Search

Due to the gap between a substitute model and a victim model, the gradient-based noise generated from a substitute model may have low transferability for a victim model since their gradients are different. Inspired by the fact that the decision boundaries of different models do not differ much, we conduct experiments and discover that the gradients of different models are more similar on the decision boundary than in the original position. Moreover, since the decision boundary in the vicinity of an input image is flat along most directions, we conjecture that the boundary gradients can help find an effective direction to cross the decision boundary of the victim models. Based on it, we propose a Boundary Fitting Attack to improve transferability. Specifically, we introduce a method to obtain a set of boundary points and leverage the gradient information of these points to update the adversarial examples. Notably, our method can be combined with existing gradient-based methods. Extensive experiments prove the effectiveness of our method, i.e., improving the success rate by 5.6% against normally trained CNNs and 14.9% against defense CNNs on average compared to state-of-the-art transfer-based attacks. Further we compare transformers with CNNs, the results indicate that transformers are more robust than CNNs. However, our method still outperforms existing methods when attacking transformers. Specifically, when using CNNs as substitute models, our method obtains an average attack success rate of 58.2%, which is 10.8% higher than other state-of-the-art transfer-based attacks.

Deep learning based blind watermarking works have gradually emerged and achieved impressive performance. However, previous deep watermarking studies mainly focus on fixed low-resolution images while paying less attention to arbitrary resolution images, especially widespread high-resolution images nowadays. Moreover, most works usually demonstrate robustness against typical non-geometric attacks (\textit{e.g.}, JPEG compression) but ignore common geometric attacks (\textit{e.g.}, Rotate) and more challenging combined attacks. To overcome the above limitations, we propose a practical deep \textbf{D}ispersed \textbf{W}atermarking with \textbf{S}ynchronization and \textbf{F}usion, called \textbf{\proposed}. Specifically, given an arbitrary-resolution cover image, we adopt a dispersed embedding scheme which sparsely and randomly selects several fixed small-size cover blocks to embed a consistent watermark message by a well-trained encoder. In the extraction stage, we first design a watermark synchronization module to locate and rectify the encoded blocks in the noised watermarked image. We then utilize a decoder to obtain messages embedded in these blocks, and propose a message fusion strategy based on similarity to make full use of the consistency among messages, thus determining a reliable message. Extensive experiments conducted on different datasets convincingly demonstrate the effectiveness of our proposed {\proposed}. Compared with state-of-the-art approaches, our blind watermarking can achieve better performance: averagely improve the bit accuracy by 5.28\% and 5.93\% against single and combined attacks, respectively, and show less file size increment and better visual quality. Our code is available at https://github.com/bytedance/DWSF., Comment: Accpeted by ACM MM 2023

In spite of debate, ambiguity, and tension around teacher dispositions, in the past over two decades, the place of dispositions in initial teacher education (ITE) has been widely supported among policy makers and researchers. Specifically, debate on whether dispositions are teachable has largely given way to action to foster dispositions. Adopting a two-cycle participatory action research design, this study explored ways to teach the first-year teacher candidates’ dispositions in an early childhood ITE programme in New Zealand. The intervention included eight focus dispositions and corresponding strategies to teach each focus disposition. Data collection methods included student self-assessment surveys, individual and focus group interviews with students and teaching staff, team meetings, and a variety of pedagogical documentation. Ethnographic content analysis generated three themes: legitimacy of the intervention, experiential orientation of the intervention, and effect of the intervention. The study exemplifies how dispositions intervention can be incorporated in ITE programmes.

Unrestricted color attacks, which manipulate semantically meaningful color of an image, have shown their stealthiness and success in fooling both human eyes and deep neural networks. However, current works usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples. As a result, the black-box attack performance of these methods is limited. To boost transferability of adversarial examples without damaging image quality, we propose a novel Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset. By conducting extensive experiments and visualizations, we convincingly demonstrate the effectiveness of our proposed method. Notably, on average, results show that our NCF can outperform state-of-the-art approaches by 15.0%$\sim$32.9% for fooling normally trained models and 10.0%$\sim$25.3% for evading defense methods. Our code is available at https://github.com/ylhz/Natural-Color-Fool., Comment: NeurIPS 2022

