Search

Artificial Intelligence (AI) systems have been increasingly used to make decision-making processes faster, more accurate, and more efficient. However, such systems are also at constant risk of being attacked. While the majority of attacks targeting AI-based applications aim to manipulate classifiers or training data and alter the output of an AI model, recently proposed Sponge Attacks against AI models aim to impede the classifier's execution by consuming substantial resources. In this work, we propose \textit{Dual Denial of Decision (DDoD) attacks against collaborative Human-AI teams}. We discuss how such attacks aim to deplete \textit{both computational and human} resources, and significantly impair decision-making capabilities. We describe DDoD on human and computational resources and present potential risk scenarios in a series of exemplary domains., 10 pages, 1 figure, IEEE Pervasive Computing, IEEE Special Issue on Human-Centered AI

The sea cucumber Apostichopus japonicus is dioecious, with seasonal reproduction. G protein-coupled receptor (GPCR)-mediated signaling systems might play critical roles in the reproductive control of A. japonicus. Here, we classified GPCR from the genome in silico and used transcriptomic analyses to further mine those that function in gonadal-development control. Totally, 487 GPCRs were predicted from A. japonicus, and 183 of these were further annotated to molecular pathways. Transcriptome analysis revealed 327 GPCRs expressed in gonads, and these were classified into four families and 19 subfamilies. Three pathways were apparently associated with reproduction, including neuroactive ligand-receptor interaction, the mTOR and Wnt signaling pathways. Seven and eight ovary- and testis-specific GPCRs were filtered, and the gene expression profiles were determined in multiple tissues and gonads at different developmental stages by qPCR. These results provide new insights into the discovery of GPCR-mediated signaling control in sea cucumber reproduction, especially in gonadal development control.

With the rapid development of deep learning techniques, the popularity of voice services implemented on various Internet of Things (IoT) devices is ever increasing. In this paper, we examine user-level membership inference in the problem space of voice services, by designing an audio auditor to verify whether a specific user had unwillingly contributed audio used to train an automatic speech recognition (ASR) model under strict black-box access. With user representation of the input audio data and their corresponding translated text, our trained auditor is effective in user-level audit. We also observe that the auditor trained on specific data can be generalized well regardless of the ASR model architecture. We validate the auditor on ASR models trained with LSTM, RNNs, and GRU algorithms on two state-of-the-art pipelines, the hybrid ASR system and the end-to-end ASR system. Finally, we conduct a real-world trial of our auditor on iPhone Siri, achieving an overall accuracy exceeding 80\%. We hope the methodology developed in this paper and findings can inform privacy advocates to overhaul IoT privacy., Accepted by PoPETs 2021.1

Two new CdII MOFs, namely, two-dimensional (2D) poly[[[μ2-1,4-bis(1H-benzimidazol-1-yl)butane](μ2-heptanedioato)cadmium(II)] tetrahydrate], {[Cd(C7H10O4)(C18H18N4)]·4H2O} n or {[Cd(Pim)(bbimb)]·4H2O} n (1), and 2D poly[diaqua[μ2-1,4-bis(1H-benzimidazol-1-yl)butane](μ4-decanedioato)(μ2-decanedioato)dicadmium(II)], [Cd2(C10H16O4)2(C18H18N4)(H2O)2] n or [Cd(Seb)(bbimb)0.5(H2O)] n (2), have been synthesized hydrothermally based on the 1,4-bis(1H-benzimidazol-1-yl)butane (bbimb) and pimelate (Pim2−, heptanedioate) or sebacate (Seb2−, decanedioate) ligands. Both MOFs were structurally characterized by single-crystal X-ray diffraction. In 1, the CdII centres are connected by bbimb and Pim2− ligands to generate a 2D sql layer structure with an octameric (H2O)8 water cluster. The 2D layers are further connected by O—H...O hydrogen bonds, resulting in a three-dimensional (3D) supramolecular structure. In 2, the CdII centres are coordinated by Seb2− ligands to form binuclear Cd2 units which are linked by bbimb and Seb2− ligands into a 2D hxl layer. The 2D layers are further connected by O—H...O hydrogen bonds, leading to an 8-connected 3D hex supramolecular network. IR and UV–Vis spectroscopy, thermogravimetric analysis and solid-state photoluminescence analysis were carried out on both MOFs. Luminescence sensing experiments reveal that both MOFs have good selective sensing towards Fe3+ in aqueous solution.

