Deep neural networks (DNN) are applied in various fields because they afford good performance. However, they seem vulnerable to adversarial examples. Therefore, studies are actively investigating adversarial defenses to improve the robustness of DNNs as well as adversarial attacks to generate more intensive adversarial perturbations. Most existing attack methods excessively modify images by generating overly large distortions or adding perturbations to regions with little impact on the DNN. As a result, the local smoothness of images is not maintained, and changes can be easily detected using a steganalysis-based detector. In this study, we propose a contour attack method to evade steganalysis-based detection. This method extracts the contour region from an image and adds perturbations only to applicable regions, thus maintaining the local smoothness. It can solve the problems mentioned above and effectively evade steganalysis-based detectors. Our experimental results demonstrate that the local smoothness is better than that in the case of original attack methods and that the detection evasion rate for a steganalysis detector is up to 19.9% higher. Further, structural similarity (SSIM) measurements and image comparisons demonstrate the improved imperceptibility of perturbations. In particular, the SSIM values for images subjected to the contour attack are close to 1.0.

Black-box attacks against deep neural network (DNN) classifiers are receiving increasing attention because they represent a more practical approach in the real world than white box attacks. In black-box environments, adversaries have limited knowledge regarding the target model. This makes it difficult to estimate gradients for crafting adversarial examples, such that powerful white-box algorithms cannot be directly applied to black-box attacks. Therefore, a well-known black-box attack strategy creates local DNNs, called substitute models, to emulate the target model. The adversaries then craft adversarial examples using the substitute models instead of the unknown target model. The substitute models repeat the query process and are trained by observing labels from the target model’s responses to queries. However, emulating a target model usually requires numerous queries because new DNNs are trained from the beginning. In this study, we propose a new training method for substitute models to minimize the number of queries. We consider the number of queries as an important factor for practical black-box attacks because real-world systems often restrict queries for security and financial purposes. To decrease the number of queries, the proposed method does not emulate the entire target model and only adjusts the partial classification boundary based on a current attack. Furthermore, it does not use queries in the pre-training phase and creates queries only in the retraining phase. The experimental results indicate that the proposed method is effective in terms of the number of queries and attack success ratio against MNIST, VGGFace2, and ImageNet classifiers in query-limited black-box environments. Further, we demonstrate a black-box attack against a commercial classifier, Google AutoML Vision.

Deep learning models are highly susceptible to adversarial attacks, where subtle perturbations in the input images lead to misclassifications. Adversarial examples typically distort specific features that are critical for accurate image classification. Therefore, distorting the visual semantic characteristics via adversarial attacks is challenging. Building on this insight, we propose a method that leverages a multimodal space for detection of adversarial examples. Our approach utilizes cross-modal semantic embeddings derived from the images and labels.We employed image and text encoders trained to maximize the similarity between the embeddings extracted from images and labels, optimized these cross-modal semantic embeddings and mapped them to a common semantic space to extract detailed semantic features. When the embeddings extracted from an image and its label are semantically similar, they are closely positioned in this space. Based on these observations, we compared the similarities between the embeddings of the input images with those of their corresponding labels to detect adversarial examples. We evaluated our proposed method on classification benchmark datasets and demonstrated detection rates of over 91.75% for various adversarial attacks. Moreover, we determined that the ground truth had higher similarity than the other label to the detected adversarial sample, enabling robust predictions with the most similar label.

Short message service (SMS) is the most widely adopted multi-factor authentication method for consumer-facing accounts. However, SMS authentication is susceptible to vulnerabilities such as man-in-the-middle attack, smishing, and device theft. This study proposes implicit authentication based on behavioral pattern of users when they check an SMS verification code and environmental information of user proximity to detect device theft. User behavioral pattern is collected by using the accelerometer and gyroscope of a smart device such as a smartphone and smart watch. User environmental information is collected using device fingerprint, wireless access point, Bluetooth, and global positioning system information. To evaluate the performance of the proposed scheme, we perform experiments using a total of 1320 behavioral and environmental data collected from 22 participants. The scheme achieves an average equal error rate of 6.27% when using both behavioral and environmental data collected from only a smartphone. Moreover, it achieves an average equal error rate of 0% when using both behavioral and environmental data collected from a smartphone and smart watch. Therefore, the proposed scheme can be employed for more secure SMS authentication.