For black-box attacks, the gap between the substitute model and the victim model is usually large, which manifests as a weak attack performance. Motivated by the observation that the transferability of adversarial examples can be improved by attacking diverse models simultaneously, model augmentation methods which simulate different models by using transformed images are proposed. However, existing transformations for spatial domain do not translate to significantly diverse augmented models. To tackle this issue, we propose a novel spectrum simulation attack to craft more transferable adversarial examples against both normally trained and defense models. Specifically, we apply a spectrum transformation to the input and thus perform the model augmentation in the frequency domain. We theoretically prove that the transformation derived from frequency domain leads to a diverse spectrum saliency map, an indicator we proposed to reflect the diversity of substitute models. Notably, our method can be generally combined with existing attacks. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our method, \textit{e.g.}, attacking nine state-of-the-art defense models with an average success rate of \textbf{95.4\%}. Our code is available in \url{https://github.com/yuyang-long/SSA}., Comment: Accepted by ECCV 2022

In spite of debate, ambiguity, and tension around teacher dispositions, in the past over two decades, the place of dispositions in initial teacher education (ITE) has been widely supported among policy makers and researchers. Specifically, debate on whether dispositions are teachable has largely given way to action to foster dispositions. Adopting a two-cycle participatory action research design, this study explored ways to teach the first-year teacher candidates’ dispositions in an early childhood ITE programme in New Zealand. The intervention included eight focus dispositions and corresponding strategies to teach each focus disposition. Data collection methods included student self-assessment surveys, individual and focus group interviews with students and teaching staff, team meetings, and a variety of pedagogical documentation. Ethnographic content analysis generated three themes: legitimacy of the intervention, experiential orientation of the intervention, and effect of the intervention. The study exemplifies how dispositions intervention can be incorporated in ITE programmes.

In recent years, the adversarial vulnerability of deep neural networks (DNNs) has raised increasing attention. Among all the threat models, no-box attacks are the most practical but extremely challenging since they neither rely on any knowledge of the target model or similar substitute model, nor access the dataset for training a new substitute model. Although a recent method has attempted such an attack in a loose sense, its performance is not good enough and computational overhead of training is expensive. In this paper, we move a step forward and show the existence of a \textbf{training-free} adversarial perturbation under the no-box threat model, which can be successfully used to attack different DNNs in real-time. Motivated by our observation that high-frequency component (HFC) domains in low-level features and plays a crucial role in classification, we attack an image mainly by manipulating its frequency components. Specifically, the perturbation is manipulated by suppression of the original HFC and adding of noisy HFC. We empirically and experimentally analyze the requirements of effective noisy HFC and show that it should be regionally homogeneous, repeating and dense. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our proposed no-box method. It attacks ten well-known models with a success rate of \textbf{98.13\%} on average, which outperforms state-of-the-art no-box attacks by \textbf{29.39\%}. Furthermore, our method is even competitive to mainstream transfer-based black-box attacks.

Defense models against adversarial attacks have grown significantly, but the lack of practical evaluation methods has hindered progress. Evaluation can be defined as looking for defense models' lower bound of robustness given a budget number of iterations and a test dataset. A practical evaluation method should be convenient (i.e., parameter-free), efficient (i.e., fewer iterations) and reliable (i.e., approaching the lower bound of robustness). Towards this target, we propose a parameter-free Adaptive Auto Attack (A$^3$) evaluation method which addresses the efficiency and reliability in a test-time-training fashion. Specifically, by observing that adversarial examples to a specific defense model follow some regularities in their starting points, we design an Adaptive Direction Initialization strategy to speed up the evaluation. Furthermore, to approach the lower bound of robustness under the budget number of iterations, we propose an online statistics-based discarding strategy that automatically identifies and abandons hard-to-attack images. Extensive experiments demonstrate the effectiveness of our A$^3$. Particularly, we apply A$^3$ to nearly 50 widely-used defense models. By consuming much fewer iterations than existing methods, i.e., $1/10$ on average (10$\times$ speed up), we achieve lower robust accuracy in all cases. Notably, we won $\textbf{first place}$ out of 1681 teams in CVPR 2021 White-box Adversarial Attacks on Defense Models competitions with this method. Code is available at: $\href{https://github.com/liuye6666/adaptive_auto_attack}{https://github.com/liuye6666/adaptive\_auto\_attack}$, Comment: Accepted by CVPR 2022

