Adversarial Deep Learning in EEG Biometrics.

Learning an effective distance measurement between sample pairs plays an important role in visual analysis, where the training procedure largely relies on hard negative samples. However, hard negative samples usually account for the tiny minority in the training set, which may fail to fully describe the data distribution close to the decision boundary. In this paper, we present a deep adversarial metric learning (DAML) framework to generate synthetic hard negatives from the original negative samples, which is widely applicable to existing supervised deep metric learning algorithms. Different from existing sampling strategies which simply ignore numerous easy negatives, our DAML aim to exploit them by generating synthetic hard negatives adversarial to the learned metric as complements. We simultaneously train the feature embedding and hard negative generator in an adversarial manner, so that adequate and targeted synthetic hard negatives are created to learn more precise distance metrics. As a single transformation may not be powerful enough to describe the global input space under the attack of the hard negative generator, we further propose a deep adversarial multi-metric learning (DAMML) method by learning multiple local transformations for more complete description. We simultaneously exploit the collaborative and competitive relationships among multiple metrics, where the metrics display unity against the generator for effective distance measurement as well as compete for more training data through a metric discriminator to avoid overlapping. Extensive experimental results on five benchmark datasets show that our DAML and DAMML effectively boost the performance of existing deep metric learning approaches through adversarial learning.

This book provided an overview of the field of adversarial machine learning. Important issues were clearly left out, some deliberately to simplify exposition, others perhaps unintentionally. The field has become quite active in recent years in no small measure due to the attention that attacks on deep learning methods have received. While we devote an entire chapter solely to adversarial deep learning, we emphasize that proper understanding of these necessitates a broader look at adversarial learning that the rest of the book provides.

Despite the great success, existing regression clustering methods based on shallow models are vulnerable due to: (1) They often pay no attention to the combination between learning representations and clustering, thus resulting in unsatisfactory clustering performance. (2) They ignore the relationship of data distribution and target distribution such that those methods are noise and illumination-change sensitive. (3) These nonlinear regression methods usually impose the hard constraint to minimize the mismatch between the discrete cluster assignment matrix and latent representations, which leads to over-fitting. In this paper, we utilize deep adversarial regression to tackle these problems and formulate regression based clustering by deep adversarial learning (RCDA). By seamlessly combining with the stacked autoencoder, the proposed model integrates learning deep nonlinear latent representation and clustering in a unified framework. Specifically, RCDA uses a kind of relax constraint between latent representations and continuous cluster assignment matrix to avoid over-fitting, and simultaneously utilizes the t-SNE algorithm and adversarial learning to analyze data distribution and target distribution so that improve representations learning. Experimental results on public benchmark datasets demonstrate that the proposed architecture achieves better performance than state-of-the-art clustering models in image clustering task.

The design of a new therapeutic agent is a time-consuming and expensive process. The rise of machine intelligence provides a grand opportunity of expeditiously discovering novel drug candidates through smart search in the vast molecular structural space. In this paper, we propose a new approach called adversarial deep evolutionary learning (ADEL) to search for novel molecules in the latent space of an adversarial generative model and keep improving the latent representation space. In ADEL, a custom-made adversarial autoencoder (AAE) model is developed and trained under a deep evolutionary learning (DEL) process. This involves an initial training of the AAE model, followed by an integration of multi-objective evolutionary optimization in the continuous latent representation space of the AAE rather than the discrete structural space of molecules. By using the AAE, an arbitrary distribution can be provided to the training of AAE such that the latent representation space is set to that distribution. This allows for a starting latent space from which new samples can be produced. Throughout the process of learning, new samples of high-quality are generated after each iteration of training and then added back into the full dataset. Therefore, allowing for a more comprehensive procedure of understanding the data structure. This combination of evolving data and continuous learning not only enables improvement in the generative model, but the data as well. By comparing ADEL to the previous work in DEL, we see that ADEL can obtain better property distributions.

Machine learning (ML) provides effective means to learn from spectrum data and solve complex tasks involved in wireless communications. Supported by recent advances in computational resources and algorithmic designs, deep learning (DL) has found success in performing various wireless communication tasks such as signal recognition, spectrum sensing and waveform design. However, ML in general and DL in particular have been found vulnerable to manipulations thus giving rise to a field of study called adversarial machine learning (AML). Although AML has been extensively studied in other data domains such as computer vision and natural language processing, research for AML in the wireless communications domain is still in its early stage. This paper presents a comprehensive review of the latest research efforts focused on AML in wireless communications while accounting for the unique characteristics of wireless systems. First, the background of AML attacks on deep neural networks is discussed and a taxonomy of AML attack types is provided. Various methods of generating adversarial examples and attack mechanisms are also described. In addition, an holistic survey of existing research on AML attacks for various wireless communication problems as well as the corresponding defense mechanisms in the wireless domain are presented. Finally, as new attacks and defense techniques are developed, recent research trends and the overarching future outlook for AML in next-generation wireless communications are discussed.

