Automatic speaker verification (ASV), one of the most important technology for biometric identification, has been widely adopted in security-critical applications. However, ASV is seriously vulnerable to recently emerged adversarial attacks, yet effective counter-measures against them are limited. In this paper, we adopt neural vocoders to spot adversarial samples for ASV. We use the neural vocoder to re-synthesize audio and find that the difference between the ASV scores for the original and re-synthesized audio is a good indicator for discrimination between genuine and adversarial samples. This effort is, to the best of our knowledge, among the first to pursue such a technical direction for detecting time-domain adversarial samples for ASV, and hence there is a lack of established baselines for comparison. Consequently, we implement the Griffin-Lim algorithm as the detection baseline. The proposed approach achieves effective detection performance that outperforms the baselines in all the settings. We also show that the neural vocoder adopted in the detection framework is dataset-independent. Our codes will be made open-source for future works to do fair comparison1.

With the development of speech synthesis or voice conversion, speech spoofing countermeasures are increasingly required for protecting automatic speaker verification system. In our daily life, if we are familiar with the speaker, we tend to seek her/his traits in our memory to distinguish between bona fide and spoofed speech of her/him. Speaker label can not be directly used to guide the training of anti-spoofing network because it is difficult to obtain in real scenes. Motivated by this, we use x-vectors to represent speaker information and propose two novel methods by introducing x-vectors on the acoustic feature and embedding level into the two mainstream anti-spoofing methods (LightCNN and SeNet). An attention module is also added on the embedding level for further improvement. Experimental results on the ASVspoof 2019 logical access (LA) database show that the best EER and mintDCF in our methods are 0.98% and 0.0294, outperforming state-of-the-art single systems as far as we know.

Privacy attacks on machine learning models aim to identify the data that is used to train such models. Such attacks, traditionally, are studied on static models that are trained once and are accessible by the adversary. Motivated to meet new legal requirements, many machine learning methods are recently extended to support machine unlearning, i.e., updating models as if certain examples are removed from their training sets, and meet new legal requirements. However, privacy attacks could potentially become more devastating in this new setting, since an attacker could now access both the original model before deletion and the new model after the deletion. In fact, the very act of deletion might make the deleted record more vulnerable to privacy attacks. Inspired by cryptographic definitions and the differential privacy framework, we formally study privacy implications of machine unlearning. We formalize (various forms of) deletion inference and deletion reconstruction attacks, in which the adversary aims to either identify which record is deleted or to reconstruct (perhaps part of) the deleted records. We then present successful deletion inference and reconstruction attacks for a variety of machine learning models and tasks such as classification, regression, and language models. Finally, we show that our attacks would provably be precluded if the schemes satisfy (variants of) deletion compliance (Garg, Goldwasser, and Vasudevan, Eurocrypt’20).

Graph alignment aims to identify node correspondence across multiple graphs, with significant implications in various domains. As supervision information is often not available, unsupervised methods have attracted a surge of research interest recently. Most of existing unsupervised methods assume that corresponding nodes should have similar local structure, which, however, often does not hold. Meanwhile, rich node attributes are often available and have shown to be effective in alleviating the above local topology inconsistency issue. Motivated by the success of graph convolution networks (GCNs) in fusing network and node attributes for various learning tasks, we aim to tackle the graph alignment problem on the basis of GCNs. However, directly grafting GCNs to graph alignment is often infeasible due to multi-faceted challenges. To bridge the gap, we propose a novel unsupervised graph alignment framework WAlign. We first develop a lightweight GCN architecture to capture both local and global graph patterns and their inherent correlations with node attributes. Then we prove that in the embedding space, obtaining optimal alignment results is equivalent to minimizing the Wasserstein distance between embeddings of nodes from different graphs. Towards this, we propose a novel Wasserstein distance discriminator to identify candidate node correspondence pairs for updating node embeddings. The whole process acts like a two-player game, and in the end, we obtain discriminative embeddings that are suitable for the alignment task. Extensive experiments on both synthetic and real-world datasets validate the effectiveness and efficiency of the proposed framework WAlign.

In this paper, we study PAC learnability and certification under instance-targeted poisoning attacks, where the adversary may change a fraction of the training set with the goal of fooling the learner at a specific target instance. Our first contribution is to formalize the problem in various settings, and explicitly discussing subtle aspects such as learner’s randomness and whether (or not) adversary’s attack can depend on it. We show that when the budget of the adversary scales sublinearly with the sample complexity, PAC learnability and certification are achievable. In contrast, when the adversary’s budget grows linearly with the sample complexity, the adversary can potentially drive up the expected 0-1 loss to one. We also study distribution-specific PAC learning in the same attack model and show that proper learning with certification is possible for learning half spaces under natural distributions. Finally, we empirically study the robustness of K nearest neighbour, logistic regression, multi-layer perceptron, and convolutional neural network on real data sets against targeted-poisoning attacks. Our experimental results show that many models, especially state-of-the-art neural networks, are indeed vulnerable to these strong attacks. Interestingly, we observe that methods with high standard accuracy might be more vulnerable to instance-targeted poisoning attacks.

