Successful Attack Research Articles

Template Attack Based on the Weighted Quadruple Residual Network

ABSTRACTTemplate attack, as a classic side‐channel attack method, has attracted extensive attention due to its ease of deployment and small number of hyperparameters. However, traditional template attacks (TA) suffer from high preprocessing complexity and poor performance in certain masked applications. To address these issues, this paper proposes a novel template attack method leveraging a weighted quadruple residual network. Specifically, we improve the quadruple network model by assigning different weights to the negative samples selected by the model, which balances the influence of the samples on the model's feedback. Aiming at the fact that the quadruple network ignores the label characteristics of samples in the side‐channel, the distance metric in the quadruple network model is improved, which can help the model select more suitable samples. The residual network designed in this paper enables the quadruplet network model to reduce feature dimensionality, thereby facilitating more effective analysis attacks in TA. Experimental results demonstrate a notable reduction in leaked traces required by the optimized template attack on the synchronous ASCAD dataset, achieving a 62.5% decrease compared to an advanced template attack scheme. On the AES_HD dataset, the energy trace needed for a successful attack diminishes by 46.5% in comparison to the advanced template attack scheme.

Enhancing adversarial transferability with local transformation

Robust deep learning models have demonstrated significant applicability in real-world scenarios. The utilization of adversarial attacks plays a crucial role in assessing the robustness of these models. Among such attacks, transfer-based attacks, which leverage white-box models to generate adversarial examples, have garnered considerable attention. These transfer-based attacks have demonstrated remarkable efficiency, particularly under the black-box setting. Notably, existing transfer attacks often exploit input transformations to amplify their effectiveness. However, prevailing input transformation-based methods typically modify input images indiscriminately, overlooking regional disparities. To bolster the transferability of adversarial examples, we propose the Local Transformation Attack (LTA) based on forward class activation maps. Specifically, we first obtain future examples through accumulated momentum and compute forward class activation maps. Subsequently, we utilize these maps to identify crucial areas and apply pixel scaling for transformation. Finally, we update the adversarial examples by using the average gradient of the transformed image. Extensive experiments convincingly demonstrate the effectiveness of our proposed LTA. Compared to the current state-of-the-art attack approaches, LTA achieves an increase of 7.9% in black-box attack performance. Particularly, in the case of ensemble attacks, our method achieved an average attack success rate of 98.3%.

How Resilient Are Kolmogorov–Arnold Networks in Classification Tasks? A Robustness Investigation

Kolmogorov–Arnold Networks (KANs) are a novel class of neural network architectures based on the Kolmogorov–Arnold representation theorem, which has demonstrated potential advantages in accuracy and interpretability over Multilayer Perceptron (MLP) models. This paper comprehensively evaluates the robustness of various KAN architectures—including KAN, KAN-Mixer, KANConv_KAN, and KANConv_MLP—against adversarial attacks, which constitute a critical aspect that has been underexplored in current research. We compare these models with MLP-based architectures such as MLP, MLP-Mixer, and ConvNet_MLP across three traffic sign classification datasets: GTSRB, BTSD, and CTSD. The models were subjected to various adversarial attacks (FGSM, PGD, CW, and BIM) with varying perturbation levels and were trained under different strategies, including standard training, adversarial training, and Randomized Smoothing. Our experimental results demonstrate that KAN-based models, particularly the KAN-Mixer, exhibit superior robustness to adversarial attacks compared to their MLP counterparts. Specifically, the KAN-Mixer consistently achieved lower Success Attack Rates (SARs) and Degrees of Change (DoCs) across most attack types and datasets while maintaining high accuracy on clean data. For instance, under FGSM attacks with ϵ=0.01, the KAN-Mixer outperformed the MLP-Mixer by maintaining higher accuracy and lower SARs. Adversarial training and Randomized Smoothing further enhanced the robustness of KAN-based models, with t-SNE visualizations revealing more stable latent space representations under adversarial perturbations. These findings underscore the potential of KAN architectures to improve neural network security and reliability in adversarial settings.

