Federated recommendation systems (FedRecs) enable multiple clients to collaboratively train recommendation models without directly sharing private user data, providing a promising solution for privacy protection. However, recent studies reveal that the collaborative mechanism in FedRecs still faces serious privacy leakage risks. To systematically assess these vulnerabilities, this article proposes CiCo-MIA, aCausalinference-basedCollaborativeMembershipInferenceAttack designed to quantify the privacy risks of FedRecs through a shadow recommendation model. CiCo-MIA utilizes interaction data from multiple clients to train a shadow model that mirrors the behavior of the target FedRecs. By constructing a causal graph and introducing counterfactual reasoning, we develop a user–item impact elimination module that enhances the robustness and interpretability of the attack. Additionally, a dynamic aggregation strategy is proposed to balance attack effectiveness and recommendation performance. Extensive experiments on six real-world datasets under two FedRec frameworks demonstrate that CiCo-MIA achieves state-of-the-art performance, improving F1 scores by about 20% and HR@10 by at least 20% compared with baseline attacks. Even under effective defense mechanisms such as local differential privacy, the attack remains effective, maintaining around 30% of its original performance. These results highlight that FedRecs are still vulnerable to collaborative inference attacks, emphasizing the urgent need for stronger privacy-preserving defenses.

Contrastive learning, as an efficient unsupervised learning, has been extensively studied for improving graph neural network (GNN) in graph-structured data mining. With the wider application of GNN, recent work has revealed that it is vulnerable toward privacy leakage (e.g., property inference). How dose contrastive learning influence privacy leakage of GNN? To address the issue, for the first time we comprehensively evaluate the privacy leakage of contrastive learning for GNN. Specifically, we conduct property inference attack on GNN and evaluate the leakage from the perspective of graph augmentation, encoders, negative sampling and privacy preservation on seven graph contrastive learning (GCL) models with five datasets. Based on extensive experiments, several important insights are gained. 1) Contrastive learning will make GNN more vulnerable to property inference attack than supervised GNNs, e.g., the inference accuracy on GCL models is$\boldsymbol{\times\sim}$1.42 of that of supervised GNNs. 2) The strategy of node augmentation in contrastive learning will make the property of the graph easier to steal among all strategies, e.g., it achieves average inference accuracy (ACC) of 83.89% on the node augmentation. 3) Negative sampling based on rationale-aware will lead to easier leakage of graph properties than other strategies, e.g., the ACC of property inference attack is 100% when using rationale-aware. 4) The better performance results of the graph encoder, the more privacy leakage of the graph property, e.g., the ACC of property inference attack reaches 83.89% on average, and reaches 84.40% when GIN is used as the encoder. 5) The simpler the structure of the graph, the more vulnerable its graph properties are, i.e., the AIDS dataset achieved the highest ACC of 90.96 with the simplest structure. 6) Existing privacy-preserving methods for supervised GNN are deficient for GCL, e.g., the ACC of property inference attack after defence maintains 96% of the nondefensive ones. Furthermore, we make an in-depth analyze of the reasons behind these observations for better understanding of robust contrastive learning for GNN.

Deep neural networks (DNNs) have achieved remarkable success in widespread applications. Meanwhile, its vulnerability towards carefully crafted adversarial attacks captures special attention. Not only adversarial perturbations in digital space will fool the target DNNs-based detectors making a wrong decision, but also actually printed patches can be camouflaged to defeat detectors in physical space. In particular, multi-view physical adversarial attacks pose a more serious threat to practical scenarios. The existing attacks are still challenged in three aspects, i.e., high-cost data augmentation, attack performance gap between digital and physical space, and low attack transferability across DNNs. To overcome the challenges, we introduce PhyCamo, a robust physical camouflage framework based on contrastive learning that distinguishes itself from prior research in various critical ways: (1) data augmentation - it utilizes the diffusion model for data augmentation to efficiently simulate sophisticated physical dynamics in real-world; (2) robustness - it leverages contrastive learning to optimize physical camouflage against encoders with the state-of-the-art (SOTA) attack performance; (3) transferability - it mitigates the model-specific noise in the optimization by adopting diverse input methods, thereby amplifying the transferability between models. Extensive experiments are carried out on a car dataset, a tank dataset, and a pedestrian dataset, comparing with 6 classic multi-view physical adversarial attacks in both digital and physical spaces. The results demonstrate PhyCamo’s superior performance. For instance, it generates more effective physical camouflage (with higher attack success rate~×1.26 and reduce the model's average precision by 55%). PhyCamo can also help to improve the robustness of detectors through adversarial training, which contributes to the application of deep neural networks in the field of security sensitivity.

Network intrusion detection (NID) plays a crucial role in cybersecurity by identifying network attacks from network traffic. In recent years, the deep learning technique has become a tendency for the NID problem. However, a major drawback of deep learning is the lack of interpretability, making NID systems (NIDSs) difficult to diagnose and response to the detected network attacks. At the same time, the existing interpretable deep learning techniques cannot adapt to the NID problem due to its specific challenges, including the cross‐feature effect and the absence of self‐interpretable features. To this end, this article proposes a decision Tree enhanced deep Attention Network (TAN), an interpretable deep learning model specifically designed for the NID problem by integrating a decision tree (DT) into a deep attention network. TAN utilizes a DT to extract self‐interpretable features and then uses a deep hierarchical attention network to capture the cross‐feature effect and pinpoint the most important self‐interpretable features. A series of experiments and case studies were performed on public datasets, including KDD99, NSL‐KDD, UNSW‐NB15, and CICIDS2017. The results indicate that TAN achieves competitive detection performance compared to existing deep learning models, while offering a more intuitive interpretation.

