Successful Attack Research Articles

Sensor Network Attack Synthesis against Fault Diagnosis of Discrete Event Systems.

This paper investigates the problem of synthesizing network attacks against fault diagnosis in the context of discrete event systems (DESs). It is assumed that the sensor observations sent to the operator that monitors a system are tampered with by an active attacker. We first formulate the process of online fault diagnosis under attack. Then, from the attack viewpoint, we define a sensor network attacker as successful if it can degrade the fault diagnosis in the case of maintaining itself as undiscovered by the operator. To verify such an attacker, an information structure called a joint diagnoser (JD) is proposed, which describes all possible attacks in a given attack scenario. Based on the refined JD, i.e., stealthy joint diagnoser (SJD), we present an algorithmic procedure for synthesizing a successful attacker if it exists.

A semantic backdoor attack against graph convolutional networks

Graph convolutional networks (GCNs) have been very effective in addressing the issue of various graph-structured related tasks, such as node classification and graph classification. However, recent research has shown that GCNs are vulnerable to a new type of threat called a backdoor attack, where the adversary can inject a hidden backdoor into GCNs so that the attacked model performs well on benign samples, but its prediction will be maliciously changed to the attacker-specified target class if the hidden backdoor is activated by the attacker-defined trigger. A semantic backdoor attack is a new type of backdoor attack on deep neural networks (DNNs), where a naturally occurring semantic feature of samples can serve as a backdoor trigger such that the infected DNNs models will misclassify testing samples containing the predefined semantic feature even without the requirement of modifying the testing samples. Since the backdoor trigger is a naturally occurring semantic feature of the samples, semantic backdoor attacks are more imperceptible and pose a new and serious threat. Existing research on semantic backdoor attacks focuses on the tasks of CNNs-based (Convolutional Neural Networks) image classification and LSTM-based (Long Short-Term Memory) text classification or word prediction. Little attention has been given to semantic backdoor attacks on GCNs models.In this paper, we investigate whether such semantic backdoor attacks are possible for GCNs and propose a semantic backdoor attack against GCNs (SBAG) under the context of graph classification to reveal the existence of this security vulnerability in GCNs. SBAG uses a certain type of nodes in the samples as a backdoor trigger and injects a hidden backdoor into GCNs models by poisoning training data. The backdoor will be activated, and the GCNs models will give malicious classification results specified by the attacker even on unmodified samples as long as the samples contain enough trigger nodes. We evaluate SBAG on five graph datasets. The experimental results indicate that SBAG can achieve attack success rates of approximately 99.9% on unmodified testing samples that naturally contain the trigger and attack success rates over 82% on testing samples modified to inject the trigger, respectively, both under poisoning rates of less than 5%. 11Our code is available at: github.

DIPA: Adversarial Attack on DNNs by Dropping Information and Pixel-Level Attack on Attention

Deep neural networks (DNNs) have shown remarkable performance across a wide range of fields, including image recognition, natural language processing, and speech processing. However, recent studies indicate that DNNs are highly vulnerable to well-crafted adversarial samples, which can cause incorrect classifications and predictions. These samples are so similar to the original ones that they are nearly undetectable by human vision, posing a significant security risk to DNNs in the real world due to the impact of adversarial attacks. Currently, the most common adversarial attack methods explicitly add adversarial perturbations to image samples, often resulting in adversarial samples that are easier to distinguish by humans. To address this issue, we are motivated to develop more effective methods for generating adversarial samples that remain undetectable to human vision. This paper proposes a pixel-level adversarial attack method based on attention mechanism and high-frequency information separation, named DIPA. Specifically, our approach involves constructing an attention suppression loss function and utilizing gradient information to identify and perturb sensitive pixels. By suppressing the model’s attention to the correct classes, the neural network is misled to focus on irrelevant classes, leading to incorrect judgments. Unlike previous studies, DIPA enhances the attack of adversarial samples by separating the imperceptible details in image samples to more effectively hide the adversarial perturbation while ensuring a higher attack success rate. Our experimental results demonstrate that under the extreme single-pixel attack scenario, DIPA achieves higher attack success rates for neural network models with various architectures. Furthermore, the visualization results and quantitative metrics illustrate that the DIPA can generate more imperceptible adversarial perturbation.

