检索结果-内蒙古大学图书馆

Securely Fine-tuning Pre-trained Encoders Against Adversarial Examples

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Zhou, Ziqi Li, Minghui Liu, Wei Hu, Shengshan Zhang, Yechao Wan, Wei Xue, Lulu Zhang, Leo Yu Yao, Dezhong Jin, Hai National Engineering Research Center for Big Data Technology and System China Services Computing Technology and System Lab. China Cluster and Grid Computing Lab. China Hubei Engineering Research Center on Big Data Security China Hubei Key Laboratory of Distributed System Security China School of Computer Science and Technology Huazhong University of Science and Technology China School of Software Engineering Huazhong University of Science and Technology China School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Information and Communication Technology Griffith University Australia

With the evolution of self-supervised learning, the pre-training paradigm has emerged as a predominant solution within the deep learning landscape. Model providers furnish pre-trained encoders designed to function as versatile feature extractors, enabling downstream users to harness the benefits of expansive models with minimal effort through fine-tuning. Nevertheless, recent works have exposed a vulnerability in pre-trained encoders, highlighting their susceptibility to downstream-agnostic adversarial examples (DAEs) meticulously crafted by attackers. The lingering question pertains to the feasibility of fortifying the robustness of downstream models against DAEs, particularly in scenarios where the pre-trained encoders are publicly accessible to the attackers. In this paper, we initially delve into existing defensive mechanisms against adversarial examples within the pre-training paradigm. Our findings reveal that the failure of current defenses stems from the domain shift between pre-training data and downstream tasks, as well as the sensitivity of encoder parameters. In response to these challenges, we propose Genetic Evolution-Nurtured Adversarial Fine-tuning (Gen-AF), a two-stage adversarial fine-tuning approach aimed at enhancing the robustness of downstream models. Gen-AF employs a genetic-directed dual-track adversarial fine-tuning strategy in its first stage to effectively inherit the pre-trained encoder. This involves optimizing the pre-trained encoder and classifier separately while incorporating genetic regularization to preserve the model’s topology. In the second stage, Gen-AF assesses the robust sensitivity of each layer and creates a dictionary, based on which the top-k robust redundant layers are selected with the remaining layers held fixed. Upon this foundation, we conduct evolutionary adaptability fine-tuning to further enhance the model’s generalizability. Our extensive experiments, conducted across ten self-supervised training methods and six

关键词： Topology

Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency

学校读者我要写书评

暂无评论

arXiv 2023年

作者： Liu, Xiaogeng Li, Minghui Wang, Haoyu Hu, Shengshan Ye, Dengpan Jin, Hai Wu, Libing Xiao, Chaowei School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Computer Science and Technology Huazhong University of Science and Technology China School of Software Engineering Huazhong University of Science and Technology China National Engineering Research Center for Big Data Technology and System China Services Computing Technology and System Lab China Hubei Key Laboratory of Distributed System Security China Hubei Engineering Research Center on Big Data Security China Cluster and Grid Computing Lab China School of Cyber Science and Engineering Wuhan University China Arizona State University United States

Deep neural networks are proven to be vulnerable to backdoor attacks. Detecting the trigger samples during the inference stage, i.e., the test-time trigger sample detection, can prevent the backdoor from being triggered. However, existing detection methods often require the defenders to have high accessibility to victim models, extra clean data, or knowledge about the appearance of backdoor triggers, limiting their practicality. In this paper, we propose the test-time corruption robustness consistency evaluation (TeCo)1, a novel test-time trigger sample detection method that only needs the hard-label outputs of the victim models without any extra information. Our journey begins with the intriguing observation that the backdoor-infected models have similar performance across different image corruptions for the clean images, but perform discrepantly for the trigger samples. Based on this phenomenon, we design TeCo to evaluate test-time robustness consistency by calculating the deviation of severity that leads to predictions' transition across different corruptions. Extensive experiments demonstrate that compared with state-of-the-art defenses, which even require either certain information about the trigger types or accessibility of clean data, TeCo outperforms them on different backdoor attacks, datasets, and model architectures, enjoying a higher AUROC by 10% and 5 times of stability. Copyright © 2023, The Authors. All rights reserved.

