Contrastive learning, as an efficient unsupervised learning, has been extensively studied for improving graph neural network (GNN) in graph-structured data mining. With the wider application of GNN, recent work has revealed that it is vulnerable toward privacy leakage (e.g., property inference). How dose contrastive learning influence privacy leakage of GNN? To address the issue, for the first time we comprehensively evaluate the privacy leakage of contrastive learning for GNN. Specifically, we conduct property inference attack on GNN and evaluate the leakage from the perspective of graph augmentation, encoders, negative sampling and privacy preservation on seven graph contrastive learning (GCL) models with five datasets. Based on extensive experiments, several important insights are gained. 1) Contrastive learning will make GNN more vulnerable to property inference attack than supervised GNNs, e.g., the inference accuracy on GCL models is$\boldsymbol{\times\sim}$1.42 of that of supervised GNNs. 2) The strategy of node augmentation in contrastive learning will make the property of the graph easier to steal among all strategies, e.g., it achieves average inference accuracy (ACC) of 83.89% on the node augmentation. 3) Negative sampling based on rationale-aware will lead to easier leakage of graph properties than other strategies, e.g., the ACC of property inference attack is 100% when using rationale-aware. 4) The better performance results of the graph encoder, the more privacy leakage of the graph property, e.g., the ACC of property inference attack reaches 83.89% on average, and reaches 84.40% when GIN is used as the encoder. 5) The simpler the structure of the graph, the more vulnerable its graph properties are, i.e., the AIDS dataset achieved the highest ACC of 90.96 with the simplest structure. 6) Existing privacy-preserving methods for supervised GNN are deficient for GCL, e.g., the ACC of property inference attack after defence maintains 96% of the nondefensive ones. Furthermore, we make an in-depth analyze of the reasons behind these observations for better understanding of robust contrastive learning for GNN.

Deep neural networks (DNNs) have achieved remarkable success in widespread applications. Meanwhile, its vulnerability towards carefully crafted adversarial attacks captures special attention. Not only adversarial perturbations in digital space will fool the target DNNs-based detectors making a wrong decision, but also actually printed patches can be camouflaged to defeat detectors in physical space. In particular, multi-view physical adversarial attacks pose a more serious threat to practical scenarios. The existing attacks are still challenged in three aspects, i.e., high-cost data augmentation, attack performance gap between digital and physical space, and low attack transferability across DNNs. To overcome the challenges, we introduce PhyCamo, a robust physical camouflage framework based on contrastive learning that distinguishes itself from prior research in various critical ways: (1) data augmentation - it utilizes the diffusion model for data augmentation to efficiently simulate sophisticated physical dynamics in real-world; (2) robustness - it leverages contrastive learning to optimize physical camouflage against encoders with the state-of-the-art (SOTA) attack performance; (3) transferability - it mitigates the model-specific noise in the optimization by adopting diverse input methods, thereby amplifying the transferability between models. Extensive experiments are carried out on a car dataset, a tank dataset, and a pedestrian dataset, comparing with 6 classic multi-view physical adversarial attacks in both digital and physical spaces. The results demonstrate PhyCamo’s superior performance. For instance, it generates more effective physical camouflage (with higher attack success rate~×1.26 and reduce the model's average precision by 55%). PhyCamo can also help to improve the robustness of detectors through adversarial training, which contributes to the application of deep neural networks in the field of security sensitivity.

ABSTRACT Federated learning (FL) has been revealed as vulnerable to backdoor attacks since the server cannot directly access the locally collected data of clients, even if they are malicious. Many efforts either try to validate the global model with trusted clients, or try to make it difficult or costly to upload malicious updates. Unfortunately, the existing solutions are still challenged in defending against stealthy backdoor attacks or negative impacts brought to the aggregation. Especially in the non‐independent and identically distributed setting. Moreover, these methods overlook the threat of adaptive attacks, that is, attackers fully know the defense implementation. To address these issues, we propose a novel run‐time defense against diverse backdoor attacks, dubbed HoneyFL . It differs from previous works in three key aspects: (1) effectiveness ‐ it is capable of defending against stealthy backdoors through leveraging honeypot clients; (2) aggregation ‐ it promises effective aggregation since only a limited number of honeypot clients are used; (3) robustness ‐ it can handle adaptive backdoor attacks based on differential prediction. Compared with five state‐of‐the‐art defense baselines, extensive experiments show that HoneyFL produces a higher backdoor detection success rate above 97% and a lower false positive rate below 3%, where seven attacks generate backdoor examples. Its impact on the aggregation results of the main task is negligible. We also show that the defense success rate of HoneyFL against adaptive attacks is approximately 3.52 of the baselines on average.