Research on Privacy Issues in Smart Metering System: An Improved TCN-Based NILM Attack Method and Practical DRL-Based Rechargeable Battery Assisted Privacy Preserving Method

Smart meters, as a key component of Advanced Metering Infrastructure (AMI), collect fine-grained electricity consumption data for demand response in smart grids. While this data improves the grid’s accuracy, it also poses significant threats to users’ privacy. In this paper, we study the privacy issue in smart metering systems from both attacker and defender perspectives. First, we propose an improved Temporal Convolutional Network (TCN) based Non-Intrusive Load Monitoring (NILM) attack method, which infers electrical appliance usage from public load curves, addressing the gradient vanishing, gradient exploding, and other problems while improving attack accuracy. Second, we develop a rechargeable battery-assisted energy management system to hide load characteristics of electrical appliances by adding physical noise, thus resisting NILM attacks. To address the privacy-cost trade-off optimization problem, we propose a Practical Deep Reinforcement Learning-based Rechargeable Battery assist Privacy Preserving Method (PRoP) that learns optimal battery charging/discharging policies. We design a novel privacy measurement method and constraints to ensure the feasibility of system deployment and prove PRoP’s effectiveness in resisting NILM attacks. Comprehensive evaluations demonstrate that our improved TCN-based NILM method achieves an attack success rate of over 80% on various electrical appliances, improving attack performance (MAE, RMSE) by 20% compared to existing methods while reducing model training time. Moreover, our proposed PRoP achieves a better trade-off between privacy protection and electricity cost than existing battery-assisted methods, reducing costs by 5% and the attack success ratio to 36%, while increasing the MAE and RMAE obtained by NILM by 3 times. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —Smart grid, which can support bidirectional information transmission, has a series of advantages, such as high efficiency and high stability. However, it also brings a significant threat to users’ electricity privacy. Although encryption-based privacy protection methods have been deployed on terminal devices of smart grids to prevent privacy leaks, this method can often only defend against intrusive attacks and has little effect on non-intrusive attacks. To this end, this paper studies the privacy issues caused by non-intrusive attacks. Specifically, to better study the protection method, we first investigate the attack mechanism and design an improved TCN-based Non-Intrusive Load Monitoring method. Then, we propose a Practical Reinforcement learning-based rechargeable battery-assisted Privacy preserving method (PRoP) to defend against this attack physically. The most practical contribution of this paper is that, compared with existing battery-assisted privacy protection methods, we do not blindly pursue algorithm performance but fully consider the practical factors of deployment, such as limiting battery capacity and constraining battery charging and discharging behavior. This can guide practitioners to better apply this technology in practice.

Boosting the transferability of adversarial CAPTCHAs

Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) is a test to distinguish humans and computers. Since attackers can achieve high accuracy in recognizing the CAPTCHAs using deep learning models, geometric transformations are added to the CAPTCHAs to disturb deep learning model recognition. However, excessive geometric transformations might also affect humans’ recognition of the CAPTCHA. Adversarial CAPTCHAs are special CAPTCHAs that can disrupt deep learning models without affecting humans. Previous works of adversarial CAPTCHAs mainly focus on defending the filtering attack. In real-world scenarios, the attackers’ models are inaccessible when generating adversarial CAPTCHAs, and the attackers may use models with different architectures, thus it is crucial to improve the transferability of the adversarial CAPTCHAs. We propose CFA, a method to generate more transferable adversarial CAPTCHAs focusing on altering content features in the original CAPTCHA. We use the attack success rate as our metric to evaluate the effectiveness of our method when attacking various models. A higher attack success rate means a higher level of preventing models from recognizing the CAPTCHAs. The experiment shows that our method can effectively attack various models, even when facing possible defense methods that the attacker might use. Our method outperforms other feature space attacks and provides a more secure version of adversarial CAPTCHAs.

KerbNet: A QoE-Aware Kernel-Based Backdoor Attack Framework

Deep neural networks are vulnerable to backdoor attacks, where a specially-designed trigger will lead to misclassification of any benign samples. However, existing backdoor attacks usually impose conspicuous patch triggers on images, which are easily detected by humans and defense algorithms. Existing works on invisible triggers, however, either have reduced attack success rate or yield detectable patterns to visual inspections. In this paper, we propose <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">KerbNet</small> , a kernel-based backdoor attack framework, which applies kernel operations to clean samples as the trigger to incur misclassification. The kernel-processed samples achieve a high attack success rate while appearing natural with high Quality-of-Experience (QoE). We carefully design the kernel trigger generation algorithm by exploiting the neural network structure to propagate the influence of the trigger to the target misclassification label under the QoE constraint. We conduct extensive experiments on five datasets, i.e., MNIST, GTSRB, CIFAR-10, CelebA, and ImageNette to evaluate the effectiveness and practicality of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">KerbNet</small> under the impact of various factors, including neuron-residing layer, kernel size, base image, loss function, model structure, and so on. We also show that our proposed attacks can evade state-of-the-art defense strategies and visual inspections. Code will be available after publication.

