Recent Defense Research Articles

Boosting certified robustness via an expectation-based similarity regularization

A certifiably robust classifier implies the one that is theoretically guaranteed to provide robust predictions against any adversarial attacks under certain conditions. Recent defense methods aim to regularize predictions by ensuring consistency across diverse perturbed samplings around the same sample, thus enhancing the certified robustness of the classifier. However, starting from the visualization of latent representations from classifiers trained with existing defense methods, we observe that noisy samplings of other classes are still easily found near a single sample, undermining the confidence in the neighborhood of inputs required by the certified robustness. Motivated by this observation, a novel training method, namely Expectation-based Similarity Regularization for Randomized Smoothing (ESR-RS), is proposed to optimize the distance between samples utilizing metric learning. To meet the requirement of certified robustness, ESR-RS focuses on the average performance of base classifier, and adopts the expected feature approximated by the average value of multiple Gaussian-corrupted samplings around every sample, to compute similarity scores between samples in the latent space. The metric learning loss is then applied to maximize the representation similarity within the same class and minimize it between different classes. Besides, an adaptive weight correlated with the classification performance is used to control the strength of the proposed similarity regularization. Extensive experiments have verified that our method contributes to stronger certified robustness over multiple defense methods without heavy computational costs.

A Statistical Review of the Cyber Test Process

The variability of cyber threats along with multiple cyber testing practices distracts teams from applying classical statistical measurements of test power and coverage to describe test effectiveness. In most cases, cyber test teams continue to test until reaching funding or schedule limits. This article explores the traditional measurements of test coverage and test power to propose multiple metrics for cyber test efficiency. The metrics are then applied to data collected on recent Defense Department programs. Original findings include feedback on cyber table top efforts, the use of linear approximation in predicting an optimum duration for penetration testing, predicting the length of time at the range by the number of machines in test, and the optimization of test teams between 9 and 14 testers. These findings greatly assist in what Scientific Test and Analysis Techniques (STAT) were designed to do: help anyone involved (customers, management, and the test team) understand, and agree upon, test risk, coverage, and decisions.

Socrates' Final Argument in Apology

AbstractSocrates provides an argument at the end of the Apology that he believes gives hope that death is a blessing. This argument, grounded on the claim that death is one of two things, has been the subject of much derision and some recent defense. In this essay, I build on the work of other sympathetic commentators to show that Socrates' argument, when taken in context, not only makes good sense, but unifies Socrates' speech into a cohesive exhortation toward virtue.

Defending Autonomy as a Criterion for Epistemic Virtue

ABSTRACT Catherine Elgin has recently offered compatibility with autonomy as a plausible criterion for the epistemic virtues. This approach mixes elements of Kantianism with virtue theory. Sasha Mudd has criticized this combination on the grounds that it weakens the structure of Kantian autonomy and undermines its resources for responding to cultural relativism. Elgin’s more recent defense of the role of autonomy has taken a more Kantian turn. Here, I defend Elgin’s original claim, grounding it in a distinctively virtue theoretic account of the development of virtues. Exploring how individuals develop their epistemic virtues within a social context, I show how these virtues can be grounded in both developmental and constitutive relational autonomy. I further argue that a virtue theoretic conception of autonomy should be substantive, not just procedural, and this limits concerns about relativism.

A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives

Backdoor attacks pose serious security threats to deep neural networks (DNNs). Backdoored models make arbitrarily (targeted) incorrect predictions on inputs containing well-designed triggers, while behaving normally on clean inputs. Prior researches have explored the invisibility of backdoor triggers to enhance attack stealthiness. However, most of them only focus on the invisibility in the spatial domain, neglecting the generation of invisible triggers in the frequency domain. This limitation renders the generated poisoned images easily detectable by recent defense methods. To address this issue, we propose a DUal stealthy BAckdoor attack method named DUBA, which simultaneously considers the invisibility of triggers in both the spatial and frequency domains, to achieve desirable attack performance, while ensuring strong stealthiness. Specifically, we first use Wavelet Transform to embed the high-frequency information of the trigger image into the clean image to ensure attack effectiveness. Then, to attain strong stealthiness, we incorporate Fourier Transform and Cosine Transform to mix the poisoned image and clean image in the frequency domain. Moreover, DUBA adopts a novel attack strategy, training the model with weak triggers and attacking with strong triggers to further enhance attack performance and stealthiness. DUBA is evaluated extensively on four datasets against popular image classifiers, showing significant superiority over state-of-the-art backdoor attacks in attack success rate and stealthiness.

