Deep learning algorithms have been recently targeted by attackers due to their vulnerability. Several research studies have been conducted to address this issue and build more robust deep learning models. Non-continuous deep models are still not robust against adversarial, where most of the recent studies have focused on developing attack techniques to evade the learning process of the models. One of the main reasons behind the vulnerability of such models is that a learning classifier is unable to slightly predict perturbed samples. To address this issue, we propose a novel objective/loss function, the so-called marginal contrastive, which enforces the features to lie under a specified margin to facilitate their prediction using deep convolutional networks (i.e., Char-CNN). Extensive experiments have been conducted on continuous cases (e.g., UNSW NB15 dataset) and discrete ones (i.e, eight-large-scale datasets [32]) to prove the effectiveness of the proposed method. The results revealed that the regularization of the learning process based on the proposed loss function can improve the performance of Char-CNN.
At present, backdoor attacks attract attention as they do great harm to deep learning models. The adversary poisons the training data making the model being injected with a backdoor after being trained unconsciously by victims using the poisoned dataset. In the field of text, however, existing works do not provide sufficient defense against backdoor attacks. In this paper, we propose a Noise-augmented Contrastive Learning (NCL) framework to defend against textual backdoor attacks when training models with untrustworthy data. With the aim of mitigating the mapping between triggers and the targe…
Contrastive learning pre-trains an image encoder using a large amount of unlabeled data such that the image encoder can be used as a general-purpose feature extractor for various downstream tasks. In this work, we propose PoisonedEncoder, a data poisoning attack to contrastive learning. In particular, an attacker injects carefully crafted poisoning inputs into the unlabeled pre-training data, such that the downstream classifiers built based on the poisoned encoder for multiple target downstream tasks simultaneously classify attacker-chosen, arbitrary clean inputs as attacker-chosen, arbitrary …
Defending Against Backdoor Attacks via Alignment Checking in Model-Contrastive Federated Learning
Shandong Computer Science Center（山东计算机科学中心）；Qilu University of Technology (Shandong Academy of Sciences)（齐鲁工业大学（山东省科学院））；College of computer science and technology, China University of Petroleum（中国石油大学计算机科学与技术学院）；School of Computer Science and Engineering, University of Electronic Science and Technology of China（电子科技大学计算机科学与工程学院）；Big Data Institute, Qilu University of Technology（齐鲁工业大学大数据研究院）
InverTune: Removing Backdoors from Multimodal Contrastive Learning Models via Trigger Inversion and Activation Tuning
1 School of Cyber Science；Engineering, Wuhan University 0.3em 2 School of Computer Science, Wuhan University 0.3em 3 Institute for Math \& AI, Wuhan University
REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）；IBM Research（IBM研究院）
University of Illinois at Chicago（伊利诺伊大学芝加哥分校）；NEC Laboratories America（美国NEC实验室）
Graph neural network (GNN), as a powerful representation learning model on graph data, attracts much attention across various disciplines. However, recent studies show that GNN is vulnerable to adversarial attacks. How to make GNN more robust? What are the key vulnerabilities in GNN? How to address the vulnerabilities and defense GNN against the adversarial attacks? In this paper, we propose DefNet, an effective adversarial defense framework for GNNs. In particular, we first investigate the latent vulnerabilities in every layer of GNNs and propose corresponding strategies including dual-stage …
American University of Beirut (AUB)（贝鲁特美国大学）；University of New Haven（纽黑文大学）
Recently published attacks against deep neural networks (DNNs) have stressed the importance of methodologies and tools to assess the security risks of using this technology in critical systems. Efficient techniques for detecting adversarial machine learning helps establishing trust and boost the adoption of deep learning in sensitive and security systems. In this paper, we propose a new technique for defending deep neural network classifiers, and convolutional ones in particular. Our defense is cheap in the sense that it requires less computation power despite a small cost to pay in terms of d…
Federated recommendation (FedRec) can train personalized recommenders without collecting user data, but the decentralized nature makes it susceptible to poisoning attacks. Most previous studies focus on the targeted attack to promote certain items, while the untargeted attack that aims to degrade the overall performance of the FedRec system remains less explored. In fact, untargeted attacks can disrupt the user experience and bring severe financial loss to the service provider. However, existing untargeted attack methods are either inapplicable or ineffective against FedRec systems. In this pa…
Deep neural networks are vulnerable to Trojan attacks. Existing attacks use visible patterns (e.g., a patch or image transformations) as triggers, which are vulnerable to human inspection. In this paper, we propose stealthy and efficient Trojan attacks, BppAttack. Based on existing biology literature on human visual systems, we propose to use image quantization and dithering as the Trojan trigger, making imperceptible changes. It is a stealthy and efficient attack without training auxiliary models. Due to the small changes made to images, it is hard to inject such triggers during training. To …
Buffer is All You Need: Defending Federated Learning against Backdoor Attacks under Non-iids via Buffering
Miner School of Computer and Information Sciences, University of Massachusetts Lowell（马萨诸塞大学洛厄尔分校迈纳计算机与信息科学学院）；University of South Florida（南佛罗里达大学）；University of Kentucky（肯塔基大学）；Purdue University（普渡大学）；North Carolina State University（北卡罗来纳州立大学）
CISPA Helmholtz Center for Information Security（亥姆霍兹信息安全中心）；Salesforce Research（赛富比研究）
