Graph prompt learning (GPL) is designed to bridge the gap between graph pretraining models and downstream graph tasks, providing advantages in terms of graph knowledge transfer. However, GPL is vulnerable to poisoned graph attacks that induce abnormal training via adversarial malicious perturbations. We observe that the prevalent meta-gradient attacks, which heavily rely on the training of surrogate graph neural networks (GNNs), fail to account for the impact of perturbations on GPL where the pretrained GNN remains frozen and graph prompt tokens are tuned. Moreover, their gradient-assigned strategies tend to corrupt the topological semantics on a few influential labeled graphs, which in turn diminishes the trustworthiness of the surrogate training. To address this issue, we propose a dynamic equilibrium gradient-assigned attack against GPL, named MetaGpro. To guarantee the transferability of MetaGpro, the surrogate GPL is utilized in our simulation across various downstream tasks. To dynamically equilibrate the relationships between the reliability of surrogate models and instable structures, the over-robust contrastive learning is integrated into the surrogate training. In this way, the gradient bias caused by excessive perturbations of labeled nodes can be effectively mitigated. Subsequently, the topology perturbation generation is exploited to assign more gradient weights to nodes that are closer to the misclassification area. The experimental results reveal that the surrogate GPL outperforms the surrogate GNN in 96% of downstream evaluations, and our MetaGpro reduces the accuracy of GPL by 2%∼20% compared to the state-of-the-art (SOTA) works mostly. The code for our MetaGpro is available here.

The multimodal datasets can be leveraged to pre-train large-scale vision-language models by providing cross-modal semantics. Current endeavors for determining the usage of datasets mainly focus on single-modal dataset ownership verification through intrusive methods and non-intrusive techniques, while cross-modal approaches remain under-explored. Intrusive methods can adapt to multimodal datasets but degrade model accuracy, while non-intrusive methods rely on label-driven decision boundaries that fail to guarantee stable behaviors for verification. To address these issues, we propose a novel prompt-adapted transferable fingerprinting scheme from a training-free perspective, called PATFinger, which incorporates the global optimal perturbation (GOP) and the adaptive prompts to capture dataset-specific distribution characteristics. Our scheme utilizes inherent dataset attributes as fingerprints instead of compelling the model to learn triggers. The GOP is derived from the sample distribution to maximize embedding drifts between different modalities. Subsequently, our PATFinger re-aligns the adaptive prompt with GOP samples to capture the cross-modal interactions on the carefully crafted surrogate model. This allows the dataset owner to check the usage of datasets by observing specific prediction behaviors linked to the PATFinger during retrieval queries. Extensive experiments demonstrate the effectiveness of our scheme against unauthorized multimodal dataset usage on various cross-modal retrieval architectures by 30% over state-of-the-art baselines.

The pervasive prevalence of DeepFakes poses a profound threat to individual privacy and the stability of society. Believing the synthetic videos of a celebrity and trumping up impersonated forgery videos as authentic are just a few consequences generated by DeepFakes. We investigate current detectors that blindly deploy deep learning techniques that are not effective in capturing subtle clues of forgery when generative models produce remarkably realistic faces. Inspired by the fact that synthetic operations inevitably modify the regions of eyes and mouth to match the target face with the identity or expression of the source face, we conjecture that the continuity of facial movement patterns representing expressions that existed in the veritable faces will be disrupted or completely broken in synthetic faces, making it a potentially formidable indicator for DeepFake detection. To prove this conjecture, we utilize a dual‐branch network to capture the inconsistent patterns of facial movements within eyes and mouth regions separately. Extensive experiments on popular FaceForensics++, Celeb‐DF‐v1, Celeb‐DF‐v2, and DFDC‐Preview datasets have demonstrated not only effectiveness but also the robust capability of our method to outperform the state‐of‐the‐art baselines. Moreover, this work represents greater robustness against adversarial attacks, achieving ASR of 54.8% in the I‐FGSM attack and 43.1% in the PGD attack on the DeepFakes dataset of FaceForensics++, respectively.

The proliferation of photorealistic images synthesized by generative adversarial networks (GANs) has posed serious threats to society. Therefore a new challenge task, named image attribution, is arising to attribute fake images to a specific GAN. However, existing approaches focus on model‐specific features but neglect the misguidance of semantic‐relevant features in image attribution, which leads to a significant performance decrease in cross‐dataset evaluation. To tackle the above problem, we propose a semantic‐agnostic fake image attribution (SFIA) method, which effectively distinguishes fake images by disentangling the GANs fingerprint and semantic‐relevant features in latent space. Specifically, we design a semantic eliminator based on residual block with skip connections that take images as input and outputs GAN fingerprint features. A classifier with an attention module for feature refinement is introduced to make the final decision. In addition, we develop a well‐trained reconstructor and classifier which supervise the semantic eliminator to achieve semantic‐agnostic feature extraction. Moreover, we propose an improved data augmentation combined with meta‐learning to enhance the model’s generalization in detecting unseen image categories. Comprehensive experiments on various datasets, namely, CelebA, LSUN‐church, and LSUN‐bedroom, demonstrate the effectiveness of our proposed SFIA. It achieves over 95% accuracy on three datasets and exhibits superior performance in terms of generalization to unseen data.

