Adversarial attacks have gained significant research interest for their ability to expose vulnerabilities in deep neural networks. However, current studies on visual adversarial attacks predominantly focus on improving attack efficiency or success rates, typically constraining perturbation magnitudes using lp-norm while overlooking the critical requirement for human imperceptibility of adversarial examples. Although globally minor perturbations are generated, they may introduce localized artifacts (e.g., abnormal brightness or perceptible texture anomalies) that compromise visual stealthiness. To address this issue, we propose an attention-inverse perturbation (AIP) strategy, which restricts perturbations to visually non-attentive regions (e.g., backgrounds) identified through class activation mapping techniques, thereby minimizing visual discrepancies between adversarial and clean examples. Our strategy can be seamlessly integrated into existing attack methods. Extensive experiments demonstrate that the proposed AIP strategy achieves superior performance across perceptual similarity metrics (e.g., MS-SSIM, VIF, and LPIPS) with only marginal trade-offs in attack success rate, offering a practical solution for balancing imperceptibility and attack efficacy.

Abstract Deep learning has transformed fields such as computer vision, natural language processing, and audio analysis through its powerful pattern recognition and predictive capabilities. However, the robustness of these models remains a major concern, as they are highly vulnerable to adversarial attacks-subtle, intentional perturbations that lead to incorrect predictions. While recent defenses like adversarial training and defensive distillation aim to improve robustness, they have notable drawbacks, including overfitting and degraded performance under strong attacks. Certified defenses, such as robust training and Randomized Smoothing, offer theoretical guarantees within a specific perturbation radius, yet struggle to reflect real-world robustness due to efficiency bottlenecks and the unpredictable nature of actual adversarial attacks. These challenges reveal a critical gap between current defenses and real-world attack scenarios, highlighting the need for more practical and resilient solutions. To address the challenges of defense-attack gaps and the inefficiency in robust training, we introduce the Explanation-Guided Robust Training Enhancer (EGRTE). EGRTE combines a self-explaining mechanism, which guides adversarial training to focus on generalized features for improved robustness and accuracy, with a masking mechanism that transforms noised data for easier model learning. This approach not only mitigates noise effects, including adversarial perturbations, but also eliminates the need for time-intensive gradient calculations, greatly enhancing training efficiency. Comprehensive experiments on several datasets show EGRTE’s superior certified accuracy and robustness against adversarial attacks, with a 6.24-fold efficiency increase over comparable methods, positioning EGRTE as a highly effective solution for robust and efficient deep learning.

Human-machine co-driving presents a significant hurdle in automated driving system. The takeover process in automated driving system involves complex human factors, failure to takeover the vehicle and control driving behavior during the takeover process may lead to severe traffic safety hazards. An augmented reality head-up display (AR-HUD) takeover assistance information can provide real-time assistance information to the driving environment, enhancing drivers’ situation awareness (SA) and takeover decisions in highly automated driving system. This study investigated the impact of different AR-HUD types of takeover assistance information display. Three AR-HUD types, corresponding to the three pre-takeover behavioral processes (perception, understanding, and prediction), were evaluated: PSR (assistance in perceiving the source of risk), AS (assistance in analyzing situations), and MD (assistance in making decisions). The baseline (without assistance information) was used as the control group. In a driving simulation experiment using 360° panoramic video, seventy-nine participants performed SA assessment and visual tracking tasks. Questionnaire and eye-tracking data indicated that the type of AR-HUD displayed positively influenced drivers’ SA and takeover decisions, with AS being the most effective in enhancing SA and improving takeover performance. Additionally, this study compared the differences between the three types of AR-HUD and the baseline under two takeover request lead times (TORlt) of 5 seconds and 7 seconds. It was found that drivers’ SA was lower when TORlt was shorter (with the corresponding AR-HUD display also being shorter). This study provides insight concerning the impact of various types of AR-HUD takeover assistance information display and TORlt on driving safety. The findings support the further optimization of AR-HUD takeover assistance information design.

Deep neural networks have been demonstrated to be vulnerable to adversarial examples, which fool networks by adding human-imperceptible perturbations to benign examples. At present, the practical transfer-based black-box attacks are attracting significant attention. However, most existing transfer-based attacks achieve only relatively limited success rates. We propose to improve the transferability of adversarial examples through the use of a virtual step and auxiliary gradients. Here, the “virtual step” refers to using an unusual step size and clipping adversarial perturbations only in the last iteration, while the “auxiliary gradients” refer to using not only gradients corresponding to the ground-truth label (for untargeted attacks), but also gradients corresponding to some other labels to generate adversarial perturbations. Our proposed virtual step and auxiliary gradients can be easily integrated into existing gradient-based attacks. Extensive experiments on ImageNet show that the adversarial examples crafted by our method can effectively transfer to different networks. For single-model attacks, our method outperforms the state-of-the-art baselines, improving the success rates by a large margin of 12%~28%. Our code is publicly available at https://github.com/mingcheung/Virtual-Step-and-Auxiliary-Gradients.

