Specpatch

Guo, Hanqing; Wang, Yuanda; Иванов, Н. А.; Xiao, Li; Yan, Qiben

doi:10.1145/3548606.3560660

Cited by 19 publications

(26 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Adversarial attack (Goodfellow, Shlens, and Szegedy 2014) is initially studied in the context of a classification problem, that a deep network can be fooled with small pixel-level changes. It has penetrated into many fields such as emotion recognition (Zhao et al 2021b), network intrusion detection (Chen et al 2023), speech recognition (Guo et al 2022), and edge computing (Zhao et al 2021a). Recent researchers have adopted a similar idea and turned it into a proactive defensive method against facial manipulations.…”

Section: Adversarial Attack Against Facial Manipulationmentioning

confidence: 99%

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Guan,

Zhao,

et al. 2024

AAAI

View full text Add to dashboard Cite

The non-consensual exploitation of facial manipulation has emerged as a pressing societal concern. In tandem with the identification of such fake content, recent research endeavors have advocated countering manipulation techniques through proactive interventions, specifically the incorporation of adversarial noise to impede the manipulation in advance. Nevertheless, with insufficient consideration of robustness, we show that current methods falter in providing protection after simple perturbations, e.g., blur. In addition, traditional optimization-based methods face limitations in scalability as they struggle to accommodate the substantial expansion of data volume, a consequence of the time-intensive iterative pipeline. To solve these challenges, we propose a learning-based model, Adversarial Robust Safeguard (ARS), to generate desirable protection noise in a single forward process, concurrently exhibiting a heightened resistance against prevalent perturbations. Specifically, our method involves a two-way protection design, characterized by a basic protection component responsible for generating efficacious noise features, coupled with robust protection for further enhancement. In robust protection, we first fuse image features with spatially duplicated noise embedding, thereby accounting for inherent information redundancy. Subsequently, a combination comprising a differentiable perturbation module and an adversarial network is devised to simulate potential information degradation during the training process. To evaluate it, we conduct experiments on four manipulation methods and compare recent works comprehensively. The results of our method exhibit good visual effects with pronounced robustness against varied perturbations at different levels.

show abstract

Section: Adversarial Attack Against Facial Manipulationmentioning

confidence: 99%

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Guan,

Zhao,

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…The above works are the basis of speech recognition UAP research, which shows different degrees of attack capabilities in specific scenarios, but they have some shortcomings in terms of threat or imperceptibility. Li et al (2020b) and Guo et al (2022) are the latest developments related to UAP in ASR. The target model of Li et al (2020b) was speaker recognition model X-vectors and lightweight speech command recognition model Speech Command.…”

Section: Specific Adversarial Perturbationmentioning

confidence: 99%

“…The experimental results showed that their UAPs were hard to penetrate to distant speech inputs. Guo et al (2022) trained SpecPatch on the segmented phoneme level, achieving good generality and time independence. The method inserts silent frames to disrupt the original user semantics in normal audio.…”

Section: Specific Adversarial Perturbationmentioning

confidence: 99%

“…However, due to the requirement of simultaneously affecting multiple audios, existing methods struggle to maintain high success rates and imperceptibility under such strict constraints. Therefore, there is little research on UAP in ASR and each has its limitations (Neekhara et al 2019;Zong et al 2021;Lu et al 2021;Guo et al 2022). Furthermore, several studies concentrate on UAP attacks in other speech-related domains, such as speaker recognition (Li et al 2020b;Xie et al 2021b), speech command classification (Li et al 2020b;Vadillo and Santana 2019;Abdoli et al 2019), and environmental sound classification (Xie et al 2021b).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

CommanderUAP: a practical and transferable universal adversarial attacks on speech recognition models

Sun,

Zhao,

Guo

et al. 2024

Cybersecurity

View full text Add to dashboard Cite

Most of the adversarial attacks against speech recognition systems focus on specific adversarial perturbations, which are generated by adversaries for each normal example to achieve the attack. Universal adversarial perturbations (UAPs), which are independent of the examples, have recently received wide attention for their enhanced real-time applicability and expanded threat range. However, most of the UAP research concentrates on the image domain, and less on speech. In this paper, we propose a staged perturbation generation method that constructs CommanderUAP, which achieves a high success rate of universal adversarial attack against speech recognition models. Moreover, we apply some methods from model training to improve the generalization in attack and we control the imperceptibility of the perturbation in both time and frequency domains. In specific scenarios, CommanderUAP can also transfer attack some commercial speech recognition APIs.

show abstract

“…Besides, regarding another future direction of our methods, we intend to generalize and adopt them to more settings and applications, such as continual learning (Wang et al, 2022b), non-transferable learning , federate learning (Dong et al, 2022), audio signal processing (Zhai et al, 2021;Guo et al, 2022a;b), and visual object tracking . We will also evaluate our methods under other DNN structures (e.g., ViT (Tu et al, 2022) and GCN (Zhao et al, 2020b)…”

mentioning

confidence: 99%

SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency

Guo¹,

Li²,

Chen³

et al. 2023

Preprint

View full text Add to dashboard Cite

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where adversaries embed a hidden backdoor trigger during the training process for malicious prediction manipulation. These attacks pose great threats to the applications of DNNs under the real-world machine learning as a service (MLaaS) setting, where the deployed model is fully black-box while the users can only query and obtain its predictions. Currently, there are many existing defenses to reduce backdoor threats. However, almost all of them cannot be adopted in MLaaS scenarios since they require getting access to or even modifying the suspicious models. In this paper, we propose a simple yet effective black-box input-level backdoor detection, called SCALE-UP, which requires only the predicted labels to alleviate this problem. Specifically, we identify and filter malicious testing samples by analyzing their prediction consistency during the pixel-wise amplification process. Our defense is motivated by an intriguing observation (dubbed scaled prediction consistency) that the predictions of poisoned samples are significantly more consistent compared to those of benign ones when amplifying all pixel values. Besides, we also provide theoretical foundations to explain this phenomenon. Extensive experiments are conducted on benchmark datasets, verifying the effectiveness and efficiency of our defense and its resistance to potential adaptive attacks. Our codes are available at https://github.com/JunfengGo/SCALE-UP.

show abstract

Specpatch

Cited by 19 publications

References 21 publications

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

CommanderUAP: a practical and transferable universal adversarial attacks on speech recognition models

SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency

Contact Info

Product

Resources

About