HID (host intrusion detection) is a security mechanism for detecting malicious activities performed in a host (e.g., a server, an edge device). Recent research has recast HID as a provenance graph learning problem thanks to the advancement in deep learning techniques, especially the GNNs (graph neural networks). Although the provenance graph learning based HID methods show promise, they are vulnerable to adversarial attacks, where the attackers can bypass the HID models by carefully modifying their attack behaviors. In this paper, we reveal that an adversarial sample generated against one HID model may not be necessarily able to attack another HID model, and we further explore the success rate of adversarial attacks between different HID models by evaluating the mutual transferability. Based on the evaluation, we propose ProvADShield, a framework designed to defend against adversarial attacks on provenance graph learning based HID models. The core idea of ProvADShield is to combine multiple HID models by leveraging the mutual transferability. We evaluate ProvADShield based on a provenance dataset collected and made public by our team. The experiment results show that ProvADShield outperforms state‐of‐the‐art defense systems against adversarial attacks.

ABSTRACT Federated learning (FL) has been revealed as vulnerable to backdoor attacks since the server cannot directly access the locally collected data of clients, even if they are malicious. Many efforts either try to validate the global model with trusted clients, or try to make it difficult or costly to upload malicious updates. Unfortunately, the existing solutions are still challenged in defending against stealthy backdoor attacks or negative impacts brought to the aggregation. Especially in the non‐independent and identically distributed setting. Moreover, these methods overlook the threat of adaptive attacks, that is, attackers fully know the defense implementation. To address these issues, we propose a novel run‐time defense against diverse backdoor attacks, dubbed HoneyFL . It differs from previous works in three key aspects: (1) effectiveness ‐ it is capable of defending against stealthy backdoors through leveraging honeypot clients; (2) aggregation ‐ it promises effective aggregation since only a limited number of honeypot clients are used; (3) robustness ‐ it can handle adaptive backdoor attacks based on differential prediction. Compared with five state‐of‐the‐art defense baselines, extensive experiments show that HoneyFL produces a higher backdoor detection success rate above 97% and a lower false positive rate below 3%, where seven attacks generate backdoor examples. Its impact on the aggregation results of the main task is negligible. We also show that the defense success rate of HoneyFL against adaptive attacks is approximately 3.52 of the baselines on average.

The vulnerabilities of deep learning models towards adversarial attacks have attracted increasing attention, especially when models are deployed in security-critical domains. Numerous defense methods, including reactive and proactive ones, have been proposed for model robustness improvement. Reactive defenses, such as conducting transformations to remove perturbations, usually fail to handle large perturbations. The proactive defenses that involve retraining, suffer from the attack dependency and high computation cost. In this article, we consider defense methods from the general effect of adversarial attacks that take on neurons inside the model. We introduce the concept of neuron influence, which can quantitatively measure neurons’ contribution to correct classification. Then, we observe that almost all attacks fool the model by suppressing neurons with larger influence and enhancing those with smaller influence. Based on this, we proposeNeuron-level Inverse Perturbation(NIP), a novel defense against general adversarial attacks. It calculates neuron influence from benign examples and then modifies input examples by generating inverse perturbations that can in turn strengthen neurons with larger influence and weaken those with smaller influence. Extensive experiments on benchmark datasets and models show that NIP outperforms the state-of-the-art methods in terms of i)effective- it shows better defense success rate ($\sim \!\!\times 1.45$) against 13 adversarial attacks; ii)elastic- it maintains better defense ($\sim \!\!\times 3.4$in the worst case) on large perturbations; iii)efficient- it runs with only$\sim \!\!1/6$time cost; iv)extensible- it can be applied to speaker recognition models and Baidu online image platforms. We further evaluate NIP against potential adaptive attacks and provide interpretable analysis for its effectiveness.

Nonintrusive load monitoring (NILM) has emerged as a pivotal technology in energy management, garnering significant attention in both research and engineering communities. Despite its potential, conventional NILM methods often exhibit limitations in addressing critical challenges such as domain shift, new appliance detection, and noise interference, thereby hindering their practical application. To overcome these limitations, we propose meta-learning named deep robust transfer neural network (RTNILM), a novel framework that simultaneously addresses these challenges while significantly enhancing NILM performance in real-world scenarios. The RTNILM framework incorporates several innovative components: first, an optimized deep, wide, and robust network architecture is derived through neural architecture search from source domain data set; second, pretrained with optimized general end-to-end loss to acquire a general appliance recognition ability and enhance the model’s robustness; third, further trained with model-agnostic meta-learning strategy to improve the model’s generalization on the target domain data set; fourth, by comparing the similarities between features from new appliances and known appliances, achieve new appliance detection. Extensive experimental evaluations across three public datasets and one self-collected dataset demonstrate the superiority of RTNILM in cross-domain recognition, new appliance detection, and noise interference. The average improvement in accuracy of cross domain appliance recognition, new appliance detection, and noise interference compared to other methods exceeded 10%, 20%, and 5%, respectively.