Adversarial deep reinforcement learning based robust depth tracking control for underactuated autonomous underwater vehicle

Path-based multi-hop reasoning over knowledge graph for answering questions via adversarial reinforcement learning

Conversational agents are getting more popular and applied in a wide range of practical application areas. The main task of these agents is not only to generate context-appropriate responses to a given query but also to make the conversation human-like. Thanks to the ability of deep learning based models in natural language modeling, recent studies have made progress in designing conversational agents that can provide more semantically accurate responses. However, the naturalness in such conversation setting has not been given adequate attention in these studies. This paper aims to incorporate both important criteria of accuracy and naturalness of conversation in developing a new model for conversational agents. To this end, inspired by the idea of Turing test and the idea of adversarial learning strategy, we propose to design a model based on generative deep neural networks that interestingly allow to generate accurate responses optimized by the mechanics of imitating human-generated conversations. Experimental results demonstrate that the proposed models produce more natural and accurate responses, yielding significant gains in BLEU scores.

Data-driven deep learning tasks for security related applications are gaining increasing popularity and achieving impressive performances. This thesis investigates adversarial vulnerabilities of such tasks in order to establish secure and reliable machine learning systems. Adversary attacks aim to extract private data from a model of a task and misguide the model so it yields wrong results or an answer desired by the attacker. This thesis studies potential adversarial attacks that may affect an existing deep learning model of a specific task. Novel approaches that expose security vulnerabilities of four typical deep learning models in three dominant tasks (i.e., matching, classification and regression) are developed. These models include image hashing for image authentication and retrieval, fake face imagery forensic detection, image classification and single object tracking. In the first model, image hashing converts images into codes that are supposed to be non-invertible. However, we prove that this can pose image privacy concerns, and propose two deep learning de-hashing neural networks to show that we can obtain high quality images that are inverted from given image hashes. In the second model, we address fake face image detection. Fake images that can escape an adversarial attacked detector are usually degraded versions of original images. We analyze the visual degradation in such face images, and show how to design attacks that result in visually imperceptible adversarial images. For the image classification model, instead of the conventionally employed visual distortion metric, we propose the use of perceptual models as a novel measure for adversarial example generation. We then propose two sets of attack methods that can generally be incorporated into all existing gradient-based attacks. Lastly, for the single object tracking model, we propose the concept of universally and physically feasible attacks on visual object tracking in real-world settings. We develop a novel attack framework and experimentally demonstrate the feasibility of the proposed concept. The adversarial explorations and examples provided in this thesis show how existing deep learning tasks and their models could be vulnerable to malicious attacks. This would help researchers design more secure and trustworthy models for digital media security and forensics.

We study two important concepts in adversarial deep learning---adversarial training and generative adversarial network (GAN). Adversarial training is the technique used to improve the robustness of discriminator by combining adversarial attacker and discriminator in the training phase. GAN is commonly used for image generation by jointly optimizing discriminator and generator. We show these two concepts are indeed closely related and can be used to strengthen each other---adding a generator to the adversarial training procedure can improve the robustness of discriminators, and adding an adversarial attack to GAN training can improve the convergence speed and lead to better generators. Combining these two insights, we develop a framework called Rob-GAN to jointly optimize generator and discriminator in the presence of adversarial attacks---the generator generates fake images to fool discriminator; the adversarial attacker perturbs real images to fool the discriminator, and the discriminator wants to minimize loss under fake and adversarial images. Through this end-to-end training procedure, we are able to simultaneously improve the convergence speed of GAN training, the quality of synthetic images, and the robustness of discriminator under strong adversarial attacks. Experimental results demonstrate that the obtained classifier is more robust than the state-of-the-art adversarial training approach, and the generator outperforms SN-GAN on ImageNet-143.

Generalized Wireless Adversarial Deep Learning

Since labeled data availability differs greatly across domains, Domain Adaptation focuses on learning in new and unfamiliar domains by reducing distribution divergence. Recent research suggests that the adversarial learning approach could be a promising way to achieve the domain adaptation objective. Adversarial learning is a strategy for learning domain-transferable features in robust deep networks. This paper introduces the TSAL paradigm, a two-step adversarial learning framework. It addresses the real-world problem of text classification, where source domain(s) has labeled data but target domain (s) has only unlabeled data. TSAL utilizes joint adversarial learning with class information and domain alignment deep network architecture to learn both domain-invariant and domain-specific features extractors. It consists of two training steps that are similar to the paradigm, in which pre-trained model weights are used as initialization for training with new data. TSAL’s two training phases, however, are based on the same data, not different data, as is the case with fine-tuning. Furthermore, TSAL only uses the learned domain-invariant feature extractor from the first training as an initialization for its peer in subsequent training. By doubling the training, TSAL can emphasize the leverage of the small unlabeled target domain and learn effectively what to share between various domains. A detailed analysis of many benchmark datasets reveals that our model consistently outperforms the prior art across a wide range of dataset distributions.