TextJuggler: Fooling text classification tasks by generating high-quality adversarial examples

Deep neural networks are vulnerable to adversarial attacks, despite performing well in a variety of tasks. In the current black-box word-level text adversarial attacks on various classification tasks, the main problems are the relatively low success rate and the need to improve the quality of the adversarial examples generated. These problems mainly involve two aspects: first, the key to effectively conducting adversarial attacks is accurately determining the key words in a sentence that significantly affect the model’s judgment. Only by precisely finding these words can the attack be effectively performed. Second, to generate high-quality adversarial examples, it is essential to mislead the classification model while minimizing changes to words in the sentence. It is essential to ensure that adversarial examples are as semantically and grammatically similar to the original samples as possible. Therefore, accurately determining key words and minimally altering them to produce high-quality adversarial examples presents a significant challenge. To address these challenges, we introduce TextJuggler, a new black-box word-level text adversarial attack method, inspired by occlusion and language modeling concepts. By using the Bert model to sample and replace words in sentences, the key words that influence classifier decisions can be efficiently determined. To ensure efficiency in the search for key words, our method reduces queries via crafted locality-sensitive hashing. For the determined key words, we adopt the robust and optimized Bert model, to generate high-quality adversarial examples through insertion or substitution operations for different text classification tasks while ensuring semantic similarity and text fluency. Extensive experiments and API experiments show that TextJuggler outperforms the baselines in attack success rate, textual similarity, and fluency.

Ransomware Early Detection using Machine Learning Approach and Pre-Encryption Boundary Identification

The escalating ransomware threat has catalysed the formation of a sophisticated network of cybercriminal enterprises. Addressing this issue, our research provides a detailed exploration of the ransomware menace and an evaluation of contemporary detection methodologies. A successful ransomware attack leverages many factors: robust encryption methods that defy decryption, the anonymity of cyber currencies, and the widespread availability of ransomware kits that enable even inexperienced actors to launch attacks. Such dynamics have cultivated a niche for cybercriminal specialists in the digital underworld. In response to these challenges, our study proposes a detection framework based on machine learning, a domain where regression algorithms have gained popularity without yielding a definitive protective model. We employ API call analysis as the foundation to assess various machine learning classifiers' efficiency in identifying ransomware. The evaluation demonstrates that the Naive Bayes classifier underperforms due to suboptimal accuracy, making it unsuitable for this application. Conversely, Logistic Regression, with an AUC of 0.951, minimal training time, and substantial efficacy gains, emerges as a strong contender. The Decision Tree and Random Forest classifiers exhibit comparable proficiency; however, the Decision Tree's interpretability and Random Forest's computational swiftness present unique advantages. Superior still, SVM and Gradient Boosted Trees command the highest AUC and gains, albeit at the cost of increased training duration. Our findings affirm the pivotal role of API call analysis in ransomware detection and the potency of machine learning approaches in learning from extensive datasets to identify novel malware strains. Given the continual evolution of malware, detection methodologies must adapt correspondingly. This study's comparative analysis elucidates the trade-offs between accuracy, computational speed, and training time, guiding the selection of the optimal machine learning algorithm for robust ransomware detection.

Efficient Adversarial Attack Based on Moment Estimation and Lookahead Gradient

Adversarial example generation is a technique that involves perturbing inputs with imperceptible noise to induce misclassifications in neural networks, serving as a means to assess the robustness of such models. Among the adversarial attack algorithms, momentum iterative fast gradient sign Method (MI-FGSM) and its variants constitute a class of highly effective offensive strategies, achieving near-perfect attack success rates in white-box settings. However, these methods’ use of sign activation functions severely compromises gradient information, which leads to low success rates in black-box attacks and results in large adversarial perturbations. In this paper, we introduce a novel adversarial attack algorithm, NA-FGTM. Our method employs the Tanh activation function instead of the sign which can accurately preserve gradient information. In addition, it utilizes the Adam optimization algorithm as well as the Nesterov acceleration, which is able to stabilize gradient update directions and expedite gradient convergence. Above all, the transferability of adversarial examples can be enhanced. Through integration with data augmentation techniques such as DIM, TIM, and SIM, NA-FGTM can further improve the efficacy of black-box attacks. Extensive experiments on the ImageNet dataset demonstrate that our method outperforms the state-of-the-art approaches in terms of black-box attack success rate and generates adversarial examples with smaller perturbations.