Domination, social norms, and the idea of an emancipatory interest

Domination, social norms, and the idea of an emancipatory interest

On the Privation Theory of Evil

Augustine’s privation theory of evil maintains that something is evil in virtue of a privation, a lack of something which ought to be present in a particular nature. While it is not evil for a human to lack wings, it is indeed evil for a human to lack rationality according to the end of a rational nature. Much of the literature on the privation theory focuses on whether it can successfully defend against counterexamples of positive evils, such as pain. This focus of the discussion is not surprising, given that the privation theory is a theory about the nature of evil. But it is also a theory that protects venerable theological concerns, namely, that God is the good creator of everything, and that everything is good. It is the purpose of this article to further this discussion on both fronts. I argue that the counterexample of pain still defeats the privation theory despite the most recent defense. What is more, I suggest, this is not theologically disastrous. The individual who rejects the privation theory is not obligated to reject the theological theses which motivate it. To show how a rejection of the privation theory is a live option, I offer an alternative view of evil that also maintains these theological theses and encompasses both privative and positive evils.

Clustering Approach for Detecting Multiple Types of Adversarial Examples.

With intentional feature perturbations to a deep learning model, the adversary generates an adversarial example to deceive the deep learning model. As an adversarial example has recently been considered in the most severe problem of deep learning technology, its defense methods have been actively studied. Such effective defense methods against adversarial examples are categorized into one of the three architectures: (1) model retraining architecture; (2) input transformation architecture; and (3) adversarial example detection architecture. Especially, defense methods using adversarial example detection architecture have been actively studied. This is because defense methods using adversarial example detection architecture do not make wrong decisions for the legitimate input data while others do. In this paper, we note that current defense methods using adversarial example detection architecture can classify the input data into only either a legitimate one or an adversarial one. That is, the current defense methods using adversarial example detection architecture can only detect the adversarial examples and cannot classify the input data into multiple classes of data, i.e., legitimate input data and various types of adversarial examples. To classify the input data into multiple classes of data while increasing the accuracy of the clustering model, we propose an advanced defense method using adversarial example detection architecture, which extracts the key features from the input data and feeds the extracted features into a clustering model. From the experimental results under various application datasets, we show that the proposed method can detect the adversarial examples while classifying the types of adversarial examples. We also show that the accuracy of the proposed method outperforms the accuracy of recent defense methods using adversarial example detection architecture.

Shrieking, Shrugging, and the Australian Plan

We observe that Jc Beall’s shrieking and shrugging strategy gives us an opportunity to reflect on the Australian plan for negation in FDE, a basic subclassical logic that is used in Beall’s argument for subclassical logics. An implication of our observation is applied to a recent defense of the Australian plan for negation by Francesco Berto and Greg Restall.

Adversarial Deep Learning: A Survey on Adversarial Attacks and Defense Mechanisms on Image Classification

The popularity of adapting deep neural networks (DNNs) in solving hard problems has increased substantially. Specifically, in the field of computer vision, DNNs are becoming a core element in developing many image and video classification and recognition applications. However, DNNs are vulnerable to adversarial attacks, in which, given a well-trained image classification model, a malicious input can be crafted by adding mere perturbations to misclassify the image. This phenomena raise many security concerns in utilizing DNNs in critical life applications which attracts the attention of academic and industry researchers. As a result, multiple studies have proposed discussing novel attacks that can compromise the integrity of state-of-the-art image classification neural networks. The raise of these attacks urges the research community to explore countermeasure methods to mitigate these attacks and increase the reliability of adapting DDNs in different major applications. Hence, various defense strategies have been proposed to protect DNNs against adversarial attacks. In this paper, we thoroughly review the most recent and state-of-the-art adversarial attack methods by providing an in-depth analysis and explanation of the working process of these attacks. In our review, we focus on explaining the mathematical concepts and terminologies of the adversarial attacks, which provide a comprehensive and solid survey to the research community. Additionally, we provide a comprehensive review of the most recent defense mechanisms and discuss their effectiveness in defending DNNs against adversarial attacks. Finally, we highlight the current challenges and open issues in this field as well as future research directions.

The 2021 British Defence Review and the British 'Tilt to the Indo-Pacific'

Britain's most recent defense review (March 2021's Defence in a Competitive Age) announced a to the Indo-Pacific on the part of British defense policy. This working paper examines the document's discussion of that tilt with a particular eye to parallels and differences with Britain's pre-1971 posture east of Suez, and especially the 1957-1971 period when the Indian Ocean littoral was its military priority. The paper's conclusion is that what the Review seems to promise is a lighter version of that posture, for vaguer ends, with the costs and benefits creating a great deal of uncertainty about the policy's plausibility and viability.

