Towards Patch-Based Noise Compression for Adversarial Attack Against Transformer-Based Visual Tracking

The adversarial attack is a cutting-edge technique used to study the vulnerability of deep neural networks (DNNs). However, most existing studies focus on the additive perturbation-based attack, which cannot represent real-world corruption and limit their applications. In particular, haze is a common natural phenomenon that significantly corrupts an image, which inevitably poses a potential threat to deep models. In this work, for the first attempt, we study the effects of haze on DNNs from the perspective of adversarial attacks and propose two adversarial haze attack methods. We first propose the optimization-based adversarial haze attack (OAdvHaze) that optimizes the parameters of the atmospheric scattering model with the guidance of a DNN to synthesize a hazy image, which leads to a high attack success rate. To achieve a more efficient attack, we further propose a predictive adversarial haze attack (PAdvHaze) employing a DNN to predict the hazing parameters through a one-step way. To validate the effectiveness of both methods, we conducted extensive experiments on two publicly available datasets, i.e., ILSVRC 2012 and NIPS 2017. OAdvHaze and PAdvHaze achieve comparable attack success rates and transferability to state-of-the-art attacks. This work would contribute to the evaluation and enhancement of the robustness of DNNs against haze perturbation that may happen in the real world.

With the continuous development of deep learning in the field of Synthetic Aperture Radar (SAR) image processing, it is found that image recognition is vulnerable to interference and the accuracy is greatly reduced. Therefore, if a general adversarial attack method is designed to generate adversarial examples(AEs) capable of deceiving different types of convolutional neural network models, it can protect target images from being correctly recognized by adversaries and safeguard image privacy information. However, most of the current adversarial attack methods have too large attack scope and interference intensity, and do not have the ability to universally attack different neural network models, resulting in poor concealment, deception, and transfer deception of adversarial attacks. In this paper, we propose a general Key Points Sparse Attack (KPSA) method for SAR images, which achieves excellent deception and transfer deception while controlling the attack range and jamming strength. It is a general and efficient adversarial attack method. KPSA uses the generator to generate intensity interference images and imposes amplitude constraint, uses the key points extraction method to generate position interference images to realize sparse attack, uses the difference value(d-value) loss function to achieve fast convergence of the training model, and achieves transfer deception performance without depending on the type of discriminator. The deception rate and transfer deception rate experiments were conducted on MSTAR and ATRNet-STAR. By comparing with the advanced methods in the field of adversarial attacks, it was verified that the KPSA method is superior to the current advanced methods, and it was confirmed that the KPSA method has application value in various complex practical scenarios.

The goal of textual adversarial attack methods is to replace some words in an input text in order to make the victim model misbehave. This article proposes an effective word-level adversarial attack method based on sememes and an improved quantum-behaved particle swarm optimization (QPSO) algorithm. The sememe-based substitute method, which uses the words sharing the same sememes as the substitutes of the original words, is first employed to form the reduced search space. Then, an improved QPSO algorithm, called historical information-guided QPSO with random drift local attractor (HIQPSO-RD), is proposed to search the reduced search space for adversarial examples. The HIQPSO-RD introduces historical information into the current mean best position of the QPSO, for the purpose of improving the convergence speed of the algorithm, by enhancing its exploration ability and preventing the premature convergence of the swarm. The proposed algorithm uses the random drift local attractor technique to make a good balance between its exploration and exploitation, so that the algorithm can find a better adversarial attack example with low grammaticality and perplexity (PPL). In addition, it employs a two-stage diversity control strategy to enhance the search performance of the algorithm. Experiments on three natural language processing (NLP) datasets, with three commonly used nature language processing models as victim models, show that our method achieves higher attack success rates but lower modification rates than the state-of-the-art adversarial attack methods. Moreover, the results of human evaluations show that adversarial examples generated by our method can better maintain the semantic similarity and grammatical correctness of the original input.