Optimization of Communication Signal Adversarial Examples by Selectively Preserving Low-Frequency Components of Perturbations

Achieving high attack success rate (ASR) with minimal perturbed distortion has consistently been a prominent and challenging research topic in the field of adversarial examples. In this paper, a novel method to optimize communication signal adversarial examples is proposed by focusing on low-frequency components of perturbations (LFCP). Observations on model attention towards DCT coefficients reveal the crucial role of LFCP within adversarial examples in altering the model’s predictions. As a result, selectively preserving LFCP is established as the fundamental concept of the optimization strategy. By utilizing the binary search algorithm, which considers the inconsistency in the model’s predictions as a constraint, LFCP can be effectively identified, and the aim of minimizing perturbed distortion while maintaining ASR can be achieved. Experimental results conducted on a publicly available dataset, six adversarial attacks and two DNN models, indicate that the proposed method not only significantly minimizes perturbed distortion for FGSM, BIM, PGD, and MI-FGSM but also achieves a modest improvement in ASR. Notably, even for DeepFool and BS-FGM, which introduce small perturbations and exhibit high ASRs, the proposed method can still deliver feasible performance.

DP-Poison: Poisoning Federated Learning under the Cover of Differential Privacy

Federated learning (FL) enables resource-constrained node devices to learn a shared model while keeping the training data local. Since recent research has demonstrated multiple privacy leakage attacks in FL, e.g., gradient inference attacks and membership inference attacks, differential privacy (DP) is applied to serve as one of the most effective privacy protection mechanisms. Despite the benefit DP brings, we observe that the introduction of DP also brings random changes to client updates, which will affect the robust aggregation algorithms. We reveal a novel poisoning attack under the cover of DP, named the DP-Poison attack in FL. Specifically, the DP-Poison attack is designed to achieve four goals: 1) maintaining the main task performance; 2) launching a successful attack; 3) escaping the robust aggregation algorithms in FL; and 4) keeping the effectiveness of DP privacy protection. To achieve these goals, we design multiple optimization goals to generate DP noise through a genetic algorithm. The optimization ensures that while the benign updates change randomly, the malicious updates can change towards the global model after adding the DP noise, so that it is easier to be accepted by the robust aggregation algorithms. Extensive experiments show that DP-Poison achieves a nearly 100% attack success rate while maintaining the proposed four goals.

Classification and Identification of Frequency-Hopping Signals Based on Jacobi Salient Map for Adversarial Sample Attack Approach

Frequency-hopping (FH) communication adversarial research is a key area in modern electronic countermeasures. To address the challenge posed by interfering parties that use deep neural networks (DNNs) to classify and identify multiple intercepted FH signals—enabling targeted interference and degrading communication performance—this paper presents a batch feature point targetless adversarial sample generation method based on the Jacobi saliency map (BPNT-JSMA). This method builds on the traditional JSMA to generate feature saliency maps, selects the top 8% of salient feature points in batches for perturbation, and increases the perturbation limit to restrict the extreme values of single-point perturbations. Experimental results in a white-box environment show that, compared with the traditional JSMA method, BPNT-JSMA not only maintains a high attack success rate but also enhances attack efficiency and improves the stealthiness of the adversarial samples.

Asymmetric variable depth learning automaton and its application in defending against selfish mining attacks on bitcoin

Learning Automaton (LA) theory, a branch of reinforcement learning, initially began with the Fixed Structure Learning Automaton (FSLA) family and was later expanded to include the Variable Structure Learning Automaton (VSLA) family. Tuning the depth of FSLA in complex environments has long been a challenging task, significantly limiting the ability to effectively navigate the exploration-exploitation dilemma. No solution has been found for this open problem yet. This study addresses this issue by introducing a novel hybrid learning automaton model called Asymmetric Variable Depth Hybrid LA (AVDHLA). The AVDHLA model intelligently learns the depth of fixed structure LA in an autonomous manner by combining LKN,K from FSLA class and Variable Action Set LA (VASLA) from VSLA class. Computer simulations are conducted to validate the proposed model in diverse environments, including both stationary and non-stationary (Markovian switching and State-dependent) scenarios. Performance evaluation is based on predefined metrics, such as total number of rewards (TNR) and action switching (TNAS). Statistical tests indicate that across both stationary and non-stationary environments, AVDHLA consistently outperforms LKN,K in terms of TNR and TNAS across the majority of experiments. Moreover, the AVDHLA model is applied in two key applications. Firstly, it is used to defend against the selfish mining attack in Bitcoin and is compared with the well-known tie-breaking mechanism. Simulation results consistently demonstrate that our proposed method increases the threshold for successful selfish mining attacks from 25% to 40%. Secondly, the AVDHLA model has been applied to develop a novel learning automaton-based recommendation system. The results demonstrate the superiority of the proposed method in terms of the Click-Through Rate (CTR) and Precision compared to previous approaches.

