对象检测是各种关键计算机视觉任务的基础，例如分割，对象跟踪和事件检测。要以令人满意的精度训练对象探测器，需要大量数据。但是，由于注释大型数据集涉及大量劳动力，这种数据策展任务通常被外包给第三方或依靠志愿者。这项工作揭示了此类数据策展管道的严重脆弱性。我们提出MACAB，即使数据策展人可以手动审核图像，也可以将干净的图像制作清洁的图像将后门浸入对象探测器中。我们观察到，当后门被不明确的天然物理触发器激活时，在野外实现了错误分类和披肩的后门效应。与带有清洁标签的现有图像分类任务相比，带有清洁通道的非分类对象检测具有挑战性，这是由于每个帧内有多个对象的复杂性，包括受害者和非视野性对象。通过建设性地滥用深度学习框架使用的图像尺度函数，II结合了所提出的对抗性清洁图像复制技术，以及在考虑到毒品数据选择标准的情况下，通过建设性地滥用图像尺度尺度，可以确保MACAB的功效。广泛的实验表明，在各种现实世界中，MacAB在90％的攻击成功率中表现出超过90％的攻击成功率。这包括披肩和错误分类后门效应，甚至限制了较小的攻击预算。最先进的检测技术无法有效地识别中毒样品。全面的视频演示位于https://youtu.be/ma7l_lpxkp4上，该演示基于yolov4倒置的毒药率为0.14％，yolov4 clokaking后门和更快的速度R-CNN错误分类后门。

As a critical threat to deep neural networks (DNNs), backdoor attacks can be categorized into two types, i.e., source-agnostic backdoor attacks (SABAs) and source-specific backdoor attacks (SSBAs). Compared to traditional SABAs, SSBAs are more advanced in that they have superior stealthier in bypassing mainstream countermeasures that are effective against SABAs. Nonetheless, existing SSBAs suffer from two major limitations. First, they can hardly achieve a good trade-off between ASR (attack success rate) and FPR (false positive rate). Besides, they can be effectively detected by the state-of-the-art (SOTA) countermeasures (e.g., SCAn). To address the limitations above, we propose a new class of viable source-specific backdoor attacks, coined as CASSOCK. Our key insight is that trigger designs when creating poisoned data and cover data in SSBAs play a crucial role in demonstrating a viable source-specific attack, which has not been considered by existing SSBAs. With this insight, we focus on trigger transparency and content when crafting triggers for poisoned dataset where a sample has an attacker-targeted label and cover dataset where a sample has a ground-truth label. Specifically, we implement $CASSOCK_{Trans}$ and $CASSOCK_{Cont}$. While both they are orthogonal, they are complementary to each other, generating a more powerful attack, called $CASSOCK_{Comp}$, with further improved attack performance and stealthiness. We perform a comprehensive evaluation of the three $CASSOCK$-based attacks on four popular datasets and three SOTA defenses. Compared with a representative SSBA as a baseline ($SSBA_{Base}$), $CASSOCK$-based attacks have significantly advanced the attack performance, i.e., higher ASR and lower FPR with comparable CDA (clean data accuracy). Besides, $CASSOCK$-based attacks have effectively bypassed the SOTA defenses, and $SSBA_{Base}$ cannot.

互联网是人类有史以来最复杂的机器，以及如何防御入侵的情况更加复杂。随着新入侵的不断增加，入侵检测任务越来越依赖人工智能。机器学习模型的可解释性和透明度是对AI驱动的入侵检测结果的信任的基础。当前的解释人工智能技术是启发式的，这既不准确也不足够。本文提出了一种基于人造免疫系统的严格可解释的人工智能驱动的入侵检测方法。介绍了决策树模型的严格解释计算过程的细节。对良性交通流的主要隐含解释是针对网络免疫系统负选择的规则。实验是在现实生活中进行的。

