Machine learning techniques have been widely applied to various applications. However, they are potentially vulnerable to data poisoning attacks, where sophisticated attackers can disrupt the learning procedure by injecting a fraction of malicious samples into the training dataset. Existing defense techniques against poisoning attacks are largely attack-specific : they are designed for one specific type of attacks but do not work for other types, mainly due to the distinct principles they follow. Yet few general defense strategies have been developed. In this paper, we propose De-Pois, an attack-agnostic defense against poisoning attacks. The key idea of De-Pois is to train a mimic model the purpose of which is to imitate the behavior of the target model trained by clean samples. We take advantage of Generative Adversarial Networks (GANs) to facilitate informative training data augmentation as well as the mimic model construction. By comparing the prediction differences between the mimic model and the target model, De-Pois is thus able to distinguish the poisoned samples from clean ones, without explicit knowledge of any ML algorithms or types of poisoning attacks. We implement four types of poisoning attacks and evaluate De-Pois with five typical defense methods on different realistic datasets. The results demonstrate that De-Pois is effective and efficient for detecting poisoned data against all the four types of poisoning attacks, with both the accuracy and F1-score over 0.9 on average.

De-Pois: An Attack-Agnostic Defense against Data Poisoning Attacks

This article proposes a novel grayscale image steganography scheme that is capable of hiding an encrypted secret image into a cover image of the same size. The secret image is encrypted using the chaos encryption technology before being hidden. The encrypted image and cover image are then transformed into the steg image by a convolutional neural network (CNN). Also, a generative adversarial network (GAN) is adopted to produce a more realistic steg image, whose appearance is difficult to distinguish from the cover image. The steganography scheme is composed of three CNNs which are regarded as hiding network, discriminative network, and extracting network, respectively. Additionally, a new weight allocation mechanism is introduced to ensure the balanced training procedure of hiding-extracting networks. The obtained experimental results show that the proposed scheme not only solved the problems of secret information leakage and color distortion of the current mainstream methods but also maintain high embedding capacity. Compared with other methods, the average values of the PSNR and SSIM of our steg images can reach 0.987 and 42.3, respectively. And the quality of the reconstructed secret images is also advantageous.

/pdf/a-novel-grayscale-image-steganography-scheme-based-on-chaos-3zfp56fc6k.pdf

A Novel Grayscale Image Steganography Scheme Based on Chaos Encryption and Generative Adversarial Networks

Image steganography aims to embed secret messages into cover images in an imperceptible manner. While steganalysis tries to identify stegos from covers, which is a special binary classification problem. Recently, some literatures show that the adversarial embedding can mislead the advanced steganalyzers based on convolutional neural network (CNN), and thus enhance the steganography security. Since adding perturbations to stegos may lead to messages extraction failure due to properties of syndrome-trellis codes (STC), the existing adversarial examples are derived from covers or their enhanced versions, while those stegos are not fully utilized. In this paper, we propose a new adversarial embedding scheme for image steganography. Unlike those related works, we first combine multiple gradients of cover and generated stegos to determine the directions of cost modifications. Next, instead of adjusting all or a random part of embedding costs in existing works, we carefully select the candidate costs according to the amplitudes of cover gradients and their costs. Extensive experimental results demonstrate that by adjusting a tiny part of embedding costs (less than 5% in most cases), the proposed method can significantly improve the security of five modern steganographic methods evaluated on both re-trained CNN-based and traditional steganalyzers, and achieve much better security performances compared with related methods. In addition, the security performances evaluated on different image database show that the generalization of the proposed method is good.

A New Adversarial Embedding Method for Enhancing Image Steganography

Audio steganography is the process of hiding secret information such as images, text, or video into the audio file. Data hiding in audio signals has been utilized in diverse applications like secret communication, hiding of data that may affect the safety and security of personnel and governments. Most of the recently introduced audio steganography approaches are content non-adaptive that may suffer low embedding capability and poor security. This paper proposes the audio steganography model for secure audio transmission during communication based on the meta-heuristic concept. In the embedding phase, the optimized instant selection is made for embedding the secret message (image) into the input audio. Further, the secret message to be embedded is encrypted using the optimized 2D-Logistic Chaotic Map. Here, the development of optimal instant selection and the optimized 2D-Logistic Chaotic Map are performed by the improved Shark Smell Optimization (SSO) called Backward Movement oriented SSO (BM-SSO). Once the secret message is encrypted, the compression of the message is done by Modified Huffman Encoding (MHE). Finally, the extraction phase uses the optimized 2D-Logistic Chaotic Map-based decryption. The proposed audio steganography by optimized instant selection for audio embedding minimizes the distortion error between the stego audio and original audio in terms of Mean Squared Error (MSE), and optimized 2D-Logistic Chaotic Map-based encryption aims to maximize the entropy of cipher image. The performance of the developed model has been estimated extensively against attacks, and simulation results are presented to prove the robustness of the proposed algorithm. 

Backward movement oriented shark smell optimization-based audio steganography using encryption and compression strategies

Deep learning-based person re-identification (Re-ID) has made great progress and achieved high performance recently. In this paper, we make the first attempt to examine the vulnerability of current person Re-ID models against a dangerous attack method, i.e. , the universal adversarial perturbation (UAP) attack, which has been shown to fool classification models with a little overhead. We propose a more universal adversarial perturbation (MUAP) method for both image-agnostic and model-insensitive person Re-ID attack. Firstly, we adopt a list-wise attack objective function to disrupt the similarity ranking list directly. Secondly, we propose a model-insensitive mechanism for cross-model attack. Extensive experiments show that the proposed attack approach achieves high attack performance and outperforms other state of the arts by large margin in cross-model scenario. The results also demonstrate the vulnerability of current Re-ID models to MUAP and further suggest the need of designing more robust Re-ID models.

Beyond Universal Person Re-Identification Attack

Recently, convolutional neural networks (CNNs) have demonstrated superior performance on digital multimedia steganalysis. However, some studies have noted that most CNN-based classifiers can be easily fooled by adversarial examples, which form slightly perturbed inputs to a target network according to the gradients. Inspired by this phenomenon, we first introduce a novel steganography method based on adversarial examples for digital audio in the time domain. Unlike related methods for image steganography, such as [1] – [4] , which are highly dependent on some existing embedding costs, the proposed method can start from a flat or even a random embedding cost and then iteratively update the initial costs by exploiting the adversarial attacks until satisfactory security performances are obtained. The extensive experimental results show that our method significantly outperforms the existing nonadaptive and adaptive steganography methods and achieves state-of-the-art results. Moreover, we also provide experimental results to investigate why the proposed embedding modifications seem evenly located at all audio segments despite their different content complexities, which is contrary to the content adaptive principle widely employed in modern steganography methods.

Yanmei Fang

Papers

Audio Steganography Based on Iterative Adversarial Attacks Against Convolutional Neural Networks