在没有解密的情况下对加密数据进行神经网络推断是一种流行的方法，可以使隐私神经网络（PNET）作为服务。与用于机器学习的常规神经网络相比，PNET需要额外的编码，例如量化精确数字和多项式激活。加密输入还引入了新颖的挑战，例如对抗性鲁棒性和安全性。据我们所知，我们是第一个研究问题，包括（i）PNET是否比常规神经网络对对抗性输入更强大？ （ii）如何在没有解密的情况下设计强大的PNET？我们建议使用PNET攻击来生成黑框对抗示例，这些示例可以成功攻击目标和非目标方式。攻击结果表明，需要改进针对对抗输入的PNET鲁棒性。这不是一项琐碎的任务，因为PNET模型所有者无法访问输入值的明文，这阻止了现有检测和防御方法的应用，例如输入调整，模型归一化和对抗性培训。为了应对这一挑战，我们提出了一种新的快速准确的噪声插入方法，称为RPNET，以设计强大的私人神经网络。我们的综合实验表明，PNET-ITSTACK比先前的工作减少了至少$ 2.5 \ times $的查询。我们从理论上分析了我们的RPNET方法，并证明RPNET可以降低$ \ sim 91.88 \％$ $攻击成功率。

虽然深度神经网络在各种任务中表现出前所未有的性能，但对对抗性示例的脆弱性阻碍了他们在安全关键系统中的部署。许多研究表明，即使在黑盒设置中也可能攻击，其中攻击者无法访问目标模型的内部信息。大多数黑匣子攻击基于查询，每个都可以获得目标模型的输入输出，并且许多研究侧重于减少所需查询的数量。在本文中，我们注意了目标模型的输出完全对应于查询输入的隐含假设。如果将某些随机性引入模型中，它可以打破假设，因此，基于查询的攻击可能在梯度估计和本地搜索中具有巨大的困难，这是其攻击过程的核心。从这种动机来看，我们甚至观察到一个小的添加剂输入噪声可以中和大多数基于查询的攻击和名称这个简单但有效的方法小噪声防御（SND）。我们分析了SND如何防御基于查询的黑匣子攻击，并展示其与CIFAR-10和ImageNet数据集的八种最先进的攻击有效性。即使具有强大的防御能力，SND几乎保持了原始的分类准确性和计算速度。通过在推断下仅添加一行代码，SND很容易适用于预先训练的模型。

We propose the Square Attack, a score-based black-box l2and l∞-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized squareshaped updates at random positions so that at each iteration the perturbation is situated approximately at the boundary of the feasible set. Our method is significantly more query efficient and achieves a higher success rate compared to the state-of-the-art methods, especially in the untargeted setting. In particular, on ImageNet we improve the average query efficiency in the untargeted setting for various deep networks by a factor of at least 1.8 and up to 3 compared to the recent state-ofthe-art l∞-attack of Al-Dujaili & OReilly (2020). Moreover, although our attack is black-box, it can also outperform gradient-based white-box attacks on the standard benchmarks achieving a new state-of-the-art in terms of the success rate. The code of our attack is available at https://github.com/max-andr/square-attack.

随着现实世界图像的大小不同，机器学习模型是包括上游图像缩放算法的较大系统的一部分。在本文中，我们研究了基于决策的黑框设置中图像缩放过程的漏洞与机器学习模型之间的相互作用。我们提出了一种新颖的采样策略，以端到端的方式使黑框攻击利用漏洞在缩放算法，缩放防御和最终的机器学习模型中。基于这种缩放感知的攻击，我们揭示了大多数现有的缩放防御能力在下游模型的威胁下无效。此外，我们从经验上观察到，标准的黑盒攻击可以通过利用脆弱的缩放程序来显着提高其性能。我们进一步在具有基于决策的黑盒攻击的商业图像分析API上证明了这个问题。

Video compression plays a crucial role in video streaming and classification systems by maximizing the end-user quality of experience (QoE) at a given bandwidth budget. In this paper, we conduct the first systematic study for adversarial attacks on deep learning-based video compression and downstream classification systems. Our attack framework, dubbed RoVISQ, manipulates the Rate-Distortion ($\textit{R}$-$\textit{D}$) relationship of a video compression model to achieve one or both of the following goals: (1) increasing the network bandwidth, (2) degrading the video quality for end-users. We further devise new objectives for targeted and untargeted attacks to a downstream video classification service. Finally, we design an input-invariant perturbation that universally disrupts video compression and classification systems in real time. Unlike previously proposed attacks on video classification, our adversarial perturbations are the first to withstand compression. We empirically show the resilience of RoVISQ attacks against various defenses, i.e., adversarial training, video denoising, and JPEG compression. Our extensive experimental results on various video datasets show RoVISQ attacks deteriorate peak signal-to-noise ratio by up to 5.6dB and the bit-rate by up to $\sim$ 2.4$\times$ while achieving over 90$\%$ attack success rate on a downstream classifier. Our user study further demonstrates the effect of RoVISQ attacks on users' QoE.