联合学习（FL）在许多分散的用户中训练全球模型，每个用户都有本地数据集。与传统的集中学习相比，FL不需要直接访问本地数据集，因此旨在减轻数据隐私问题。但是，由于推理攻击，包括成员推理，属性推理和数据反演，FL中的数据隐私泄漏仍然存在。在这项工作中，我们提出了一种新型的隐私推理攻击，创造的偏好分析攻击（PPA），它准确地介绍了本地用户的私人偏好，例如，最喜欢（不喜欢）来自客户的在线购物中的（不喜欢）项目和最常见的表达式从用户的自拍照中。通常，PPA可以在本地客户端（用户）的特征上介绍top-k（即，尤其是k = 1、2、3和k = 1）的偏好。我们的关键见解是，本地用户模型的梯度变化对给定类别的样本比例（尤其是大多数（少数）类别的样本比例具有明显的敏感性。通过观察用户模型对类的梯度敏感性，PPA可以介绍用户本地数据集中类的样本比例，从而公开用户对类的偏好。 FL的固有统计异质性进一步促进了PPA。我们使用四个数据集（MNIST，CIFAR10，RAF-DB和PRODUCTS-10K）广泛评估了PPA的有效性。我们的结果表明，PPA分别达到了MNIST和CIFAR10的90％和98％的TOP-1攻击精度。更重要的是，在实际的购物商业商业场景（即产品-10k）和社交网络（即RAF-DB）中，PPA在前一种情况下，PPA获得了78％的TOP-1攻击精度，以推断出最有序的物品（即作为商业竞争对手），在后一种情况下，有88％来推断受害者用户最常见的面部表情，例如恶心。

后门深度学习（DL）模型的行为通常在清洁输入上，但在触发器输入时不端行为，因为后门攻击者希望为DL模型部署构成严重后果。最先进的防御是限于特定的后门攻击（源无关攻击）或在该机器学习（ML）专业知识或昂贵的计算资源中不适用于源友好的攻击。这项工作观察到所有现有的后门攻击都具有不可避免的内在弱点，不可转换性，即触发器输入劫持劫持模型，但不能对另一个尚未植入同一后门的模型有效。通过此密钥观察，我们提出了不可转换性的反向检测（NTD）来识别运行时在运行时的模型欠测试（MUT）的触发输入。特定，NTD允许潜在的回溯静电预测输入的类别。同时，NTD利用特征提取器（FE）来提取输入的特征向量，并且从其预测类随机拾取的一组样本，然后比较FE潜在空间中的输入和样本之间的相似性。如果相似性低，则输入是对逆势触发输入;否则，良性。 FE是一个免费的预训练模型，私下从开放平台保留。随着FE和MUT来自不同来源，攻击者非常不可能将相同的后门插入其中两者。由于不可转换性，不能将突变处工作的触发效果转移到FE，使NTD对不同类型的后门攻击有效。我们在三个流行的定制任务中评估NTD，如面部识别，交通标志识别和一般动物分类，结果确认NDT具有高效率（低假验收率）和具有低检测延迟的可用性（低误报率）。

尽管深度神经网络模型在各种应用程序中表现出出色的性能，但它们的较大模型大小和广泛的浮点操作使移动计算平台上的部署成为主要挑战，尤其是在物联网设备上。一种吸引人的解决方案是模型量化，可降低模型大小并使用微控制器通常支持的整数操作。为此，1位量化的DNN模型或深二进制神经网络可最大化存储效率，其中BNN模型中的每个参数仅具有1位。在本文中，我们提出了一个可重构的BNN（RBNN），以进一步扩大资源约束的物联网设备的内存效率。通常，可以根据需要重新配置RBNN，以实现具有相同参数集的M（m> 1）不同的任务，因此只有一个任务决定了内存要求。换句话说，通过时间M改善了内存利用率。我们的广泛实验证实了多达七个常用的任务可以共存（M的值更大）。这些具有不同类别的任务在三个二氧化流行的DNN体系结构（包括VGG，Resnet和ReactNet）上没有准确性或微不足道的准确性下降。这些任务跨越了不同域，例如本文验证的计算机视觉和音频域，并以模型体系结构可以服务于这些跨域任务的先决条件。为了保护RBNN模型的知识属性，可以通过用户密钥和由固有硬件指纹生成的设备唯一的根键来控制重新配置。通过这样做，RBNN模型只能使用每个授权设备的每个付费用户使用，从而使用户和模型提供商受益。