Observation Resilient Authentication Schemes (ORAS) are a class of shared secret challenge–response identification schemes where a user mentally computes the response via a cognitive function to authenticate herself such that eavesdroppers cannot readily extract the secret. Security evaluation of ORAS generally involves quantifying information leaked via observed challenge–response pairs. However, little work has evaluated information leaked via human behavior while interacting with these schemes. A common way to achieve observation resilience is by including a modulus operation in the cognitive function. This minimizes the information leaked about the secret due to the many-to-one map from the set of possible secrets to a given response. In this work, we show that user behavior can be used as a side channel to obtain the secret in such ORAS. Specifically, the user’s eye-movement patterns and associated timing information can deduce whether a modulus operation was performed (a fundamental design element) to leak information about the secret. We further show that the secret can still be retrieved if the deduction is erroneous, a more likely case in practice. We treat the vulnerability analytically and propose a generic attack algorithm that iteratively obtains the secret despite the “faulty” modulus information. We demonstrate the attack on five ORAS and show that the secret can be retrieved with considerably less challenge–response pairs than non-side-channel attacks (e.g., algebraic/statistical attacks). In particular, our attack is applicable on Mod10, a one-time-pad-based scheme, for which no non-side-channel attack exists. We field test our attack with a small-scale eye-tracking user study.

Two new heterometallic CuEr cluster complexes based on 3,5-dichlorobenzoic acid (HL) and 2,2′:6′,2″-terpyridine (TPY), [Cu(L)(TPY)][Er(L)4]·H2O (1) and [Cu(L)(TPY)][Er2(L)7] (2), have been hydrothermally prepared by controlling the metal–ligand ratios. Comparative study revealed that metal–ligand ratios affected the coordination modes of L− and thus generate two distinct structures. Both complexes display as ion-pair bicomponent structures. The cationic [Cu(L)(TPY)]+ components show the similar binuclear cluster structure in two complexes, while the two anionic parts are very different. In 1, two Er(III) centers are coordinated by four bridging and four chelating L− ligands to form the binuclear anionic [Er2(L)8]2− cluster. While in 2, all L− ligands show the bridging modes and connect the Er(III) centers into an extended one-dimensional (1D) chain. So the overall structures of 1 and 2 are bicomponent 0D + 0D and 0D + 1D structures, respectively. Direct current magnetic susceptibility measurements were performed for two complexes and they both showed antiferromagnetic behavior.

The integral equation method is one of the most successful computational models for microwave devices or integrated circuits in planar layered media. However, the efficient and accurate evaluation of the associated Green’s function consisting of Sommerfeld integrals (SIs) is still a remaining challenge. To mitigate this difficulty, this work proposes a spatial domain rational function fitting technique (RFFT) for SIs so that the approximation accuracy is controllable. In conjunction with an adaptive sampling strategy, the proposed RFFT minimizes the orders of rational functions, and the resultant SI evaluation efficiency is optimized. In addition, we investigate the semi-analytical singularity treatment for the rational expression of SIs in method of moment (MoM) implementation. Extensive simulation of representative planar devices validates the correctness of the proposed method and demonstrates its superior performance over conventional SI approximation methods.

An exact and asymptotic expression for dyadic Green function of a vertical dipole above impedance surface is studied in this paper. Based on the single image expression for Sommerfeld integral, the vector field quantities caused by a vertical dipole placed above impedance surface are derived. In addition, the far-field asymptotic expression is presented in terms of series expansion, which provides new physical insights of the vertical dipole radiation above impedance surface.