Although deep neural networks (DNNs) have achieved great success in many tasks, they can often be fooled by adversarial examples that are generated by adding small but purposeful distortions to natural examples. Previous studies to defend against adversarial examples mostly focused on refining the DNN models, but have either shown limited success or required expensive computation. We propose a new strategy, feature squeezing, that can be used to harden DNN models by detecting adversarial examples. Feature squeezing reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with that on squeezed inputs, feature squeezing detects adversarial examples with high accuracy and few false positives.This paper explores two feature squeezing methods: reducing the color bit depth of each pixel and spatial smoothing. These simple strategies are inexpensive and complementary to other defenses, and can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks.

The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision boundary. The proposed family includes both untargeted and targeted attacks optimized for 2 and ∞ similarity metrics respectively. Theoretical analysis is provided for the proposed algorithms and the gradient direction estimate. Experiments show HopSkipJumpAttack requires significantly fewer model queries than several state-of-the-art decision-based adversarial attacks. It also achieves competitive performance in attacking several widely-used defense mechanisms.

深度神经网络（DNNS）的广泛应用要求越来越多的关注对其现实世界的鲁棒性，即DNN是否抵抗黑盒对抗性攻击，其中包括基于得分的查询攻击（SQA）是最威胁性的。由于它们的实用性和有效性：攻击者只需要在模型输出上进行数十个查询即可严重伤害受害者网络。针对SQA的防御需要对用户的服务目的而略有但巧妙的输出变化，这些用户与攻击者共享相同的输出信息。在本文中，我们提出了一种称为统一梯度（UNIG）的现实世界防御，以统一不同数据的梯度，以便攻击者只能探究不同样本相似的较弱的攻击方向。由于这种普遍的攻击扰动的验证与投入特定的扰动相比，Unig通过指示攻击者一个扭曲且信息不足的攻击方向来保护现实世界中的DNN。为了增强Unig在现实世界应用中的实际意义，我们将其实现为Hadamard产品模块，该模块具有计算效率且很容易插入任何模型。根据对5个SQA和4个防御基线的广泛实验，Unig显着改善了现实世界的鲁棒性，而不会伤害CIFAR10和Imagenet上的清洁准确性。例如，Unig在2500 Query Square攻击下保持了77.80％精度的CIFAR-10模型，而最先进的对手训练的模型仅在CIFAR10上具有67.34％的速度。同时，Unig在清洁精度和输出的修改程度上大大超过了所有基准。代码将发布。

最近的研究表明，深神经网络（DNN）易受对抗的对抗性斑块，这引入了对输入的可察觉而且局部化的变化。尽管如此，现有的方法都集中在图像上产生对抗性补丁，视频中的对应于视频的探索。与图像相比，攻击视频更具挑战性，因为它不仅需要考虑空间线索，而且需要考虑时间线索。为了缩短这种差距，我们在本文中介绍了一种新的对抗性攻击，子弹屏幕评论（BSC）攻击，攻击了BSC的视频识别模型。具体地，通过增强学习（RL）框架产生对抗性BSC，其中环境被设置为目标模型，并且代理商扮演选择每个BSC的位置和透明度的作用。通过不断查询目标模型和接收反馈，代理程序逐渐调整其选择策略，以实现具有非重叠BSC的高鬼速。由于BSC可以被视为一种有意义的补丁，将它添加到清洁视频不会影响人们对视频内容的理解，也不会引起人们的怀疑。我们进行广泛的实验，以验证所提出的方法的有效性。在UCF-101和HMDB-51数据集中，我们的BSC攻击方法可以在攻击三个主流视频识别模型时达到约90 \％的愚蠢速率，同时仅在视频中封闭\无文无线8 \％区域。我们的代码可在https://github.com/kay -ck/bsc-attack获得。

尽管机器学习系统的效率和可扩展性，但最近的研究表明，许多分类方法，尤其是深神经网络（DNN），易受对抗的例子;即，仔细制作欺骗训练有素的分类模型的例子，同时无法区分从自然数据到人类。这使得在安全关键区域中应用DNN或相关方法可能不安全。由于这个问题是由Biggio等人确定的。 （2013）和Szegedy等人。（2014年），在这一领域已经完成了很多工作，包括开发攻击方法，以产生对抗的例子和防御技术的构建防范这些例子。本文旨在向统计界介绍这一主题及其最新发展，主要关注对抗性示例的产生和保护。在数值实验中使用的计算代码（在Python和R）公开可用于读者探讨调查的方法。本文希望提交人们将鼓励更多统计学人员在这种重要的令人兴奋的领域的产生和捍卫对抗的例子。