Neural network laundering: Removing black-box backdoor watermarks from deep neural networks

Creating a state-of-the-art deep-learning system requires vast amounts of data, expertise, and hardware, yet research into copyright protection for neural networks has been limited. One of the main methods for achieving such protection involves relying on the susceptibility of neural networks to backdoor attacks in order to inject a watermark into the network, but the robustness of these tactics has been primarily evaluated against pruning, fine-tuning, and model inversion attacks. In this work, we propose an offensive neural network “laundering” algorithm to remove these backdoor watermarks from neural networks even when the adversary has no prior knowledge of the structure of the watermark. We can effectively remove watermarks used for recent defense or copyright protection mechanisms while retaining test accuracies on the target task above 97% and 80% for both MNIST and CIFAR-10, respectively. For all watermarking methods addressed in this paper, we find that the robustness of the watermark is significantly weaker than the original claims. We also demonstrate the feasibility of our algorithm in more complex tasks as well as in more realistic scenarios where the adversary can carry out efficient laundering attacks using less than 1% of the original training set size, demonstrating that existing watermark-embedding procedures are not sufficient to reach their claims.

Performance evaluation for the outsourcing of military base management services in the Republic of Korea using SERVQUAL and IPA

This study was conducted to evaluate the performance of a contracting-out project for military base management in response to recent defense reforms in the Republic of Korea that require military forces to concentrate on operations and combat missions. In this study, the service quality perspective via SERVQUAL was applied to the ROK defense sector for the first time, with the soldiers viewed as customers receiving a service. In addition, to improve the effectiveness of the contracted services, the importance-performance analysis framework was employed to identify the tasks that required urgent attention. We conducted a large-scale survey of 2,112 uniformed members within pilot project units. To avoid problems such as insincere responses or low response rates, we held interviews with the officers managing the units on the subject of the importance and purpose of the questionnaire. As a result, it was found that the outsourcing of cleaning services was the most successful initiative, while mowing/landscaping had the most urgent tasks for improvement, with some respondents believing that reliability and assurance should be improved.

Review: Architecture, Liberty and Civic Order: Architectural Theories from Vitruvius to Jefferson and Beyond, by Carroll William Westfall

Review: <i>Architecture, Liberty and Civic Order: Architectural Theories from Vitruvius to Jefferson and Beyond</i>, by Carroll William Westfall

How Save Aquinas’s “Intellectus essentiae Argument” for the Real Distinction between Essence and Esse?

Aquinas’ so-called “Intellectus essentiae Argument” for the distinction between being and essence is notoriously suspect, including among defenders of Aquinas’ distinction. For the paper in this volume, I take as my starting point the recent defense of the argument by Fr. Lawrence Dewan, O.P. Fr. Dewan’s project is unsuccessful. Pointing out some shortcomings in his readings allows me to take up his call to highlight the “formal” or “quidditative side” of Aquinas’ metaphysics, in this case in regards to the proofs of the “real distinction.” Accordingly, the second half of this paper sets forth a way in which the famous “Intellectus essentiae Argument” of De Ente et Essentia 4 can succeed as a proof of the real distinction. Aquinas’ argument presupposes the prior real distinction between essence and supposit or individual substance. Esse is the ontological component that makes true our judgments that substances actually are: Obama exists. By contrast, this “truth-maker” cannot be predicated of humanity, although it is in Obama as really distinct from him. If Aquinas’ reasoning in this most contentious of his proofs can be saved, so, perhaps, can most of his other proofs.

Shifting the Focus: Food Choice, Paternalism, and State Regulation

In this paper, I examine the question of whether there is justification for regulations that place limits on food choices. I begin by discussing Sarah Conly’s recent defense of paternalist limits on food choice. I argue that Conly’s argument is flawed because it assumes a particular conception of health that is not universally shared. I examine this conception of health in some detail, and I argue that we need to shift our focus from individual behaviors and lifestyle to the broader social and environmental context. Such a shift allows us to see the ways in which industry practices are negatively impacting our well-being (a broader concept than “health”). I argue that state regulatory activity surrounding the conditions under which food is grown, processed, marketed, and sold needs to be strengthened. As a result, there are likely to be some indirect limitations on food choice. These indirect limitations are justified, but regulations in which the goal is to change individual behavior or lifestyle are not.

