Survey on adversarial attacks and defenses for images, graphs, and text.
problem Adversarial examples threaten the safety of deep learning applications.
method Review of adversarial attack and defense mechanisms for images, graphs, and text.
result Systematic overview of adversarial attacks and countermeasures.
Face recognition systems are vulnerable to composite face reconstruction attacks.
problem Vulnerability of face recognition systems to composite face reconstruction attacks.
method Assumed attacker uses composite face parts to reconstruct faces faster and more efficiently.
result Current face recognition systems are extremely vulnerable to random search attacks.
This paper presents the Speech Technology Center (STC) replay attack detection systems proposed for Automatic Speaker Verification Spoofing and Countermeasures Challenge 2017. In this study we focused on comparison of different spoofing detection approaches. These were GMM based methods, high level features extraction …
This study combines ASV and CM systems for better performance using reinforcement learning.
problem Improving the combined performance of ASV and CM systems for better t-DCF measure.
method Training ASV and CM components together using reinforcement learning.
result Training ASV and CM components together improves the performance of the combined system.
Proposes a method for private aggregation in heterogeneous federated learning.
problem Ensuring resilience to Byzantine clients and maintaining client data privacy in federated learning with heterogeneous data.
method Careful co-design of verifiable secret sharing, secure aggregation, and private information retrieval scheme.
result Achieves information-theoretic privacy guarantees and Byzantine resilience under data heterogeneity.
Survey on adversarial attacks and defenses in deep learning.
problem Vulnerability of deep learning systems to adversarial examples.
method Discussion on different types of adversarial attacks and countermeasures.
result Challenges and inefficiencies in current countermeasures.
TG-PSM morphs encrypted traffic to reduce traffic analysis accuracy.
problem Traffic analysis on encrypted traffic reveals sensitive information.
method Clusters websites, finds target sites, morphs traffic using greedy algorithm.
result TG-PSM reduces attacker's accuracy significantly with low overhead.
This paper presents the Speech Technology Center (STC) systems submitted to Automatic Speaker Verification Spoofing and Countermeasures (ASVspoof) Challenge 2015. In this work we investigate different acoustic feature spaces to determine reliable and robust countermeasures against spoofing attacks. In addition to the c…
Study reveals mutual reinforcement between adversarial inputs and poisoned models.
problem Understanding and mitigating vulnerabilities of deep learning models.
method Developed a new attack model to jointly optimize adversarial inputs and poisoned models.
result Mutual reinforcement effects between adversarial inputs and poisoned models significantly amplify each other's effectiveness.
The ASVspoof challenge series was born to spearhead research in anti-spoofing for automatic speaker verification (ASV). The two challenge editions in 2015 and 2017 involved the assessment of spoofing countermeasures (CMs) in isolation from ASV using an equal error rate (EER) metric. While a strategic approach to assess…
Growing interest in automatic speaker verification (ASV)systems has lead to significant quality improvement of spoofing attackson them. Many research works confirm that despite the low equal er-ror rate (EER) ASV systems are still vulnerable to spoofing attacks. Inthis work we overview different acoustic feature spaces…
Machine learning (ML) models may be deemed confidential due to their sensitive training data, commercial value, or use in security applications. Increasingly often, confidential ML models are being deployed with publicly accessible query interfaces. ML-as-a-service ("predictive analytics") systems are an example: Some …
Fawkes protects images from unauthorized facial recognition models.
problem Unauthorized training of facial recognition models poses privacy risks.
method Fawkes adds imperceptible pixel-level changes (cloaks) to images before release.
result Fawkes can protect images from misidentification by 95% and 80% even when clean images are leaked.
It is well known that speaker verification systems are subject to spoofing attacks. The Automatic Speaker Verification Spoofing and Countermeasures Challenge -- ASVSpoof2015 -- provides a standard spoofing database, containing attacks based on synthetic speech, along with a protocol for experiments. This paper describe…
Voice conversion (VC) aims at conversion of speaker characteristic without altering content. Due to training data limitations and modeling imperfections, it is difficult to achieve believable speaker mimicry without introducing processing artifacts; performance assessment of VC, therefore, usually involves both speaker…
Adds layers to NNs to protect them from reverse engineering.
problem Extracting the underlying model of a Neural Network.
method Introducing parasitic layers that approximate a noisy identity mapping with a Convolutional NN.
result The protected NN's predictions remain mostly unchanged while making reverse-engineering more complex.