In a membership inference attack, an attacker aims to infer whether a data sample is in a target classifier's training dataset or not. Specifically, given a black-box access to the target classifier, the attacker trains a binary classifier, which takes a data sample's confidence score vector predicted by the target classifier as an input and predicts the data sample to be a member or non-member of the target classifier's training dataset. Membership inference attacks pose severe privacy and security threats to the training dataset. Most existing defenses leverage differential privacy when training the target classifier or regularize the training process of the target classifier. These defenses suffer from two key limitations: 1) they do not have formal utility-loss guarantees of the confidence score vectors, and 2) they achieve suboptimal privacy-utility tradeoffs.In this work, we propose MemGuard, the first defense with formal utility-loss guarantees against black-box membership inference attacks. Instead of tampering the training process of the target classifier, MemGuard adds noise to each confidence score vector predicted by the target classifier. Our key observation is that attacker uses a classifier to predict member or non-member and classifier is vulnerable to adversarial examples. Based on the observation, we propose to add a carefully crafted noise vector to a confidence score vector to turn it into an adversarial example that misleads the attacker's classifier. Specifically, MemGuard works in two phases. In Phase I, MemGuard finds a carefully crafted noise vector that can turn a confidence score vector into an adversarial example, which is likely to mislead the attacker's classifier to make a random guessing at member or non-member. We find such carefully crafted noise vector via a new method that we design to incorporate the unique utility-loss constraints on the noise vector. In Phase II, Mem-Guard adds the noise vector to the confidence score vector with a certain probability, which is selected to satisfy a given utility-loss budget on the confidence score vector. Our experimental results on

深度神经网络（DNNS）在各种方案中对对抗数据敏感，包括黑框方案，在该方案中，攻击者只允许查询训练有素的模型并接收输出。现有的黑框方法用于创建对抗性实例的方法是昂贵的，通常使用梯度估计或培训替换网络。本文介绍了\ textit {Attackar}，这是一种基于分数的进化，黑框攻击。 Attackar是基于一个新的目标函数，可用于无梯度优化问题。攻击仅需要访问分类器的输出徽标，因此不受梯度掩蔽的影响。不需要其他信息，使我们的方法更适合现实生活中的情况。我们使用三个基准数据集（MNIST，CIFAR10和Imagenet）使用三种不同的最先进模型（Inception-V3，Resnet-50和VGG-16-BN）测试其性能。此外，我们评估了Attackar在非分辨率转换防御和最先进的强大模型上的性能。我们的结果表明，在准确性得分和查询效率方面，攻击性的表现出色。

Current neural network-based classifiers are susceptible to adversarial examples even in the black-box setting, where the attacker only has query access to the model. In practice, the threat model for real-world systems is often more restrictive than the typical black-box model where the adversary can observe the full output of the network on arbitrarily many chosen inputs. We define three realistic threat models that more accurately characterize many real-world classifiers: the query-limited setting, the partialinformation setting, and the label-only setting. We develop new attacks that fool classifiers under these more restrictive threat models, where previous methods would be impractical or ineffective. We demonstrate that our methods are effective against an ImageNet classifier under our proposed threat models. We also demonstrate a targeted black-box attack against a commercial classifier, overcoming the challenges of limited query access, partial information, and other practical issues to break the Google Cloud Vision API.

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

已知深度学习系统容易受到对抗例子的影响。特别是，基于查询的黑框攻击不需要深入学习模型的知识，而可以通过提交查询和检查收益来计算网络上的对抗示例。最近的工作在很大程度上提高了这些攻击的效率，证明了它们在当今的ML-AS-A-Service平台上的实用性。我们提出了Blacklight，这是针对基于查询的黑盒对抗攻击的新防御。推动我们设计的基本见解是，为了计算对抗性示例，这些攻击在网络上进行了迭代优化，从而在输入空间中产生了非常相似的图像查询。 Blacklight使用在概率内容指纹上运行的有效相似性引擎来检测高度相似的查询来检测基于查询的黑盒攻击。我们根据各种模型和图像分类任务对八次最先进的攻击进行评估。 Blacklight通常只有几次查询后，都可以识别所有这些。通过拒绝所有检测到的查询，即使攻击者在帐户禁令或查询拒绝之后持续提交查询，Blacklight也可以防止任何攻击完成。 Blacklight在几个强大的对策中也很强大，包括最佳的黑盒攻击，该攻击近似于效率的白色框攻击。最后，我们说明了黑光如何推广到其他域，例如文本分类。

Vertical federated learning (VFL) is an emerging paradigm that enables collaborators to build machine learning models together in a distributed fashion. In general, these parties have a group of users in common but own different features. Existing VFL frameworks use cryptographic techniques to provide data privacy and security guarantees, leading to a line of works studying computing efficiency and fast implementation. However, the security of VFL's model remains underexplored.