SecDefender: Detecting low-quality models in multidomain federated learning systems

Federated learning (FL) is an innovative distributed learning paradigm that permits multiple parties to train models collaboratively while protecting individual privacy. However, it encounters security challenges, making it vulnerable to several adversarial attacks and leading to compromising model performance. Existing research on FL poisoning attacks and defense techniques tends to be application-specific, primarily emphasizing attack capabilities. However, it fails to consider inherent vulnerabilities in FL and the impact of attack intensity. To our knowledge, no existing work has delved into these issues within a multi-domain FL environment. This paper addresses these concerns by investigating the consequences of targeted label-flipping attacks within FL systems and comprehensively examining the effects of the attacks in single-label, double-label, and triple-label scenarios with different levels of poisoning intensities. Additionally, we investigate the influence of a temporal label-flipping attack, where we study the impact of adversaries available only for specific federated training rounds. Moreover, we propose a novel server-based defense mechanism called SecDefender to detect low-quality models in both IID and non-IID settings of multi-domain environments. Our approach is rigorously evaluated against state-of-the-art alternatives using six benchmark datasets: CIC-Darknet2020, Fashion-MNIST, FEDMNIST, GTSR, HAR, and MNIST. Extensive experiments demonstrate that our proposed SecDefender significantly enhances its performance by over 65% in terms of source class recall, maintaining a low attack success rate. Consequently, there is a 1 to 2% enhancement in global model accuracy compared to existing approaches.

A Reconsideration of Imaginative Points of Resistance

In this short piece, I want to explore the idea that limits of imagination, that I refer to here as to ‘points of resistance’, can play an essential role in certain imaginative tasks. To show how points of resistance can be carriers of crucial information, I focus here on the analysis of 9/11. Leaving aside personal and political implications, I investigate the possible plausibility of some statements of the US Secretary of the Defense at the time of the attacks, attributing the cause of 9/11 to imagination. I propose that, despite being dismissed as an outrageous analysis of responsibilities involved in the success of the terroristic attacks, there could be a role that a failure of imagination might have played.

Backdoor Attacks in Peer-to-Peer Federated Learning

Most machine learning applications rely on centralized learning processes, opening up the risk of exposure of their training datasets. While federated learning (FL) mitigates to some extent these privacy risks, it relies on a trusted aggregation server for training a shared global model. Recently, new distributed learning architectures based on Peer-to-Peer Federated Learning (P2PFL) offer advantages in terms of both privacy and reliability. Still, their resilience to poisoning attacks during training has not been investigated. In this paper, we propose new backdoor attacks for P2PFL that leverage structural graph properties to select the malicious nodes, and achieve high attack success, while remaining stealthy. We evaluate our attacks under various realistic conditions, including multiple graph topologies, limited adversarial visibility of the network, and clients with non-IID data. Finally, we show the limitations of existing defenses adapted from FL and design a new defense that successfully mitigates the backdoor attacks, without an impact on model accuracy.

Mitigating adversarial manipulation in LLMs: a prompt-based approach to counter Jailbreak attacks (Prompt-G)

Large language models (LLMs) have become transformative tools in areas like text generation, natural language processing, and conversational AI. However, their widespread use introduces security risks, such as jailbreak attacks, which exploit LLM’s vulnerabilities to manipulate outputs or extract sensitive information. Malicious actors can use LLMs to spread misinformation, manipulate public opinion, and promote harmful ideologies, raising ethical concerns. Balancing safety and accuracy require carefully weighing potential risks against benefits. Prompt Guarding (Prompt-G) addresses these challenges by using vector databases and embedding techniques to assess the credibility of generated text, enabling real-time detection and filtering of malicious content. We collected and analyzed a dataset of Self Reminder attacks to identify and mitigate jailbreak attacks, ensuring that the LLM generates safe and accurate responses. In various attack scenarios, Prompt-G significantly reduced jailbreak success rates and effectively identified prompts that caused confusion or distraction in the LLM. Integrating our model with Llama 2 13B chat reduced the attack success rate (ASR) to 2.08%. The source code is available at: https://doi.org/10.5281/zenodo.13501821.