Despite significant progress in object categorization, in recent years, a number of important challenges remain; mainly, the ability to learn from limited labeled data and to recognize object classes within large, potentially open, set of labels. Zero-shot learning is one way of addressing these challenges, but it has only been shown to work with limited sized class vocabularies and typically requires separation between supervised and unsupervised classes, allowing former to inform the latter but not vice versa. We propose the notion of vocabulary-informed learning to alleviate the above mentioned challenges and address problems of supervised, zero-shot, generalized zero-shot and open set recognition using a unified framework. Specifically, we propose a weighted maximum margin framework for semantic manifold-based recognition that incorporates distance constraints from (both supervised and unsupervised) vocabulary atoms. Distance constraints ensure that labeled samples are projected closer to their correct prototypes, in the embedding space, than to others. We illustrate that resulting model shows improvements in supervised, zero-shot, generalized zero-shot, and large open set recognition, with up to 310K class vocabulary on Animal with Attributes and ImageNet datasets.

A noisy training set usually leads to the degradation of the generalization and robustness of neural networks. In this paper, we propose a novel theoretically guaranteed clean sample selection framework for learning with noisy labels. Specifically, we first present a Scalable Penalized Regression (SPR) method, to model the linear relation between network features and one-hot labels. In SPR, the clean data are identified by the zero mean-shift parameters solved in the regression model. We theoretically show that SPR can recover clean data under some conditions. Under general scenarios, the conditions may be no longer satisfied; and some noisy data are falsely selected as clean data. To solve this problem, we propose a data-adaptive method for Scalable Penalized Regression with Knockoff filters (Knockoffs-SPR), which is provable to control the False-Selection-Rate (FSR) in the selected clean data. To improve the efficiency, we further present a split algorithm that divides the whole training set into small pieces that can be solved in parallel to make the framework scalable to large datasets. While Knockoffs-SPR can be regarded as a sample selection module for a standard supervised training pipeline, we further combine it with a semi-supervised algorithm to exploit the support of noisy data as unlabeled data. Experimental results on several benchmark datasets and real-world noisy datasets show the effectiveness of our framework and validate the theoretical results of Knockoffs-SPR. Our code and pre-trained models will be released.

As natural language processing (NLP) for gender bias becomes a significant interdisciplinary topic, the prevalent data-driven techniques such as large-scale language models suffer from data inadequacy and biased corpus, especially for languages with insufficient resources such as Chinese. To this end, we propose a Chinese cOrpus foR Gender bIas Probing and Mitigation CORGI-PM, which contains 32.9k sentences with high-quality labels derived by following an annotation scheme specifically developed for gender bias in the Chinese context. Moreover, we address three challenges for automatic textual gender bias mitigation, which requires the models to detect, classify, and mitigate textual gender bias. We also conduct experiments with state-of-the-art language models to provide baselines. To our best knowledge, CORGI-PM is the first sentence-level Chinese corpus for gender bias probing and mitigation.

Medical image segmentation (MIS) is essential for supporting disease diagnosis and treatment effect assessment. Despite considerable advances in artificial intelligence (AI) for MIS, clinicians remain skeptical of its utility, maintaining low confidence in such black box systems, with this problem being exacerbated by low generalization for out-of-distribution (OOD) data. To move towards effective clinical utilization, we propose a foundation model named EvidenceCap, which makes the box transparent in a quantifiable way by uncertainty estimation. EvidenceCap not only makes AI visible in regions of uncertainty and OOD data, but also enhances the reliability, robustness, and computational efficiency of MIS. Uncertainty is modeled explicitly through subjective logic theory to gather strong evidence from features. We show the effectiveness of EvidenceCap in three segmentation datasets and apply it to the clinic. Our work sheds light on clinical safe applications and explainable AI, and can contribute towards trustworthiness in the medical domain.