The vulnerabilities of deep learning models towards adversarial attacks have attracted increasing attention, especially when models are deployed in security-critical domains. Numerous defense methods, including reactive and proactive ones, have been proposed for model robustness improvement. Reactive defenses, such as conducting transformations to remove perturbations, usually fail to handle large perturbations. The proactive defenses that involve retraining, suffer from the attack dependency and high computation cost. In this article, we consider defense methods from the general effect of adversarial attacks that take on neurons inside the model. We introduce the concept of neuron influence, which can quantitatively measure neurons’ contribution to correct classification. Then, we observe that almost all attacks fool the model by suppressing neurons with larger influence and enhancing those with smaller influence. Based on this, we proposeNeuron-level Inverse Perturbation(NIP), a novel defense against general adversarial attacks. It calculates neuron influence from benign examples and then modifies input examples by generating inverse perturbations that can in turn strengthen neurons with larger influence and weaken those with smaller influence. Extensive experiments on benchmark datasets and models show that NIP outperforms the state-of-the-art methods in terms of i)effective- it shows better defense success rate ($\sim \!\!\times 1.45$) against 13 adversarial attacks; ii)elastic- it maintains better defense ($\sim \!\!\times 3.4$in the worst case) on large perturbations; iii)efficient- it runs with only$\sim \!\!1/6$time cost; iv)extensible- it can be applied to speaker recognition models and Baidu online image platforms. We further evaluate NIP against potential adaptive attacks and provide interpretable analysis for its effectiveness.

The increasing complexity of deep neural networks (DNNs) poses significant resource challenges for edge devices, prompting the development of compression technologies like model quantization. However, while improving model efficiency, quantization can introduce or perpetuate the original model’s bias. Existing debiasing methods for quantized models often incur additional costs. To address this issue, we propose FairQuanti , a novel quantization approach that leverages neuron role contribution to achieve fairness. By distinguishing between biased and normal neurons, FairQuanti employs mixed precision quantization to mitigate model bias during the quantization process. FairQuanti has four key differences from previous studies: (1) Neuron Roles - It formally defines biased and normal neuron roles, establishing a framework for feasible model quantization and bias mitigation; (2) Effectiveness - It introduces a fair quantization strategy that discriminatively quantizes neuron roles, balancing model accuracy and fairness through Bayesian optimization; (3) Generality - It applies to both structured and unstructured data across various quantization bit levels; (4) Robustness - It demonstrates resilience against adaptive attacks. Extensive experiments on five datasets (three structured and two unstructured) using five different models validate FairQuanti ’s superior performance against eight baseline methods. Specifically, fairness metrics such as demographic parity (DP) improve by approximately 1.03 times, and the demographic parity ratio (DPR) improves by approximately 1.51 times compared to the baselines, with an average accuracy loss of less than 7.5% at 8-bit quantization. FairQuanti presents a promising solution for deploying fair and efficient deep models on resource-constrained devices and holds potential for application in large language models to reduce size and computational demands while minimizing bias. Our source code is available at https://github.com/Caozq2/FairQuanti .

Federated learning (FL) enables resource-constrained node devices to learn a shared model while keeping the training data local. Since recent research has demonstrated multiple privacy leakage attacks in FL, e.g., gradient inference attacks and membership inference attacks, differential privacy (DP) is applied to serve as one of the most effective privacy protection mechanisms. Despite the benefit DP brings, we observe that the introduction of DP also brings random changes to client updates, which will affect the robust aggregation algorithms. We reveal a novel poisoning attack under the cover of DP, named the DP-Poison attack in FL. Specifically, the DP-Poison attack is designed to achieve four goals: (1) maintaining the main task performance; (2) launching a successful attack; (3) escaping the robust aggregation algorithms in FL; and (4) keeping the effectiveness of DP privacy protection. To achieve these goals, we design multiple optimization goals to generate DP noise through a genetic algorithm. The optimization ensures that while the benign updates change randomly, the malicious updates can change toward the global model after adding the DP noise, so that it is easier to be accepted by the robust aggregation algorithms. Extensive experiments show that DP-Poison achieves a nearly 100% attack success rate while maintaining the proposed four goals.