Video classification systems are vulnerable to adversarial attacks, which can create severe security problems in video verification. Current black-box attacks need a large number of queries to succeed, resulting in high computational overhead in the process of attack. On the other hand, attacks with restricted perturbations are ineffective against defenses such as denoising or adversarial training. In this paper, we focus on unrestricted perturbations and propose StyleFool, a black-box video adversarial attack via style transfer to fool the video classification system. StyleFool first utilizes color theme proximity to select the best style image, which helps avoid unnatural details in the stylized videos. Meanwhile, the target class confidence is additionally considered in targeted attacks to influence the output distribution of the classifier by moving the stylized video closer to or even across the decision boundary. A gradient-free method is then employed to further optimize the adversarial perturbations. We carry out extensive experiments to evaluate StyleFool on two standard datasets, UCF-101 and HMDB-51. The experimental results demonstrate that StyleFool outperforms the state-of-the-art adversarial attacks in terms of both the number of queries and the robustness against existing defenses. Moreover, 50% of the stylized videos in untargeted attacks do not need any query since they can already fool the video classification model. Furthermore, we evaluate the indistinguishability through a user study to show that the adversarial samples of StyleFool look imperceptible to human eyes, despite unrestricted perturbations.

Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that thirteen defenses recently published at ICLR, ICML and NeurIPS-and which illustrate a diverse set of defense strategies-can be circumvented despite attempting to perform evaluations using adaptive attacks. While prior evaluation papers focused mainly on the end result-showing that a defense was ineffective-this paper focuses on laying out the methodology and the approach necessary to perform an adaptive attack. Some of our attack strategies are generalizable, but no single strategy would have been sufficient for all defenses. This underlines our key message that adaptive attacks cannot be automated and always require careful and appropriate tuning to a given defense. We hope that these analyses will serve as guidance on how to properly perform adaptive attacks against defenses to adversarial examples, and thus will allow the community to make further progress in building more robust models.

已经提出了安全的多方计算（MPC），以允许多个相互不信任的数据所有者在其合并数据上共同训练机器学习（ML）模型。但是，通过设计，MPC协议忠实地计算了训练功能，对抗性ML社区已证明该功能泄漏了私人信息，并且可以在中毒攻击中篡改。在这项工作中，我们认为在我们的框架中实现的模型合奏是一种称为Safenet的框架，是MPC的高度无限方法，可以避免许多对抗性ML攻击。 MPC培训中所有者之间数据的自然分区允许这种方法在训练时间高度可扩展，可证明可保护免受中毒攻击的保护，并证明可以防御许多隐私攻击。我们展示了Safenet对在端到端和转移学习方案训练的几个机器学习数据集和模型上中毒的效率，准确性和韧性。例如，Safenet可显着降低后门攻击的成功，同时获得$ 39 \ times $ $的培训，$ 36 \ times $ $ $少于达尔斯科夫（Dalskov）等人的四方MPC框架。我们的实验表明，即使在许多非IID设置中，结合也能保留这些好处。结合的简单性，廉价的设置和鲁棒性属性使其成为MPC私下培训ML模型的强大首选。

随着各种3D安全关键应用的关注，点云学习模型已被证明容易受到对抗性攻击的影响。尽管现有的3D攻击方法达到了很高的成功率，但它们会以明显的扰动来深入研究数据空间，这可能会忽略几何特征。取而代之的是，我们从新的角度提出了点云攻击 - 图谱域攻击，旨在在光谱域中扰动图形转换系数，该系数对应于改变某些几何结构。具体而言，利用图形信号处理，我们首先通过图形傅立叶变换（GFT）自适应地将点的坐标转换为光谱域，以进行紧凑的表示。然后，我们基于我们建议通过可学习的图形光谱滤波器扰动GFT系数的几何结构的影响。考虑到低频组件主要有助于3D对象的粗糙形状，我们进一步引入了低频约束，以限制不察觉到的高频组件中的扰动。最后，通过将扰动的光谱表示形式转换回数据域，从而生成对抗点云。实验结果证明了拟议攻击的有效性，这些攻击既有易经性和攻击成功率。