ADDITION: Detecting Adversarial Examples With Image-Dependent Noise Reduction

INOR—An Intelligent noise reduction method to defend against adversarial audio examples

Generating adversarial examples via enhancing latent spatial features of benign traffic and preserving malicious functions

Automatic diagnosis based on clinical notes has become a popular research field recently, and many proposed deep learning models have achieved competitive performance in diseases inference. However, previous research reveals that deep learning models are susceptible to negligibly perturbed inputs named adversarial examples, which contradicts with the safety and reliability requirements of the medical domain. To analyze the vulnerability and robustness of current automatic diagnosis models, we investigate in the generation of adversarial text examples. The main challenges for generating adversarial text examples are divided into three parts. First, the word embedding space is discrete, which makes it hard to perturb as small as adversarial image examples generation. Second, previous adversarial example generation methods focus mainly on multi-class classification models, while automatic diagnosis is a multi-label classification task. Third, the semantic and medical meaning of clinical notes are vital in disease inference, and even small perturbations can change them to a large extent. In this paper, we address the three main challenges and propose Clinical-Attacker, a general framework for both white-box and black-box adversarial text examples generation against automatic diagnosis models. Experimental results on MIMIC-III dataset demonstrate that our framework can easily alter the predictions of automatic diagnosis models with the semantic and medical meaning preserved.

Deep neural networks, which can learn the representative and discriminative features from data in a hierarchical manner, have achieved state-of-the-art performance in the remote sensing scene classification task. Despite the great success that deep learning algorithms have obtained, their vulnerability toward adversarial examples deserves our special attention. In this article, we systematically analyze the threat of adversarial examples on deep neural networks for remote sensing scene classification. Both targeted and untargeted attacks are performed to generate subtle adversarial perturbations, which are imperceptible to a human observer but may easily fool the deep learning models. Simply adding these perturbations to the original high-resolution remote sensing (HRRS) images, adversarial examples can be generated, and there are only slight differences between the adversarial examples and the original ones. An intriguing discovery in our study shows that most of these adversarial examples may be misclassified into the wrong category by the state-of-the-art deep neural networks with very high confidence. This phenomenon, undoubtedly, may limit the practical deployment of these deep learning models in the safety-critical remote sensing field. To address this problem, the adversarial training strategy is further investigated in this article, which significantly increases the resistibility of deep models toward adversarial examples. Extensive experiments on three benchmark HRRS image data sets demonstrate that while most of the well-known deep neural networks are sensitive to adversarial perturbations, the adversarial training strategy helps to alleviate their vulnerability toward adversarial examples.

Most deep neural networks are vulnerable to adversarial attacks, making it crucial to develop effective defenses against them. Adversarial examples are created by applying slight perturbations either to the entire image or specific regions, depending on attack methods. By contrast, benign examples typically lead models to focus attention on contiguous regions of the image during classification. Therefore, adversarial examples can be detected effectively by leveraging attention values. First, we conduct simple experiment to investigate how the model’s attention responds to adversarial perturbations. Second, we derive features by calculating the changes in attention values across ViT layers for adversarial and benign examples. These attention-derived features are then fed into the detection model, ResNet-50, to learn the differences in the activation locations between both examples. Third, we demonstrate the effectiveness of our approach by thorough experiments on various attack methods, datasets, and target models. The experiments prove the effectiveness of our approach, achieving superior performance compared to baseline methods on the ImageNet dataset across ViT-B and ViT-L. Our findings underscore the potential of utilizing attention-derived features as powerful indicators for enhancing the resilience of ViT models against adversarial perturbations.