With the rise of autonomous driving, LiDAR-based object detection using deep neural networks (DNNs) has shown exceptional performance. However, DNNs are vulnerable to adversarial attacks, especially on LiDAR sensors. Existing attacks face challenges in terms of (i) effective -they’re generally effective in white-box scenarios, but suffer significant performance degradation in black-box scenarios; (ii) robustness -they’re much less effective when exposed to the diverse changes in the real world (i.e., angle and distance changes); (iii) concealing -most attacks overlook the crucial stealth aspect, making them susceptible to detection and defense. To address these issues, LiDAttack is introduced as a robust black-box attack that leverages genetic algorithms with simulated annealing to precisely control perturbation points, ensuring both stealth and efficacy. Extensive experiments on KITTI, nuScenes, and a custom dataset demonstrate LiDAttack’s high attack success rate (ASR) of up to 90% across diverse detection models (PointRCNN, PointPillar, PV-RCNN++). Practical robustness is validated in real world tests, both indoors and outdoors. For concealment, the generated adversarial object volume is restricted to under 0.1% of the target object’s volume, achieving ASR up to 90%. The code is available at https://github.com/Cinderyl/LiDAttack.git

Federated learning has achieved remarkable results in a variety of decision-making tasks, but may create models that are biased toward some groups due to the labeling bias and distributional differences of client data. Therefore, exploring how to reduce decision-making bias is an urgent problem for future large-scale deployment of federated learning systems into society. The most effective approaches to enhance the fairness of federated learning include preprocessing, in-processing, and post-processing algorithms, which improve the fairness and credibility of the models while preserving privacy. However, existing debiasing algorithms are still limited in three aspects: poor fairness enhancement of the global model, high impact on the performance of the main task, and inconsistent evaluation metrics. Motivated by the challenge of group fairness in federated learning, we propose Fedfair, a debiasing algorithm for federated learning systems that differs from previous work in several key aspects: (1) it requires clients to upload a small amount of anonymized data to the server, which allows most centralized debiasing algorithms that rely on data to be applied to federated learning; (2) by mapping the implicit relationship between the model and the group bias, it fine-tunes the global model to reduce the group bias, thus weakening the impact on the model's performance on the main task; (3) it applies a unified fairness evaluation metric, which reasonably and intuitively demonstrates the advantages of debiasing compared to various other algorithms. Experiments verify that compared with other federated learning debiasing algorithms, Fedfair is more efficient, the debiasing effect is more obvious, and the impact on the performance of federated learning models is weaker.

Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses’ transaction behavior features by random walking or constructing static subgraphs. The random walking methods, unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address’s transaction behaviors in different periods. Then, we provide a fast nonparametric phishing detector (FD) to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions toward a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learned time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art (SOTA) detection performance. The code of TEGDetector is open sourced at https://github.com/Seaocn/TEGDetector.

Graph neural network (GNN) with a powerful representation capability has been widely applied to various areas. Recent works have exposed that GNN is vulnerable to the backdoor attack, i.e., models trained with maliciously crafted training samples are easily fooled by patched samples. Most of the proposed studies launch the backdoor attack using a trigger that is either the randomly generated subgraph [e.g., erdős-rényi backdoor (ER-B)] for less computational burden or the gradient-based generative subgraph [e.g., graph trojaning attack (GTA)] to enable a more effective attack. However, the interpretation of how is the trigger structure and the effect of the backdoor attack related has been overlooked in the current literature. Motifs, recurrent and statistically significant subgraphs in graphs, contain rich structure information. In this article, we are rethinking the trigger from the perspective of motifs and propose a motif-based backdoor attack, denoted as Motif-Backdoor. It contributes from three aspects. First, Interpretation, it provides an in-depth explanation for backdoor effectiveness by the validity of the trigger structure from motifs, leading to some novel insights, e.g., using subgraphs that appear less frequently in the graph as the trigger can achieve better attack performance. Second, Effectiveness, Motif-Backdoor reaches the state-of-the-art (SOTA) attack performance in both black-box and defensive scenarios. Third, Efficiency, based on the graph motif distribution, Motif-Backdoor can quickly obtain an effective trigger structure without target model feedback or subgraph model generation. Extensive experimental results show that Motif-Backdoor realizes the SOTA performance on three popular models and four public datasets compared with five baselines, e.g., Motif-Backdoor improves the attack success rate (ASR) by 14.73% compared with baselines on average. In addition, under a possible defense, Motif-Backdoor still implements satisfying performance, highlighting the requirement of defenses against backdoor attacks on GNNs. The datasets and code are available athttps://github.com/Seaocn/Motif-Backdoor.