Being realistic and demanding the impossible

Characterising realism by contrasting it with moralism leaves open several questions to do with realism’s practical import. If political judgment is not to be derived — exclusively or at all — from pre-political moral commitments, what scope is there for genuinely normative political thinking? And even if there is some scope for political normativity, does realism’s reliance on interpretations of political practices condemn it to some form of status quo bias? In this paper I address those questions. My main aim is to assuage some worries about realism’s alleged conservative tendencies. I argue that there is an important sense in which realists can support radical and even unachievable political change — one can be realistic and demand the impossible, as the soixante- huitard slogan goes. To see how that may be the case one needs to characterise realism by contrasting it with both non-ideal theory and utopianism. In a nutshell, realism differs from non- ideal theory because it need not be concerned with feasibility constraints, and it differs from utopianism because it eschews detailed blueprints of the perfect polity.

Catherine Elgin on peerhood and the epistemic benefits of disagreement

Conciliationism is the view that an agent must revise her belief in a proposition when she becomes aware that there is an epistemic peer who disagrees with her about that proposition. If epistemic peers are anything less than strict cognitive and evidential equals, then even slight differences could explain away why the two parties disagree in the first place. But this strict notion of peerhood never obtains in many, if not most, of real-life cases disagreements between inquirers. One recent account of peerhood which might obtain more frequently in cases of real-life disagreements comes from Elgin (in: Johnson CR (ed) Voicing dissent: the ethics and epistemology of making disagreement public, Routledge, New York, pp 10–21, 2018). She argues that two scientists who are epistemic peers can disagree because while they might have the same reasoning abilities, they can have different reasoning styles. While there are merits to Elgin’s account, I argue that two people with different reasoning styles are unlikely to be epistemic peers since such differences could serve to explain away why they disagree. I argue that there is a conception of peerhood which can retain the sceptical force of conciliationism without trivializing or dismissing the problem of disagreement. I then conclude that a particularly attractive argument against conciliationism is gestured at by Elgin in one of her earlier pieces on disagreement. This argument is based on the idea that there are epistemic benefits to be gained from remaining steadfast in the face of disagreement (Elgin, in: Feldman R, Warfield TA (eds) Disagreement, Oxford University Press, Oxford, pp 53–68, 2010). The success of this argument, however, might force an inquirer faced with disagreement to choose between synchronic reasons and diachronic reasons. If Hughes’ (Synthese, forthcoming) recent defense of epistemic dilemmism is correct this may be a feature of the argument, rather than a bug.

Sellars's Argument for an Ontology of Absolute Processes

Scholars have rejected Wilfrid Sellars’s argument for an ontology of absolute processes on the grounds that it relies on a dubious and dogmatic appeal to the homogeneity of color. Borrowing from Rosenthal’s recent defense, but ultimate rejection of homogeneity, I defend this claim on Sellarsian/Kantian transcendental grounds, and reconstruct the remainder of his argument. I argue that Sellars has good reason to suppose that homogeneity is a necessary condition of any possible experience, including indirect experience of theoretical-explanatory posits, and therefore good reason to hold that Reductive Materialism, as he conceives it, is an untenable account of color. The remainder of his argument aims to answer the question of what the metaphysical relation is between the state of an experiencing subject that we take color to be and the colorless microphysical particles that we take to constitute that subject. After rejecting Substance Dualism, Epiphenomenalism, and Wholistic or Emergent Materialism as explanatorily inadequate, Sellars proposes that both color-states and micro-physical particles should be understood as manifestations of an underlying ontology on absolute processes.

The naked ‘duchess’: names are titles

In her recent defense of predicativism for proper names, Delia Graff Fara proposes the following non-metalinguistic being-called condition (BCC) for the applicability of names as predicates: A name ‘N’ is true of a thing if and only if it is called N. The BCC is supposed to hold for names only. In this essay I criticize Fara’s BCC by arguing that the word ‘called’ is ambiguous, and that the BCC holds only for the particular sense of ‘calling’ as naming. I revise accordingly Fara’s BCC and propose in its place a non-metalinguistic being-named condition (BNC). I also argue, against Fara, that being-named conditions are not unique to proper names: they hold for (at least some) mass nouns, common count nouns, as well as for family names, which I distinguish from surnames. Finally, I discuss honorific titles and propose a being-entitled condition according to which a title ‘T’ (when a predicate) is true of a thing just in case it is dubbed T. I conclude the paper with pragmatic, syntactic, as well as semantic considerations in favor of the thesis that names are a subspecies of non-hereditary, honorific titles.