The increasing complexity of deep neural networks (DNNs) poses significant resource challenges for edge devices, prompting the development of compression technologies like model quantization. However, while improving model efficiency, quantization can introduce or perpetuate the original model’s bias. Existing debiasing methods for quantized models often incur additional costs. To address this issue, we propose FairQuanti , a novel quantization approach that leverages neuron role contribution to achieve fairness. By distinguishing between biased and normal neurons, FairQuanti employs mixed precision quantization to mitigate model bias during the quantization process. FairQuanti has four key differences from previous studies: (1) Neuron Roles - It formally defines biased and normal neuron roles, establishing a framework for feasible model quantization and bias mitigation; (2) Effectiveness - It introduces a fair quantization strategy that discriminatively quantizes neuron roles, balancing model accuracy and fairness through Bayesian optimization; (3) Generality - It applies to both structured and unstructured data across various quantization bit levels; (4) Robustness - It demonstrates resilience against adaptive attacks. Extensive experiments on five datasets (three structured and two unstructured) using five different models validate FairQuanti ’s superior performance against eight baseline methods. Specifically, fairness metrics such as demographic parity (DP) improve by approximately 1.03 times, and the demographic parity ratio (DPR) improves by approximately 1.51 times compared to the baselines, with an average accuracy loss of less than 7.5% at 8-bit quantization. FairQuanti presents a promising solution for deploying fair and efficient deep models on resource-constrained devices and holds potential for application in large language models to reduce size and computational demands while minimizing bias. Our source code is available at https://github.com/Caozq2/FairQuanti .

Federated learning (FL) enables resource-constrained node devices to learn a shared model while keeping the training data local. Since recent research has demonstrated multiple privacy leakage attacks in FL, e.g., gradient inference attacks and membership inference attacks, differential privacy (DP) is applied to serve as one of the most effective privacy protection mechanisms. Despite the benefit DP brings, we observe that the introduction of DP also brings random changes to client updates, which will affect the robust aggregation algorithms. We reveal a novel poisoning attack under the cover of DP, named the DP-Poison attack in FL. Specifically, the DP-Poison attack is designed to achieve four goals: (1) maintaining the main task performance; (2) launching a successful attack; (3) escaping the robust aggregation algorithms in FL; and (4) keeping the effectiveness of DP privacy protection. To achieve these goals, we design multiple optimization goals to generate DP noise through a genetic algorithm. The optimization ensures that while the benign updates change randomly, the malicious updates can change toward the global model after adding the DP noise, so that it is easier to be accepted by the robust aggregation algorithms. Extensive experiments show that DP-Poison achieves a nearly 100% attack success rate while maintaining the proposed four goals.

With the rise of autonomous driving, LiDAR-based object detection using deep neural networks (DNNs) has shown exceptional performance. However, DNNs are vulnerable to adversarial attacks, especially on LiDAR sensors. Existing attacks face challenges in terms of (i) effective -they’re generally effective in white-box scenarios, but suffer significant performance degradation in black-box scenarios; (ii) robustness -they’re much less effective when exposed to the diverse changes in the real world (i.e., angle and distance changes); (iii) concealing -most attacks overlook the crucial stealth aspect, making them susceptible to detection and defense. To address these issues, LiDAttack is introduced as a robust black-box attack that leverages genetic algorithms with simulated annealing to precisely control perturbation points, ensuring both stealth and efficacy. Extensive experiments on KITTI, nuScenes, and a custom dataset demonstrate LiDAttack’s high attack success rate (ASR) of up to 90% across diverse detection models (PointRCNN, PointPillar, PV-RCNN++). Practical robustness is validated in real world tests, both indoors and outdoors. For concealment, the generated adversarial object volume is restricted to under 0.1% of the target object’s volume, achieving ASR up to 90%. The code is available at https://github.com/Cinderyl/LiDAttack.git

APT (Advanced Persistent Threat) with the characteristics of persistence, stealth, and diversity is one of the greatest threats against cyber-infrastructure. As a countermeasure, existing studies leverage provenance graphs to capture the complex relations between system entities in a host for effective APT detection. In addition to detecting single attack events as most existing work does, understanding the tactics / techniques (e.g., Kill-Chain, ATT&CK) applied to organize and accomplish the APT attack campaign is also important for security operations. Existing studies try to manually design a set of rules to map low-level system events to high-level APT tactics / techniques. However, the rule based methods are coarse-grained and lack generalization ability. Thus, they can only recognize APT tactics and have difficulty in identifying APT techniques. They also cannot adapt to mutant behaviors of existing APT tactics / techniques.

Federated learning has achieved remarkable results in a variety of decision-making tasks, but may create models that are biased toward some groups due to the labeling bias and distributional differences of client data. Therefore, exploring how to reduce decision-making bias is an urgent problem for future large-scale deployment of federated learning systems into society. The most effective approaches to enhance the fairness of federated learning include preprocessing, in-processing, and post-processing algorithms, which improve the fairness and credibility of the models while preserving privacy. However, existing debiasing algorithms are still limited in three aspects: poor fairness enhancement of the global model, high impact on the performance of the main task, and inconsistent evaluation metrics. Motivated by the challenge of group fairness in federated learning, we propose Fedfair, a debiasing algorithm for federated learning systems that differs from previous work in several key aspects: (1) it requires clients to upload a small amount of anonymized data to the server, which allows most centralized debiasing algorithms that rely on data to be applied to federated learning; (2) by mapping the implicit relationship between the model and the group bias, it fine-tunes the global model to reduce the group bias, thus weakening the impact on the model's performance on the main task; (3) it applies a unified fairness evaluation metric, which reasonably and intuitively demonstrates the advantages of debiasing compared to various other algorithms. Experiments verify that compared with other federated learning debiasing algorithms, Fedfair is more efficient, the debiasing effect is more obvious, and the impact on the performance of federated learning models is weaker.

Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses’ transaction behavior features by random walking or constructing static subgraphs. The random walking methods, unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address’s transaction behaviors in different periods. Then, we provide a fast nonparametric phishing detector (FD) to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions toward a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learned time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art (SOTA) detection performance. The code of TEGDetector is open sourced at https://github.com/Seaocn/TEGDetector.