Link prediction, inferring the undiscovered or potential links of the graph, is widely applied in the real world. By facilitating labeled links of the graph as the training data, numerous deep learning-based link prediction methods have been studied, which have dominant prediction accuracy compared with nondeep methods. However, the threats of maliciously crafted training graphs will leave a specific backdoor in the deep model; thus, when some specific examples are fed into the model, it will make a wrong prediction, defined as a backdoor attack. It is an important aspect that has been overlooked in the current literature. In this article, we prompt the concept of a backdoor attack on link prediction and propose Link-Backdoor to reveal the training vulnerability of the existing link prediction methods. Specifically, the Link-Backdoor combines the fake nodes with the nodes of the target link to form a trigger. Moreover, it optimizes the trigger by the gradient information from the target model. Consequently, the link prediction model trained on the backdoored dataset will predict the link with a trigger to the target state. Extensive experiments on five benchmark datasets and five well-performing link prediction models demonstrate that the Link-Backdoor achieves the state-of-the-art attack success rate under both the white box (i.e., available of the target model parameter) and the black box (i.e., unavailable of the target model parameter) scenarios. In addition, we testify the attack under the defensive circumstance, and the results indicate that the Link-Backdoor still can construct a successful attack on the well-performing link prediction methods. The code and data are available athttps://github.com/Seaocn/Link-Backdoor.

With the development of deep learning processors and accelerators, deep learning models have been widely deployed on edge devices as part of the Internet of Things. Edge device models are generally considered as valuable intellectual properties that are worth for careful protection. Unfortunately, these models have a great risk of being stolen or illegally copied. The existing model protections using encryption algorithms are suffered from high computation overhead which is not practical due to the limited computing capacity on edge devices. In this work, we propose a light-weight, practical, and general Edge device model Protection method at neuron level, denoted as EdgePro. Specifically, we select several neurons as authorization neurons and set their activation values to locking values and scale the neuron outputs during training, where the authorization neurons, locking value, and scale factor together form the “passwords”. Then, we design lock training to implement model property protection through alternately locking and releasing, which correspond to model performance preservation and encryption, respectively. EdgePro protects the model by ensuring it can only work correctly when the “passwords” are met, at the cost of encrypting and storing the information of the “passwords” instead of the whole model. Extensive experimental results indicate that EdgePro can work well on the task of protecting models on different datasets. The inference time increase of EdgePro is only 60% of state-of-the-art methods, and the accuracy loss is less than 1%. Additionally, EdgePro is robust against adaptive attacks including fine-tuning, reverse engineering, and pruning, which makes it more practical in real-world applications. EdgePro is also open sourced to facilitate future research:https://github.com/Leon022/EdgePro.