In recent years, the public has become more aware of security concerns, and the demand for convenient and efficient encryption technology has increased. Biological data is used in identity authentication and key generation as the innate characteristic information of people. Biological key have the advantage of convenience and fast application without carrying any document; however, they also have the disadvantage of biological characteristic leaks and the inability to change. Based on the advantages and disadvantages of biological key, we propose the concept of semantic key. Language, a medium that fills the lives of people, has similar characteristics of convenience and fast application as biological key; however, semantic key will not reveal biological information. As the amount of semantic information is large, it can be changed at any time. Compared with biological key, it provides better security and flexibility. Therefore, we propose a semantic key generation framework of semantic extraction + feature stabilization + fuzzy extraction that improves the existing semantic extraction model and feature stabilization model and design the semantic key extraction model. In terms of artificial sentence formation, semantic key can be extracted with an accuracy of more than 99%, and an error rate of less than 0.5%.

With the increasing use of biometric identity authentication, biological key generation technology is receiving much attention. A high-strength key that is easy to store and manage can be generated from biological characteristics, which can improve the convenience and security of user-encryption operations. However, the generation of a high-strength, stable, and robust key using the currently available fingerprint bio-key generation technology is difficult. This paper proposes a three-layer framework for fingerprint bio-key generation that is composed of a fingerprint bio-key preprocessor, fingerprint bio-key stabilizer (FPBK_Stabilizer), and fingerprint bio-key fuzzy extractor. In the FPBK_Stabilizer, feature selection and layer-by-layer convolution projection characteristics from deep neural networks are used to effectively eliminate the instability between fingerprint samples. Furthermore, a suitable multilayer convolutional projection fingerprint bio-key generation model is designed for generating the fingerprint bio-key. The results of a fingerprint bio-key generation experiment involving a fingerprint library comprising 100 people verified the efficacy of the proposed framework. Specifically, the proposed framework exhibited a generation intensity >1024 bits, accuracy rate >98.0%, and misrecognition rate <1.5%, thereby verifying its high-strength, stable, and robust fingerprint bio-key generation capability.

Single biometric method has been widely used in the field of wireless multimedia authentication. However, it is vulnerable to spoofing and limited accuracy. To tackle this challenge, in this paper, we propose a multimodal fusion method for fingerprint and voiceprint by using a dynamic Bayesian method, which takes full advantage of the feature specificity extracted by a single biometrics project and authenticates users at the decision-making level. We demonstrate that this method can be extended to more modal biometric authentication and can achieve flexible accuracy of the authentication. The experiment of the method shows that the recognition rate and stability have been greatly improved, which achieves 4.46% and 5.94%, respectively, compared to the unimodal. Furthermore, it also increases 1.94% when compared with general multimodal methods for the biometric fusion recognition.

During the last few years, the speaker recognition technique has been widely attractive for its extensive application in many fields, such as speech communications, domestics services, and smart terminals. As a critical method, the Gaussian mixture model (GMM) makes it possible to achieve the recognition capability that is close to the hearing ability of human in a long speech. However, the GMM is failing to recognize a short utterance speaker with a high accuracy. Aiming at solving this problem, in this paper, we propose a novel model to enhance the recognition accuracy of the short utterance speaker recognition system. Different from traditional models based on the GMM, we design a method to train a convolutional neural network to process spectrograms, which can describe speakers better. Thus, the recognition system gains the considerable accuracy as well as the reasonable convergence speed. The experiment results show that our model can help to decrease the equal error rate of the recognition from 4.9% to 2.5%.

Data races hidden in concurrent programs have caused severe failures. To improve the reliability, many race detectors are proposed. However, most of the reported races are not harmful, which consumes manual effort to identify the harmful races. This paper proposes RaceChecker that can detect the potential races and identify the harmful races effectively and efficiently. Unlike previous detectors, RaceChecker combines happens-before relation and ad-hoc synchronization to prune the infeasible races so that fewer potential races are required to be verified. Before verification, RaceChecker groups the remaining potential races, guaranteeing the potential races in one group do not interfere with each other. Therefore, multiple potential races in one group can be verified together in one execution. To our knowledge, this is the first effective technique that groups the potential races to improve the efficiency. Unlike previous detectors that verify one potential race in one execution, RaceChecker dynamically controls thread scheduler to create real race conditions to verify multiple potential races in one execution, identifying the harmful races that cause program failures. We have implemented RaceChecker as a prototype tool and have experimented on a number of real-world concurrent programs. Results show that 66% of the potential races are infeasible and nearly 48% of the executions are reduced by the grouping strategy. The known harmful races are also identified effectively. By pruning and grouping, RaceChecker identifies the harmful races more efficiently. Comparing with RaceMob and RaceFuzzer, the time is reduced significantly, with an average of 45% and 81% respectively.