Recurrent Neural Networks (RNNs) have made great achievements for sequential prediction tasks. In practice, the target sequence often follows certain model properties or patterns (e.g., reasonable ranges, consecutive changes, resource constraint, temporal correlations between multiple variables, existence, unusual cases, etc.). However, RNNs cannot guarantee their learned distributions satisfy these model properties. It is even more challenging for predicting large-scale and complex Cyber-Physical Systems. Failure to produce outcomes that meet these model properties will result in inaccurate and even meaningless results. In this paper, we develop a new temporal logic-based learning framework, STLnet, which guides the RNN learning process with auxiliary knowledge of model properties, and produces a more robust model for improved future predictions. Our framework can be applied to general sequential deep learning models, and trained in an end-to-end manner with back-propagation. We evaluate the performance of STLnet using large-scale real-world city data. The experimental results show STLnet not only improves the accuracy of predictions, but importantly also guarantees the satisfaction of model properties and increases the robustness of RNNs.

Estimating multiple sparse Gaussian Graphical Models (sGGMs) jointly for many related tasks (large $K$) under a high-dimensional (large $p$) situation is an important task. Most previous studies for the joint estimation of multiple sGGMs rely on penalized log-likelihood estimators that involve expensive and difficult non-smooth optimizations. We propose a novel approach, FASJEM for \underlinefast and \underlinescalable \underlinejoint structure-\underlineestimation of \underlinemultiple sGGMs at a large scale. As the first study of joint sGGM using the M-estimator framework, our work has three major contributions: (1) We solve FASJEM through an entry-wise manner which is parallelizable. (2) We choose a proximal algorithm to optimize FASJEM. This improves the computational efficiency from $O(Kp^3)$ to $O(Kp^2)$ and reduces the memory requirement from $O(Kp^2)$ to $O(K)$. (3) We theoretically prove that FASJEM achieves a consistent estimation with a convergence rate of $O(\log(Kp)/n_tot)$. On several synthetic and four real-world datasets, FASJEM shows significant improvements over baselines on accuracy, computational complexity and memory costs.

Autonomic service-oriented computing system, which exposes much flexibility and intelligence, is taken as a promising paradigm to deal with drawbacks appearing in current complex large scale heterogeneous computing systems, such as difficulties in construction, administration and maintenance. However presently there are not suitable approaches to design and implement such kind of systems. In this paper, a lightweight approach to autonomic service-oriented computing system development is proposed. The approach consists of three parts: an architectural style which entails quite a few flexible and intelligent properties; a lightweight process to design computing system under the proposed architectural style; a high level executable modeling language to implement the designed system. A case study is given to illustrate the approach

Cooperative design is distinguished from other cooperative behaviors by its inherent requirement for creativity. It is usually an ill-structured problem without complete and precise prescription. However, current agent-based cooperative design systems, which simply apply traditional multi-agent models to the domain of cooperative design, lack the adaptation to meet this essential requirement, so cannot be well applied. This paper proposes a hybrid multi-agent collaboration mode integrating determinate (recipe-guided) collaboration, policy-compliant collaboration and self-organizing mechanism for cooperative design. Determinate collaboration is suitable for those problems with determinate solutions in the design, while policy-compliant collaboration and self-organizing mechanism have advantages in dynamic regulations and loosely-coupled collaboration, which is necessary for creative work. They are complementary to each problem domain. Hence the hybrid mode is adaptive and flexible to broad organizing requirements of cooperative design process. The RPACPIagent model constructed for the hybrid collaboration mode is the core of the system, and thus formally specified in this paper. A case study is also given in this paper

Appropriate trust in and reliance on automation are critical for safe and efficient system operation. This paper fills an important research gap by describing a quantitative model of trust in automation. We extend decision field theory (DFT) to describe the multiple sequential decisions that characterize reliance on automation in supervisory control situations. Extended DFT (EDFT) represents an iterated decision process and the evolution of operator preference for automatic and manual control. The EDFT model predicts trust and reliance, and describes the dynamic interaction between operator and automation in a closed-loop fashion: the products of earlier decisions can transform the nature of later events and decisions. The simulation results show that the EDFT model captures several consistent empirical findings, such as the inertia of trust and the nonlinear characteristics of trust and reliance. The model also demonstrates the effects of different types of automation on ttrust and reliance. It is possible to expand the EDFT model for multioperator multiautomation situations.

Although EDI (electronic data interchange) have provided a useful method to the automated message interchanging between enterprises, this method costs a lot of money and resources, there is a new technology named ebXML (electronic business using eXtensible Markup Language) BPSS (business process specification schema) which provides a more easy way to integrate the whole business process. EbXML BPSS supports the specification of the set of elements required to configure a runtime system in order to execute a set of ebXML business transactions. EbXML BPSS describes which message should be interchanged and how to interchange, and provides a set of specification for the process automation. In this study, we propose a federated multi-agents system, which can implement the business process, and describe a detailed mechanism to apply the BPS to a prototype implementation.

Location management, which consists of location updating and location query, is a challenging topic in mobile communication. The location query of the basic location management scheme (basic scheme for short) used in personal communication services (PCS) networks, such as GSM, IS-41 and so forth, in many countries, requires to page all the cells of a location area (LA) simultaneously. Obviously, this scheme is likely to waste the system's channel resource and processing resource enormously, since the LA is constituted by many cells while the mobile only resides in one cell. This paper proposed a new location management scheme (cell layered scheme for short) that layered all the cells of each LA and paged the cells one layer after another in order of the probabilities from large to small. In addition, both the probability of the mobile residing in each layer and the average number of cell layers paged by the cell layered scheme, are derived. Generally, the cost of the location management of the cell layered scheme is less than that of the basic scheme. Furthermore, the cell layered scheme makes it possible to make efficient use of the limited frequency spectrum efficiently.