Deep Neural Networks have achieved unprecedented success in the field of face recognition such that any individual can crawl the data of others from the Internet without their explicit permission for the purpose of training high-precision face recognition models, creating a serious violation of privacy. Recently, a well-known system named Fawkes [37] (published in USENIX Security 2020) claimed this privacy threat can be neutralized by uploading cloaked user images instead of their original images. In this paper, we present Oriole, a system that combines the advantages of data poisoning attacks and evasion attacks, to thwart the protection offered by Fawkes, by training the attacker face recognition model with multi-cloaked images generated by Oriole. Consequently, the face recognition accuracy of the attack model is maintained and the weaknesses of Fawkes are revealed. Experimental results show that our proposed Oriole system is able to effectively interfere with the performance of the Fawkes system to achieve promising attacking results. Our ablation study highlights multiple principal factors that affect the performance of the Oriole system, including the DSSIM perturbation budget, the ratio of leaked clean user images, and the numbers of multi-cloaks for each uncloaked image. We also identify and discuss at length the vulnerabilities of Fawkes. We hope that the new methodology presented in this paper will inform the security community of a need to design more robust privacy-preserving deep learning models.

Serotonin (5-hydroxytryptamine [5-HT]) receptors (5-HTRs) mediate neuroendocrine signaling via interactions with the ligand serotonin (5-HT). The 5-HT signaling system has been well studied in vertebrates, but rarely known in invertebrate animals, especially in the marine invertebrates. In this study, we identified and characterized a novel 5-HTR from the sea cucumber Apostichopus japonicus (Aj5-HT4/6 ). The cloned Aj5-HT4/6 open reading frame comprised 1290 bp and encoded 429 amino acids. Bioinformatic analysis of the receptor indicated that it was a member of the class A of the G protein-coupled receptor family. Further experiments using Aj5-HT4/6 -transfected HEK293 cells demonstrated that treatment with 5-HT could induce rapid internalization of Aj5-HT4/6 fused with enhanced green fluorescent protein from the cell surface into the cytoplasm and triggered a significant increase in levels of the second messenger cAMP as well as mitogen-activated protein kinase phosphorylation in a 5-HT dose-dependent manner. Quantitative real time-polymerase chain reaction demonstrated that Aj5-HT4/6 was predominantly expressed in the muscle and respiratory tree, and its expression was significantly decreased during estivation. Taken together, these results imply that Aj5-HT4/6 is potentially involved in the movement and metabolism of the sea cucumber.

Two new Cd

With the rise of third parties in the machine learning pipeline, the service provider in "Machine Learning as a Service" (MLaaS), or external data contributors in online learning, or the retraining of existing models, the need to ensure the security of the resulting machine learning models has become an increasingly important topic. The security community has demonstrated that without transparency of the data and the resulting model, there exist many potential security risks, with new risks constantly being discovered. In this paper, we focus on one of these security risks -- poisoning attacks. Specifically, we analyze how attackers may interfere with the results of regression learning by poisoning the training datasets. To this end, we analyze and develop a new poisoning attack algorithm. Our attack, termed Nopt, in contrast with previous poisoning attack algorithms, can produce larger errors with the same proportion of poisoning data-points. Furthermore, we also significantly improve the state-of-the-art defense algorithm, termed TRIM, proposed by Jagielsk et al. (IEEE S&P 2018), by incorporating the concept of probability estimation of clean data-points into the algorithm. Our new defense algorithm, termed Proda, demonstrates an increased effectiveness in reducing errors arising from the poisoning dataset through optimizing ensemble models. We highlight that the time complexity of TRIM had not been estimated; however, we deduce from their work that TRIM can take exponential time complexity in the worst-case scenario, in excess of Proda's logarithmic time. The performance of both our proposed attack and defense algorithms is extensively evaluated on four real-world datasets of housing prices, loans, health care, and bike sharing services. We hope that our work will inspire future research to develop more robust learning algorithms immune to poisoning attacks., Accepted to IEEE Transactions on Information Forensics and Security (TIFS) 2021