Despite the successful application of machine learning (ML) in a wide range of domains, adaptability---the very property that makes machine learning desirable---can be exploited by adversaries to contaminate training and evade classification. In this paper, we investigate the feasibility of applying a specific class of…
This paper explores how to fool ECG diagnosis systems with adversarial ECGs.
problem Vulnerability of DNN-powered ECG diagnosis systems to adversarial attacks.
method Analyzed ECG properties to design effective adversarial attacks under two models.
result Demonstrates weaknesses in DNN-powered ECG diagnosis systems under adversarial attacks.
Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this …
With rapid progress and significant successes in a wide spectrum of applications, deep learning is being applied in many safety-critical environments. However, deep neural networks have been recently found vulnerable to well-designed input samples, called adversarial examples. Adversarial examples are imperceptible to …
Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization a…
Deep neural networks have been widely adopted in recent years, exhibiting impressive performances in several application domains. It has however been shown that they can be fooled by adversarial examples, i.e., images altered by a barely-perceivable adversarial noise, carefully crafted to mislead classification. In thi…
In recent years, real estate industry has captured government and public attention around the world. The factors influencing the prices of real estate are diversified and complex. However, due to the limitations and one-sidedness of their respective views, they did not provide enough theoretical basis for the fluctuati…
This paper evaluates targeted data poisoning attacks by focusing on the hardest samples, improving evaluation and defense strategies.
problem The effectiveness of targeted data poisoning attacks is often overestimated due to average evaluation methods.
method The paper introduces metrics to identify the hardest and easiest to poison samples based on clean model information.
result The proposed metrics reliably stratify samples by poisoning vulnerability, enabling rigorous worst-case evaluation and proactive defense.
Online surveillance detects systemic risk in financial markets.
problem Detecting and monitoring systemic risk in financial markets.
method Online monitoring procedures for multiple series, controlling for false rejections.
result Procedures allow timely detection of financial distress.
Paper examines Go AI robustness against adversarial attacks.
problem Superhuman Go AIs are vulnerable to simple adversarial strategies.
method Three defenses tested: adversarial training, iterated adversarial training, and changing network architecture.
result No defense is robust against newly trained adversaries, and attacks are similar to cyclic attacks.
Deep learning improves Android malware detection.
problem Detecting and preventing Android malware.
method Review of static, dynamic, and hybrid deep learning approaches.
result Identifies strengths and weaknesses of deep learning methods.
This paper tackles adversarial reinforcement learning in cyber defence with partial observability.
problem Adversarial manipulation of reinforcement learning agents in autonomous cyber defence.
method Proposes an inversion defence method to counteract causative attacks under partial observability.
result The proposed inversion defence method effectively reduces the impact of adversarial attacks without affecting non-attack training scenarios.
A new system detects audio replay attacks with high accuracy.
problem Detecting and preventing audio replay attacks in speaker verification systems.
method Proposes Attentive Filtering Network combining attention-based filtering and ResNet classifier.
result Achieves EER of 8.99% on ASVspoof 2017 Version 2.0 dataset.
Class imbalance is a challenging issue in practical classification problems for deep learning models as well as traditional models. Traditionally successful countermeasures such as synthetic over-sampling have had limited success with complex, structured data handled by deep learning models. In this paper, we propose D…
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
Study finds environmental liability insurance reduces industrial carbon emissions.
problem Reduction of industrial carbon emissions.
method Two-way fixed effect model using provincial (city) level panel data from 2010 to 2020.
result Environmental liability insurance reduces industrial carbon emissions at both direct and indirect levels, with varying effects.
A new method approximates loss functions asymmetrically to prevent catastrophic forgetting.
problem Catastrophic forgetting in deep neural networks.
method Approximating a true loss function using an asymmetric quadratic function with one side overestimated.
result Achieves state-of-the-art accuracy close to upper-bound performance on benchmark datasets.