Graph neural network (GNN) with a powerful representation capability has been widely applied to various areas. Recent works have exposed that GNN is vulnerable to the backdoor attack, i.e., models trained with maliciously crafted training samples are easily fooled by patched samples. Most of the proposed studies launch the backdoor attack using a trigger that is either the randomly generated subgraph [e.g., erdős-rényi backdoor (ER-B)] for less computational burden or the gradient-based generative subgraph [e.g., graph trojaning attack (GTA)] to enable a more effective attack. However, the interpretation of how is the trigger structure and the effect of the backdoor attack related has been overlooked in the current literature. Motifs, recurrent and statistically significant subgraphs in graphs, contain rich structure information. In this article, we are rethinking the trigger from the perspective of motifs and propose a motif-based backdoor attack, denoted as Motif-Backdoor. It contributes from three aspects. First, Interpretation, it provides an in-depth explanation for backdoor effectiveness by the validity of the trigger structure from motifs, leading to some novel insights, e.g., using subgraphs that appear less frequently in the graph as the trigger can achieve better attack performance. Second, Effectiveness, Motif-Backdoor reaches the state-of-the-art (SOTA) attack performance in both black-box and defensive scenarios. Third, Efficiency, based on the graph motif distribution, Motif-Backdoor can quickly obtain an effective trigger structure without target model feedback or subgraph model generation. Extensive experimental results show that Motif-Backdoor realizes the SOTA performance on three popular models and four public datasets compared with five baselines, e.g., Motif-Backdoor improves the attack success rate (ASR) by 14.73% compared with baselines on average. In addition, under a possible defense, Motif-Backdoor still implements satisfying performance, highlighting the requirement of defenses against backdoor attacks on GNNs. The datasets and code are available athttps://github.com/Seaocn/Motif-Backdoor.

Link prediction, inferring the undiscovered or potential links of the graph, is widely applied in the real world. By facilitating labeled links of the graph as the training data, numerous deep learning-based link prediction methods have been studied, which have dominant prediction accuracy compared with nondeep methods. However, the threats of maliciously crafted training graphs will leave a specific backdoor in the deep model; thus, when some specific examples are fed into the model, it will make a wrong prediction, defined as a backdoor attack. It is an important aspect that has been overlooked in the current literature. In this article, we prompt the concept of a backdoor attack on link prediction and propose Link-Backdoor to reveal the training vulnerability of the existing link prediction methods. Specifically, the Link-Backdoor combines the fake nodes with the nodes of the target link to form a trigger. Moreover, it optimizes the trigger by the gradient information from the target model. Consequently, the link prediction model trained on the backdoored dataset will predict the link with a trigger to the target state. Extensive experiments on five benchmark datasets and five well-performing link prediction models demonstrate that the Link-Backdoor achieves the state-of-the-art attack success rate under both the white box (i.e., available of the target model parameter) and the black box (i.e., unavailable of the target model parameter) scenarios. In addition, we testify the attack under the defensive circumstance, and the results indicate that the Link-Backdoor still can construct a successful attack on the well-performing link prediction methods. The code and data are available athttps://github.com/Seaocn/Link-Backdoor.

With the development of deep learning processors and accelerators, deep learning models have been widely deployed on edge devices as part of the Internet of Things. Edge device models are generally considered as valuable intellectual properties that are worth for careful protection. Unfortunately, these models have a great risk of being stolen or illegally copied. The existing model protections using encryption algorithms are suffered from high computation overhead which is not practical due to the limited computing capacity on edge devices. In this work, we propose a light-weight, practical, and general Edge device model Protection method at neuron level, denoted as EdgePro. Specifically, we select several neurons as authorization neurons and set their activation values to locking values and scale the neuron outputs during training, where the authorization neurons, locking value, and scale factor together form the “passwords”. Then, we design lock training to implement model property protection through alternately locking and releasing, which correspond to model performance preservation and encryption, respectively. EdgePro protects the model by ensuring it can only work correctly when the “passwords” are met, at the cost of encrypting and storing the information of the “passwords” instead of the whole model. Extensive experimental results indicate that EdgePro can work well on the task of protecting models on different datasets. The inference time increase of EdgePro is only 60% of state-of-the-art methods, and the accuracy loss is less than 1%. Additionally, EdgePro is robust against adaptive attacks including fine-tuning, reverse engineering, and pruning, which makes it more practical in real-world applications. EdgePro is also open sourced to facilitate future research:https://github.com/Leon022/EdgePro.

The backdoor attacks have posed a severe threat to deep neural networks (DNNs). Online training platforms and third-party model training providers are more vulnerable to backdoor attacks due to uncontrollable data sources, untrusted developers or unmonitorable training processes. Researchers have proposed to detect the backdoor in the well-trained models, and then remove them by some mitigation techniques, e.g., retraining and pruning. However, they are still limited from two aspects: (i) real-time - they cannot detect in time at the beginning of training due to their reliance on well-trained models; (ii) mitigation effect - the later discovery of backdoors usually leads to 1) deeper backdoors, 2) less effective mitigation, and 3) greater costs. To address these challenges, we rethink the evolution of the backdoor, and intend to cope with backdoors along with the online training process, that is to detect the backdoors sooner rather than later. We propose BackdoorTracer, a novel framework that detects the backdoor in the training phase. BackdoorTracer constructs the model into an equivalent graph based on the activated neural path during training, thereby detecting the backdoor through multiple graph metrics. BackdoorTracer can incorporate any existing backdoor mitigation approaches that require accessing training to stop the impact of backdoors as soon as possible. It differs from previous works in several key aspects: (i) lightweight - BackdoorTracer is independent of the training process, and thus it has little negative impact on the training efficiency and testing accuracy; (ii) generalizable - it works different modalities of data, models and different backdoor attacks. BackdoorTracer outperforms the state-of-the-art (SOTA) detection approaches in experiments on 5 modes, 10 models and 9 backdoor attack scenarios. Compared with the existing 5 backdoor detection methods, our method can detect backdoors earlier ($\sim ~1.5$epochs) and higher detection rate (~ +10%), effectively improving the effectiveness of backdoor defense (ASR. ~ -78%, ACC. +47%). Finally, we make BackdoorTracer a plug-and-play backdoor detector, which enables real-time backdoor tracing in the training phase.