The threat posed by adversarial examples (AEs) to deep learning applications has garnered significant attention from the academic community. In response, various defense strategies have been proposed, including adversarial example detection. A range of detection algorithms has been developed to differentiate between benign samples and adversarial examples. However, the detection accuracy of these algorithms is significantly influenced by the characteristics of the adversarial attacks, such as attack type and intensity. Furthermore, the impact of image preprocessing on detection robustness-a common step before adversarial example generation-has been largely overlooked in prior research. To address these challenges, this paper introduces a novel adversarial example detection algorithm based on high-level feature differences (HFDs), which is specifically designed to improve robustness against both attacks and preprocessing operations. For each test image, a counterpart image with the same predicted label is randomly selected from the training dataset. The high-level features of both images are extracted using an encoder and compared through a similarity measurement model. If the feature similarity is low, the test image is classified as an adversarial example. The proposed method was evaluated for detection accuracy against four comparison methods, showing significant improvements over FS, DF, and MD, with a performance comparable to ESRM. Therefore, the subsequent robustness experiments focused exclusively on ESRM. Our results demonstrate that the proposed method exhibits superior robustness against preprocessing operations, such as downsampling and common corruptions, applied by attackers before generating adversarial examples. It is also applicable to various target models. By exploiting semantic conflicts in high-level features between clean and adversarial examples with the same predicted label, the method achieves high detection accuracy across diverse attack types while maintaining resilience to preprocessing, providing a valuable new perspective in the design of adversarial example detection algorithms.

Remove adversarial perturbations with linear and nonlinear image filters

AdvOps: Decoupling adversarial examples

With intentional feature perturbations to a deep learning model, the adversary generates an adversarial example to deceive the deep learning model. As an adversarial example has recently been considered in the most severe problem of deep learning technology, its defense methods have been actively studied. Such effective defense methods against adversarial examples are categorized into one of the three architectures: (1) model retraining architecture; (2) input transformation architecture; and (3) adversarial example detection architecture. Especially, defense methods using adversarial example detection architecture have been actively studied. This is because defense methods using adversarial example detection architecture do not make wrong decisions for the legitimate input data while others do. In this paper, we note that current defense methods using adversarial example detection architecture can classify the input data into only either a legitimate one or an adversarial one. That is, the current defense methods using adversarial example detection architecture can only detect the adversarial examples and cannot classify the input data into multiple classes of data, i.e., legitimate input data and various types of adversarial examples. To classify the input data into multiple classes of data while increasing the accuracy of the clustering model, we propose an advanced defense method using adversarial example detection architecture, which extracts the key features from the input data and feeds the extracted features into a clustering model. From the experimental results under various application datasets, we show that the proposed method can detect the adversarial examples while classifying the types of adversarial examples. We also show that the accuracy of the proposed method outperforms the accuracy of recent defense methods using adversarial example detection architecture.

Quantum machine learning explores the interplay between machine learning and quantum physics, which may lead to unprecedented perspectives for both fields. In fact, recent works have shown strong evidence that quantum computers could outperform classical computers in solving certain notable machine learning tasks. Yet, quantum learning systems may also suffer from the vulnerability problem: adding a tiny carefully crafted perturbation to the legitimate input data would cause the systems to make incorrect predictions at a notably high confidence level. In this paper, we study the universality of adversarial examples and perturbations for quantum classifiers. Through concrete examples involving classifications of real-life images and quantum phases of matter, we show that there exist universal adversarial examples that can fool a set of different quantum classifiers. We prove that, for a set of k classifiers with each receiving input data of n qubits, an O(ln [k]/2 n ) increase of the perturbation strength is enough to ensure a moderate universal adversarial risk. In addition, for a given quantum classifier, we show that there exist universal adversarial perturbations, which can be added to different legitimate samples to make them adversarial examples for the classifier. Our results reveal the universality perspective of adversarial attacks for quantum machine learning systems, which would be crucial for practical applications of both near-term and future quantum technologies in solving machine learning problems.