The challenge of classifying multimodal remote sensing images has garnered significant interest in light of the growing diversity of remote sensing image data modalities. Current studies primarily concentrate on increasing the classification task’s accuracy by improving the fusion strategy or incorporating auxiliary architectures. However, there is currently a lack of research in the area of adversarial attack for multimodal remote sensing image classification models as compared to the study of unimodal classification models. To overcome this issue, our research firstly investigates the adversarial robustness of multimodal remote sensing image classification under different fusion strategies, which adopts the improved classical adversarial attack methods to test the adversarial robustness of multimodal remote sensing image classification model architectures with three different fusion strategies; Then a new multimodal adversarial attack method is proposed for the multimodal model, which adopts balanced perturbation loss and cooperative adversarial loss, in which the balanced perturbation loss is used to balance the level of perturbation of different modalities, and the cooperative adversarial loss is used to reduce the conflict of different modality perturbations on the classification result. By combining balanced perturbation loss and cooperative adversarial loss to attack multimodal models, the cooperation between modalities is continuously optimized.Finally, the study demonstrates the weak adversarial robustness of the multimodal remote sensing image classification model, which robustness is easily influenced by the fusion strategies and the attack methods. Additionally, a better attack effect is obtained by the multimodal multiloss cooperative adversarial attack method proposed in this paper.

Adversarial examples: A survey of attacks and defenses in deep learning-enabled cybersecurity systems

Deep learning has revolutionized image recognition. One significant obstacle still remains, the vulnerability of these models to adversarial attacks. These attacks manipulate images with subtle changes that cause CNN misclassification. While methods, such as adversarial training, have been proposed to defend against adversarial attacks, they incur additional training costs, either extra input samples or auxiliary models. In this work, we propose an efficient approach to deploying robust models that utilize image transformations to remove adversarial noises. We investigate the performance of simple transformations and report several effective ones, including Affine blur, Gaussian blur, Median blur, and Bilateral blur against various adversarial attack methods, such as Fast Gradient Sign Method (FGSM), Randomized + FGSM (RFGSM), and Projected Gradient Descent (PGD). We apply these image transformation techniques to the widely used ImageNet dataset, and experimental results demonstrate the potential of image transformation methods as a strong defense against adversarial attacks in deep learning-based image classification systems, especially when combined with cutting-edge neural network architectures such as ResNet50 and DenseNet121. Our comprehensive results show that these transformations can significantly improve the robustness of CNN models against adversarial attacks on ImageNet, achieving a recovery rate of up to 85% to 90% without incurring extra resource costs.

It has been shown that there exist small and image-independent perturbations, called universal perturbations, that can fool deep-learning-based classifiers, resulting in a significant decrease in classification accuracy. In this paper, we propose a novel method to compute more effective universal perturbations via enhanced projected gradient descent on targeted classifiers. By maximizing the original loss function of the targeted model, we update the adversarial example with back-propagation and optimize the perturbation by accumulating small updates on perturbed images consecutively. We generate our attack for several modern CNN classifiers using ImageNet and compare the attack performance with other state-of-the-art universal adversarial attack methods. Performance results show that our proposed adversarial attack method can achieve much higher fooling rates as compared to state-of-the-art universal adversarial attack methods and can realize good generalization on cross-model evaluation.

EnsembleFool: A method to generate adversarial examples based on model fusion strategy

Recently, adversarial attacks have shown to lead the state-of-the-art deep neural networks (DNNs) to misclassification. However, most adversarial attacks are generated according to whether they are perceptual to human visual system, measured by geometric metrics such as the l2-norm, which ignores the common watermarks in cyber-physical systems. In this paper, we propose a fast adversarial watermark attack (FAWA) method based on fast differential evolution technique, which optimally superimposes a watermark on an image to fool DNNs. We also attempt to explain the reason why the attack is successful and propose two hypotheses on the vulnerability of DNN classifiers and the influence of the watermark attack on higher-layer features extraction respectively. In addition, we propose two countermeasure methods against FAWA based on random rotation and median filtering respectively. Experimental results show that our method achieves 41.3% success rate in fooling VGG-16 and have good transferability. Our approach is also shown to be effective in deceiving deep learning as a service (DLaaS) systems as well as the physical world. The proposed FAWA, hypotheses, and the countermeasure methods, provide a timely help for DNN designers to gain some knowledge of model vulnerability while designing DNN classifiers and related DLaaS applications.