Auto encoder-based defense mechanism against popular adversarial attacks in deep learning.

Convolutional Neural Network (CNN)-based models are prone to adversarial attacks, which present a significant hurdle to their reliability and robustness. The vulnerability of CNN-based models may be exploited by attackers to launch cyber-attacks. An attacker typically adds small, carefully crafted perturbations to original medical images. When a CNN-based model receives the perturbed medical image as input, it misclassifies the image, even though the added perturbation is often imperceptible to the human eye. The emergence of such attacks has raised security concerns regarding the implementation of deep learning-based medical image classification systems within clinical environments. To address this issue, a reliable defense mechanism is required to detect adversarial attacks on medical images. This study will focus on the robust detection of pneumonia in chest X-ray images through CNN-based models. Various adversarial attacks and defense strategies will be evaluated and analyzed in the context of CNN-based pneumonia detection. From earlier studies, it has been observed that a single defense mechanism is usually not effective against more than one type of adversarial attack. Therefore, this study will propose a defense mechanism that is effective against multiple attack types. A reliable defense framework for pneumonia detection models will ensure secure clinical deployment, facilitating radiologists and doctors in their diagnosis and treatment planning. It can also save time and money by automating routine tasks. The proposed defense mechanism includes a convolutional autoencoder to denoise perturbed Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) adversarial images, two state- of-the-art attacks carried out at five magnitudes, i.e., ε (epsilon) values. Two pre-trained models, VGG19 and VGG16, and our hybrid model of MobileNetV2 and DenseNet169, called Stack Model, have been used to compare their results. This study shows that the proposed defense mechanism outperforms state-of-the-art studies. The PGD attack using the VGG16 model shows a better attack success rate by reducing overall accuracy by up to 67%. The autoencoder improves accuracy by up to 16% against PGD attacks in both the VGG16 and VGG19 models.

The dual problem of space: Relative player positioning determines attacking success in elite men’s football

ABSTRACT The concept of space has been successfully modelled in football using spatiotemporal player data and Voronoi diagrams. Current approaches, however, are narrow in scope by focusing on an inter-team allocation of space to measure space control. The present work extends this widespread perspective with an intra-team application of the Voronoi diagram and its dual Delaunay triangulation to measure space management. Both models are leveraged to derive novel performance metrics, which assess how teams use triangular positioning and how players tie up defenders during attacks. The outcome of N = 128,187 attacking sequences from 306 elite men’s football matches is analysed using linear mixed-effects models to validate the proposed performance metrics. Results show that attacking success is characterized by player positioning which promotes forming of large triangles especially in ball proximity, whereas the overall number of triangles is of no relevance. Furthermore, players tie up more defenders and thus create free teammates more often during successful attacks. The results demonstrate that a new perspective on space is helpful to better quantify and understand the effect of space management and player positioning on attacking performance in football.

Defending against backdoor attack on deep neural networks based on multi-scale inactivation

Deep neural networks (DNNs) have excellent performance in various applications, especially for image classification tasks. However, DNNs also face the threat of backdoor attacks. Backdoor attacks embed a hidden backdoor into a model, after which the infected model can achieve correct classification on benign images, while incorrectly classify the images with the backdoor triggers as the target label. To obtain a clean model from a backdoor dataset, we propose a Kalman filtering based multi-scale inactivation scheme, which can effectively remove poison data in a poison dataset and obtain a clean model. Every sample in the suspicious training dataset will be judged by multi-scale inactivation and obtain a series of judging results, then data fusion is conducted using kalman filtering to determine whether it is a poison sample. To further improve the performance, a trigger localization and target determination based scheme is proposed. Extensive experiments are conducted to demonstrate the superior effectiveness of the proposed method. The results show that the proposed methods can remove poison samples effectively, and achieve greater than 99% recall rate, and the attack success rate of the retrained clean model is smaller than 1%.

