Backdoor attacks pose severe threats to machine learning systems, prompting extensive research in this area. However, most existing work focuses on single-target All-to-One (A2O) attacks, overlooking the more complex All-to-X (A2X) attacks with multiple target classes, which are often assumed to have low attack success rates. In this paper, we first demonstrate that A2X attacks are robust against state-of-the-art defenses. We then propose a novel attack strategy that enhances the success rate of A2X attacks while maintaining robustness by optimizing grouping and target class assignment mechanisms. Our method improves the attack success rate by up to 28%, with average improvements of 6.7%, 16.4%, 14.1% on CIFAR10, CIFAR100, and Tiny-ImageNet, respectively. We anticipate that this study will raise awareness of A2X attacks and stimulate further research in this underexplored area.

As new technologies spread, phone fraud crimes have become master strategies to steal money and personal identities. Inspired by website authentication, we propose an end-to-end data modem over voice channels that can transmit the caller’s digital certificate to the callee for verification. Without assistance from telephony providers, it is difficult to carry useful information over voice channels. For example, voice activity detection may quickly classify the encoded signals as non-speech signals and reject the input waveform. To address this problem, we propose a chirp-based modulation method and corresponding demodulator using deep learning technology. We demonstrate that FastDOV works in the real world and outperforms the existing methods in terms of goodput.

Multivariate time series anomaly detection (MT-SAD) plays a crucial role for the Internet of Things (IoT) systems. Various IoT systems rely on time series to monitor and identify anomalies, as well as to initiate remediation procedures. Existing contrastive learning methods for MTSAD have strong ability to learn invariant representations from augmented views. However, these methods rely on special data augmentation strategies and may not be suitable for certain time series. Besides, when abnormal points intensively occur in a segment, the similarity representations they learned from augmented views would make normal and abnormal points indistinguishable. To address these issues, we propose a novel Anchor-guided contrastive learning method with a general data augmentation strategy for multivariate time series Anomaly Detection (AgileAD). Specifically, this general strategy is a simple yet efficient data augmentation strategy to shuffle each univariate time series (i.e., metric) vertically. It can fit any time series to create different but correlated views. To improve the model discrimination in the presence of anomaly aggregation, AgileAD utilizes an anchor-guided contrastive structure module to learn the anchor representations of the raw input and capture temporal and intermetric dependencies of time series. Moreover, the triplet representation discrepancy is designed to promote the learning of shuffle invariant representations. It cooperates with the guided module to effectively distinguish between normal and abnormal points. Extensive experiments show that AgileAD achieves state-of-the-art results on multiple IoT benchmark datasets.

Transfer learning is a popular method for tuning pretrained (upstream) models for different downstream tasks using limited data and computational resources. We study how an adversary with control over an upstream model used in transfer learning can conduct property inference attacks on a victim's tuned downstream model. For example, to infer the presence of images of a specific individual in the downstream training set. We demonstrate attacks in which an adversary can manipulate the upstream model to conduct highly effective and specific property inference attacks (AUC score > 0.9), without incurring significant performance loss on the main task. The main idea of the manipulation is to make the upstream model generate activations (intermediate features) with different distributions for samples with and without a target property, thus enabling the adversary to distinguish easily between downstream models trained with and without training examples that have the target property. Our code is available at https://github.com/yulongt23/Transfer-Inference.

Federated learning, in contrast to traditional learning paradigms, has demonstrated its unique advantages in providing intelligence at the edge. However, existing federated learning approaches focus on the end-to-end classification tasks requiring a simple collaboration procedure where each participant can perform its local training independently. Unfortunately, there are still many tasks relying on learning the distinguishable feature metrics with respect to all the data, which is a different collaboration procedure across training participants. For example, the model for people identification has to ensure the feature representing a person is dissimilar to those representing others. To enable such federated learning for deep metrics (a.k.a federated deep metric learning) is challenging due to the data privacy and procedure robustness issues. With the consideration of these two challenges, this work proposes a novel computing framework for federated deep metric learning. This framework leverages the system-algorithm co-design to address privacy concerns via the Trusted Execution Environment (SGX enclave) and Differential Privacy mechanism. It also introduces a large-scale federated protocol which can robustly and efficiently deal with practical factors like the network fluctuation. We implement and evaluate our computing framework with two settings. One is a real-world implementation with a large number of mobile devices, while the other one is in our controllable environment for conducting experiments in various tasks. Our evaluation results show that our computing framework is able to train federated deep metric learning models with excellent scalability, data privacy preserving, and considerable accuracy even in exception conditions.

Model compression is a widely-used approach for reducing the size of deep learning models without much accuracy loss, enabling resource-hungry models to be compressed for use on resource-constrained devices. In this paper, we study the risk that model compression could provide an opportunity for adversaries to inject stealthy backdoors. In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a small trigger pattern. We design stealthy backdoor attacks such that the full-sized model released by adversaries appears to be free from backdoors (even when tested using state-of-the-art techniques), but when the model is compressed it exhibits a highly effective backdoor. We show this can be done for two common model compression techniques—model pruning and model quantization—even in settings where the adversary has limited knowledge of how the particular compression will be done. Our findings demonstrate the importance of performing security tests on the models that will actually be deployed not in their precompressed version. Our implementation is available athttps://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts.

In order to perform deep learning tasks everywhere, many optimizations have been proposed to address the resource limitations on mobile systems like IoTs. A key approach among others is to dynamically adjust computational resources of the deep learning inference according to the characteristics of incoming inputs. For example, one of popular optimizations is to pick for each input a suitable combination of computations with respect to its inference difficulty. However, we find out that such “dynamic routing” of computations could be exploited to drain/waste precious resources on mobile deep learning systems. In this work, we introduce a new deep learning attack dimension, the computational resources draining, and demonstrate its feasibility in one of possible attack manners, the adversarial examples of input data. We describe how to construct our special adversarial examples aiming to the resource draining, and show that these poisoned inputs are able to increase the computation loads on purpose with two experiment datasets. We hope that our findings can shed light on the path of improving the robustness of mobile deep learning optimizations.

The great potential of mobile crowdsourcing has started to attract attention of both industries and the research community. However, current commercial mobile crowdsourcing marketplaces are unsatisfactory because of the limited worker base and functionality. In this paper, we first revisit the foundation of performing mobile crowdsourcing on location-based social networks (LBSNs) through specially designed survey studies and comparison experiments involving hundreds of users. Our results reveal that active check-ins are good indicators of picking a right user to perform tasks, and LBSN could be an ideal platform for mobile crowdsourcing given proper services provided. We then propose both the centralized and decentralized design of MobiCrowd, a mobile crowdsourcing service built on LBSNs. Our evaluation, through trace-driven simulation and real-world experiments, demonstrates that the proposed schemes can effectively find workers for mobile crowdsourcing tasks associated with different venues by analyzing their location check-in histories.