Adversarial examples have posed a severe threat to deep neural networks due to their transferable nature. Currently, various works have paid great efforts to enhance the cross-model transferability, which mostly assume the substitute model is trained in the same domain as the target model. However, in reality, the relevant information of the deployed model is unlikely to leak. Hence, it is vital to build a more practical black-box threat model to overcome this limitation and evaluate the vulnerability of deployed models. In this paper, with only the knowledge of the ImageNet domain, we propose a Beyond ImageNet Attack (BIA) to investigate the transferability towards black-box domains (unknown classification tasks). Specifically, we leverage a generative model to learn the adversarial function for disrupting low-level features of input images. Based on this framework, we further propose two variants to narrow the gap between the source and target domains from the data and model perspectives, respectively. Extensive experiments on coarse-grained and fine-grained domains demonstrate the effectiveness of our proposed methods. Notably, our methods outperform state-of-the-art approaches by up to 7.71\% (towards coarse-grained domains) and 25.91\% (towards fine-grained domains) on average. Our code is available at \url{https://github.com/qilong-zhang/Beyond-ImageNet-Attack}., Comment: Accepted by ICLR 2022

Ning Wu,1,* Taohua Yuan,1,* ZhiXin Yin,1 Xiaotian Yuan,1 Jianfei Sun,1 Zunqiu Wu,1 Qilong Zhang,1 Carl Redshaw,2 Shenggang Yang,1 Xiaotian Dai3 1Guizhou Medical University, Guiyang, Guizhou, People’s Republic of China; 2Department of Chemistry, University of Hull, Hull, Yorkshire, HU6 7RX, UK; 3Department of Mathematics and Statistics, University of Calgary, Calgary, AB, Canada*These authors contributed equally to this workCorrespondence: Shenggang Yang, Guizhou Medical University, Guiyang, Guizhou, 550025, People’s Republic of China, Tel/Fax +86 13158000576, Email yangshenggang2021@126.com Xiaotian Dai, Department of Mathematics and Statistics, University of Calgary, Calgary, AB, T2N 1N4, Canada, Tel/Fax +1 435 754 4980, Email xiaotian.dai@uCalgary.caPurpose: This study aimed to investigate the molecular mechanisms of Compound Sidaxue (SX), a prescription of Chinese Miao medicine, in treating rheumatoid arthritis (RA) using network pharmacology and in vivo experimental approaches.Methods: Network pharmacology was adopted to detect the active components of four Traditional Chinese herbal medicine (TCM) of SX, and the key targets and signaling pathways in the treatment of RA were predicted, and the key components and targets were screened for molecular docking. The predicted targets and pathways were validated in bovine type II collagen and incomplete Freund’s adjuvant emulsifier-induced rat RA model.Results: In this study, we identified 33 active components from SX, predicted to act on 44 RA-associated targets by network pharmacology. PPI network demonstrated that TNF-α, VEGF-A, IL-2, IL-6, AKT, PI3K, STAT1 may serve as the key targets of SX for the treatment of RA. The main functional pathways involving these key targets include PI3K-AKT signaling pathway, TNF signaling pathway, NF-κB signaling pathway. Molecular docking analysis found that the active components β-amyrin, cajanin, eleutheroside A have high affinity for TNF-α, VEGFA

Adversarial attacks make their success in DNNs, and among them, gradient-based algorithms become one of the mainstreams. Based on the linearity hypothesis, under $\ell_\infty$ constraint, $sign$ operation applied to the gradients is a good choice for generating perturbations. However, side-effects from such operation exist since it leads to the bias of direction between real gradients and perturbations. In other words, current methods contain a gap between real gradients and actual noises, which leads to biased and inefficient attacks. Therefore in this paper, based on the Taylor expansion, the bias is analyzed theoretically, and the correction of $sign$, i.e., Fast Gradient Non-sign Method (FGNM), is further proposed. Notably, FGNM is a general routine that seamlessly replaces the conventional $sign$ operation in gradient-based attacks with negligible extra computational cost. Extensive experiments demonstrate the effectiveness of our methods. Specifically, for untargeted black-box attacks, ours outperform them by 27.5% at most and 9.5% on average. For targeted attacks against defense models, it is 15.1% and 12.7%. Our anonymous code is publicly available at https://github.com/yaya-cheng/FGNM