The backdoor attacks have posed a severe threat to deep neural networks (DNNs). Online training platforms and third-party model training providers are more vulnerable to backdoor attacks due to uncontrollable data sources, untrusted developers or unmonitorable training processes. Researchers have proposed to detect the backdoor in the well-trained models, and then remove them by some mitigation techniques, e.g., retraining and pruning. However, they are still limited from two aspects: (i) real-time - they cannot detect in time at the beginning of training due to their reliance on well-trained models; (ii) mitigation effect - the later discovery of backdoors usually leads to 1) deeper backdoors, 2) less effective mitigation, and 3) greater costs. To address these challenges, we rethink the evolution of the backdoor, and intend to cope with backdoors along with the online training process, that is to detect the backdoors sooner rather than later. We propose BackdoorTracer, a novel framework that detects the backdoor in the training phase. BackdoorTracer constructs the model into an equivalent graph based on the activated neural path during training, thereby detecting the backdoor through multiple graph metrics. BackdoorTracer can incorporate any existing backdoor mitigation approaches that require accessing training to stop the impact of backdoors as soon as possible. It differs from previous works in several key aspects: (i) lightweight - BackdoorTracer is independent of the training process, and thus it has little negative impact on the training efficiency and testing accuracy; (ii) generalizable - it works different modalities of data, models and different backdoor attacks. BackdoorTracer outperforms the state-of-the-art (SOTA) detection approaches in experiments on 5 modes, 10 models and 9 backdoor attack scenarios. Compared with the existing 5 backdoor detection methods, our method can detect backdoors earlier ($\sim ~1.5$epochs) and higher detection rate (~ +10%), effectively improving the effectiveness of backdoor defense (ASR. ~ -78%, ACC. +47%). Finally, we make BackdoorTracer a plug-and-play backdoor detector, which enables real-time backdoor tracing in the training phase.

Consensus protocols play a crucial role in determining the security and performance of blockchain systems, with committee-based consensus protocols being particularly important, especially in sharding consensus protocols. Anonymous election of committee nodes can mitigate DDoS attacks and bribery attempts. This approach can also be applied to sharding systems to mitigate the risk associated with a single vulnerable shard. However, current node secret selection schemes still present remaining issues. Single secret leader election schemes struggle to elect multiple leaders with equal anonymity, and existing secret committee election schemes lack adequate measures for tracking malicious nodes. To address these issues, we propose accountable secret committee election schemes that not only regulate the number of nodes but also maintain anonymity during the phases of leader proposal and verifier voting. Furthermore, our schemes enable the tracing of malicious nodes in a threshold way. In addition, we introduce two efficient threshold traceable membership proof schemes for both ad hoc and interactive scenarios. Unlike traceable ring signatures, our scheme can trace malicious nodes even after a single malicious behavior. Subsequently, we apply the accountable secret committee election scheme to sharding blockchains and devise a fully accountable anonymous consensus protocol. The experiment demonstrates that this protocol can elevate the difficulty of corrupting a single shard to the level of compromising the entire system, thereby significantly enhancing the security of the sharding system.

A wireless communications system usually consists of a transmitter which transmits the information and a receiver which recovers the original information from the received distorted signal. Deep learning (DL) has been used to improve the performance of the receiver in complicated channel environments and state-of-the-art (SOTA) performance has been achieved. However, its robustness has not been investigated. In order to evaluate the robustness of DL-based information recovery models under adversarial circumstances, we investigate adversarial attacks on the SOTA DL-based information recovery model, i.e., DeepReceiver. We formulate the problem as an optimization problem with power and peak-to-average power ratio (PAPR) constraints. We design different adversarial attack methods according to the adversary’s knowledge of DeepReceiver’s model and/or testing samples. Extensive experiments show that the DeepReceiver is vulnerable to the designed attack methods in all of the considered scenarios. Even in the scenario of both model and test sample restricted, the adversary can attack the DeepReceiver and increase its bit error rate (BER) above 10%. It can also be found that the DeepReceiver is vulnerable to adversarial perturbations even with very low power and limited PAPR. These results suggest that defense measures should be taken to enhance the robustness of DeepReceiver.

Deep neural networks (DNNs) have demonstrated their outperformance in various software systems, but also exhibit misbehavior and even result in irreversible disasters. Therefore, it is crucial to identify the misbehavior of DNN-based software and improve DNNs' quality. Test input prioritization is one of the most appealing ways to guarantee DNNs' quality, which prioritizes test inputs so that more bug-revealing inputs can be identified earlier with limited time and manual labeling efforts. However, the existing prioritization methods are still limited from three aspects: certifiability, effectiveness, and generalizability. To overcome the challenges, we propose CertPri, a test input prioritization technique designed based on a movement cost perspective of test inputs in DNNs' feature space. CertPri differs from previous works in three key aspects: (1) certifiable - it provides a formal robustness guarantee for the movement cost; (2) effective - it leverages formally guaranteed movement costs to identify malicious bug-revealing inputs; and (3) generic - it can be applied to various tasks, data, models, and scenarios. Extensive evaluations across 2 tasks (i.e., classification and regression), 6 data forms, 4 model structures, and 2 scenarios (i.e., white-box and black-box) demonstrate CertPri's superior performance. For instance, it significantly improves 53.97 % prioritization effectiveness on average compared with baselines. Its robustness and generalizability are 1.41~2.00 times and 1.33~3.39 times that of baselines on average, respectively. The code of CertPri is open-sourced at https://github.com/haibinzheng/CertPri.