Physical unclonable function using photonic spin Hall effect

This study presents a novel method leveraging surface wave-assisted photonic spin Hall effect (PSHE) to construct physical unclonable functions (PUFs). PUFs exploit inherent physical variations to generate unique Challenge–Response pairs, which are critical for hardware security and arise from manufacturing discrepancies, device characteristics, or timing deviations. We explore PSHE generation-based PUF design, expanding existing design possibilities. With recent applications in precise sensing and computing, PSHE offers promising performance metrics for our proposed PUFs, including an inter-Hamming distance of 47.50% , an average proportion of unique responses of 62.5% , and a Pearson correlation coefficient of − 0.198. The PUF token demonstrates robustness to simulated noise. Additionally, we evaluate security using a machine learning-based attack model, employing a multi-layer perceptron (MLP) regression model with a randomized search method. The average accuracy of successful attack prediction is 9.70% for the selected dataset. Our novel PUF token exhibits high non-linearity due to the PSHE effect, resilience to MLP-based attacks, and sensitivity to process variation.

Reconciling privacy and accuracy in AI for medical imaging

Artificial intelligence (AI) models are vulnerable to information leakage of their training data, which can be highly sensitive, for example, in medical imaging. Privacy-enhancing technologies, such as differential privacy (DP), aim to circumvent these susceptibilities. DP is the strongest possible protection for training models while bounding the risks of inferring the inclusion of training samples or reconstructing the original data. DP achieves this by setting a quantifiable privacy budget. Although a lower budget decreases the risk of information leakage, it typically also reduces the performance of such models. This imposes a trade-off between robust performance and stringent privacy. Additionally, the interpretation of a privacy budget remains abstract and challenging to contextualize. Here we contrast the performance of artificial intelligence models at various privacy budgets against both theoretical risk bounds and empirical success of reconstruction attacks. We show that using very large privacy budgets can render reconstruction attacks impossible, while drops in performance are negligible. We thus conclude that not using DP at all is negligent when applying artificial intelligence models to sensitive data. We deem our results to lay a foundation for further debates on striking a balance between privacy risks and model performance.

Comprehensive comparisons of gradient-based multi-label adversarial attacks

Adversarial examples which mislead deep neural networks by adding well-crafted perturbations have become a major threat to classification models. Gradient-based white-box attack algorithms have been widely used to generate adversarial examples. However, most of them are designed for multi-class models, and only a few gradient-based adversarial attack algorithms specifically designed for multi-label classification models. Due to the correlation between multiple labels, the performance of these gradient-based algorithms in generating adversarial examples for multi-label classification is worthy of analyzing and evaluating comprehensively. In this paper, we first transplant five typical gradient-based adversarial attack algorithms in the multi-class environment to the multi-label environment. Secondly, we comprehensively compared the performance of these five attack algorithms and the other four existing multi-label adversarial attack algorithms by experiments on six different attack types, and evaluated the transferability of adversarial examples generated by all algorithms under two attack types. Experimental results show that, among different attack types, the majority of multi-step attack algorithms have higher attack success rates compared to one-step attack algorithms. Additionally, these gradient-based algorithms face greater difficulty in augmenting labels than in hiding them. For transfer experimental results, the adversarial examples generated by all attack algorithms exhibit weaker transferability when attacking other different models.

Web 3.0 security: Backdoor attacks in federated learning-based automatic speaker verification systems in the 6G era

With the advent of Next-Generation Web 3.0 and the integration of 6G technologies, digital industrial applications are undergoing unprecedented transformations. Among these, the field of intelligent voice recognition, particularly Federated Learning-based Automatic Speaker Verification (FL-ASV) systems, stands out by collaboratively training robust ASV models across systems while protecting sensitive voiceprint data. However, the aspect of security within such systems is still largely unexplored and presents potential vulnerabilities. To bridge this gap, we design a voiceprint-driven backdoor attack for FL-ASV, termed FedCTS. Concretely, we employ contrastive learning techniques to significantly improve the feature extraction process for individual speakers. This enhancement not only maintains the inherent performance of FL-ASV systems but also introduces a level of complexity that can mislead even the most skilled defenders. Furthermore, we intricately obfuscate the triggers by subtly embedding voice and backdoor clips within the utterances. This is achieved by dividing the utterances into chronological segments through a meticulously devised time-series injection strategy, thereby ensuring the triggers remain undetectable. Additionally, we have conceptualized a unique defense mechanism tailored to counter such attacks. This defense mechanism operates by scrutinizing the speaker’s frequencies and filtering out any suspicious frequencies that fall outside the normal range of human voice, helping to mitigate the risk of backdoor attacks without compromising the system’s functionality. In the context of the fast-evolving digitalized industrial landscape, our attack strategy, FedCTS, has demonstrated a significant improvement in effectiveness. It achieves an average increase of 7.03% in the attack success rate when compared to existing state-of-the-art methods.

