Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence
Federated learning (FL) enables multiple clients to collaboratively train an accurate global mode... more Federated learning (FL) enables multiple clients to collaboratively train an accurate global model while protecting clients' data privacy. However, FL is susceptible to Byzantine attacks from malicious participants. Although the problem has gained significant attention, existing defenses have several flaws: the server irrationally chooses malicious clients for aggregation even after they have been detected in previous rounds; the defenses perform ineffectively against sybil attacks or in the heterogeneous data setting. To overcome these issues, we propose MAB-RFL, a new method for robust aggregation in FL. By modelling the client selection as an extended multi-armed bandit (MAB) problem, we propose an adaptive client selection strategy to choose honest clients that are more likely to contribute high-quality updates. We then propose two approaches to identify malicious updates from sybil and non-sybil attacks, based on which rewards for each client selection decision can be accur...
Proceedings of the AAAI Conference on Artificial Intelligence
Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become ... more Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example ...
In this paper, an effective intra prediction mode-based video strganography is proposed. Secret m... more In this paper, an effective intra prediction mode-based video strganography is proposed. Secret messages are embedded during the intra prediction of the video encoding without causing large embedding impact. The influence on the sum of absolute difference (SAD) in intra prediction modes (IPMs) reversion phenomenon is sharp when modifying IPMs. It inspires us to take the SAD prediction deviation (SPD) to define the distortion function. What’s more, the mapping rule between IPMs and the codewords is introduced to further reduce the SPD values of each intra block. Syndrome-trellis code (STC) is used as the practical embedding implementation. Experimental results demonstrate that our proposed steganographic scheme presents high undetectability compared with existing IPMs-based steganographic approaches. It also outperforms these schemes on stego video quality.
While deep face recognition (FR) systems have shown amazing performance in identification and ver... more While deep face recognition (FR) systems have shown amazing performance in identification and verification, they also arouse privacy concerns for their excessive surveillance on users, especially for public face images widely spread on social networks. Recently, some studies adopt adversarial examples to protect photos from being identified by unauthorized face recognition systems. However, existing methods of generating adversarial face images suffer from many limitations, such as awkward visual, white-box setting, weak transferability, making them difficult to be ap-plied to protect face privacy in reality. In this paper, we propose adversarial makeup transfer GAN (AMT-GAN) 1 , a novel face protection method aim-ing at constructing adversarial face images that preserve stronger black-box transferability and better visual quality simultaneously. AMT-GAN leverages generative adversarial networks (GAN) to synthesize adversarial face images with makeup transferred from reference image...
The existing works on histogram-based watermark embedding share the common notions of non-informe... more The existing works on histogram-based watermark embedding share the common notions of non-informed random host sample selection and uniform embedding, resulting in limited and yet similar performances. This letter develops two methods to improve imperceptibility and robustness of histogram-based embedding. We first propose a content-aware method which performs uniform embedding in ranked energy-significant regions of the host signal. We show that the embedded ternary watermark signal is more likely to be masked by the strong host signal component, thus improving imperceptibility without compromising robustness. Further, a non-uniform embedding method is proposed, which modifies host samples according to their relationships with the center of the target histogram bin. It ensures minimum host sample modifications without reducing the payload size. Meanwhile, watermark robustness could also be improved since it becomes the most difficult to move samples at bin centers into other bins via attacks. The proposed methods are supported by extensive experimental results.
Cryptographic keys should be established for the smart home devices in order to secure home area ... more Cryptographic keys should be established for the smart home devices in order to secure home area networks. In certain smart home applications, however, the devices might be produced by different factories. As a result, it becomes impractical to assume devices are preloaded with secrets before leaving factories. Moreover, in some scenarios, smart home devices have no access to an online trusted third party. These problems make conventional key agreement schemes inapplicable for these devices. It is investigated that devices can extract secrets from received signal strength (RSS) measurements at the physical layer. However, the bit extraction rate is low. The Merkle puzzle is introduced to design the key agreement scheme by expanding the low entropy seed to high entropy secret key. However, it introduces considerable time and computation costs. To alleviate these problems, in this article, we design a hybrid key agreement scheme for smart homes. Namely, smart home devices first extract short random keys at the physical layer. Then, they establish secret communication keys at higher layers by making use of the Merkle puzzle. In this way, secret keys can be established without using any preloaded secrets or online trusted third party. We prove the security of the new scheme and present a prototype implementation using Ralink WiFi cards. Moreover, we evaluate the performance of our scheme and compare it with other related schemes. The analysis shows that comparing with the related schemes, in our scheme, the time cost is at least one order of magnitude lower, the computation cost is at least five orders of magnitude lower, and the extra communication cost is moderate.
Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence
Federated learning (FL) enables multiple clients to collaboratively train an accurate global mode... more Federated learning (FL) enables multiple clients to collaboratively train an accurate global model while protecting clients' data privacy. However, FL is susceptible to Byzantine attacks from malicious participants. Although the problem has gained significant attention, existing defenses have several flaws: the server irrationally chooses malicious clients for aggregation even after they have been detected in previous rounds; the defenses perform ineffectively against sybil attacks or in the heterogeneous data setting. To overcome these issues, we propose MAB-RFL, a new method for robust aggregation in FL. By modelling the client selection as an extended multi-armed bandit (MAB) problem, we propose an adaptive client selection strategy to choose honest clients that are more likely to contribute high-quality updates. We then propose two approaches to identify malicious updates from sybil and non-sybil attacks, based on which rewards for each client selection decision can be accur...
Proceedings of the AAAI Conference on Artificial Intelligence
Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become ... more Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example ...
In this paper, an effective intra prediction mode-based video strganography is proposed. Secret m... more In this paper, an effective intra prediction mode-based video strganography is proposed. Secret messages are embedded during the intra prediction of the video encoding without causing large embedding impact. The influence on the sum of absolute difference (SAD) in intra prediction modes (IPMs) reversion phenomenon is sharp when modifying IPMs. It inspires us to take the SAD prediction deviation (SPD) to define the distortion function. What’s more, the mapping rule between IPMs and the codewords is introduced to further reduce the SPD values of each intra block. Syndrome-trellis code (STC) is used as the practical embedding implementation. Experimental results demonstrate that our proposed steganographic scheme presents high undetectability compared with existing IPMs-based steganographic approaches. It also outperforms these schemes on stego video quality.
While deep face recognition (FR) systems have shown amazing performance in identification and ver... more While deep face recognition (FR) systems have shown amazing performance in identification and verification, they also arouse privacy concerns for their excessive surveillance on users, especially for public face images widely spread on social networks. Recently, some studies adopt adversarial examples to protect photos from being identified by unauthorized face recognition systems. However, existing methods of generating adversarial face images suffer from many limitations, such as awkward visual, white-box setting, weak transferability, making them difficult to be ap-plied to protect face privacy in reality. In this paper, we propose adversarial makeup transfer GAN (AMT-GAN) 1 , a novel face protection method aim-ing at constructing adversarial face images that preserve stronger black-box transferability and better visual quality simultaneously. AMT-GAN leverages generative adversarial networks (GAN) to synthesize adversarial face images with makeup transferred from reference image...
The existing works on histogram-based watermark embedding share the common notions of non-informe... more The existing works on histogram-based watermark embedding share the common notions of non-informed random host sample selection and uniform embedding, resulting in limited and yet similar performances. This letter develops two methods to improve imperceptibility and robustness of histogram-based embedding. We first propose a content-aware method which performs uniform embedding in ranked energy-significant regions of the host signal. We show that the embedded ternary watermark signal is more likely to be masked by the strong host signal component, thus improving imperceptibility without compromising robustness. Further, a non-uniform embedding method is proposed, which modifies host samples according to their relationships with the center of the target histogram bin. It ensures minimum host sample modifications without reducing the payload size. Meanwhile, watermark robustness could also be improved since it becomes the most difficult to move samples at bin centers into other bins via attacks. The proposed methods are supported by extensive experimental results.
Cryptographic keys should be established for the smart home devices in order to secure home area ... more Cryptographic keys should be established for the smart home devices in order to secure home area networks. In certain smart home applications, however, the devices might be produced by different factories. As a result, it becomes impractical to assume devices are preloaded with secrets before leaving factories. Moreover, in some scenarios, smart home devices have no access to an online trusted third party. These problems make conventional key agreement schemes inapplicable for these devices. It is investigated that devices can extract secrets from received signal strength (RSS) measurements at the physical layer. However, the bit extraction rate is low. The Merkle puzzle is introduced to design the key agreement scheme by expanding the low entropy seed to high entropy secret key. However, it introduces considerable time and computation costs. To alleviate these problems, in this article, we design a hybrid key agreement scheme for smart homes. Namely, smart home devices first extract short random keys at the physical layer. Then, they establish secret communication keys at higher layers by making use of the Merkle puzzle. In this way, secret keys can be established without using any preloaded secrets or online trusted third party. We prove the security of the new scheme and present a prototype implementation using Ralink WiFi cards. Moreover, we evaluate the performance of our scheme and compare it with other related schemes. The analysis shows that comparing with the related schemes, in our scheme, the time cost is at least one order of magnitude lower, the computation cost is at least five orders of magnitude lower, and the extra communication cost is moderate.
Uploads