Background : This study was conducted to evaluate and update the current prevalence of and risk factors for chronic kidney disease (CKD) and diabetic kidney disease (DKD) in China. Methods : From December 2017 to June 2018, a total of 5231 subjects were randomly recruited from 3 communities in 3 districts of Zhengzhou. CKD was defined as estimated glomerular filtration rate (eGFR) < 60 mL/min.1.73m 2 or urinary albumin to creatinine ratio ≥ 30 mg/g (albuminuria). Diabetic subjects with systolic blood blood pressure > 140 mmHg, albuminuria or an eGFR less than 60 mL/min/1.73 m 2 were classified as having DKD. Participants completed a questionnaire assessing lifestyle and relevant medical history, and blood and urine specimens were taken. Serum creatinine, uric acid, total cholesterol, triglycerides, low-density lipoprotein, high-density lipoprotein and urinary albumin were assessed. The age- and sex-adjusted prevalences of CKD and DKD were calculated, and risk factors associated with the presence of reduced eGFR, albuminuria, DKD, severity of albuminuria and progression of reduced renal function were analyzed by binary and ordinal logistic regression. Results : The overall adjusted prevalence of CKD was 16.8% (15.8 – 17.8%) and that of DKD was 3.5% (3.0 – 4.0%). Decreased renal function was detected in 132 participants (2.9%, 95% confidence interval [CI]: 2.5 – 3.2%), whereas albuminuria was found in 858 participants (14.9%, 95% CI: 13.9 – 15.9%). In all participants with diabetes, the prevalence of reduced eGFR was 6.3% (95% CI = 3.9 – 8.6%) and that of albuminuria was 45.3% (95% CI = 40.4 – 50.1%). The overall prevalence of CKD in participants with diabetes was 48.0% (95% CI = 43.1 – 52.9%). The results of the binary and ordinal logistic regression indicated that the factors independently associated with a higher risk of reduced eGFR and albuminuria were older age, sex, smoking, alcohol consumption, overweight, obesity, diabetes, hypertension, dyslipidemia and hyperuricemia. Conclusions : Our study shows the current prevalence of CKD and DKD in residents of Central China. The high prevalence suggests an urgent need to implement interventions to relieve the high burden of CKD and DKD in China.

Data holders are increasingly seeking to protect their user's privacy, whilst still maximizing their ability to produce machine models with high quality predictions. In this work, we empirically evaluate various implementations of differential privacy (DP), and measure their ability to fend off real-world privacy attacks, in addition to measuring their core goal of providing accurate classifications. We establish an evaluation framework to ensure each of these implementations are fairly evaluated. Our selection of DP implementations add DP noise at different positions within the framework, either at the point of data collection/release, during updates while training of the model, or after training by perturbing learned model parameters. We evaluate each implementation across a range of privacy budgets, and datasets, each implementation providing the same mathematical privacy guarantees. By measuring the models' resistance to real world attacks of membership and attribute inference, and their classification accuracy. we determine which implementations provide the most desirable tradeoff between privacy and utility. We found that the number of classes of a given dataset is unlikely to influence where the privacy and utility tradeoff occurs. Additionally, in the scenario that high privacy constraints are required, perturbing input training data does not trade off as much utility, as compared to noise added later in the ML process., 12 pages, Accepted at CCSW'20, an ACM CCS Workshop