We propose a novel model‐free unsupervised learning paradigm to tackle the unfavorable prevailing problem of real‐world image deraining, dubbed MUL‐Derain. Beyond existing unsupervised deraining efforts, MUL‐Derain leverages a model‐free Multiscale Attentive Filtering (MSAF) to handle multiscale rain streaks. Therefore, formulation of any rain imaging is not necessary, and it requires neither iterative optimization nor progressive refinement operations. Meanwhile, MUL‐Derain can efficiently compute spatial coherence and global interactions by modeling long‐range dependencies, allowing MSAF to learn useful knowledge from a larger or even global rain region. Furthermore, we formulate a novel multiloss function to constrain MUL‐Derain to preserve both color and structure information from the rainy images. Extensive experiments on both synthetic and real‐world datasets demonstrate that our MUL‐Derain obtains state‐of‐the‐art performance over un/semisupervised methods and exhibits competitive advantages over the fully‐supervised ones.

Intrusion detection systems are crucial in fighting against various network attacks. By monitoring the network behavior in real time, possible attack attempts can be detected and acted upon. However, with the development of openness and flexibility of networks, artificial immunity‐based network anomaly detection methods lack continuous adaptability and hence have poor detection performance. Thus, a novel framework for network anomaly detection with adaptive regulation is built in this paper. First, a heuristic dimensionality reduction algorithm based on unsupervised clustering is proposed. This algorithm uses the correlation between features to select the best subset. Then, a hybrid partitioning strategy is introduced in the negative selection algorithm (NSA), which divides the feature space into a grid based on the sample distribution density and generates specific candidate detectors in the boundary grid to effectively mitigate the holes caused by boundary diversity. Finally, the NSA is improved by self‐set clustering and a novel gray wolf optimizer to achieve adaptive adjustment of the detector radius and position. The results show that the proposed NSA algorithm based on mixed hierarchical division and gray wolf optimization (MDGWO‐NSA) achieves a higher detection rate, lower false alarm rate, and better generation quality than other network anomaly detection algorithms.

Image steganalysis is a technique to detect whether an image contains hidden information. Although the existing cross-domain steganalysis methods have been presented to narrow the distribution gap between different domains, it is still challenging to effectively capture the transferable steganalysis representations under the condition of severe distribution shifts. To address this issue, we propose a novel consensus-clustering-based automatic distribution matching scheme, called CADM, which can automatically and accurately match inconsistent distributions in cross-domain steganalysis scenarios. First, the original steganalysis features are clustered by the spatially constrained fuzzyc-means (SCFCM) algorithm with controllable parameters to fully perceive and mine inherent structural relationships. Subsequently, the cluster consensus knowledge is derived from the perspective of intra-domain and inter-domain to facilitate the clustering and the matching. In this way, the representations of weak stego signals can be augmented by identifying cluster centers that can be combined across domains. Ultimately, the cycle-consistent optimization and adaptation is achieved by gradually adjusting the learning strength of well-aligned and poorly-aligned samples to promote the positive transfer of overlapped clusters and prevent the negative transfer of outlier clusters. Furthermore, extensive experiments on various benchmark databases for cross-domain steganalysis demonstrate the superiority of CADM over the current state-of-the-art methods.

Deep neural networks (DNNs) have achieved remarkable success in various tasks (e.g., image classification, speech recognition, and natural language processing (NLP)). However, researchers have demonstrated that DNN-based models are vulnerable to adversarial examples, which cause erroneous predictions by adding imperceptible perturbations into legitimate inputs. Recently, studies have revealed adversarial examples in the text domain, which could effectively evade various DNN-based text analyzers and further bring the threats of the proliferation of disinformation. In this paper, we give a comprehensive survey on the existing studies of adversarial techniques for generating adversarial texts written by both English and Chinese characters and the corresponding defense methods. More importantly, we hope that our work could inspire future studies to develop more robust DNN-based text analyzers against known and unknown adversarial techniques. We classify the existing adversarial techniques for crafting adversarial texts based on the perturbation units, helping to better understand the generation of adversarial texts and build robust models for defense. In presenting the taxonomy of adversarial attacks and defenses in the text domain, we introduce the adversarial techniques from the perspective of different NLP tasks. Finally, we discuss the existing challenges of ad-versarial attacks and defenses in texts and present the future research directions in this emerging and challenging field.

State-of-the-art adversarial attacks in the text domain have shown their power to induce machine learning models to produce abnormal outputs. The samples generated in these attacks have three important attributes: attack ability, transferability, and imperceptibility. However, compared with the other two attributes, the imperceptibility of adversarial examples has not been well investigated. Unlike the pixel-level perturbations in images, adversarial perturbations in the text are usually traceable, reflecting changes in characters, words, or sentences. The generation of imperceptible samples in texts is more difficult than in images. Therefore, how to constrain adversarial perturbations added in the text is a crucial step to construct more natural adversarial texts. Unfortunately, recent studies merely select measurements to constrain the added adversarial perturbations, but none of them explain where these measurements are suitable, which one is better, and how they perform in different kinds of adversarial attacks. In this paper, we fill this gap by comparing the performance of these metrics in various attacks. Furthermore, we propose a stricter constraint for word-level attacks to obtain more imperceptible samples. It is also helpful to enhance existing word-level attacks for adversarial training.