Strategic safeguarding: A game theoretic approach for analyzing attacker-defender behavior in DNN backdoors

Deep neural networks (DNNs) are fundamental to modern applications like face recognition and autonomous driving. However, their security is a significant concern due to various integrity risks, such as backdoor attacks. In these attacks, compromised training data introduce malicious behaviors into the DNN, which can be exploited during inference or deployment. This paper presents a novel game-theoretic approach to model the interactions between an attacker and a defender in the context of a DNN backdoor attack. The contribution of this approach is multifaceted. First, it models the interaction between the attacker and the defender using a game-theoretic framework. Second, it designs a utility function that captures the objectives of both parties, integrating clean data accuracy and attack success rate. Third, it reduces the game model to a two-player zero-sum game, allowing for the identification of Nash equilibrium points through linear programming and a thorough analysis of equilibrium strategies. Additionally, the framework provides varying levels of flexibility regarding the control afforded to each player, thereby representing a range of real-world scenarios. Through extensive numerical simulations, the paper demonstrates the validity of the proposed framework and identifies insightful equilibrium points that guide both players in following their optimal strategies under different assumptions. The results indicate that fully using attack or defense capabilities is not always the optimal strategy for either party. Instead, attackers must balance inducing errors and minimizing the information conveyed to the defender, while defenders should focus on minimizing attack risks while preserving benign sample performance. These findings underscore the effectiveness and versatility of the proposed approach, showcasing optimal strategies across different game scenarios and highlighting its potential to enhance DNN security against backdoor attacks.

Adversarial sample attack method based on loss smoothing

Deep neural networks (DNNs) are vulnerable to adversarial examples.Although the existing momentum-based adversarial example generation method can achieve a close 100%white-box attack success rate, it is still not ideal when attacking other models, and the black- box attack success rate is low. To address this, an adversarial example attack method based on loss smoothing is proposed to improve the transferability of adversarial examples. In the iterative process of calculating the gradient at each step, the current gradient is not used directly, but the local average gradient is used to accumulate momentum, so as to suppress the local oscillation phenomenon on the loss function surface, thereby stabilizing the update direction and escaping the local extreme point. A large number of experimental results on the ImageNet dataset show that compared with the existing momentum-based method, the average black-box attack success rate of the proposed method in single model attack experiments is improved by 38.07%and 27.77%, and the average black-box attack success rate in integrated model attack experiments is improved by and.Rising32.50%and28.63%

BLOCKCHAIN AND ITS APPLICATION IN THE DEFENCE SECTOR

The digital transformation of the economy affects many sectors, including the defence sector, which is sensitive from both a national and international perspective. The digitalisation of the economy is based on technologies such as robotics, autonomy, additive manufacturing technologies (3D printing), augmented reality, big data, quantum computers, artificial intelligence and blockchains. In this article, we will take a closer look at the latter, namely blockchain technology. We will briefly outline its main properties and advantages, which make it particularly attractive for use in the defence sector, and dwell on its application to implement such a tool as smart contracts. One of the key advantages of blockchain in the context of military operations is ensuring transparency and traceability of supplies. In today's realities, logistical problems can cost lives, but blockchain helps prevent fraud and improve coordination between interacting communication nodes. Thanks to the use of blockchain technologies, each unit of supply can be recorded in an immutable register, which allows you to track its path from sender to recipient. This reduces the risk of loss or theft, and simplifies the process of monitoring and verifying the accuracy of information about deliveries. In addition, the decentralised nature of the blockchain enhances the security of military communications, protecting them from interception and attack. Each message is encrypted in such a way that it can only be read by the addressee. This ensures a high level of confidentiality and data protection, as information transmitted through the blockchain is distributed among numerous network nodes, making it difficult for attackers to access. By using cryptographic methods, the blockchain ensures that even in the event of a successful attack, attackers will not be able to alter or falsify information. Creating a tamper-proof ID system will help fight counterfeiting and improve the process of identifying wounded or fallen soldiers. By assigning unique and unchangeable authenticators to personnel, equipment or weapons, one hundred per cent identification of military entities can be ensured. This allows for accurate tracking of the movement and status of each soldier and equipment, which contributes to more efficient resource management. This system also increases the level of trust in the information provided, as it is recorded in the blockchain and cannot be changed or deleted. The introduction of blockchain technology in the defence sector can bring significant benefits, including increased security, transparency and efficiency. However, this process is accompanied by numerous challenges and risks that need to be considered and overcome for successful integration.