关键词： Crime

Downstream-agnostic Adversarial Examples

学校读者我要写书评

暂无评论

arXiv 2023年

作者： Zhou, Ziqi Hu, Shengshan Zhao, Ruizhi Wang, Qian Zhang, Leo Yu Hou, Junhui Jin, Hai School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Computer Science and Technology Huazhong University of Science and Technology China School of Cyber Science and Engineering Wuhan University China School of Information and Communication Technology Griffith University Australia Department of Computer Science City University of Hong Kong Hong Kong National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Hubei Key Laboratory of Distributed System Security China Hubei Engineering Research Center on Big Data Security China Cluster and Grid Computing Lab

Self-supervised learning usually uses a large amount of unlabeled data to pre-train an encoder which can be used as a general-purpose feature extractor, such that downstream users only need to perform fine-tuning operations to enjoy the benefit of "large model". Despite this promising prospect, the security of pre-trained encoder has not been thoroughly investigated yet, especially when the pre-trained encoder is publicly available for commercial use. In this paper, we propose AdvEncoder, the first framework for generating downstream-agnostic universal adversarial examples based on the pre-trained encoder. AdvEncoder aims to construct a universal adversarial perturbation or patch for a set of natural images that can fool all the downstream tasks inheriting the victim pre-trained encoder. Unlike traditional adversarial example works, the pre-trained encoder only outputs feature vectors rather than classification labels. Therefore, we first exploit the high frequency component information of the image to guide the generation of adversarial examples. Then we design a generative attack framework to construct adversarial perturbations/patches by learning the distribution of the attack surrogate dataset to improve their attack success rates and transferability. Our results show that an attacker can successfully attack downstream tasks without knowing either the pre-training dataset or the downstream dataset. We also tailor four defenses for pre-trained encoders, the results of which further prove the attack ability of AdvEncoder. Our codes are available at: https://github. com/CGCL-codes/AdvEncoder. Copyright © 2023, The Authors. All rights reserved.

关键词： Machine learning

PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examples

学校读者我要写书评

暂无评论

arXiv 2022年

作者： Hu, Shengshan Zhang, Junwei Liu, Wei Hou, Junhui Li, Minghui Zhang, Leo Yu Jin, Hai Sun, Lichao School of Cyber Science and Engineering Huazhong University of Science and Technology China School of Computer Science and Technology Huazhong University of Science and Technology China School of Software Engineering Huazhong University of Science and Technology China Cluster and Grid Computing Lab China National Engineering Research Center for Big Data Technology and System Hubei Engineering Research Center on Big Data Security China Hubei Key Laboratory of Distributed System Security China Services Computing Technology and System Lab China City University of Hong Kong Hong Kong Deakin University Australia Lehigh University United States

Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example and the target point set to jointly explore the adversarial point clouds in the geometry space and the feature space. Furthermore, to launch a stealthier attack, we innovatively employ the neighbourhood density information to tailor the perturbation constraint, leading to geometry-aware and distribution-adaptive modification for each point. Extensive experiments against different premier point cloud completion networks show that PointCA can cause a performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01. We conclude that existing completion models are severely vulnerable to adversarial examples, and state-of-the-art defenses for point cloud classification will be partially invalid when applied to incomplete and uneven point cloud data. Copyright © 2022, The Authors. All rights reserved.

关键词： Deep neural networks

The Power of Bamboo: On the Post-Compromise Security for Searchable Symmetric Encryption

学校读者我要写书评

暂无评论

arXiv 2024年

作者： Chen, Tianyang Xu, Peng Picek, Stjepan Luo, Bo Susilo, Willy Jin, Hai Liang, Kaitai National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab China Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data Security School of Cyber Science and Engineering China Cluster and Grid Computing Lab School of Computer Science and Technology China Huazhong University of Science and Technology Wuhan430074 China Digital Security Group Radboud University Nijmegen Netherlands Department of EECS Institute of Information Sciences The University of Kansas LawrenceKS United States Institute of Cybersecurity and Cryptology School of Computing and Information Technology University of Wollongong WollongongNSW2522 Australia Faculty of Electrical Engineering Mathematics and Computer Science Delft University of Technology Delft2628 CD Netherlands

Dynamic searchable symmetric encryption (DSSE) enables users to delegate the keyword search over dynamically updated encrypted databases to an honest-but-curious server without losing keyword privacy. This paper studies a new and practical security risk to DSSE, namely, secret key compromise (e.g., a user’s secret key is leaked or stolen), which threatens all the security guarantees offered by existing DSSE schemes. To address this open problem, we introduce the notion of searchable encryption with key-update (SEKU) that provides users with the option of non-interactive key updates. We further define the notion of post-compromise secure with respect to leakage functions to study whether DSSE schemes can still provide data security after the client’s secret key is compromised. We demonstrate that post-compromise security is achievable with a proposed protocol called "Bamboo". Interestingly, the leakage functions of Bamboo satisfy the requirements for both forward and backward security. We conduct a performance evaluation of Bamboo using a real-world dataset and compare its runtime efficiency with the existing forward-and-backward secure DSSE schemes. The result shows that Bamboo provides strong security with better or comparable performance. © 2024, CC BY.