The core objective of image steganalysis is to explore the presence of weak image steganographic signals. Extracting effective steganographic signal features will play an essential role in digital image steganalysis. However, existing networks rely more on spatial rich model kernels or random learnable kernels to obtain noise residuals during the stage of steganographic signal features extraction. In this paper, we proposed a JPEG steganalysis network which based on denoising network and attention module, mainly including a noise extract block, a noise analysis block, and a judgment block. Specifically, a professional denoising convolutional neural network is first introduced in noise extract block to obtain better steganalysis features. The noise analysis block is integrated with the attention module to finely extract the steganographic signals hidden in the complex texture regions, which is quite effective in improving the signal-to-noise ratio of the stego signal. The judgment block is primarily a classifier to distinguish between cover images and stego images. Comprehensive experiments show a significant improvement in performance over the state-of-the-art steganalysis scheme. Moreover, the proposed network has better generalization capability than the compared steganalysis network for the case of cover-source and quality factor mismatch, which is critical for future steganalysis systems.

Steganalysis is a detection technology against steganography that embeds secret data into digital media carriers. The selection channel, which indicates the embedding details of steganography, is well recognized in boosting the detection performance of image steganalysis. However, nearly all the selection channels are constructed in a hand-crafted manner, even when they are incorporated into end-to-end deep steganalytic networks, for which the embedding rate and steganographic algorithms also need to be predetermined. Such prior knowledge is usually assumed completely known in existing literature, which is obviously unreasonable and impractical. To address this issue, we propose to automatically learn the selection channels for deep learning-based image steganalysis in a progressive way. Specifically, we divide the image steganalysis task into two phases: selection channel estimation and steganalytic detection. For the first phase, we design a multistage progressive network, which enables the learning of selection channels in a coarse-to-fine fashion. For the second phase, we integrate the learned selection channels into the multilayers of the steganalytic network, allowing full exploitation of selection channels for accurate detection. Extensive experiments demonstrate that the proposed method can learn the selection channels rapidly and precisely, and also significantly improve the detection accuracy of the existing state-of-the-art steganographic network without any prior knowledge.

Fuzzing is considered to be an essential approach to guarantee the reliability of deep neural networks (DNNs) based systems. The DNN fuzzing leverages various inputs prioritization methods to guide the testing process. The current research mainly focus on constructing testing metrics that symbolize the logical representation of the DNN to guide the generation of test cases, which neglects the potential performance brought by implementing heuristic algorithm. Moreover, the straightforward implementation of queue structure can not represent the metamorphic relationships between generated inputs in DNN fuzzing. Therefore, developing the appropriate heuristic algorithm-based inputs prioritization method is critical to improve the performance of DNN fuzzers. In this paper, we propose a Monte Carlo Tree Search (MCTS) based inputs prioritization method called E x 2 $E{x}^{2}$ (Exploration and Exploitation) that formulates DNN testing exploration as the sequential decision process. The technique introduces an innovative tree-structure design that schedules inputs from the statistical perspective. Different from traditional DNN testing, the batch pool is maintained in the form of nodes in MCTS. The links between nodes precisely represent the metamorphic relationship between input batches, which indicates the potential value for in-depth search. Furthermore, a novel simulation mechanism is implemented to adapt MCTS in DNN testing, which attain better coverage feedback. The effectiveness of our method is comprehensively investigated on six popular deep learning models from LeNet and VGG families. The comparison experiments are conducted between DeepHunter, TensorFuzz, and DeepSmartFuzzer to demonstrate efficacy on various testing metrics. The experimental results show that the E x 2 $E{x}^{2}$ significantly enhance the coverage gain of DNN fuzzing up to 30% against the best performance in comparison groups.

Steganalysis in real-world application often exhibit skewed sample distribution which poses a massive challenge for steganography detection. Conventional steganalysis algorithms are not effective when the training data distribution is imbalanced, and may fail in the scenario of imbalanced data distribution. To address imbalanced data distribution issue in steganalysis, a novel framework termed adaptive cost-sensitive feature learning via F-measure maximization is proposed, which is inspired by the fact that F-measure is a more suitable performance metric compared to accuracy for imbalanced data. We investigate the adaptive cost-sensitive strategy by generating and assigning different weight to each instance with misclassification occurrence. This scheme adaptively determines the weights according to the intra-class and inter-class costs from the imbalanced distribution. Features corresponding to the largest F-measure can be obtained by solving a series of adaptive cost-sensitive feature learning problems with optimization theory. In this way, the learned features are the most representative features between the cover and stego images so that imbalanced steganalysis can significantly alleviate. Extensive experiments on various imbalanced steganalysis tasks show the superiority of the proposed method over the state-of-the-art methods, and it can recognize more minority samples and has excellent classification performance.