Self-supervised representation learning techniques have been developing rapidly to make full use of unlabeled images. They encode images into rich features that are oblivious to downstream tasks. Behind their revolutionary representation power, the requirements for dedicated model designs and a massive amount of computation resources expose image encoders to the risks of potential model stealing attacks - a cheap way to mimic the well-trained encoder performance while circumventing the demanding requirements. Yet conventional attacks only target supervised classifiers given their predicted lab…
In today's integrated circuit (IC) ecosystem, owning a foundry is not economically viable, and therefore most IC design houses are now working under a fabless business model. In order to overcome security concerns associated with the outsorcing of IC fabrication, the Split Manufacturing technique was proposed. In Split Manufacturing, the Front End of Line (FEOL) layers (transistors and lower metal layers) are fabricated at an untrusted high-end foundry, while the Back End of Line (BEOL) layers (higher metal layers) are manufactured at a trusted low-end foundry. This approach hides the BEOL con…
Optimal transport (OT) based distributional robust optimisation (DRO) has received some traction in the recent past. However, it is at a nascent stage but has a sound potential in robustifying the deep learning models. Interestingly, OT barycenters demonstrate a good robustness against adversarial attacks. Owing to the computationally expensive nature of OT barycenters, they have not been investigated under DRO framework. In this work, we propose a new barycenter, namely Beckman barycenter, which can be computed efficiently and used for training the network to defend against adversarial attack…
Flordia International University（佛罗里达国际大学）；Northeastern University（东北大学）
Image compression-based approaches for defending against the adversarial-example attacks, which threaten the safety use of deep neural networks (DNN), have been investigated recently. However, prior works mainly rely on directly tuning parameters like compression rate, to blindly reduce image features, thereby lacking guarantee on both defense efficiency (i.e. accuracy of polluted images) and classification accuracy of benign images, after applying defense methods. To overcome these limitations, we propose a JPEG-based defensive compression framework, namely "feature distillation", to effectiv…
Deep Learning Model Security: Threats and Defenses
Xi’an Jiaotong-Liverpool University（西交利物浦大学）；Indiana University（印第安纳大学）；The University of Texas at Dallas（德州大学达拉斯分校）；Purdue University（普渡大学）；National Tsing Hua University（国立清华大学）；National Taiwan Normal University（国立台湾师范大学）；Hong Kong University of Science and Technology（香港科技大学）；University of Hawaii（夏威夷大学）；AppCubic；Kyoto University（京都大学）；Georgia Institute of Technology（佐治亚理工学院）；Rutgers University（罗格斯大学）；National University of Singapore（新加坡国立大学）；Pingtan Research Institute of Xiamen University（厦门大学平潭研究院）；University of Manchester（曼彻斯特大学）；Aarhus University（奥胡斯大学）；Imperial College London（伦敦帝国学院）；School of Visual Arts（视觉艺术学院）；Zhejiang University（浙江大学）；University of Edinburgh（爱丁堡大学）
Self-supervised learning in computer vision aims to pre-train an image encoder using a large amount of unlabeled images or (image, text) pairs. The pre-trained image encoder can then be used as a feature extractor to build downstream classifiers for many downstream tasks with a small amount of or no labeled training data. In this work, we propose BadEncoder, the first backdoor attack to self-supervised learning. In particular, our BadEncoder injects backdoors into a pre-trained image encoder such that the downstream classifiers built based on the backdoored image encoder for different downstre…
While great progress has been made at making neural networks effective across a wide range of visual tasks, most models are surprisingly vulnerable. This frailness takes the form of small, carefully chosen perturbations of their input, known as adversarial examples, which represent a security threat for learned vision models in the wild -- a threat which should be responsibly defended against in safety-critical applications of computer vision. In this paper, we advocate for and experimentally investigate the use of a family of logit regularization techniques as an adversarial defense, which ca…
Naval Center for Applied Research in Artificial Intelligence（海军人工智能应用研究中心）；U.S. Naval Research Laboratory（美国海军研究实验室）
Adversarial attacks and defenses are currently active areas of research for the deep learning community. A recent review paper divided the defense approaches into three categories; gradient masking, robust optimization, and adversarial example detection. We divide gradient masking and robust optimization differently: (1) increasing intra-class compactness and inter-class separation of the feature vectors improves adversarial robustness, and (2) marginalization or removal of non-robust image features also improves adversarial robustness. By reframing these topics differently, we provide a fresh…
AgentRAE: Remote Action Execution through Notification-based Visual Backdoors against Screenshots-based Mobile GUI Agents
Nanjing University of Science and Technology（南京理工大学）；Macquarie University（麦考瑞大学）；Western Sydney University（西澳大学）；University of Hong Kong（香港大学）；CSIRO’s Data61（澳大利亚CSIRO Data61）
ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；School of Cyber Science and Technology, Beihang University（北京航空航天大学网络空间安全学院）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）
R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning
University of Science and Technology of China（中国科学技术大学）；NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；University of Chinese Academy of Sciences（中国科学院大学）
ToxicTextCLIP: Text-Based Poisoning and Backdoor Attacks on CLIP Pre-training
School of Computer Science and Engineering, Central South University（中南大学计算机科学与工程学院）；Miner School of Computer & Information Sciences, University of Massachusetts Lowell（马萨诸塞大学洛厄尔分校Miner计算机与信息科学学院）
