2020 IEEE Security and Privacy Workshops (SPW)最新文献_第6页

Backdooring and Poisoning Neural Networks with Image-Scaling Attacks 用图像缩放攻击后门和毒害神经网络

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-03-19 DOI: 10.1109/SPW50608.2020.00024

Erwin Quiring, Konrad Rieck

{"title":"Backdooring and Poisoning Neural Networks with Image-Scaling Attacks","authors":"Erwin Quiring, Konrad Rieck","doi":"10.1109/SPW50608.2020.00024","DOIUrl":"https://doi.org/10.1109/SPW50608.2020.00024","url":null,"abstract":"Backdoors and poisoning attacks are a major threat to the security of machine-learning and vision systems. Often, however, these attacks leave visible artifacts in the images that can be visually detected and weaken the efficacy of the attacks. In this paper, we propose a novel strategy for hiding backdoor and poisoning attacks. Our approach builds on a recent class of attacks against image scaling. These attacks enable manipulating images such that they change their content when scaled to a specific resolution. By combining poisoning and image-scaling attacks, we can conceal the trigger of backdoors as well as hide the overlays of clean-label poisoning. Furthermore, we consider the detection of image-scaling attacks and derive an adaptive attack. In an empirical evaluation, we demonstrate the effectiveness of our strategy. First, we show that backdoors and poisoning work equally well when combined with image-scaling attacks. Second, we demonstrate that current detection defenses against image-scaling attacks are insufficient to uncover our manipulations. Overall, our work provides a novel means for hiding traces of manipulations, being applicable to different poisoning approaches.","PeriodicalId":413600,"journal":{"name":"2020 IEEE Security and Privacy Workshops (SPW)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-03-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129681191","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 53

Minimum-Norm Adversarial Examples on KNN and KNN based Models KNN和基于KNN模型的最小范数对抗例子

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-03-14 DOI: 10.1109/SPW50608.2020.00023

Chawin Sitawarin, David A. Wagner

引用次数: 13

Trusted Confidence Bounds for Learning Enabled Cyber-Physical Systems 可信赖的学习网络物理系统的置信限

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-03-11 DOI: 10.1109/SPW50608.2020.00053

Dimitrios Boursinos, X. Koutsoukos

引用次数: 9

Out-of-Distribution Detection in Multi-Label Datasets using Latent Space of β-VAE 基于β-VAE潜空间的多标签数据的分布外检测

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-03-10 DOI: 10.1109/SPW50608.2020.00057

V. Sundar, Shreyas Ramakrishna, Zahra Rahiminasab, A. Easwaran, Abhishek Dubey

{"title":"Out-of-Distribution Detection in Multi-Label Datasets using Latent Space of β-VAE","authors":"V. Sundar, Shreyas Ramakrishna, Zahra Rahiminasab, A. Easwaran, Abhishek Dubey","doi":"10.1109/SPW50608.2020.00057","DOIUrl":"https://doi.org/10.1109/SPW50608.2020.00057","url":null,"abstract":"Learning Enabled Components (LECs) are widely being used in a variety of perceptions based autonomy tasks like image segmentation, object detection, end-to-end driving, etc. These components are trained with large image datasets with multimodal factors like weather conditions, time-of-day, traffic-density, etc. The LECs learn from these factors during training, and while testing if there is variation in any of these factors, the components get confused resulting in low confidence predictions. Those images with factor values, not seen, during training are commonly referred to as Out-of-Distribution (OOD). For safe autonomy, it is important to identify the OOD images, so that a suitable mitigation strategy can be performed. Classical one-class classifiers like SVM and SVDD are used to perform OOD detection. However, multiple labels attached to images in these datasets restrict the direct application of these techniques. We address this problem using the latent space of the $beta$ -Variational Autoencoder ($beta$ -VAE). We use the fact that compact latent space generated by an appropriately selected $beta$ - VAE will encode the information about these factors in a few latent variables, and that can be used for quick and computationally inexpensive detection. We evaluate our approach on the nuScenes dataset, and our results show the latent space of $beta$ - VAE is sensitive to encode changes in the values of the generative factor.","PeriodicalId":413600,"journal":{"name":"2020 IEEE Security and Privacy Workshops (SPW)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-03-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129916724","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

On the Robustness of Cooperative Multi-Agent Reinforcement Learning 协同多智能体强化学习的鲁棒性研究