Reversible adversarial example (RAE) is an effective cutting‐edge technology for protecting the intellectual property (IP) of datasets. However, existing RAE schemes primarily focus on the adversarial and restoration capabilities of adversarial examples (AE), with little attention paid to traceability, which is crucial for IP protection. This oversight leads to the inability to prevent authorized users from redistributing data, thereby posing significant IP security risks. To address this issue, we propose a novel approach named TAE‐RWP, wherein adversarial perturbations in AEs are treated as tools for IP verification. To enable the traceability of AEs, we introduce varying degrees of warping to the adversarial perturbations within the AEs of authorized users, utilizing the warping degree as a traceable feature. To further strengthen traceability, we adopt a technique named “random warping” to maintain the resilience of adversarial perturbations against distortions, and employ a strategy named “noise mode” to improve the verification model’s capacity to recognize distortion features. Experimental results indicate that AEs generated by TAE‐RWP exhibit remarkable adversarial strength and restoration abilities, while the verification model demonstrates excellence in recognizing distortion features.

Negatively correlated ensemble against transfer adversarial attacks

Adversarial malware examples refer to the malwares that can evade the malware detector. Researching adversarial malware examples can help us find the vulnerability of malware detector and improve the defense ability of cyberspace. Considering the huge market share of android system, adversarial malware examples of android are studied in this paper. And an algorithm is proposed to find universal adversarial perturbations of malware. Such perturbation can be inserted the different malwares to generate adversarial examples. Then the effectiveness of algorithm is verified in the experiment. And three classic android malware detectors are used as targets. Experimental results show that universal adversarial perturbations for different machine learning models can be discovered via the proposed algorithm.KeywordsAdversarial malware examplesUniversal adversarial perturbationsAndroid platform

Deep learning models face significant security threats from adversarial attacks, which can mislead model predictions by introducing subtle perturbations to input images. Existing adversarial example detection methods often suffer from limited detection accuracy and poor generalization capabilities. To address these challenges, we propose AEAED (Attention-Enhanced Autoencoder for Adversarial Example Detection with Multi-Scale Feature Learning), a novel detection model that integrates Transformer's multi-head self-attention mechanism into an autoencoder framework, significantly enhancing the model's ability to capture both global and local image features. AEAED comprises three key components: (1) a multi-scale attention encoder that combines convolutional layers' local feature extraction capabilities with self-attention mechanisms for global dependency modeling, improving sensitivity to adversarial perturbations; (2) an adaptive reconstruction decoder that leverages multi-head self-attention mechanisms to achieve high-quality image reconstruction; and (3) a comprehensive reconstruction error calculation method that integrates pixel-level errors and feature layer discrepancies, coupled with an adaptive threshold strategy for adversarial example detection. Experimental results on the CIFAR-10 dataset demonstrate that AEAED significantly outperforms existing baseline models, including MagNet, DAGMM, and SafetyNet, across multiple evaluation metrics. Notably, when detecting FGSM adversarial examples generated using the Swin Transformer, the model achieves an accuracy of 87.10%, a recall of 85.40%, and an AUC-ROC value of 0.89, while reducing the false positive rate to 0.08. These results conclusively validate the effectiveness and superiority of the proposed method in adversarial example detection tasks.

Deep Convolutional Networks (DCNs) have been shown to be vulnerable to adversarial examples---perturbed inputs specifically designed to produce intentional errors in the learning algorithms at test time. Existing input-agnostic adversarial perturbations exhibit interesting visual patterns that are currently unexplained. In this paper, we introduce a structured approach for generating Universal Adversarial Perturbations (UAPs) with procedural noise functions. Our approach unveils the systemic vulnerability of popular DCN models like Inception v3 and YOLO v3, with single noise patterns able to fool a model on up to 90% of the dataset. Procedural noise allows us to generate a distribution of UAPs with high universal evasion rates using only a few parameters. Additionally, we propose Bayesian optimization to efficiently learn procedural noise parameters to construct inexpensive untargeted black-box attacks. We demonstrate that it can achieve an average of less than 10 queries per successful attack, a 100-fold improvement on existing methods. We further motivate the use of input-agnostic defences to increase the stability of models to adversarial perturbations. The universality of our attacks suggests that DCN models may be sensitive to aggregations of low-level class-agnostic features. These findings give insight on the nature of some universal adversarial perturbations and how they could be generated in other applications.