Due to the vulnerability of deep neural networks (DNNs) to adversarial examples, a large number of defense techniques have been proposed to alleviate this problem in recent years. However, the progress of building more robust models is usually hampered by the incomplete or incorrect robustness evaluation. To accelerate the research on reliable evaluation of adversarial robustness of the current defense models in image classification, the TSAIL group at Tsinghua University and the Alibaba Security group organized this competition along with a CVPR 2021 workshop on adversarial machine learning (https://aisecure-workshop.github.io/amlcvpr2021/). The purpose of this competition is to motivate novel attack algorithms to evaluate adversarial robustness more effectively and reliably. The participants were encouraged to develop stronger white-box attack algorithms to find the worst-case robustness of different defenses. This competition was conducted on an adversarial robustness evaluation platform -- ARES (https://github.com/thu-ml/ares), and is held on the TianChi platform (https://tianchi.aliyun.com/competition/entrance/531847/introduction) as one of the series of AI Security Challengers Program. After the competition, we summarized the results and established a new adversarial robustness benchmark at https://ml.cs.tsinghua.edu.cn/ares-bench/, which allows users to upload adversarial attack algorithms and defense models for evaluation., Comment: Competition Report

By adding human-imperceptible perturbations to images, DNNs can be easily fooled. As one of the mainstream methods, feature space targeted attacks perturb images by modulating their intermediate feature maps, for the discrepancy between the intermediate source and target features is minimized. However, the current choice of pixel-wise Euclidean Distance to measure the discrepancy is questionable because it unreasonably imposes a spatial-consistency constraint on the source and target features. Intuitively, an image can be categorized as "cat" no matter the cat is on the left or right of the image. To address this issue, we propose to measure this discrepancy using statistic alignment. Specifically, we design two novel approaches called Pair-wise Alignment Attack and Global-wise Alignment Attack, which attempt to measure similarities between feature maps by high-order statistics with translation invariance. Furthermore, we systematically analyze the layer-wise transferability with varied difficulties to obtain highly reliable attacks. Extensive experiments verify the effectiveness of our proposed method, and it outperforms the state-of-the-art algorithms by a large margin. Our code is publicly available at https://github.com/yaya-cheng/PAA-GAA.

Crafting adversarial examples for the transfer-based attack is challenging and remains a research hot spot. Currently, such attack methods are based on the hypothesis that the substitute model and the victim model learn similar decision boundaries, and they conventionally apply Sign Method (SM) to manipulate the gradient as the resultant perturbation. Although SM is efficient, it only extracts the sign of gradient units but ignores their value difference, which inevitably leads to a deviation. Therefore, we propose a novel Staircase Sign Method (S$^2$M) to alleviate this issue, thus boosting attacks. Technically, our method heuristically divides the gradient sign into several segments according to the values of the gradient units, and then assigns each segment with a staircase weight for better crafting adversarial perturbation. As a result, our adversarial examples perform better in both white-box and black-box manner without being more visible. Since S$^2$M just manipulates the resultant gradient, our method can be generally integrated into the family of FGSM algorithms, and the computational overhead is negligible. Extensive experiments on the ImageNet dataset demonstrate the effectiveness of our proposed methods, which significantly improve the transferability (i.e., on average, \textbf{5.1\%} for normally trained models and \textbf{12.8\%} for adversarially trained defenses). Our code is available at \url{https://github.com/qilong-zhang/Staircase-sign-method}.

By adding human-imperceptible noise to clean images, the resultant adversarial examples can fool other unknown models. Features of a pixel extracted by deep neural networks (DNNs) are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. Motivated by this, we propose a patch-wise iterative algorithm -- a black-box attack towards mainstream normally trained and defense models, which differs from the existing attack methods manipulating pixel-wise noise. In this way, without sacrificing the performance of white-box attack, our adversarial examples can have strong transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $\epsilon$-constraint is properly assigned to its surrounding regions by a project kernel. Our method can be generally integrated to any gradient-based attack methods. Compared with the current state-of-the-art attacks, we significantly improve the success rate by 9.2\% for defense models and 3.7\% for normally trained models on average. Our code is available at \url{https://github.com/qilong-zhang/Patch-wise-iterative-attack}, Comment: Accepted by ECCV 2020

