Adversarial example detection, which can be conveniently applied in many scenarios, is important in the area of adversarial defense. Unfortunately, existing detection methods suffer from poor generalization performance because their training process usually relies on the examples generated from a single known adversarial attack and there exists a large discrepancy between the training and unseen testing adversarial examples. To address this issue, we propose a novel method, named Adversarial Example Detection via Principal Adversarial Domain Adaptation (AED-PADA). Specifically, our approach identifies the Principal Adversarial Domains (PADs), i.e., a combination of features of the adversarial examples generated by different attacks, which possesses a large portion of the entire adversarial feature space. Subsequently, we pioneer to exploit Multi-source Unsupervised Domain Adaptation in adversarial example detection, with PADs as the source domains. Experimental results demonstrate the superior generalization ability of our proposed AED-PADA. Note that this superiority is particularly achieved in challenging scenarios characterized by employing the minimal magnitude constraint for the perturbations.

E15143 Background: To evaluate the efficacy of 125I radioactive seed implantation for locally recurrent rectal cancer (LRRC), and analyze the associated prognostic factors, the relationship between the efficacy and dosimetry. Methods: From September 2003 to December 2011, 36 patients with locally recurrent rectal cancer received 125I seeds implantation under CT guidance in our center. Each patients underwent three-dimentional treatment planning pre-implantation and dosimetric verification post-implantation. The median activity of seed was 0.7 mCi (0.4 to 0.8 mCi), and the median number of seeds was 74 (33 to 137). Double variates correlation analysis for gross tumor volume (GTV), D90, D100, V100, V150 and volume covered with the prescription dose, homogeneity index (HI), external index (EI) and conformity index (CI). The Logistic regression analysis between the overall survival, local control and the dosimetry was performed with the SPSS 22.0. Overall survival of the patients was calculated and prognostic factors were evaluated. Results: The D90 was 118.6±25.1Gy, the V100 was 90.0±0.3%. The mean CI, HI and EI was 1.48±0.36, 0.32±0.08, and 0.58±0.37. The D90 and CI decreased with the increasing of the GTV volume. The median overall survival was 16.2 months (95%CI 13.5-18.9 months). The median local control time was 10.0 months (95%CI 6.2-13.8 months). Analysis using the Cox proportional hazards model suggested that V100 is correlated to the overall survival time (p = 0.026), D90 is correlated to the local control time (p = 0.017). D90 > 140Gy and V100 > 90% is beneficial to improve the tumor control and patient survival. CI and EI is not related to the overall survival and local control, but related to the normal tissue sparing. Conclusions: CT-guided radioactive seed implantation provides a safe and effective method to control local tumor growth and prolong the survival of patients with locally recurrent rectal cancer without additional complications. V100 and D90 may predict a favorable tumor control and patients survival, whereas CI and EI is closely related to the normal structure side effects. CT image-guidance and satisfactory seeds implant is the key technique components for better clinical efficacy.

Most of the transfer-based adversarial attack methods suffer from large perceptual distortions, i.e., visible artifacts, when the attack success rate is relatively high. It is worth noting that these distortions usually contain a large portion which contributes less to the attack success rate. This portion of distortions, which is induced by unnecessary modifications and lack of proper perceptual distortion constraint, is our target. In this paper, we propose a perceptual distortion reduction framework to achieve high attack success rates and good perceptual qualities, by explicitly modeling the tradeoff between perceptual quality and attack success rate. Specifically, we propose a perceptual distortion constraint to constrain the generated adversarial example to comply with human perceptions. Secondly, by considering the discrepancy among different samples, we propose an adaptive penalty factor $\lambda$ to automatically assign necessary importance to the perceptual distortion constraint and guarantee a certain attack success rate. Thirdly, since the proposed optimization formulation is a complex non-convex problem, the commonly used momentum optimization technique cannot be directly applied because they cannot converge decently, as proved in the experiments. Therefore, we exploit the second moment of gradient to achieve an effective and efficient convergence. Extensive experiments have verified the superiority of our proposed work.

This work studies black-box adversarial attacks against deep neural networks, where the attacker only has access to the query feedback from the target model. The current state-of-the-art (SOTA) query-efficient attacks usually combine transfer-based and query-based methods by utilizing the gradient or initializations of surrogate models. However, these strategies typically incur significant computational costs and require a large number of queries during the attack process. In this paper, we propose a novel query-efficient method for generating black-box adversarial perturbations, named Vector Quantization based Query-efficient Adversarial Perturbation generation (VQQAP). Specifically, we propose a Nucleus Sampling based Discretization Module (NSDM) to create diverse adversarial examples in the discrete latent space. To directly optimize the latent vector, we formulate the optimization problem as a direct preference optimization (DPO) problem, and iteratively solve this problem based on the target model feedback. Experimental evaluations demonstrate the effectiveness and efficiency of our method.