关键词： Bamboo

学校读者我要写书评

暂无评论

基于污点和概率的逃逸恶意软件多路径探索

Security and Safety 2023年第3期2卷 83-106页

作者：徐钫洲张网羌卫中金海 National Engineering Research Center for Big Data Technology and System Wuhan 430074China Services Computing Technology and System Lab Cluster and Grid Computing LabWuhan 430074China Hubei Key Laboratory of Distributed System Security Hubei Engineering Research Center on Big Data SecurityWuhan 430074China School of Cyber Science and Engineering Huazhong University of Science and TechnologyWuhan 430074China School of Computer Science and Technology Huazhong University of Science and TechnologyWuhan 430074China Jinyinhu Laboratory Wuhan 430040China

Static analysis is often impeded by malware obfuscation techniques,such as encryption and packing,whereas dynamic analysis tends to be more resistant to obfuscation by leveraging concrete execution ***,malware can employ evasive techniques to detect the analysis environment and alter its behavior *** known evasive techniques can be explicitly dismantled,the challenge lies in generically dismantling evasions without full knowledge of their conditions or implementations,such as logic bombs that rely on uncertain conditions,let alone unsupported evasive techniques,which contain evasions without corresponding dismantling strategies and those leveraging unknown *** this paper,we present Antitoxin,a prototype for automatically exploring evasive *** utilizes multi-path exploration guided by taint analysis and probability calculations to effectively dismantle evasive *** probabilities of branch execution are derived from dynamic coverage,while taint analysis helps identify paths associated with evasive techniques that rely on uncertain ***,Antitoxin prioritizes branches with lower execution probabilities and those influenced by taint analysis for multi-path *** is achieved through forced execution,which forcefully sets the outcomes of branches on selected ***,Antitoxin employs active anti-evasion countermeasures to dismantle known evasive techniques,thereby reducing exploration ***,Antitoxin provides valuable insights into sensitive behaviors,facilitating deeper manual *** experiments on a set of highly evasive samples demonstrate that Antitoxin can effectively dismantle evasive techniques in a generic *** probability calculations guide the multi-path exploration of evasions without requiring prior knowledge of their conditions or implementations,enabling the dismantling of unsupported techniques such as C2 and signific

关键词： Malware analysis dynamic binary instrumentation forced execution taint analysis evasion detection

A deep learning system for predicting time to progression of diabetic retinopathy

学校读者我要写书评

暂无评论

NATURE MEDICINE 2024年第2期30卷 358-359页

作者： [Anonymous] Shanghai Belt and Road International Joint Laboratory for Intelligent Prevention and Treatment of Metabolic Disorders Department of Computer Science and Engineering School of Electronic Information and Electrical Engineering Shanghai Jiao Tong University Department of Endocrinology and Metabolism Shanghai Sixth People’s Hospital Affiliated to Shanghai Jiao Tong University School of Medicine Shanghai Diabetes Institute Shanghai Clinical Center for Diabetes Shanghai China MOE Key Laboratory of AI School of Electronic Information and Electrical Engineering Shanghai Jiao Tong University Shanghai China Department of Ophthalmology Huadong Sanatorium Wuxi China Department of Ophthalmology Shanghai Sixth People’s Hospital Affiliated to Shanghai Jiao Tong University School of Medicine Shanghai China Department of Ophthalmology and Visual Sciences The Chinese University of Hong Kong Hong Kong China Singapore Eye Research Institute Singapore National Eye Centre Singapore Singapore Department of Computer Science and Engineering The Hong Kong University of Science and Technology Hong Kong China Department of Chemical and Biological Engineering The Hong Kong University of Science and Technology Hong Kong China State Key Laboratory of Ophthalmology Zhongshan Ophthalmic Center Sun Yat-sen University Guangdong Provincial Key Laboratory of Ophthalmology and Visual Science Guangzhou China Department of Ophthalmology Peking Union Medical College Hospital Peking Union Medical College Chinese Academy of Medical Sciences Beijing China Medical Records and Statistics Office Shanghai Sixth People’s Hospital Affiliated to Shanghai Jiao Tong University School of Medicine Shanghai China Department of Geriatrics Tongji Hospital Tongji Medical College Huazhong University of Science and Technology Wuhan China National Engineering Research Center for Big Data Technology and System Services Computing Technology and System Lab Cluster and Grid Computing Lab School of Computer Science and Tech

We developed and validated a deep learning system (termed DeepDR Plus) in a diverse, multiethnic, multi-country dataset to predict personalized risk and time to progression of diabetic retinopathy. We show that DeepDR Plus can be integrated into the clinical workflow to promote individualized intervention strategies for the management of diabetic retinopathy.