The communication efficiency optimization, censorship resilience, and generation of shared randomness are inseparable from the threshold cryptography in the existing Byzantine Fault Tolerant (BFT) consensus. The membership in consensus in a blockchain scenario supports dynamic changes, which effectively prevents the corruption of consensus participants. Especially in cross-chain protocols, the dynamic access to different blockchains will inevitably bring about the demand for member dynamic. Most existing threshold cryptography schemes rely on redefined key shares, leading to a static set of secret sharing participants. In this paper, we propose a general approach to coupling blockchain consensus and dynamic secret sharing. The committee performs consensus confirmation of both dynamic secret sharing and transaction proposals. Our scheme facilitates threshold cryptography membership dynamic, thus underlying support for membership dynamic of threshold cryptography-based BFT consensus schemes. We instantiate a dynamic HotStuff consensus to demonstrate the effectiveness of the scheme. After the correctness and security proof, our scheme achieves the secrecy and integrity of the threshold key shares while ensuring consensus liveness and safety. Experimental results prove that our scheme obtains dynamic membership with negligible overhead.

Graph neural network (GNN) has achieved great success on graph representation learning. Challenged by large-scale private data collected from user side, GNN may not be able to reflect the excellent performance, without rich features and complete adjacent relationships. Addressing the problem, vertical federated learning (VFL) is proposed to implement local data protection through training a global model collaboratively. Consequently, for graph-structured data, it is a natural idea to construct a GNN-based VFL (GVFL) framework. However, GNN has been proven vulnerable to adversarial attacks. Whether the vulnerability will be brought into the GVFL has not been studied. This is the first study of adversarial attacks on GVFL. A novel adversarial attack method is proposed, named Graph-Fraudster. It generates adversarial perturbations based on the noise-added global node embeddings via the privacy leakage and the gradient of pairwise node. Specifically, first, Graph-Fraudster steals the global node embeddings and sets up a shadow model of the server for the attack generator. Second, noise is added into node embeddings to confuse the shadow model. Finally, the gradient of pairwise node is used to generate attacks with the guidance of noise-added node embeddings. Extensive experiments on five benchmark datasets demonstrate that Graph-Fraudster achieves the state-of-the-art attack performance compared with baselines in different GNN based GVFLs. Furthermore, Graph-Fraudster can remain a threat to GVFL even if two possible defense mechanisms are applied. In addition, some suggestions are put forward for the future work to improve the robustness of GVFL. The code and datasets can be downloaded athttps://github.com/hgh0545/Graph-Fraudster.

Graph embedding learns low-dimensional representations for nodes or edges on the graph, which is widely applied in many real-world applications. Excessive graph mining promotes the research of attack methods on graph embedding. Most attack methods generate perturbations that maximize the deviation of the prediction confidence. They are difficult to accurately misclassify the instances into the target label, and the nonminimized perturbations are more easily detected by defense methods. To address these problems, we propose Graphfool, a novel targeted label adversarial attack on graph embedding. It can generate adversarial graphs to attack graph embedding methods via classification boundary and gradient information in the target graph embedding method. Graphfool first estimates the classification boundaries of different categories. Then, it calculates the minimum perturbation matrix to misclassify the attacked node according to the target classification boundary. Finally, the adjacency matrix is modified according to the maximum absolute value of the perturbation matrix. Extensive experiments demonstrate that Graphfool achieves the state-of-the-art attack performance with minimum perturbations. Besides, the possible defense experiments further prove that the perturbations generated by Graphfool are more imperceptible.