We assess the security of machine learning based biometric authentication systems against an attacker who submits uniform random inputs, either as feature vectors or raw inputs, in order to find an accepting sample of a target user. The average false positive rate (FPR) of the system, i.e., the rate at which an impostor is incorrectly accepted as the legitimate user, may be interpreted as a measure of the success probability of such an attack. However, we show that the success rate is often higher than the FPR. In particular, for one reconstructed biometric system with an average FPR of 0.03, the success rate was as high as 0.78. This has implications for the security of the system, as an attacker with only the knowledge of the length of the feature space can impersonate the user with less than 2 attempts on average. We provide detailed analysis of why the attack is successful, and validate our results using four different biometric modalities and four different machine learning classifiers. Finally, we propose mitigation techniques that render such attacks ineffective, with little to no effect on the accuracy of the system., Comment: Accepted by NDSS2020, 18 pages

With Google, Amazon, Microsoft, and other entities establishing “Machine Learning as a Service” (MLaaS), ensuring the security of the resulting machine learning models has become an increasingly important topic. The security community has demonstrated that MLaaS contains many potential security risks, with new risks constantly being discovered. In this paper, we focus on one of these security risks – data poisoning attacks. Specifically, we analyze how attackers interfere with the results of logistic regression by poisoning the training datasets. To this end, we analyze and propose an alternative formulation for the optimization of poisoning training points capable of poisoning the logistic regression classifier, a model that has previously not been susceptible to poisoning attacks. We evaluate the performance of our proposed attack algorithm on the three real-world datasets of wine cultivars, adult census information, and breast cancer diagnostics. The success of our proposed formulation is evident in decreasing testing accuracy of logistic regression models exposed to an increasing number of poisoned training samples.

Purpose Previous western studies have found Caucasians with skin cancer, either melanoma or nonmelanoma skin cancer (NMSC), have an elevated risk of second primary cancer. Our objective was to assess the risk of second primary cancer in Taiwanese with NMSC. Materials and methods By using data from Taiwan's National Health Insurance Research Database, we conducted a population-based cohort study to assess the risk of incident second primary cancer in Taiwanese affected by NMSC. Results We identified 505 subjects with NMSC and 2,020 matched controls. After adjustment for potential confounders including age, sex, urbanization, and Charlson Comorbidity Index, people who had NMSC had a 1.43-fold (95% confidence interval [CI], 1.05 to 1.96) risk for the development of second primary cancer as comparedwith control group. Menwith NMSC had a 2.99-fold (95% CI, 1.00 to 9.10) risk for second primary cancer involving the lip, oral cavity, and pharynx and a 3.51-fold (95% CI, 1.21 to 10.17) risk for second primary cancer involving the genitourinary organs when compared to the control group. By contrast, women with NMSC did not have an increased risk of second primary cancer. Conclusion This study revealed Asians with NMSC have an increased risk of second primary cancer. Our findings can be a useful reference for health care for people diagnosed with NMSC.

We argue that touch-based gestures on touch-screen devices enable the threat of a form of persistent and ubiquitous tracking which we call touch-based tracking. Touch-based tracking goes beyond the tracking of virtual identities and has the potential for cross-device tracking as well as identifying multiple users using the same device. We demonstrate the likelihood of touch-based tracking by focusing on touch gestures widely used to interact with touch devices such as swipes and taps.. Our objective is to quantify and measure the information carried by touch-based gestures which may lead to tracking users. For this purpose, we develop an information theoretic method that measures the amount of information about users leaked by gestures when modelled as feature vectors. Our methodology allows us to evaluate the information leaked by individual features of gestures, samples of gestures, as well as samples of combinations of gestures. Through our purpose-built app, called TouchTrack, we gather gesture samples from 89 users, and demonstrate that touch gestures contain sufficient information to uniquely identify and track users. Our results show that writing samples (on a touch pad) can reveal 73.7% of information (when measured in bits), and left swipes can reveal up to 68.6% of information. Combining different combinations of gestures results in higher uniqueness, with the combination of keystrokes, swipes and writing revealing up to 98.5% of information about users. We further show that, through our methodology, we can correctly re-identify returning users with a success rate of more than 90%.