Behavioral malware clustering can be compromised by poisoning attacks.
problem Security of clustering algorithms for malware analysis.
method Investigated poisoning attacks on behavioral malware clustering.
result Behavioral malware clustering is vulnerable to poisoning attacks.
Graph neural networks are vulnerable to adversarial attacks by manipulating graph structure.
problem Vulnerability of Graph Neural Networks to adversarial attacks.
method Categorization and review of existing attacks and defenses.
result Developed a repository for empirical studies on graph adversarial attacks and defenses.
New method protects neural networks from adversarial attacks without generating adversarial examples.
problem Vulnerability of neural networks to adversarial examples.
method Entropic retraining, inspired by information theory.
result Significant increase in NNs' security and robustness.
Poisoning attacks can undermine fairness in machine learning models.
problem Poisoning attacks can introduce classification disparities among different groups in data.
method Developed a gradient-based poisoning attack framework to target algorithmic fairness.
result Demonstrated the effectiveness of poisoning attacks in both white-box and black-box scenarios.
Paper improves anomaly detection and categorization in multi-cloud environments.
problem Differentiating among different types of attacks for better defense.
method Used supervised machine learning techniques (LR and RF) on a public dataset.
result More than 99% detection accuracy and 93.6% categorization accuracy.
The burgeoning success of deep learning has raised the security and privacy concerns as more and more tasks are accompanied with sensitive data. Adversarial attacks in deep learning have emerged as one of the dominating security threat to a range of mission-critical deep learning systems and applications. This paper ta…
PAC-MCTS addresses biased search in LLM-guided planning by dynamically pruning.
problem Systematic biases in LLMs lead to inefficient and unsafe search in deep planning tasks.
method Formulates node expansion as BAI under bounded bias, derives sample complexity bounds, and proposes PAC-MCTS for dynamic confidence bounds.
result PAC-MCTS improves robustness and efficiency by up to 78% fewer API evaluations and 3x higher sample efficiency.
New method optimizes weights and quantizers in ternary neural networks.
problem Reducing model size and computational cost in deep neural networks.
method Simultaneous optimization of weights and quantizers using truncated Gaussian approximation.
result 3.9-2.16% accuracy loss in ImageNet classification tasks.
Recent advances in adversarial Deep Learning (DL) have opened up a largely unexplored surface for malicious attacks jeopardizing the integrity of autonomous DL systems. With the wide-spread usage of DL in critical and time-sensitive applications, including unmanned vehicles, drones, and video surveillance systems, onli…
Proposes a deep tree-ensemble model for multi-output prediction.
problem Lack of efficient solutions for multi-output prediction.
method Integrates tree-embeddings into deep tree-ensembles for structured output prediction.
result Superior performance in multi-label classification and multi-target regression tasks.
New adversarial training enhances malware detectors against various attacks.
problem Vulnerability of malware detectors to evasion attacks.
method Proposes a mixture of attacks and adversarial training to improve deep neural networks.
result Significantly enhances robustness of deep neural networks against a wide range of attacks.
Poisoning attack is identified as a severe security threat to machine learning algorithms. In many applications, for example, deep neural network (DNN) models collect public data as the inputs to perform re-training, where the input data can be poisoned. Although poisoning attack against support vector machines (SVM) h…
Paper detects adversarial speech inputs with high accuracy.
problem Adversarial attacks on ASR systems.
method Uncertainty quantification using neural networks.
result Detection accuracy of adversarial inputs over 0.99.
New study tackles free-rider attacks in federated learning models.
problem Free-rider attacks compromise federated learning models by non-contributing to data updates.
method Theoretical and experimental analysis of iterative federated learning schemes, including FedAvg and FedProx.
result Formal guarantees for free-rider attacks to converge to aggregated models of fair participants.
ReRe detects anomalies in real-time for time series data.
problem Real-time anomaly detection for time series data requires human intervention or domain knowledge and high computation complexity.
method ReRe uses two lightweight LSTM models to predict and determine anomalies based on historical data and adaptive thresholds.
result ReRe detects anomalies in real-time without requiring human intervention or domain knowledge.