A wireless communications system usually consists of a transmitter which transmits the information and a receiver which recovers the original information from the received distorted signal. Deep learning (DL) has been used to improve the performance of the receiver in complicated channel environments and state-of-the-art (SOTA) performance has been achieved. However, its robustness has not been investigated. In order to evaluate the robustness of DL-based information recovery models under adversarial circumstances, we investigate adversarial attacks on the SOTA DL-based information recovery model, i.e., DeepReceiver. We formulate the problem as an optimization problem with power and peak-to-average power ratio (PAPR) constraints. We design different adversarial attack methods according to the adversary’s knowledge of DeepReceiver’s model and/or testing samples. Extensive experiments show that the DeepReceiver is vulnerable to the designed attack methods in all of the considered scenarios. Even in the scenario of both model and test sample restricted, the adversary can attack the DeepReceiver and increase its bit error rate (BER) above 10%. It can also be found that the DeepReceiver is vulnerable to adversarial perturbations even with very low power and limited PAPR. These results suggest that defense measures should be taken to enhance the robustness of DeepReceiver.

Deep neural networks (DNNs) have demonstrated their outperformance in various software systems, but also exhibit misbehavior and even result in irreversible disasters. Therefore, it is crucial to identify the misbehavior of DNN-based software and improve DNNs' quality. Test input prioritization is one of the most appealing ways to guarantee DNNs' quality, which prioritizes test inputs so that more bug-revealing inputs can be identified earlier with limited time and manual labeling efforts. However, the existing prioritization methods are still limited from three aspects: certifiability, effectiveness, and generalizability. To overcome the challenges, we propose CertPri, a test input prioritization technique designed based on a movement cost perspective of test inputs in DNNs' feature space. CertPri differs from previous works in three key aspects: (1) certifiable - it provides a formal robustness guarantee for the movement cost; (2) effective - it leverages formally guaranteed movement costs to identify malicious bug-revealing inputs; and (3) generic - it can be applied to various tasks, data, models, and scenarios. Extensive evaluations across 2 tasks (i.e., classification and regression), 6 data forms, 4 model structures, and 2 scenarios (i.e., white-box and black-box) demonstrate CertPri's superior performance. For instance, it significantly improves 53.97 % prioritization effectiveness on average compared with baselines. Its robustness and generalizability are 1.41~2.00 times and 1.33~3.39 times that of baselines on average, respectively. The code of CertPri is open-sourced at https://github.com/haibinzheng/CertPri.

Graph neural network (GNN) has achieved great success on graph representation learning. Challenged by large-scale private data collected from user side, GNN may not be able to reflect the excellent performance, without rich features and complete adjacent relationships. Addressing the problem, vertical federated learning (VFL) is proposed to implement local data protection through training a global model collaboratively. Consequently, for graph-structured data, it is a natural idea to construct a GNN-based VFL (GVFL) framework. However, GNN has been proven vulnerable to adversarial attacks. Whether the vulnerability will be brought into the GVFL has not been studied. This is the first study of adversarial attacks on GVFL. A novel adversarial attack method is proposed, named Graph-Fraudster. It generates adversarial perturbations based on the noise-added global node embeddings via the privacy leakage and the gradient of pairwise node. Specifically, first, Graph-Fraudster steals the global node embeddings and sets up a shadow model of the server for the attack generator. Second, noise is added into node embeddings to confuse the shadow model. Finally, the gradient of pairwise node is used to generate attacks with the guidance of noise-added node embeddings. Extensive experiments on five benchmark datasets demonstrate that Graph-Fraudster achieves the state-of-the-art attack performance compared with baselines in different GNN based GVFLs. Furthermore, Graph-Fraudster can remain a threat to GVFL even if two possible defense mechanisms are applied. In addition, some suggestions are put forward for the future work to improve the robustness of GVFL. The code and datasets can be downloaded athttps://github.com/hgh0545/Graph-Fraudster.

Graph embedding learns low-dimensional representations for nodes or edges on the graph, which is widely applied in many real-world applications. Excessive graph mining promotes the research of attack methods on graph embedding. Most attack methods generate perturbations that maximize the deviation of the prediction confidence. They are difficult to accurately misclassify the instances into the target label, and the nonminimized perturbations are more easily detected by defense methods. To address these problems, we propose Graphfool, a novel targeted label adversarial attack on graph embedding. It can generate adversarial graphs to attack graph embedding methods via classification boundary and gradient information in the target graph embedding method. Graphfool first estimates the classification boundaries of different categories. Then, it calculates the minimum perturbation matrix to misclassify the attacked node according to the target classification boundary. Finally, the adjacency matrix is modified according to the maximum absolute value of the perturbation matrix. Extensive experiments demonstrate that Graphfool achieves the state-of-the-art attack performance with minimum perturbations. Besides, the possible defense experiments further prove that the perturbations generated by Graphfool are more imperceptible.