Finding and Mitigating a Vulnerability of the Color Wheel PIN Protocol

There is an increasing usage in the banking sector of Smartphones enabled with Near Field Communication (NFC), to improve the services offered for the customers. This usage requires a security enhancement of the systems that employ this technology like the Automated Teller Machines (ATMs). One example is the Color Wheel Personal Identification Number (CWPIN) security protocol designed to authenticate users on ATMs using NFC enabled smartphones without typing the PIN code directly. CWPIN has been compared in the literature to several other protocols and was considered easier to use, more cost-effective and more resistant to various attacks on ATMs such as card reader skimming, keylogger injection, shoulder surfing, etc. Nevertheless, we demonstrate in this paper that CWPIN is vulnerable to the multiple video recordings intersection attack. We do so through concrete examples and a thorough analysis that reveals a high theoretical probability of attack success. A malicious party can use one or two hidden cameras to record the ATM and smartphone screens during several authentication sessions, then disclose the user's PIN code by intersecting the information extracted from the video recordings. In a more complex scenario, these video recordings could be obtained by malware injected into the ATM and the user's smartphone to record their screens during CWPIN authentication sessions. Our intersection attack requires a few recordings, usually three or four, to reveal the PIN code and can lead to unauthorized transactions if the user's smartphone is stolen. We also propose a mitigation of the identified attack through several modifications to the CWPIN protocol and discuss its strengths and limitations.

Improving Differential-Neural Cryptanalysis

Our first objective is to enhance the capabilities of differential-neural distinguishers by applying more deep-learning techniques, focusing on handling more rounds and improving accuracy. Inspired by the Inception Block in GoogLeNet, we adopted a design that uses multiple parallel convolutional layers with varying kernel sizes before the residual block to capture multi-dimensional information. Additionally, we expanded the convolutional kernels in the residual blocks, enlarging the network's receptive field. In the case of Speck32/64, our efforts yield accuracy improvements in rounds 6, 7, and 8, enabling the successful training of a 9-round differential-neural distinguisher. As for Simon32/64, we developed a differential-neural distinguisher capable of effectively handling 12 rounds while achieving noteworthy accuracy enhancements in rounds 9, 10, and 11. Additionally, we utilized neutral bits to ensure the required data distribution for launching a successful key recovery attack when using multiple-ciphertext pairs as input for the neural network. Meanwhile, we redefined the formula for time complexity based on the differences in prediction speeds of the distinguisher between a single-core CPU and a GPU. Combining these various advancements allows us to considerably reduce the time and data complexity of key recovery attacks on 13-round Speck32/64. Furthermore, we used knowledge distillation techniques to reduce the model size, accelerating the distinguisher's prediction speed and reducing the time complexity. In particular, we achieved a successful 14-round key recovery attack by exhaustively guessing a 1-round subkey. For Simon32/64, we accomplished a 17-round key recovery attack for the first time and reduced the time complexity of the 16-round key recovery attack.

Asymmetric arms races between predators and prey: a tug of war between the life-dinner principle and the rare-enemy principle.

Antagonistic co-evolution can be asymmetric, where one species lags behind another. Asymmetry in a predator-prey context is expressed by the 'life-dinner principle', a classic informal model predicting that prey should be in some sense ahead in this arms race, since prey are running for their lives, while predators lag as they only run for their dinner. The model has undergone surprisingly little theoretical scrutiny. We derive analytical models that show coevolutionary outcomes do not always align with the life-dinner principle. Our results show that other important asymmetries can easily reverse the outcome, especially the rare-enemy principle: predators are usually outnumbered by their prey, sometimes substantially (trophic asymmetry), which can make selection on prey relatively weak. We additionally show that the antagonists typically exhibit different evolutionary responses to a situation where both predator and prey start out as equally fast runners. Although predators sometimes become so efficient that attacks always succeed, attack success often reaches a stable intermediate value. We conclude that the life-dinner principle has some validity as a metaphor, but its effect is of an 'all else being equal' type, which is surprisingly easily overridden by other features of the evolutionary dynamics.