Deep convolutional neural networks (DCNNs) have dominated as the best performers in machine learning, but can be challenged by adversarial attacks. In this paper, we defend against adversarial attacks using neural architecture search (NAS) which is based on a comprehensive search of denoising blocks, weight-free operations, Gabor filters and convolutions. The resulting anti-bandit NAS (ABanditNAS) incorporates a new operation evaluation measure and search process based on the lower and upper confidence bounds (LCB and UCB). Unlike the conventional bandit algorithm using UCB for evaluation only, we use UCB to abandon arms for search efficiency and LCB for a fair competition between arms. Extensive experiments demonstrate that ABanditNAS is faster than other NAS methods, while achieving an $8.73\%$ improvement over prior arts on CIFAR-10 under PGD-$7$.
Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks
The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；School of Cyber Science and Engineering, Wuhan University（武汉大学网络安全学院）；School of Computer Science and Engineering, Central South University（中南大学计算机科学与工程学院）；X Digital Dynamics（X数字动力公司）；Tencent Data Platform（腾讯数据平台）
Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Models
University of Macau（澳门大学）；Shenzhen Institute of Advanced Technology（深圳先进技术研究院）；Kuaishou Technology（快手科技）；Macau University of Science and Technology（澳门科技大学）
Evidential Detection and Tracking Collaboration: New Problem, Benchmark and Algorithm for Robust Anti-UAV System
Jiangnan University（江南大学）；Institute of North Electronic Equipment（北方电子设备研究所）；Intelligent Game and Decision Laboratory（智能博弈与决策实验室）；Peng Cheng Laboratory（鹏城实验室）；National University of Singapore（新加坡国立大学）；Beijing Institute of Basic Medical Sciences（北京基础医学研究所）；Beijing Institute of Technology（北京理工大学）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；Beijing University of Posts and Telecommunications（北京邮电大学）；PhiGent Robotics（鉴智机器人）；Tsinghua University（清华大学）
George Mason University（乔治梅森大学）；Drexel University（德雷塞尔大学）；University of California, Davis（加州大学戴维斯分校）
This paper presents a novel model training solution, denoted as Adaptive-Gravity, for enhancing the robustness of deep neural network classifiers against adversarial examples. We conceptualize the model parameters/features associated with each class as a mass characterized by its centroid location and the spread (standard deviation of the distance) of features around the centroid. We use the centroid associated with each cluster to derive an anti-gravity force that pushes the centroids of different classes away from one another during network training. Then we customized an objective function …
Xi’an Jiaotong University（西安交通大学）；Alibaba Group（阿里巴巴集团）；ABB Corporate Research Center（ABB企业研究中心）；Wormpex AI Research（Wormpex人工智能研究院）
Deep Neural Network classifiers are vulnerable to adversarial attack, where an imperceptible perturbation could result in misclassification. However, the vulnerability of DNN-based image ranking systems remains under-explored. In this paper, we propose two attacks against deep ranking systems, i.e., Candidate Attack and Query Attack, that can raise or lower the rank of chosen candidates by adversarial perturbations. Specifically, the expected ranking order is first represented as a set of inequalities, and then a triplet-like objective function is designed to obtain the optimal perturbation. C…
Fragile by Design: On the Limits of Adversarial Defenses in Personalized Generation
Department of Computer Science, University of Liverpool, Liverpool, L69 3BX, UK（利兹大学计算机科学系）；WMG, University of Warwick, Coventry, CV4 7AL, UK（沃里克大学WMG）
Macquarie University（麦考瑞大学）；Swinburne University of Technology（斯威本科技大学）
The rapid development of artificial intelligence, especially deep learning technology, has advanced autonomous driving systems (ADSs) by providing precise control decisions to counterpart almost any driving event, spanning from anti-fatigue safe driving to intelligent route planning. However, ADSs are still plagued by increasing threats from different attacks, which could be categorized into physical attacks, cyberattacks and learning-based adversarial attacks. Inevitably, the safety and security of deep learning-based autonomous driving are severely challenged by these attacks, from which the…
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；Nanyang Technological University（南洋理工大学）；Sun Yat-sen University-Shenzhen（中山大学深圳校区）
University of Texas at Austin（得克萨斯大学奥斯汀分校）；Queen’s University Belfast（贝尔法斯特女王大学）；KBR Inc.（KBR公司）；NASA Ames（美国国家航空航天局艾姆斯研究中心）；Carnegie Mellon University（卡内基梅隆大学）
We study backdoor poisoning attacks against image classification networks, whereby an attacker inserts a trigger into a subset of the training data, in such a way that at test time, this trigger causes the classifier to predict some target class. %There are several techniques proposed in the literature that aim to detect the attack but only a few also propose to defend against it, and they typically involve retraining the network which is not always possible in practice. We propose lightweight automated detection and correction techniques against poisoning attacks, which are based on neuron pa…
Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院，清华大学）；School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）；Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）
Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition
School of Artificial Intelligence, Anhui University（安徽大学人工智能学院）；School of Computer Science and Technology, Anhui University（安徽大学计算机科学与技术学院）；National University of Defense Technology（国防科学技术大学）；Harbin Institute of Technology（哈尔滨工业大学）；Peng Cheng Laboratory（鹏城实验室）
Carnegie Mellon University（卡内基梅隆大学）；Tel Aviv University（特拉维夫大学）；VMware；Duke University（杜克大学）；NortonLifeLock Research Group（NortonLifeLock研究组）
Motivated by the transformative impact of deep neural networks (DNNs) in various domains, researchers and anti-virus vendors have proposed DNNs for malware detection from raw bytes that do not require manual feature engineering. In this work, we propose an attack that interweaves binary-diversification techniques and optimization frameworks to mislead such DNNs while preserving the functionality of binaries. Unlike prior attacks, ours manipulates instructions that are a functional part of the binary, which makes it particularly challenging to defend against. We evaluated our attack against thr…