A critical side effect of online social networks’ flourishing is fast-spreading rumors on the Internet, making the information diffusion control on social networks a fundamental requirement. While information diffusion control has received extensive attention at the global level, there have been fewer user-level diffusion control studies under minimal budget. In this article, we study the information diffusion at the user level and propose a diffusion control method based on gradient information to generate an optimized network structure, namely ConTroL information DIFFusion (CTL-DIFF). CTL-DIFF targets a user through subtle modifications of its local network structure. It first selects the edges with the largest absolute gradient based on the prediction model to optimize the original network’s structure. It then employs several prediction methods to verify whether the target user’s social action status is controlled. CTL-DIFF achieves state-of-the-art control performance with a minimum budget, comparing with five baselines based on edge centrality strategies on four real-world datasets. We extend the diffusion control from user-level to global-level, comparing with four baselines on three datasets. Experimental results show that CTL-DIFF can effectively control information diffusion in the global social network by identifying and controlling the most influential users.

Critical nodes detection (CND) focuses on identifying the nodes that significantly impact the network’s robustness and is applied in various fields such as power grids, communication networks, and disease spreading. However, detecting the critical nodes is a challenging nondeterministic polynomial time complete (NP-complete) problem. One possible solution is using the evolutionary algorithm which has a high global search capability. However, the existing evolutionary algorithms for CND only focus on independent nodes, ignoring the underlying relationship among the nodes. Thus, in this work, we proposed a new topology-combined differential evolution framework called TDE to explore the possibility of improving the performance by fusing topology information, which designs individual genotypes through node degree, and new mutation and decoding-based selection operators are designed for these genotypes to use topology information effectively. The experiments on synthetic and real networks show that it is feasible to improve the search capability of the algorithm by fusing node degree information.

In network link prediction, it is possible to hide a target link from being predicted with a small perturbation on network structure. This observation may be exploited in many real world scenarios, for example, to preserve privacy, or to exploit financial security. There have been many recent studies to generate adversarial examples to mislead deep learning models on graph data. However, none of the previous work has considered the dynamic nature of real-world systems. In this work, we present the first study of adversarial attack on dynamic network link prediction (DNLP). The proposed attack method, namely time-aware gradient attack (TGA), utilizes the gradient information generated by deep dynamic network embedding (DDNE) across different snapshots to rewire a few links, so as to make DDNE fail to predict target links. We implement TGA in two ways: one is based on traversal search, namely TGA-Tra; and the other is simplified with greedy search for efficiency, namely TGA-Gre. We conduct comprehensive experiments which show the outstanding performance of TGA in attacking DNLP algorithms.

Deep neural networks (DNNs) have demonstrated their outperformance in various domains. However, it raises a social concern whether DNNs can produce reliable and fair decisions especially when they are applied to sensitive domains involving valuable resource allocation, such as education, loan, and employment. It is crucial to conduct fairness testing before DNNs are reliably deployed to such sensitive domains, i.e., generating as many instances as possible to uncover fairness violations. However, the existing testing methods are still limited from three aspects: interpretability, performance, and generalizability. To overcome the challenges, we propose NeuronFair, a new DNN fairness testing framework that differs from previous work in several key aspects: (1) interpretable - it quantitatively interprets DNNs' fairness violations for the biased decision; (2) effective - it uses the interpretation results to guide the generation of more diverse instances in less time; (3) generic - it can handle both structured and unstructured data. Extensive evaluations across 7 datasets and the corresponding DNNs demonstrate NeuronFair's superior performance. For instance, on structured datasets, it generates much more instances (~ ×5.84) and saves more time (with an average speedup of 534.56%) compared with the state-of-the-art methods. Besides, the instances of NeuronFair can also be leveraged to improve the fairness of the biased DNNs, which helps build more fair and trustworthy deep learning systems. The code of NeuronFair is open-sourced at https://github.com/haibinzheng/NeuronFair.

The last decade has witnessed the rapid growth of open-source software (OSS). Still, all contributors may find it difficult to assimilate into the OSS community even they are enthusiastic to make contributions. We thus suggest that partner recommendation across different roles may benefit both the users and developers, i.e., once we are able to make successful recommendation for those in need, it may dramatically contribute to the productivity of developers and the enthusiasm of users, thus further boosting OSS projects’ development. Motivated by this potential, we model the partner recommendation as link prediction task from email data via network embedding methods. In this article, we introduce time-series snapshot network (TSSN) that is a mixture network to model the interactions among users and developers. Based on the established TSSN, we perform temporal biased walk (TBW) to automatically capture both temporal and structural information of the email network, i.e., the behavioral similarity between individuals in the OSS email network. Experiments on ten Apache data sets demonstrate that the proposed TBW significantly outperforms a number of advanced random walk-based embedding methods, leading to the state-of-the-art recommendation performance.

Despite of its tremendous popularity and success in computer vision (CV) and natural language processing, deep learning is inherently vulnerable to adversarial attacks in which adversarial examples (AEs) are carefully crafted by imposing imperceptible perturbations on the clean examples to deceive the target deep neural networks (DNNs). Many defense solutions in CV have been proposed. However, most of them, e.g., adversarial training, suffer from a low generality due to the reliance on limited AEs. Moreover, some solutions even have a non-negligible negative impact on the classification accuracy of clean examples. Last but not least, they are impotent against the unconstrained attacks in which the attackers optimize the perturbation direction and size by additionally taking the defense methods into accounts. In this article, we propose GRIP-GAN to learn a general robust inverse perturbation (GRIP), which is not only able to offset any potential adversarial perturbations but also strengthen the target class-related features, purely from the clean images via a generative adversarial network (GAN). By feeding a random noise, GRIP-GAN is able to generate a dynamic GRIP for each input image to defend against unconstrained attacks. To further improve the defense performance, we also enable GRIP-GAN to generate a GRIP tailored to each input image via feeding input image specific noise to GRIP-GAN. Extensive experiments are carried out on MNIST, CIFAR10, and ImageNet datasets against 17 adversarial attacks. The results show that GRIP-GAN outperforms all the baselines. We further share insights on the success of GRIP-GAN and provide visualized proofs.

