hash: Black Box Attacks

Introduced less than twenty years ago, cuckoo hashing has a number of attractive features like a constant worst case number of memory accesses for queries and close to full memory utilization. Cuckoo hashing has been widely adopted to perform exact matching of an incoming key with a set of stored (key, value) pairs in both software and hardware implementations. This widespread adoption makes it important to consider the security of cuckoo hashing. Most hash based data structures can be attacked by generating collisions that reduce their performance. In fact, for cuckoo hashing collisions could lead to insertion failures which in some systems would lead to a system failure. For example, if cuckoo hashing is used to perform Ethernet lookup and a given MAC address cannot be added to the cuckoo hash, the switch would not be able to correctly forward frames to that address. Previous works have shown that this can be done when the attacker knows the hash functions used in the implementation. However, in many cases the attacker would not have that information and would only have access to the cuckoo hash operations to perform insertions, removals or queries. This article considers the security of a cuckoo hash to an attacker that has only a black box access to it. The analysis shows that by carefully performing user operations on the cuckoo hash, the attacker can force insertion failures with a small set of elements. The proposed attack has been implemented and tested for different configurations to demonstrate its feasibility. The fact that cuckoo hash can be broken with only access to its user functions should be taken into account when implementing it in critical systems. The article also discusses potential approaches to mitigate this vulnerability.

Research on White-Box Counter-Attack Method based on Convolution Neural Network Face Recognition

In recent years, deep neural network has been widely used in face recognition, in which the model of a convolution neural network for face recognition is mostly black box model. Because the model structure and related parameters cannot be obtained, the attack effect of the counter sample is poor. In order to better realize the attack effect of the black box attack, this paper uses the white box attack to realize the black box attack. Aiming at the convolution neural network face recognition model, this paper proposes an improved FGMS counterattack algorithm, which uses the cosine similarity between the clean sample and the antagonistic sample as the loss function. The threshold is set to 0.8 as the condition for the success of the attack. In order to avoid excessive changes in the image, the threshold super-parameters is set to limit the range and size of the disturbance fluctuation, so that the countermeasure samples are not easy to be detected and improve the visual quality. Countermeasure samples are detected by black box attack on the VGG16 model, and a good attack effect is obtained.

Ensemble transfer attack targeting text classification systems

Deep neural networks provide good performance for image recognition, speech recognition, text recognition, and pattern recognition. However, such networks are vulnerable to attack by adversarial examples. Adversarial examples are created by adding a small amount of noise to an original sample in such a way that no problem is perceptible to humans yet the sample will be incorrectly classified by a classification model. Adversarial examples have been studied mainly in the context of images, but research has expanded to include the text domain. In the textual context, an adversarial example is a sample of text in which certain important words have been changed so that the sample will be misclassified by a model even though to humans it is the same as the original text in terms of meaning and grammar. However, studies of black box attacks using text adversarial examples are sparse. In this paper, we propose the ensemble transfer textfooler method. This method performs a black box attack on an unknown model after generating an ensemble adversarial example that simultaneously deceives several models. Experiments were conducted using a movie review dataset and with TensorFlow as the machine learning library. The experimental results show that the proposed method has an attack success rate of 71.64%, in contrast to the 19.01%, 24.29%, and 44.96% attack success rate for the conventional transfer attacks using an adversarial example generated to deceive a WordCNN, WordLSTM, and BERT model.

A Deep Ensemble-Based Wireless Receiver Architecture for Mitigating Adversarial Attacks in Automatic Modulation Classification

Deep learning-based automatic modulation classification (AMC) models are susceptible to adversarial attacks. Such attacks inject specifically crafted wireless interference into transmitted signals to induce erroneous classification predictions. Furthermore, adversarial interference is transferable in black box environments, allowing an adversary to attack multiple deep learning models with a single perturbation crafted for a particular classification model. In this work, we propose a novel wireless receiver architecture to mitigate the effects of adversarial interference in various black box attack environments. We begin by evaluating the architecture uncertainty environment, where we show that adversarial attacks crafted to fool specific AMC DL architectures are not directly transferable to different DL architectures. Next, we consider the domain uncertainty environment, where we show that adversarial attacks crafted on time domain and frequency domain features to not directly transfer to the altering domain. Using these insights, we develop our Assorted Deep Ensemble (ADE) defense, which is an ensemble of deep learning architectures trained on time and frequency domain representations of received signals. Through evaluation on two wireless signal datasets under different sources of uncertainty, we demonstrate that our ADE obtains substantial improvements in AMC classification performance compared with baseline defenses across different adversarial attacks and potencies.

Countering Physical Eavesdropper Evasion with Adversarial Training

Signal classification is a universal problem in adversarial wireless scenarios, especially when an eavesdropping radio receiver attempts to glean information about a target transmitter’s patterns, attributes, and contents over a wireless channel. In recent years, research surrounding the idea of Machine Learning (ML)-based signal classification has focused on modulation classification, with the downstream objective of demodulation. However, while the computer vision data domain has made significant progress in ensuring robust classification of images despite crafted perturbations, this success has not been translated to secure modulation classification. In this work, we perform the first-ever physical test of an eavesdropping ML-based modulation classifier radio, which we trained offline using a ensemble of i.i.d. models. Each model is trained with a weighted mixture of data perturbed by iterative“, least likely” white box attacks and non-attacked data. We then tested the ensemble online using coaxial-connected Software Defined Radios (SDRs). We conducted a case study comparing our results to the state-of-the-art computer vision approaches to investigate the presence of “label leaking”, model capacity sensitivity, understand the viability of parallel and sequential variations on perturbation training, and assess the effectiveness of iterative attack training. Our results show that perturbations can result in guessing-level classification performance from eavesdroppers, and that varying levels of robustness can be achieved against all presented attacks. These findings confirm that any receiver presents a new attack vector by utilizing ML techniques for classification tasks, and can be vulnerable to evasion attacks at little-to-no cost to transmitters. Consequently, we argue for the use of our training scheme in all ML-based classifying radios where security is a concern.