Explanation-Guided Adversarial Example Attacks

In adversarial attacks, most existing methods adopt global attack methods, which attack by changing all image pixels, but this is not realistic. On the contrary, sparse attacks indicate that only perturbing local regions of the input image can deceive DNN models into making incorrect predictions. However, this method requires a large number of queries to generate adversarial examples, and the key issues it faces are locating the perturbation area and optimizing the magnitude of the perturbation. Currently, generating high-quality adversarial examples and improving query efficiency in restricted environments is a challenge for black-box attacks. In this paper, we propose a sparse black-box attack method based on the Active Subspace Evolution Strategy AS-ES , which locates the active subspace of the input image through the multi-arm bandit method, and uses the Covariance Matrix Adaptive Evolution Strategy algorithm for perturbation search in the low-dimensional subspace. We model this problem as a bi-level optimization problem, optimizing both the perturbation position and magnitude to generate high-quality adversarial examples while achieving efficient attacks. We conducted extensive experiments on multiple datasets and verified that the AS-ES method generates adversarial examples with higher quality and query efficiency than existing state-of-the-art attack methods.

Resisting the adversarial sample attack on encrypted traffic is a challenging task in the Intelligent Transportation System. This paper focuses on the classification, adversarial samples attack and defense method for the encrypted traffic. To be more specific, the one-dimensional encrypted traffic data is firstly translated into the two-dimensional images for further utilization. Then different classification networks based on the deep learning algorithm are adopted to classify the encrypted traffic data. Moreover, various adversarial sample generation methods are employed to generate the adversarial sample to implement the attacking process on the classification network. Furthermore, the passive and active defense method are proposed to resist the adversarial sample attack: 1) the passive defense is used to denoise the perturbation in the adversarial sample and to restore to the original image; and 2) the active defense is used to resist the adversarial sample attack by leveraging the adversarial training method, which can improve the robustness of the classification network. We conduct the extensive experiments on the ISCXVPN2016 dataset to evaluate the effectiveness of classification, adversarial sample attacking and defending.

State-of-the-art neural network models are actively used in various fields, but it is well-known that they are vulnerable to adversarial example attacks. Throughout the efforts to make the models robust against adversarial example attacks, it has been found to be a very difficult task. While many defense approaches were shown to be not effective, adversarial training remains as one of the promising methods. In adversarial training, the training data are augmented by “adversarial” samples generated using an attack algorithm. If the attacker uses a similar attack algorithm to generate adversarial examples, the adversarially trained network can be quite robust to the attack. However, there are numerous ways of creating adversarial examples, and the defender does not know what algorithm the attacker may use. A natural question is: Can we use adversarial training to train a model robust to multiple types of attack? Previous work have shown that, when a network is trained with adversarial examples generated from multiple attack methods, the network is still vulnerable to white-box attacks where the attacker has complete access to the model parameters. In this paper, we study this question in the context of black-box attacks, which can be a more realistic assumption for practical applications. Experiments with the MNIST dataset show that adversarially training a network with an attack method helps defending against that particular attack method, but has limited effect for other attack methods. In addition, even if the defender trains a network with multiple types of adversarial examples and the attacker attacks with one of the methods, the network could lose accuracy to the attack if the attacker uses a different data augmentation strategy on the target network. These results show that it is very difficult to make a robust network using adversarial training, even for black-box settings where the attacker has restricted information on the target network.

DiffProtect: Generative adversarial examples using diffusion models for facial privacy protection

Deep neural networks(DNNs) are widely used in AI-controlled Cyber-Physical Systems (CPS) to controll cars, robotics, water treatment plants and railways. However, DNNs have vulnerabilities to well-designed input samples that are called adversarial examples. Adversary attack is one of the important techniques for detecting and improving the security of neural networks. Existing attacks, including state-of-the-art black-box attack have a lower success rate and make invalid queries that are not beneficial to obtain the direction of generating adversarial examples. For these reasons, this paper proposed a CMA-ES-based adversarial attack on black-box DNNs. Firstly, an efficient method to reduce the number of invalid queries is introduced. Secondly, a black-box attack of generating adversarial examples to fit a high-dimensional independent Gaussian distribution of the local solution space is proposed. Finally, a new CMA-based perturbation compression method is applied to make the process of reducing perturbation smoother. Experimental results on ImageNet classifiers show that the proposed attack has a higher success-rate than the state-of-the-art black-box attack but reduce the number of queries by 30% equally.