Recently, adversarial attacks have shown to lead the state-of-the-art deep neural networks (DNNs) to misclassification. However, most adversarial attacks are generated according to whether they are perceptual to human visual system, measured by geometric metrics such as the $\ell _2$ -norm, which ignores the common watermarks in cyber-physical systems. In this article, we propose a fast adversarial watermark attack (FAWA) method based on fast differential evolution technique, which optimally superimposes a watermark on an image to fool DNNs. We also attempt to explain the reason why the attack is successful and propose two hypotheses on the vulnerability of DNN classifiers and the influence of the watermark attack on higher-layer features extraction respectively. In addition, we propose two countermeasure methods against FAWA based on random rotation and median filtering respectively. Experimental results show that our method achieves 41.3 percent success rate in fooling VGG-16 and have good transferability. Our approach is also shown to be effective in deceiving deep learning as a service (DLaaS) systems as well as the physical world. The proposed FAWA, hypotheses, and the countermeasure methods, provide a timely help for DNN designers to gain some knowledge of model vulnerability while designing DNN classifiers and related DLaaS applications.

Adversarial examples present a severe threat to deep neural networks’ application in safetycritical domains such as autonomous driving. Although there are numerous defensive solutions, they all have some flaws, such as the fact that they can only defend against adversarial attacks with a limited range of adversarial intensities. Therefore, there is a need for a detection method that can distinguish the adversarial intensity in a fine-grained manner so that subsequent tasks can perform different defense processing against perturbations of various intensities. Based on thefact that adversarial attack samples of different intensities are significantly different in the highfrequency region, this paper proposes a method to amplify the high-frequency component of the image and input it into the deep neural network based on the residual block structure. To our best knowledge, the proposed method is the first to classify adversarial intensities at a fine-grained level, thus providing an attack detection component for a general AI firewall. Experimental results show that our proposed method not only has advanced performance in AutoAttack detection by perturbation intensity classification, but also can effectively apply to detect examples of unseen adversarial attack methods.

In underwater target tracking, complex environmental interference and sensor anomalies introduce outliers into observations, leading to suboptimal state estimation. To address this challenge, a robust Kalman filter (SGαSSWMRKF) based on sliding window median and Sub-Gaussian α-stable (SGαS) distribution is proposed. The SGαS distribution models measurement noise in underwater tracking, with the Inverse Wishart distribution as the prior for measurement noise covariance. For the lack of a closed-form expression of the SGαS mixture probability density function, an estimator integrating Gamma Series approximation and Gauss-Laguerre Quadrature is developed to adaptively update asymptotic residual variance. Additionally, a median-based adaptive sliding window method with dynamically adjusted size computes the smoothed target state posterior, balancing real-time performance and estimation accuracy. Leveraging the Variational Bayes framework, SGαSSWMRKF suppresses outlier interference by iteratively updating the target state, measurement noise covariance, auxiliary random variables, and degrees of freedom parameters. Simulation results demonstrate that under an unknown non-stationary HMN environment, the SGαSSWMRKF outperforms the SWRKF filter. Specifically, it reduces the Average Root Mean Square Error by 16.74%, 8.14%, and 7.19% in distance, bearing, and velocity, respectively. Consequently, more accurate state estimation is achieved with SGαSSWMRKF. Additionally, experiments on a publicly available real-world dataset demonstrate that SGαSSWMRKF enables more accurate state estimation.