Neural networks are vulnerable to data inference attacks, including the membership inference attack, the model inversion attack, and the attribute inference attack. In this paper, we proposePurifierto defend against membership inference attacks by quantifying the differences between dataset members and non-members in three dimensions: individual shape, statistical distribution, and prediction label.Purifierinvolves transforming the confidence scores produced by the target classifier, resulting in purified confidence scores that are indistinguishable across the dimensions above. We conduct experiments on widely-used datasets and models. The results show thatPurifieroffers robust defense against membership inference attacks with superior efficacy compared to prior defense techniques while maintaining minimal utility degradation (e.g., less than 0.7% classification accuracy drop of most datasets). Additionally, our extended experiments explore the effectiveness ofPurifierin defending against the model inversion attack and the attribute inference attack.

Deep neural networks are vulnerable to adversarial attacks. We study such threats in the decision-based black-box setting where the adversary could obtain only the predicted labels of the victim classifier within limited queries and aims at performing targeted and untargeted adversarial attacks under different perturbation constraints. In this paper, we propose BounceAttack as a query-efficient attack method. We propose the bounce vector which encourages the iterations to maximally explore the adversarial space towards the optimal adversarial example within limited queries to improve the query efficiency. We perform extensive experiments on various benchmark datasets and models. Experimental results show that BounceAttack achieves both high query efficiency and small perturbation size. BounceAttack outperforms existing attack methods. For example, BounceAttack achieves 48.1% smaller perturbation compared to the state-of-the-art attack methods on average using the same number of model queries.

Neural networks are susceptible to data inference attacks such as the membership inference attack, the adversarial model inversion attack and the attribute inference attack, where the attacker could infer useful information such as the membership, the reconstruction or the sensitive attributes of a data sample from the confidence scores predicted by the target classifier. In this paper, we propose a method, namely PURIFIER, to defend against membership inference attacks. It transforms the confidence score vectors predicted by the target classifier and makes purified confidence scores indistinguishable in individual shape, statistical distribution and prediction label between members and non-members. The experimental results show that PURIFIER helps defend membership inference attacks with high effectiveness and efficiency, outperforming previous defense methods, and also incurs negligible utility loss. Besides, our further experiments show that PURIFIER is also effective in defending adversarial model inversion attacks and attribute inference attacks. For example, the inversion error is raised about 4+ times on the Facescrub530 classifier, and the attribute inference accuracy drops significantly when PURIFIER is deployed in our experiment.

Abstract Community detection on high‐mixed networks has been a challenging problem for complex network researchers. In a Lancichinetti–Fortunato–Radicchi (LFR) network with a mixing parameter mu greater than or equal to 0.5, the quality of the communities partitioned by currently available algorithms will decrease rapidly with increasing mu. To address this issue, we propose a label propagation algorithm on high‐mixed networks, called LPA‐HM, for community detection. In our algorithm, the initial node labels are preprocessed using the number of common neighbors of the nodes, which greatly reduces the initial number of labels and thus improves the quality of the subsequent label propagation process. During the label propagation stage, each node is given the label that is shared by the maximum number of its neighbors. If there are several labels that meet this requirement, the influence of the labels' nodes is calculated, and the label with the maximum total influence is selected as the label of the current node. Early stop conditions based on modularity and run‐to‐run changes in the number of detected communities are incorporated in the algorithm to prevent label overpropagation. The communities that fail to satisfy the definition of weak communities are merged with their most similar neighboring communities. In experiments based on real networks and LFR networks, it is found that the LPA‐HM algorithm is well suited to community detection in a variety of networks. In a high‐mixed LFR network with mu = 0.7, the NMI measure of the LPA‐HM algorithm's community detection performance is still greater than 0.9.