Community detection, aiming to group nodes based on their connections, plays an important role in network analysis since communities, treated as meta-nodes, allow us to create a large-scale map of a network to simplify its analysis. However, for privacy reasons, we may want to prevent communities from being discovered in certain cases, leading to the topics on community deception. In this article, we formalize this community detection attack problem in three scales, including global attack (macroscale), target community attack (mesoscale), and target node attack (microscale). We treat this as an optimization problem and further propose a novel evolutionary perturbation attack (EPA) method, where we generate adversarial networks to realize the community detection attack. Numerical experiments validate that our EPA can successfully attack network community algorithms in all three scales, i.e., hide target nodes or communities and further disturb the community structure of the whole network by only changing a small fraction of links. By comparison, our EPA behaves better than a number of baseline attack methods on six synthetic networks and three real-world networks. More interestingly, although our EPA is based on the Louvain algorithm, it is also effective in attacking other community detection algorithms, validating its good transferability.

The adversarial attack methods based on gradient information can adequately find the perturbations, that is, the combinations of rewired links, thereby reducing the effectiveness of the deep learning model-based graph embedding algorithms, but it is also easy to fall into a local optimum. Therefore, this article proposes a momentum gradient attack (MGA) against the graph convolutional network (GCN) model, which can achieve more aggressive attacks with fewer rewiring links. Compared with directly updating the original network using gradient information, integrating the momentum term into the iterative process can stabilize the updating direction, which makes the model jump out of poor local optimum and enhances the method with stronger transferability. Experiments on node classification and community detection methods based on three well-known network embedding algorithms show that MGA has a better attack effect and transferability.

Recently, a graph neural network (GNN) was proposed to analyze various graphs/networks, which has been proven to outperform many other network analysis methods. However, it is also shown that such state-of-the-art methods suffer from adversarial attacks, i.e., carefully crafted adversarial networks with slight perturbation on clean one may invalid these methods on lots of applications, such as network embedding, node classification, link prediction, and community detection. Adversarial training has been testified as an efficient defense strategy against adversarial attacks in computer vision and graph mining. However, almost all the algorithms based on adversarial training focus on global defense through overall adversarial training. In a more practical scene, certain users would be targeted to attack, i.e., specific labeled users. It is still a challenge to defend against target node attack by existing adversarial training methods. Therefore, we propose smoothing adversarial training (SAT) to improve the robustness of GNNs. In particular, we analytically investigate the robustness of graph convolutional network (GCN), one of the classic GNNs, and propose two smooth defensive strategies: smoothing distillation and smoothing cross-entropy loss function. Both of them smooth the gradients of GCN and, consequently, reduce the amplitude of adversarial gradients, benefiting gradient masking from attackers in both global attack and target label node attack. The comprehensive experiments on five real-world networks testify that the proposed SAT method shows state-of-the-art defensibility against different adversarial attacks on node classification and community detection. Especially, the average attack success rate of different attack methods can be decreased by about 40% by SAT at the cost of tolerable embedding performance decline of the original network.

Predicting the potential relations between nodes in networks, known as link prediction, has long been a challenge in network science. However, most studies just focused on link prediction of static network, while real-world networks always evolve over time with the occurrence and vanishing of nodes and links. Dynamic network link prediction (DNLP) thus has been attracting more and more attention since it can better capture the evolution nature of networks, but still most algorithms fail to achieve satisfied prediction accuracy. Motivated by the excellent performance of long short-term memory (LSTM) in processing time series, in this article, we propose a novel encoder-LSTM-decoder (E-LSTM-D) deep learning model to predict dynamic links end to end. It could handle long-term prediction problems, and suits the networks of different scales with fine-tuned structure. To the best of our knowledge, it is the first time that LSTM, together with an encoder-decoder architecture, is applied to link prediction in dynamic networks. This new model is able to automatically learn structural and temporal features in a unified framework, which can predict the links that never appear in the network before. The extensive experiments show that our E-LSTM-D model significantly outperforms newly proposed DNLP methods and obtain the state-of-the-art results.

Link prediction has long been the focus in the analysis of network-structured data. Though straightforward and efficient, heuristic approaches like Common Neighbors perform link prediction with pre-defined assumptions and only use superficial structural features. While it is widely acknowledged that a vertex could be characterized by a bunch of neighbor vertices, network embedding algorithms and newly emerged graph neural networks still exploit structural features on the whole network, which may inevitably bring in noises and limits the scalability of those methods. In this paper, we propose an end-to-end deep learning framework, namely hyper-substructure enhanced link predictor (HELP), for link prediction. HELP utilizes local topological structures from the neighborhood of the given vertex pairs, avoiding useless features. For further exploiting higher-order structural information, HELP also learns features from hyper-substructure network (HSN).Extensive experiments on six benchmark datasets have shown the state-of-the-art performance of HELP on link prediction.

Software defect prediction aims to automatically locate defective code modules to better focus testing resources and human effort. Typically, software defect prediction pipelines are comprised of two parts: the first extracts program features, like abstract syntax trees, by using external tools, and the second applies machine learning-based classification models to those features in order to predict defective modules. Since such approaches depend on specific feature extraction tools, machine learning classifiers have to be custom-tailored to effectively build most accurate models.

Signal modulation recognition plays a critical role in many fields to identify the modulation type of wireless signals. Since the deep learning based models have achieved great success in classification tasks, more deep neural networks are proposed for signal modulation recognition. In this paper, we explore the use of different deep neural networks in both macro network architecture level and micro cell size and layer level to compare and understand their effect on classification performance. We also bring up a feature explainable deep neural network by visualizing the critical features in the deep neural models. We visually show and compare the commonality and differences of hidden layer characteristics extracted by different network structure to explain and analyze the reason why some models can achieve better classification results than the others. We believe it is an effective way to explain how deep neural model based signal classification work. Thus the explanation will help users establish appropriate understand and trust in predictions from deep modulation recognition networks.