Improving query efficiency of black-box attacks via the preference of deep learning models

Black-box query attacks are effective at compromising deep-learning models using only the model's output. These attacks typically face challenges with low attack success rates (ASRs) when limited to fewer than ten queries per example. Recent approaches have improved ASRs due to the transferability of initial perturbations, yet they still suffer from inefficient querying. Our study introduces the Gradient-Aligned Attack (GAA) to enhance ASRs with minimal perturbation by focusing on the model's preference. We define a preference property where the generated adversarial example prefers to be misclassified as the wrong category with a high initial confidence. This property is further elucidated by the gradient preference, suggesting a positive correlation between the magnitude of a coefficient in a partial derivative and the norm of the derivative itself. Utilizing this, we devise the gradient-aligned CE (GACE) loss to precisely estimate gradients by aligning these coefficients between the surrogate and victim models, with coefficients assessed by the victim model's outputs. GAA, based on the GACE loss, also aims to achieve the smallest perturbation. Our tests on ImageNet, CIFAR10, and Imagga API show that GAA can increase ASRs by 25.7% and 40.3% for untargeted and targeted attacks respectively, while only needing minimally disruptive perturbations. Furthermore, the GACE loss reduces the number of necessary queries by up to 2.5x and enhances the transferability of advanced attacks by up to 14.2%, especially when using an ensemble surrogate model. Code is available at https://github.com/HaloMoto/GradientAlignedAttack.

Adversarial Infrared Curves: An attack on infrared pedestrian detectors in the physical world

Deep neural network security is a persistent concern, with considerable research on visible light physical attacks but limited exploration in the infrared domain. Existing approaches, like white-box infrared attacks using bulb boards and QR suits, lack realism and stealthiness. Meanwhile, black-box methods with cold and hot patches often struggle to ensure robustness. To bridge these gaps, we propose Adversarial Infrared Curves (AdvIC). Using Particle Swarm Optimization, we optimize two Bezier curves and employ cold patches in the physical realm to introduce perturbations, creating infrared curve patterns for physical sample generation. Our extensive experiments confirm AdvIC’s effectiveness, achieving 94.8% and 67.2% attack success rates for digital and physical attacks, respectively. Stealthiness is demonstrated through a comparative analysis, and robustness assessments reveal AdvIC’s superiority over baseline methods. When deployed against diverse advanced detectors, AdvIC achieves an average attack success rate of 76.2%, emphasizing its robust nature. We conduct thorough experimental analyses, including ablation experiments, transfer attacks, adversarial defense investigations, etc. Given AdvIC’s substantial security implications for real-world vision-based applications, urgent attention and mitigation efforts are warranted.

The Armistice of Villa Giusti

In the First World War, the Austro-Hungarian Empire was a part of the Central Powers. As from 1916, the Empire had been very keen for the war to end. The Austro-Hungarian Empire, which was deprived of the financial power to continue the war and faced with the demands of independence from the minorities before and during the war, approached the armistice proposals very positively that could end the war in 1916 and 1917. In mid-June 1918, the failure of the attack launched by the Austro-Hungarian troops against the Italian troops and the superiority of the Allied Powers over Germany on the western front in July-August put the situation of the Central Powers in the European fronts in trouble, and after the successful attack launched by the Italian troops on 24 October, there was no possibility for Austria-Hungary to continue the war. The Austro-Hungarian Empire withdrew from the First World War by signing an armistice with Italy on 3 November 1918 at Villa Giusti del Giardino outside the city of Padova. The armistice contained very harsh terms and severely limited the empire in every respect. The Armistice of Villa Giusti consisted of two chapters and nineteen clauses including eight military and eleven naval and maritime provisions. The additional protocol of the armistice consisted of two chapters and nineteen clauses, ten of which were military and nine of which were related to the naval forces and maritime affairs.