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-03-08 DOI: 10.1109/SPW50608.2020.00027

Jieyu Lin, Kristina Dzeparoska, S. Zhang, A. Leon-Garcia, Nicolas Papernot

{"title":"On the Robustness of Cooperative Multi-Agent Reinforcement Learning","authors":"Jieyu Lin, Kristina Dzeparoska, S. Zhang, A. Leon-Garcia, Nicolas Papernot","doi":"10.1109/SPW50608.2020.00027","DOIUrl":"https://doi.org/10.1109/SPW50608.2020.00027","url":null,"abstract":"In cooperative multi-agent reinforcement learning (c-MARL), agents learn to cooperatively take actions as a team to maximize a total team reward. We analyze the robustness of c-MARL to adversaries capable of attacking one of the agents on a team. Through the ability to manipulate this agent's observations, the adversary seeks to decrease the total team reward. Attacking c-MARL is challenging for three reasons: first, it is difficult to estimate team rewards or how they are impacted by an agent mispredicting; second, models are non-differentiable; and third, the feature space is low-dimensional. Thus, we introduce a novel attack. The attacker first trains a policy network with reinforcement learning to find a wrong action it should encourage the victim agent to take. Then, the adversary uses targeted adversarial examples to force the victim to take this action. Our results on the StartCraft II multi-agent benchmark demonstrate that c-MARL teams are highly vulnerable to perturbations applied to one of their agent's observations. By attacking a single agent, our attack method has highly negative impact on the overall team reward, reducing it from 20 to 9.4. This results in the team's winning rate to go down from 98.9% to 0%.","PeriodicalId":413600,"journal":{"name":"2020 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-03-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130153408","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 43

Partially Observable Games for Secure Autonomy* 安全自治的部分可观察博弈*

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-02-05 DOI: 10.1109/SPW50608.2020.00046

M. Ahmadi, A. Viswanathan, M. Ingham, K. Tan, A. Ames

引用次数: 1

On the Feasibility of Acoustic Attacks Using Commodity Smart Devices 利用商品智能设备进行声学攻击的可行性研究

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-01-20 DOI: 10.1109/SPW50608.2020.00031

Matt Wixey, Shane Johnson, Emiliano De Cristofaro

引用次数: 4

Adversarial Machine Learning-Industry Perspectives 对抗性机器学习——行业视角

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-01-20 DOI: 10.2139/ssrn.3532474

R. Kumar, Magnus Nyström, J. Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, Sharon Xia

引用次数: 160

The Geometry of Syntax and Semantics for Directed File Transformations 定向文件转换的语法和语义几何

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2020-01-14 DOI: 10.1109/SPW50608.2020.00062

Steve Huntsman, Michael Robinson

引用次数: 0

SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems 哨兵:检测针对深度学习系统的局部通用攻击

2020 IEEE Security and Privacy Workshops (SPW) Pub Date : 2018-12-02 DOI: 10.1109/SPW50608.2020.00025

Edward Chou, Florian Tramèr, Giancarlo Pellegrino

{"title":"SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems","authors":"Edward Chou, Florian Tramèr, Giancarlo Pellegrino","doi":"10.1109/SPW50608.2020.00025","DOIUrl":"https://doi.org/10.1109/SPW50608.2020.00025","url":null,"abstract":"SentiNet is a novel detection framework for localized universal attacks on neural networks. These attacks restrict adversarial noise to contiguous portions of an image and are reusable with different images-constraints that prove useful for generating physically-realizable attacks. Unlike most other works on adversarial detection, SentiNet does not require training a model or preknowledge of an attack prior to detection. Our approach is appealing due to the large number of possible mechanisms and attack-vectors that an attack-specific defense would have to consider. By leveraging the neural network's susceptibility to attacks and by using techniques from model interpretability and object detection as detection mechanisms, SentiNet turns a weakness of a model into a strength. We demonstrate the effectiveness of SentiNet on three different attacks-i.e., data poisoning attacks, trojaned networks, and adversarial patches (including physically realizable attacks)-and show that our defense is able to achieve very competitive performance metrics for all three threats. Finally, we show that SentiNet is robust against strong adaptive adversaries, who build adversarial patches that specifically target the components of SentiNet's architecture.","PeriodicalId":413600,"journal":{"name":"2020 IEEE Security and Privacy Workshops (SPW)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-12-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128094367","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 187