关键词： Diabetes complications Machine learning Predictive markers

学校读者我要写书评

暂无评论

高可扩展的RDF数据存储系统

高可扩展的RDF数据存储系统

第29届中国数据库学术会议

作者： Yuan Pingpeng 袁平鹏 Liu Pu 刘谱 Zhang Wenya 张文娅 Wu Buwen 吴步文 Key Laboratory of Services Computing Technology and System(Huazhong University of Science and Technology) Ministry of Education Wuhan 430074 服务计算技术与系统教育部重点实验室(华中科技大学) 武汉430074 Key Laboratory of Cluster and Grid Computing of Hubei Province(Huazhong University of Science and Technology)Wuhan 430074 集群与网格计算湖北省重点实验室(华中科技大学) 武汉430074 School of Computer Science and Technology Huazhong University of Science and Technology Wuhan 430074 华中科技大学计算机科学与技术学院武汉430074

由于资源描述框架(resource description framework,RDF)具有表达灵活、简洁等优点,已被接受为表达元数据及万维网上数据互联的规范.近年来,其数据量在以飞快的速度增长.相应地,要求存储RDF数据的系统应具有高扩展性.介绍了一个高可扩展... 详细信息

由于资源描述框架(resource description framework,RDF)具有表达灵活、简洁等优点,已被接受为表达元数据及万维网上数据互联的规范.近年来,其数据量在以飞快的速度增长.相应地,要求存储RDF数据的系统应具有高扩展性.介绍了一个高可扩展的RDF数据存储系统TripleBit.为尽可能降低存储空间消耗,采用了增量压缩和变长整数编码方法.并采用了数据分块的存储方法,既使得存储管理方便又使得存储结构紧凑,加速了数据读取.系统提供了基于启发式规则的动态查询计划生成方法,所产生的查询计划在执行过程中根据中间结果会相应作调整,以保持最优的执行顺序.对于多变量的查询,使用二步执行策略以减少查询过程中产生的中间结果.与目前流行RDF数据存储系统相比较,在存储空间上RDF-3X比TripleBit至少多40％；在查询性能上,比RDF-3X和MonetDB获得数倍的提升.

关键词：数据存储系统资源描述框架数据编码查询处理

学校读者我要写书评

暂无评论

大规模RDF数据库系统TripleBit

大规模RDF数据库系统TripleBit

第29届中国数据库学术会议

作者： Liu Pu 刘谱 Wang Jing 王晶 Yuan Pingpen 袁平鹏 Wu Buwen 吴步文 Key Laboratoty of Services Computing Technology and System (Huazhong University of Science and Technology) Ministry of Education Wuhan 430074 服务计算技术与系统教育部重点实验室(华中科技大学) 武汉430074 Key Laboratory of Cluster and Grid Computing of Hubei Province(Huazhong University of Science and Technology)Wuhan 430074 集群与网格计算湖北省重点实验室(华中科技大学) 武汉430074 School of Computer Science and Technology Huazhong University of Science and Technology Wuhan 430074 华中科技大学计算机科学与技术学院武汉430074

由于RDF(Resource Description Framework)具有表达灵活、简洁等优点,已被接受为表达元数据及万维网上数据互联的规范。近年来,其数据量以飞快的速度增长,相应地,要求存储RDF数据的系统应具有高扩展性。大规模RDF数据库系统TripleBit旨... 详细信息

由于RDF(Resource Description Framework)具有表达灵活、简洁等优点,已被接受为表达元数据及万维网上数据互联的规范。近年来,其数据量以飞快的速度增长,相应地,要求存储RDF数据的系统应具有高扩展性。大规模RDF数据库系统TripleBit旨在为大规模RDF数据提供一个高效的存储和查询方案。为尽可能降低存储空间消耗,采用了增量压缩和变长整数编码方法。并采用了数据分块的存储方法,既使得存储管理方便又使得存储结构紧凑,加速了数据读取。系统提供了基于启发式规则的动态查询计划生成方法。所产生的查询计划在执行过程中根据中间结果会相应作调整,以保持最优的执行顺序。对于多变量的查询,使用二步执行策略以减少查询过程中产生的中间结果。与当前著名系统RDF-3X相比,TripleBit具有较好的性能。

关键词：资源描述框架数据库系统优化设计应用框架查询处理