Transferable adversarial attack based on sensitive perturbation analysis in frequency domain

Recently, transferable adversarial attacks on deep neural networks (DNNs) have attracted significant attention. Although existing adversarial attacks have achieved high attack success rates in white-box scenarios, they perform poorly in black-box attack scenarios. To address the issue of low transferability in black-box adversarial attacks, we propose a frequency-sensitive perturbation-based black-box adversarial attack method to enhance transferability performance from the perspective of Fourier domain sensitivity. Initially, the Fourier sensitivity heatmaps of multiple substitute models are integrated to identify the common sensitive frequency region. Subsequently, the perturbations in the frequency domain are optimized through joint loss, thereby constraining the sensitive region and limiting the perturbations in the non-sensitive region. Finally, in each iteration, a spectral model enhancement is performed to simulate additional substitute models and reduce the spectral discrepancy between the substitute and target models. Extensive experimental results on benchmark datasets demonstrated the effectiveness of the proposed method. Compared to existing black-box adversarial attack methods, the proposed approach generates targeted and non-targeted adversarial samples with higher transfer success rates and good invisibility, thereby confirming its superiority.

DSCAPS: A decentralized smart contract auditing platform based on sidechain

Successful attacks on smart contracts can result in loss of digital assets with potential financial and reputation implications. This reinforces the importance of auditing smart contracts prior to deployment. However, existing auditing approaches are generally non transparent, inefficient, limited to known bugs, and imprecise due to lack of real-world information in the blockchain. Therefore, we design a Decentralized Smart Contract Auditing Platform based on Sidechain (DSCAPS) in this paper. DSCAPS leverages the two-way peg sidechain technology to implement the interactions between the main chain and the sidechain which is used as the audit chain platform. Unlike conventional centralized audits, blockchain users can evaluate the security of contracts in a real-world smart contract execution environment by designing an appropriate incentive mechanism. Thus, detection results will be more comprehensive and precise. Moreover, to prevent multi-party collusion from manipulating the blockchain or audit process, we introduce a margin mechanism. Findings from our security analysis demonstrate that DSCAPS can mitigate potential threats. Evaluation findings based on the system implementation also show that DSCAPS is efficient in auditing a contract with performance overheads of less than 10%.

SUETA: Speaker-specific utterance ensemble based transfer attack on speaker identification system

With the widespread application of speaker identification (SI) systems in security-related tasks, the robustness of SI systems against adversarial examples has garnered increasing attention. Existing works have demonstrated the vulnerability of SI systems to transfer-based black-box attacks, wherein attackers generate adversarial examples with a surrogate model and then transfer them to attack the target system. However, the attack success rate (ASR) of transfer-based black-box attacks is limited by the transferability of adversarial examples. As far as we know, few works have investigated enhancing the transferability of adversarial examples for speech utterances to attack SI systems. Furthermore, existing works only utilize a single utterance in the attack process, but in practical situations, an attacker can usually collect multiple utterances of a speaker. In this paper, we propose a novel transfer-based black-box attack method, called speaker-specific utterance ensemble based transfer attack (SUETA), to attack SI systems. To the best of our knowledge, SUETA is the first transfer-based black-box attack method that utilizes multiple utterances instead of a single one. Furthermore, we also propose an improved variant of SUETA, called SUETA+, by sharing gradients of utterances at the speaker-embedding level. Empirical results show that both SUETA and SUETA+ improve the ASR compared to the baselines under the classical cross-model situation. SUETA+ further shows additional improvement over SUETA, especially in the case of the untargeted attack. SUETA+ also outperforms the baselines in cross-dataset and cross-preprocessor situations, although the ASR for all transfer-based attacks decreases compared to that in the cross-model situation. Moreover, SUETA+ can significantly improve the ASR against commercial APIs (iFlytek and TalentedSoft) and the voice assistant (Tmall Genie) for the untargeted attack compared to the baselines.

How alliances form and conflict ensues

In a social network in which friendly and rival bilateral links can be formed, how do alliances between decision-makers form, and what determines whether a conflict will arise? We study a network formation game between ex-ante symmetric players in the laboratory to examine the dynamics of alliance formation and conflict evolution. A peaceful equilibrium yields the greatest social welfare, while a successful bullying attack transfers the victimized player's resources evenly to the attackers at a cost. In within-subject and between-subject laboratory experiments, we find that the relative frequency of peaceful and bullying outcomes increases in the cost of attack. We further examine the dynamics leading to the final network and find that groups tend to coordinate quickly on a first target for attack, while the first attacker entails a non-negligible risk of successful counter-attack. These findings provide insights for understanding social dynamics in group coordination.