Although great progress has been made on adversarial attacks for deep neural networks (DNNs), their transferability is still unsatisfactory, especially for targeted attacks. There are two problems behind that have been long overlooked: 1) the conventional setting of $T$ iterations with the step size of $\epsilon/T$ to comply with the $\epsilon$-constraint. In this case, most of the pixels are allowed to add very small noise, much less than $\epsilon$; and 2) usually manipulating pixel-wise noise. However, features of a pixel extracted by DNNs are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. To tackle these issues, our previous work proposes a patch-wise iterative method (PIM) aimed at crafting adversarial examples with high transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $\epsilon$-constraint is properly assigned to its surrounding regions by a project kernel. But targeted attacks aim to push the adversarial examples into the territory of a specific class, and the amplification factor may lead to underfitting. Thus, we introduce the temperature and propose a patch-wise++ iterative method (PIM++) to further improve transferability without significantly sacrificing the performance of the white-box attack. Our method can be generally integrated to any gradient-based attack methods. Compared with the current state-of-the-art attack methods, we significantly improve the success rate by 33.1\% for defense models and 31.4\% for normally trained models on average.

Aim: This study aims to evaluate lumbar drainage (LD) for controlling refractory intracranial hypertension among non-HIV cryptococcal meningitis patients. Patients & methods: A case-control study was designed to compare LD (case) with repeated lumbar puncture (control). Results: Both LD and repeated lumbar puncture can efficiently control refractory intracranial hypertension. LD group showed better clinical symptom remission, such as lower rate of headache, vision disorders, signs of meningeal irritation and conscious disturbance, than control group. LD group was reported with higher intracranial pressure reduction (173.75 ± 17.72 mmH2O) than those among control group (113.50 ± 14.94 mmH2O; p < 0.05). Conclusion: LD is an effective and safe alternative to control refractory intracranial hypertension in HIV-negative cryptococcal meningitis patients.

Aim: This study aims to evaluate lumbar drainage (LD) for controlling refractory intracranial hypertension among non-HIV cryptococcal meningitis patients. Patients & methods: A case-control study was designed to compare LD (case) with repeated lumbar puncture (control). Results: Both LD and repeated lumbar puncture can efficiently control refractory intracranial hypertension. LD group showed better clinical symptom remission, such as lower rate of headache, vision disorders, signs of meningeal irritation and conscious disturbance, than control group. LD group was reported with higher intracranial pressure reduction (173.75 ± 17.72 mmH2O) than those among control group (113.50 ± 14.94 mmH2O; p < 0.05). Conclusion: LD is an effective and safe alternative to control refractory intracranial hypertension in HIV-negative cryptococcal meningitis patients.

Practicum is the cornerstone of teacher education. Triadic assessment of practicum is an established model in early childhood initial teacher education in New Zealand. Based on a phenomenographic study on assessment of practicum, this paper presents a new perspective on triadic assessment. Interview data are collected from 35 participants (20 associate teachers, 5 visiting lecturers, 10 student teachers) to obtain a specimen of collective conceptions of key stakeholders about triadic assessment. The analysis reveals three sets of logically related categories of conceptions (outcome spaces) that denote the tensions around the final judging role in assessment of practicum, in particular, visiting lecturers’ scheduled observation. Based on the findings from this study, we contemplate some significant modifications to the triadic assessment model which calls in question visiting lecturers’ final judging role in assessment of practicum.

Practicum is the cornerstone of teacher education. Triadic assessment of practicum is an established model in early childhood initial teacher education in New Zealand. Based on a phenomenographic study on assessment of practicum, this paper presents a new perspective on triadic assessment. Interview data are collected from 35 participants (20 associate teachers, 5 visiting lecturers, 10 student teachers) to obtain a specimen of collective conceptions of key stakeholders about triadic assessment. The analysis reveals three sets of logically related categories of conceptions (outcome spaces) that denote the tensions around the final judging role in assessment of practicum, in particular, visiting lecturers’ scheduled observation. Based on the findings from this study, we contemplate some significant modifications to the triadic assessment model which calls in question visiting lecturers’ final judging role in assessment of practicum.