Deep neural networks (DNNs) have demonstrated their outperformance in various domains. However, it raises a social concern whether DNNs can produce reliable and fair decisions especially when they are applied to sensitive domains involving valuable resource allocation, such as education, loan, and employment. It is crucial to conduct fairness testing before DNNs are reliably deployed to such sensitive domains, i.e., generating as many instances as possible to uncover fairness violations. However, the existing testing methods are still limited from three aspects: interpretability, performance, and generalizability. To overcome the challenges, we propose NeuronFair, a new DNN fairness testing framework that differs from previous work in several key aspects: (1) interpretable - it quantitatively interprets DNNs' fairness violations for the biased decision; (2) effective - it uses the interpretation results to guide the generation of more diverse instances in less time; (3) generic - it can handle both structured and unstructured data. Extensive evaluations across 7 datasets and the corresponding DNNs demonstrate NeuronFair's superior performance. For instance, on structured datasets, it generates much more instances (~ ×5.84) and saves more time (with an average speedup of 534.56%) compared with the state-of-the-art methods. Besides, the instances of NeuronFair can also be leveraged to improve the fairness of the biased DNNs, which helps build more fair and trustworthy deep learning systems. The code of NeuronFair is open-sourced at https://github.com/haibinzheng/NeuronFair.

Despite of its tremendous popularity and success in computer vision (CV) and natural language processing, deep learning is inherently vulnerable to adversarial attacks in which adversarial examples (AEs) are carefully crafted by imposing imperceptible perturbations on the clean examples to deceive the target deep neural networks (DNNs). Many defense solutions in CV have been proposed. However, most of them, e.g., adversarial training, suffer from a low generality due to the reliance on limited AEs. Moreover, some solutions even have a non-negligible negative impact on the classification accuracy of clean examples. Last but not least, they are impotent against the unconstrained attacks in which the attackers optimize the perturbation direction and size by additionally taking the defense methods into accounts. In this article, we propose GRIP-GAN to learn a general robust inverse perturbation (GRIP), which is not only able to offset any potential adversarial perturbations but also strengthen the target class-related features, purely from the clean images via a generative adversarial network (GAN). By feeding a random noise, GRIP-GAN is able to generate a dynamic GRIP for each input image to defend against unconstrained attacks. To further improve the defense performance, we also enable GRIP-GAN to generate a GRIP tailored to each input image via feeding input image specific noise to GRIP-GAN. Extensive experiments are carried out on MNIST, CIFAR10, and ImageNet datasets against 17 adversarial attacks. The results show that GRIP-GAN outperforms all the baselines. We further share insights on the success of GRIP-GAN and provide visualized proofs.

The adversarial attack methods based on gradient information can adequately find the perturbations, that is, the combinations of rewired links, thereby reducing the effectiveness of the deep learning model-based graph embedding algorithms, but it is also easy to fall into a local optimum. Therefore, this article proposes a momentum gradient attack (MGA) against the graph convolutional network (GCN) model, which can achieve more aggressive attacks with fewer rewiring links. Compared with directly updating the original network using gradient information, integrating the momentum term into the iterative process can stabilize the updating direction, which makes the model jump out of poor local optimum and enhances the method with stronger transferability. Experiments on node classification and community detection methods based on three well-known network embedding algorithms show that MGA has a better attack effect and transferability.

Recently, a graph neural network (GNN) was proposed to analyze various graphs/networks, which has been proven to outperform many other network analysis methods. However, it is also shown that such state-of-the-art methods suffer from adversarial attacks, i.e., carefully crafted adversarial networks with slight perturbation on clean one may invalid these methods on lots of applications, such as network embedding, node classification, link prediction, and community detection. Adversarial training has been testified as an efficient defense strategy against adversarial attacks in computer vision and graph mining. However, almost all the algorithms based on adversarial training focus on global defense through overall adversarial training. In a more practical scene, certain users would be targeted to attack, i.e., specific labeled users. It is still a challenge to defend against target node attack by existing adversarial training methods. Therefore, we propose smoothing adversarial training (SAT) to improve the robustness of GNNs. In particular, we analytically investigate the robustness of graph convolutional network (GCN), one of the classic GNNs, and propose two smooth defensive strategies: smoothing distillation and smoothing cross-entropy loss function. Both of them smooth the gradients of GCN and, consequently, reduce the amplitude of adversarial gradients, benefiting gradient masking from attackers in both global attack and target label node attack. The comprehensive experiments on five real-world networks testify that the proposed SAT method shows state-of-the-art defensibility against different adversarial attacks on node classification and community detection. Especially, the average attack success rate of different attack methods can be decreased by about 40% by SAT at the cost of tolerable embedding performance decline of the original network.