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system

The lack of training samples is one of the main factors affecting the development of deep learning methods. Deep learning models often fail to learn useful features and have serious over-fitting problems when lacking of training data. In this work, we exploit two popular unsupervised learning techniques: adversarial learning and self-supervised learning, which is aimed at mine more useful representations and relieve over-fitting problems. Our training scheme is mainly divided into three steps. Firstly, we train a self-supervision network with unsupervised learning to extract obvious features from our liver lesion samples and these features will be transferred to next step. Secondly, we use the final output feature map generated by self-supervision network to train a discriminator by adversarial learning. Finally, the backbone network is trained under the constraint of discriminator and classifier. Our main idea is to train a discriminator with adversarial learning and self-supervised learning. Then, we use the discriminator to constrain the backbone network, which is aimed to reduce the backbone network solution search space. In particular, Different from generating data with GAN, we use GAN to feature adversarial learning for feature augmentation. Our experiments on liver lesion classification in CT show an average accuracy as 92.51% compared with the baseline training scheme, which demonstrates our proposed method can mime useful features and relieve over-fitting problem. It can assist physicians in the early detection and treatment of liver lesions.KeywordsSelf-supervised learningAdversarial learningLiver lesions

Human voices contain a significant number of sources of variability. This fact can result in speaker's intrinsic characteristics, such as gender, age, accent, and other extrinsic characteristics, such as the acoustic environment, severely interfering with the performance of different speech technology applications. Along the years, several proposals have been developed in the area of speech technologies to tackle the impact of these undesired sources of variability. There is clearly a need to build robust speech representations that avoid these undesired factors, which are one of the reasons for complexity when speech applications are developed. One of these approaches is domain adaptation which has been proposed to learn a mapping between different domains, reducing the gap that may exist between them. With the rapid advances in Deep Learning, new methods for robust speech representations are being proposed. The concept of adversarial learning necessitates the creation of an intermediate latent space representation, which is invariant to a specific domain. This method formulates a minimization-maximization problem, where a primary learning optimization task is combined with a secondary domain classification task, which is optimized to perform badly. The main objective of this Thesis is to contribute to the research on supervised adversarial learning within Deep Neural Networks, as a powerful way to obtain speech features discriminant to the application task, and invariant to undesired sources of variability. This goal was planned to attempt to solve the limitations of speech technologies in three different areas of application: i) the assessment of obstructive sleep apnea from speech, where the target is to model robust apnea-related representations by suppressing the undesirable effect of other patient characteristics, such age or obesity; ii) speech privacy preservation, by developing a state-of-the-art anonymization system to model speaker-invariant representations by removing personal identifiable information, such as gender or accent; and iii) automatic speech recognition to build robust speech representations invariant to challenging acoustic conditions in TV shows. The experimental results proved that adversarial learning contributes to improve the peri formance in the three analyzed speech applications: increasing the accuracy of the obstructive sleep apnea assessment after removing speaker's body mass index; obtaining high level of speech privacy and good intelligibility, being one of the best methods in the state-of-the art; and finally, achieving slight improvements in automatic speech recognition but yielding promising results to continue its exploration. Thus, the specific objectives of this Thesis can be considered fulfilled. Main contributions of this PhD Thesis resulted in several publications in Journals with JCR and peer-reviewed conferences. Three of them, each one related to the aforementioned speech applications, are advocated for the compendium presentation of this Thesis according to the requirements demanded by the Universidad Politécnica de Madrid. An additional, but no less significant, contribution is an in-depth review of the state-ofthe-art adversarial learning techniques, which leads us to study the evolution of this technique, helping us to determine that it is a competitive approach to develop domain-invariant features in speech applications. Asimismo, me gustaría agradecer a los revisores de esta tesis, su tiempo y predisposición, para mejorar la calidad de esta memoria, y por las valoraciones presentadas. Dr. Rubén San Segundo, Dra. Ascensión Gallardo, y Dr. Doroteo Torre, gracias. Mi agradecimiento a todos los miembros de Sigma Technologies y Tax Planning, especialmente al Dr. Daniel Tapias, quién apoyó el inicio de este camino dentro de la empresa. A Javier, eterno compañero, con el que hice los primeros pinitos en un congreso. A Richard, por su tiempo y ayuda revisando esta memoria escrita en su idioma natal. A Rafael, quien me dio la oportunidad de tutorizar su TFM y aprender juntos. Y a todos aquellos antiguos compañeros que se han quedado con un sitio de amigo/a. Siempre guardo una mención especial para mi amigo Fulgencio, un hermano, gracias por tu apoyo y tus consejos a lo largo de estos años. Gracias también a mis amigos David, Guille, Mario, Raúl, Ángel y Jorge, la mayoría de ellos han convertido mis viernes de regreso a Madrid, en una cita obligada. vii No pueden faltar los integrantes de la familia del "Alcobendas United": Marco, Isma, Robert, Nando, Diego, Rodri, Miguel, Jose, Raúl. Siempre dispuestos a repartir alegría en la jornada del domingo. A los de siempre: Álvaro, Rubén, Nacho y Sergio. Seguimos creciendo juntos. Y a María R., con quien la distancia no es un obstáculo para mantenerse actualizados. Tampoco quiero olvidarme de los que llegaron no hace mucho, pero han contribuido a que Tarragona se convierta en nuestra casa: Arantxa,