Increasing deep neural networks are applied in solving graph evolved tasks, such as node classification and link prediction. However, the vulnerability of deep models can be revealed using carefully crafted adversarial examples generated by various adversarial attack methods. To explore this security problem, we define the link prediction adversarial attack problem and put forward a novel iterative gradient attack (IGA) strategy using the gradient information in the trained graph autoencoder (GAE) model. Not surprisingly, GAE can be fooled by an adversarial graph with a few links perturbed on the clean one. The results on comprehensive experiments of different real-world graphs indicate that most deep models and even the state-of-the-art link prediction algorithms cannot escape the adversarial attack, such as GAE. We can benefit the attack as an efficient privacy protection tool from the link prediction of unknown violations. On the other hand, the adversarial attack is a robust evaluation metric for current link prediction algorithms of their defensibility.

Community detection plays an important role in social networks, since it can help to naturally divide the network into smaller parts so as to simplify network analysis. However, on the other hand, it arises the concern that individual information may be overmined, and the concept community deception has been proposed to protect individual privacy on social networks. Here, we introduce and formalize the problem of community detection attack and develop efficient strategies to attack community detection algorithms by rewiring a small number of connections, leading to privacy protection. In particular, we first give two heuristic attack strategies, i.e., Community Detection Attack (CDA) and Degree Based Attack (DBA), as baselines, utilizing the information of detected community structure and node degree, respectively. Then, we propose an attack strategy called “genetic algorithm (GA)-based Q-Attack,” where the modularity Q is used to design the fitness function. We launch community detection attack based on the above three strategies against six community detection algorithms on several social networks. By comparison, our Q-Attack method achieves much better attack effects than CDA and DBA, in terms of the larger reduction of both modularity Q and normalized mutual information (NMI). In addition, we further take transferability tests and find that adversarial networks obtained by Q-Attack on a specific community detection algorithm also show considerable attack effects while generalized to other algorithms.

Recommender systems are becoming more and more important in our daily lives. However, traditional recommendation methods are challenged by data sparsity and efficiency, as the numbers of users, items, and interactions between the two in many real-world applications increase fast. In this paper, we propose a novel clustering recommender system based on node2vec technology and rich information network, namely, N2VSCDNNR, to solve these challenges. In particular, we use a bipartite network to construct the user-item network and represent the interactions among users (or items) by the corresponding one-mode projection network. In order to alleviate the data sparsity problem, we enrich the network structure according to user and item categories, and construct the one-mode projection category network. Then, considering the data sparsity problem in the network, we employ node2vec to capture the complex latent relationships among users (or items) from the corresponding one-mode projection category network. Moreover, considering the dependence on parameter settings and information loss problem in clustering methods, we use a novel spectral clustering method, which is based on dynamic nearest-neighbors (DNNs) and a novel automatically determining cluster number (ADCN) method that determines the cluster centers based on the normal distribution method, to cluster the users and items separately. After clustering, we propose the two-phase personalized recommendation to realize the personalized recommendation of items for each user. A series of experiments validate the outstanding performance of our N2VSCDNNR over several advanced embedding and side information based recommendation algorithms. Meanwhile, N2VSCDNNR seems to have lower time complexity than the baseline methods in online recommendations, indicating its potential to be widely applied in large-scale systems.

Network embedding plays an important role in various network applications, such as node classification and link prediction. Lots of structure-based network embedding methods have been proposed. Yet, they suffer from unsteady embedding performances due to the parameter sensitivity. How to extract valuable attribute information in networks with less parameter influence is still a challenge. In this paper, we propose a novel algorithm, named adaptive network embedding with particle swarm optimization (PSO-ANE), which is based on the second-order dynamic random walk and PSO method, for learning network representations. A second-order dynamic random walk is designed to search a suitable strategy for each node based on the structure-based transition probability, the centrality-based transition probability, and the static link weights. To reduce the parameter dependence, PSO is adopted for key-parameter optimization to get global steady network embedding. The experiments validate that the proposed method outperforms the existing state-of-the-art techniques on multilabel classification, multiclass classification, and link prediction tasks.

Real-world networks feature weights of interactions, where link weights often represent some physical attributes. In many situations, to recover the missing data or predict the network evolution, we need to predict link weights in a network. In this paper, we first proposed a series of new centrality indices for links in line graph. Then, utilizing these line graph indices, as well as a number of original graph indices, we designed three supervised learning methods to realize link weight prediction both in the networks of single layer and multiple layers, which perform much better than several recently proposed baseline methods. We found that the resource allocation index (RA) plays a more important role in the weight prediction than other topological properties, and the line graph indices are at least as important as the original graph indices in link weight prediction. In particular, the success application of our methods on Yelp layered network suggests that we can indeed predict the offline co-foraging behaviors of users just based on their online social interactions, which may open a new direction for link weight prediction algorithms, and meanwhile provide insights to design better restaurant recommendation systems.

In artificial immune system, many algorithms based on negative selection methods have been proposed to achieve satisfying classification performances. However, there are still many problems required to be solved, such as parameters sensibility and computational complexity. In this paper, a novel classification algorithm based on T-cells maturation algorithm was proposed for anomaly detection. Data set from UC Irvine Machine Learning Repository was used for 10-fold cross-validation, and simulation results confirmed its similar performances with AIRS. Compared with other classification algorithms based on negative selection methods, the proposed algorithm has no parameters and lower complexity, and can achieve satisfying classification results.