Signal modulation recognition plays a critical role in many fields to identify the modulation type of wireless signals. Since the deep learning based models have achieved great success in classification tasks, more deep neural networks are proposed for signal modulation recognition. In this paper, we explore the use of different deep neural networks in both macro network architecture level and micro cell size and layer level to compare and understand their effect on classification performance. We also bring up a feature explainable deep neural network by visualizing the critical features in the deep neural models. We visually show and compare the commonality and differences of hidden layer characteristics extracted by different network structure to explain and analyze the reason why some models can achieve better classification results than the others. We believe it is an effective way to explain how deep neural model based signal classification work. Thus the explanation will help users establish appropriate understand and trust in predictions from deep modulation recognition networks.

Recommender systems are becoming more and more important in our daily lives. However, traditional recommendation methods are challenged by data sparsity and efficiency, as the numbers of users, items, and interactions between the two in many real-world applications increase fast. In this paper, we propose a novel clustering recommender system based on node2vec technology and rich information network, namely, N2VSCDNNR, to solve these challenges. In particular, we use a bipartite network to construct the user-item network and represent the interactions among users (or items) by the corresponding one-mode projection network. In order to alleviate the data sparsity problem, we enrich the network structure according to user and item categories, and construct the one-mode projection category network. Then, considering the data sparsity problem in the network, we employ node2vec to capture the complex latent relationships among users (or items) from the corresponding one-mode projection category network. Moreover, considering the dependence on parameter settings and information loss problem in clustering methods, we use a novel spectral clustering method, which is based on dynamic nearest-neighbors (DNNs) and a novel automatically determining cluster number (ADCN) method that determines the cluster centers based on the normal distribution method, to cluster the users and items separately. After clustering, we propose the two-phase personalized recommendation to realize the personalized recommendation of items for each user. A series of experiments validate the outstanding performance of our N2VSCDNNR over several advanced embedding and side information based recommendation algorithms. Meanwhile, N2VSCDNNR seems to have lower time complexity than the baseline methods in online recommendations, indicating its potential to be widely applied in large-scale systems.

Network embedding plays an important role in various network applications, such as node classification and link prediction. Lots of structure-based network embedding methods have been proposed. Yet, they suffer from unsteady embedding performances due to the parameter sensitivity. How to extract valuable attribute information in networks with less parameter influence is still a challenge. In this paper, we propose a novel algorithm, named adaptive network embedding with particle swarm optimization (PSO-ANE), which is based on the second-order dynamic random walk and PSO method, for learning network representations. A second-order dynamic random walk is designed to search a suitable strategy for each node based on the structure-based transition probability, the centrality-based transition probability, and the static link weights. To reduce the parameter dependence, PSO is adopted for key-parameter optimization to get global steady network embedding. The experiments validate that the proposed method outperforms the existing state-of-the-art techniques on multilabel classification, multiclass classification, and link prediction tasks.

Abstract Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature‐then‐encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute‐based signcryption (ABSC), which simultaneously achieves the functionalities of attribute‐based encryption and attribute‐based signature, two important cryptographic primitives proposed to enforce fine‐grained access control and user authentication in cloud computing applications. In this paper, we present a threshold ABSC scheme. The scheme is proven secure under the well‐established Decisional Bilinear Diffie–Hellman and the standard Computational Diffie–Hellman assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle. Furthermore, we construct an authenticated key agreement protocol based on this threshold attribute‐based signcryption from the point of improving the security of cloud computing. Copyright © 2016 John Wiley & Sons, Ltd.

Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature-then-encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute-based signcrytion (ABSC) which simultaneously achieves the functionalities of attribute-based encryption (ABE) and attribute-based signature (ABS), two important cryptographic primitives proposed to enforce fine-grained access control and user authentication in cloud computing applications. In this paper, we present a threshold attribute-based signcryption (TABSC) scheme. The scheme is proven secure under the well-established Decisional Bilinear Diffie-Hellman (DBDH) and the standard Computational Diffie-Hellman (CDH) assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle.