arXiv subjects

Yao Zhu

Publications and source records attributed to Yao Zhu.

At least 73 records · Page 4Linked to original sources

arXiv2023

COCO-O: A Benchmark for Object Detectors under Natural Distribution Shifts

Practical object detection application can lose its effectiveness on image inputs with natural distribution shifts. This problem leads the research community to pay more attention on the robustness of detectors under Out-Of-Distribution (OOD) inputs. Existing works construct datasets to benchmark the detector's OOD robustness for a specific application scenario, e.g., Autonomous Driving. However, these datasets lack universality and are hard to benchmark general detectors built on common tasks such as COCO. To give a more comprehensive robustness assessment, we introduce COCO-O(ut-of-distribution), a test dataset based on COCO with 6 types of natural distribution shifts. COCO-O has a large distribution gap with training data and results in a significant 55.7% relative performance drop on a Faster R-CNN detector. We leverage COCO-O to conduct experiments on more than 100 modern object detectors to investigate if their improvements are credible or just over-fitting to the COCO test set. Unfortunately, most classic detectors in early years do not exhibit strong OOD generalization. We further study the robustness effect on recent breakthroughs of detector's architecture design, augmentation and pre-training techniques. Some empirical findings are revealed: 1) Compared with detection head or neck, backbone is the most important part for robustness; 2) An end-to-end detection transformer design brings no enhancement, and may even reduce robustness; 3) Large-scale foundation models have made a great leap on robust object detection. We hope our COCO-O could provide a rich testbed for robustness study of object detection. The dataset will be available at https://github.com/alibaba/easyrobust/tree/main/benchmarks/coco_o.

cs.CV↗

arXiv2023

Non-Orthogonal Multiplexing in the FBL Regime Enhances Physical Layer Security with Deception

We propose a new security framework for physical layer security (PLS) in the finite blocklength (FBL) regime that incorporates deception technology, allowing for active countermeasures against potential eavesdroppers. Using a symmetric block cipher and power-domain non-orthogonal multiplexing (NOM), our approach is able to achieve high secured reliability while effectively deceiving the eavesdropper, and can benefit from increased transmission power. This work represents a promising direction for future research in PLS with deception technology.

cs.IT↗

arXiv2023

Green Steganalyzer: A Green Learning Approach to Image Steganalysis

A novel learning solution to image steganalysis based on the green learning paradigm, called Green Steganalyzer (GS), is proposed in this work. GS consists of three modules: 1) pixel-based anomaly prediction, 2) embedding location detection, and 3) decision fusion for image-level detection. In the first module, GS decomposes an image into patches, adopts Saab transforms for feature extraction, and conducts self-supervised learning to predict an anomaly score of their center pixel. In the second module, GS analyzes the anomaly scores of a pixel and its neighborhood to find pixels of higher embedding probabilities. In the third module, GS focuses on pixels of higher embedding probabilities and fuses their anomaly scores to make final image-level classification. Compared with state-of-the-art deep-learning models, GS achieves comparable detection performance against S-UNIWARD, WOW and HILL steganography schemes with significantly lower computational complexity and a smaller model size, making it attractive for mobile/edge applications. Furthermore, GS is mathematically transparent because of its modular design.

eess.IV↗

arXiv2023

ImageNet-E: Benchmarking Neural Network Robustness via Attribute Editing

Recent studies have shown that higher accuracy on ImageNet usually leads to better robustness against different corruptions. Therefore, in this paper, instead of following the traditional research paradigm that investigates new out-of-distribution corruptions or perturbations deep models may encounter, we conduct model debugging in in-distribution data to explore which object attributes a model may be sensitive to. To achieve this goal, we create a toolkit for object editing with controls of backgrounds, sizes, positions, and directions, and create a rigorous benchmark named ImageNet-E(diting) for evaluating the image classifier robustness in terms of object attributes. With our ImageNet-E, we evaluate the performance of current deep learning models, including both convolutional neural networks and vision transformers. We find that most models are quite sensitive to attribute changes. A small change in the background can lead to an average of 9.23\% drop on top-1 accuracy. We also evaluate some robust models including both adversarially trained models and other robust trained models and find that some models show worse robustness against attribute changes than vanilla models. Based on these findings, we discover ways to enhance attribute robustness with preprocessing, architecture designs, and training strategies. We hope this work can provide some insights to the community and open up a new avenue for research in robust computer vision. The code and dataset are available at https://github.com/alibaba/easyrobust.

cs.CV↗

arXiv2023

TransAudio: Towards the Transferable Adversarial Audio Attack via Learning Contextualized Perturbations

In a transfer-based attack against Automatic Speech Recognition (ASR) systems, attacks are unable to access the architecture and parameters of the target model. Existing attack methods are mostly investigated in voice assistant scenarios with restricted voice commands, prohibiting their applicability to more general ASR related applications. To tackle this challenge, we propose a novel contextualized attack with deletion, insertion, and substitution adversarial behaviors, namely TransAudio, which achieves arbitrary word-level attacks based on the proposed two-stage framework. To strengthen the attack transferability, we further introduce an audio score-matching optimization strategy to regularize the training process, which mitigates adversarial example over-fitting to the surrogate model. Extensive experiments and analysis demonstrate the effectiveness of TransAudio against open-source ASR models and commercial APIs.

cs.SD↗

arXiv2023

Information-containing Adversarial Perturbation for Combating Facial Manipulation Systems

With the development of deep learning technology, the facial manipulation system has become powerful and easy to use. Such systems can modify the attributes of the given facial images, such as hair color, gender, and age. Malicious applications of such systems pose a serious threat to individuals' privacy and reputation. Existing studies have proposed various approaches to protect images against facial manipulations. Passive defense methods aim to detect whether the face is real or fake, which works for posterior forensics but can not prevent malicious manipulation. Initiative defense methods protect images upfront by injecting adversarial perturbations into images to disrupt facial manipulation systems but can not identify whether the image is fake. To address the limitation of existing methods, we propose a novel two-tier protection method named Information-containing Adversarial Perturbation (IAP), which provides more comprehensive protection for {facial images}. We use an encoder to map a facial image and its identity message to a cross-model adversarial example which can disrupt multiple facial manipulation systems to achieve initiative protection. Recovering the message in adversarial examples with a decoder serves passive protection, contributing to provenance tracking and fake image detection. We introduce a feature-level correlation measurement that is more suitable to measure the difference between the facial images than the commonly used mean squared error. Moreover, we propose a spectral diffusion method to spread messages to different frequency channels, thereby improving the robustness of the message against facial manipulation. Extensive experimental results demonstrate that our proposed IAP can recover the messages from the adversarial examples with high average accuracy and effectively disrupt the facial manipulation systems.

cs.CV↗

arXiv2023

Trade Reliability for Security: Leakage-Failure Probability Minimization for Machine-Type Communications in URLLC

How to provide information security while fulfilling ultra reliability and low-latency requirements is one of the major concerns for enabling the next generation of ultra-reliable and low-latency communications service (xURLLC), specially in machine-type communications. In this work, we investigate the reliability-security tradeoff via defining the leakage-failure probability, which is a metric that jointly characterizes both reliability and security performances for short-packet transmissions. We discover that the system performance can be enhanced by counter-intuitively allocating fewer resources for the transmission with finite blocklength (FBL) codes. In order to solve the corresponding optimization problem for the joint resource allocation, we propose an optimization framework, that leverages lower-bounded approximations for the decoding error probability in the FBL regime. We characterize the convexity of the reformulated problem and establish an efficient iterative searching method, the convergence of which is guaranteed. To show the extendability of the framework, we further discuss the blocklength allocation schemes with practical requirements of reliable-secure performance, as well as the transmissions with the statistical channel state information (CSI). Numerical results verify the accuracy of the proposed approach and demonstrate the reliability-security tradeoff under various setups.

cs.IT↗

arXiv2022

Rethinking Out-of-Distribution Detection From a Human-Centric Perspective

Out-Of-Distribution (OOD) detection has received broad attention over the years, aiming to ensure the reliability and safety of deep neural networks (DNNs) in real-world scenarios by rejecting incorrect predictions. However, we notice a discrepancy between the conventional evaluation vs. the essential purpose of OOD detection. On the one hand, the conventional evaluation exclusively considers risks caused by label-space distribution shifts while ignoring the risks from input-space distribution shifts. On the other hand, the conventional evaluation reward detection methods for not rejecting the misclassified image in the validation dataset. However, the misclassified image can also cause risks and should be rejected. We appeal to rethink OOD detection from a human-centric perspective, that a proper detection method should reject the case that the deep model's prediction mismatches the human expectations and adopt the case that the deep model's prediction meets the human expectations. We propose a human-centric evaluation and conduct extensive experiments on 45 classifiers and 8 test datasets. We find that the simple baseline OOD detection method can achieve comparable and even better performance than the recently proposed methods, which means that the development in OOD detection in the past years may be overestimated. Additionally, our experiments demonstrate that model selection is non-trivial for OOD detection and should be considered as an integral of the proposed method, which differs from the claim in existing works that proposed methods are universal across different models.

cs.CV↗

arXiv2022

Low-Latency Hybrid NOMA-TDMA: QoS-Driven Design Framework

Enabling ultra-reliable and low-latency communication services while providing massive connectivity is one of the major goals to be accomplished in future wireless communication networks. In this paper, we investigate the performance of a hybrid multi-access scheme in the finite blocklength (FBL) regime that combines the advantages of both non-orthogonal multiple access (NOMA) and time-division multiple access (TDMA) schemes. Two latency-sensitive application scenarios are studied, distinguished by whether the queuing behaviour has an influence on the transmission performance or not. In particular, for the latency-critical case with one-shot transmission, we aim at a certain physical-layer quality-of-service (QoS) performance, namely the optimization of the reliability. And for the case in which queuing behaviour plays a role, we focus on the link-layer QoS performance and provide a design that maximizes the effective capacity. For both designs, we leverage the characterizations in the FBL regime to provide the optimal framework by jointly allocating the blocklength and transmit power of each user. In particular, for the reliability-oriented design, the original problem is decomposed and the joint convexity of sub-problems is shown via a variable substitution method. For the effective-capacity-oriented design, we exploit the method of Lagrange multipliers to formulate a solvable dual problem with strong duality to the original problem. Via simulations, we validate our analytical results of convexity/concavity and show the advantage of our proposed approaches compared to other existing schemes.

cs.IT↗

arXiv2022

Boosting Out-of-distribution Detection with Typical Features

Out-of-distribution (OOD) detection is a critical task for ensuring the reliability and safety of deep neural networks in real-world scenarios. Different from most previous OOD detection methods that focus on designing OOD scores or introducing diverse outlier examples to retrain the model, we delve into the obstacle factors in OOD detection from the perspective of typicality and regard the feature's high-probability region of the deep model as the feature's typical set. We propose to rectify the feature into its typical set and calculate the OOD score with the typical features to achieve reliable uncertainty estimation. The feature rectification can be conducted as a {plug-and-play} module with various OOD scores. We evaluate the superiority of our method on both the commonly used benchmark (CIFAR) and the more challenging high-resolution benchmark with large label space (ImageNet). Notably, our approach outperforms state-of-the-art methods by up to 5.11$\%$ in the average FPR95 on the ImageNet benchmark.

cs.CV↗

arXiv2022

Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective

Transferable adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective, e.g., decision boundary, model architecture, and model capacity. adversarial attacks against Deep neural networks (DNNs) have received broad attention in recent years. An adversarial example can be crafted by a surrogate model and then attack the unknown target model successfully, which brings a severe threat to DNNs. The exact underlying reasons for the transferability are still not completely understood. Previous work mostly explores the causes from the model perspective. Here, we investigate the transferability from the data distribution perspective and hypothesize that pushing the image away from its original distribution can enhance the adversarial transferability. To be specific, moving the image out of its original distribution makes different models hardly classify the image correctly, which benefits the untargeted attack, and dragging the image into the target distribution misleads the models to classify the image as the target class, which benefits the targeted attack. Towards this end, we propose a novel method that crafts adversarial examples by manipulating the distribution of the image. We conduct comprehensive transferable attacks against multiple DNNs to demonstrate the effectiveness of the proposed method. Our method can significantly improve the transferability of the crafted attacks and achieves state-of-the-art performance in both untargeted and targeted scenarios, surpassing the previous best method by up to 40$\%$ in some cases.

cs.CV↗

arXiv2022

Joint Convexity of Error Probability in Blocklength and Transmit Power in the Finite Blocklength Regime

To support ultra-reliable and low-latency services for mission-critical applications, transmissions are usually carried via short blocklength codes, i.e., in the so-called finite blocklength (FBL) regime. Different from the infinite blocklength regime where transmissions are assumed to be arbitrarily reliable at the Shannon's capacity, the reliability and capacity performances of an FBL transmission are impacted by the coding blocklength. The relationship among reliability, coding rate, blocklength and channel quality has recently been characterized in the literature, considering the FBL performance model. In this paper, we follow this model, and prove the joint convexity of the FBL error probability with respect to blocklength and transmit power within a region of interest, as a key enabler for designing systems to achieve globally optimal performance levels. Moreover, we apply the joint convexity to general use cases and efficiently solve the joint optimization problem in the setting with multiple users. We also extend the applicability of the proposed approach by proving that the joint convexity still holds in fading channels, as well as in relaying networks. Via simulations, we validate our analytical results and demonstrate the advantage of leveraging the joint convexity compared to other commonly-applied approaches.

cs.IT↗

arXiv2022

Enhance the Visual Representation via Discrete Adversarial Training

Adversarial Training (AT), which is commonly accepted as one of the most effective approaches defending against adversarial examples, can largely harm the standard performance, thus has limited usefulness on industrial-scale production and applications. Surprisingly, this phenomenon is totally opposite in Natural Language Processing (NLP) task, where AT can even benefit for generalization. We notice the merit of AT in NLP tasks could derive from the discrete and symbolic input space. For borrowing the advantage from NLP-style AT, we propose Discrete Adversarial Training (DAT). DAT leverages VQGAN to reform the image data to discrete text-like inputs, i.e. visual words. Then it minimizes the maximal risk on such discrete images with symbolic adversarial perturbations. We further give an explanation from the perspective of distribution to demonstrate the effectiveness of DAT. As a plug-and-play technique for enhancing the visual representation, DAT achieves significant improvement on multiple tasks including image classification, object detection and self-supervised learning. Especially, the model pre-trained with Masked Auto-Encoding (MAE) and fine-tuned by our DAT without extra data can get 31.40 mCE on ImageNet-C and 32.77% top-1 accuracy on Stylized-ImageNet, building the new state-of-the-art. The code will be available at https://github.com/alibaba/easyrobust.

cs.CV↗

arXiv2021

Time-Energy-Constrained Closed-Loop FBL Communication for Dependable MEC

The deployment of multi-access edge computing (MEC) is paving the way towards pervasive intelligence in future 6G networks. This new paradigm also proposes emerging requirements of dependable communications, which goes beyond the ultra-reliable low latency communication (URLLC), focusing on the performance of a closed loop instead of that of an unidirectional link. This work studies the simple but efficient one-shot transmission scheme, investigating the closed-loop-reliability-optimal policy of blocklength allocation under stringent time and energy constraints.

cs.IT↗

arXiv2021

A-PixelHop: A Green, Robust and Explainable Fake-Image Detector

A novel method for detecting CNN-generated images, called Attentive PixelHop (or A-PixelHop), is proposed in this work. It has three advantages: 1) low computational complexity and a small model size, 2) high detection performance against a wide range of generative models, and 3) mathematical transparency. A-PixelHop is designed under the assumption that it is difficult to synthesize high-quality, high-frequency components in local regions. It contains four building modules: 1) selecting edge/texture blocks that contain significant high-frequency components, 2) applying multiple filter banks to them to obtain rich sets of spatial-spectral responses as features, 3) feeding features to multiple binary classifiers to obtain a set of soft decisions, 4) developing an effective ensemble scheme to fuse the soft decisions into the final decision. Experimental results show that A-PixelHop outperforms state-of-the-art methods in detecting CycleGAN-generated images. Furthermore, it can generalize well to unseen generative models and datasets.

cs.CV↗

arXiv2021

Towards Understanding the Generative Capability of Adversarially Robust Classifiers

Recently, some works found an interesting phenomenon that adversarially robust classifiers can generate good images comparable to generative models. We investigate this phenomenon from an energy perspective and provide a novel explanation. We reformulate adversarial example generation, adversarial training, and image generation in terms of an energy function. We find that adversarial training contributes to obtaining an energy function that is flat and has low energy around the real data, which is the key for generative capability. Based on our new understanding, we further propose a better adversarial training method, Joint Energy Adversarial Training (JEAT), which can generate high-quality images and achieve new state-of-the-art robustness under a wide range of attacks. The Inception Score of the images (CIFAR-10) generated by JEAT is 8.80, much better than original robust classifiers (7.50).

cs.LG↗

arXiv2021

CLARQ: A Dynamic ARQ Solution for Ultra-high Closed-loop Reliability

Emerging wireless control applications demand for extremely high closed-loop reliability under strict latency constraints, which the conventional Automatic Repeat reQuest (ARQ) solutions with static schedules fail to provide. To overcome this issue and enable data-link layer error control for ultra reliable low-latency communication (URLLC) services, we propose a novel protocol: the Closed-Loop ARQ (CLARQ), which forces to accomplish an information exchange round within a fixed loop-back latency, and dynamically re-allocates the remaining resource between uplink and downlink slots upon the result of last uplink transmission. The proposed method guarantees to meet the latency requirement, while delivering high communication reliability and power efficiency. It can be efficiently offline optimized by means of dynamic programming techniques, and is capable of real-time deployment with a low-cost implementation based on look-up tables. Numerical evaluations have verified that CLARQ outperforms baselines with significantly improved closed-loop reliability and reduced energy consumption. Especially, over a Rayleigh channel with 0dB mean SNR, it is able to provide a closed-loop error rate below 1e-7 within 10ms loop-back latency, which makes our proposal competitive for practical URLLC applications in future 5G-and-beyond networks.

cs.IT↗

arXiv2021

Fairness for Freshness: Optimal Age of Information Based OFDMA Scheduling with Minimal Knowledge

It is becoming increasingly clear that an important task for wireless networks is to minimize the age of information (AoI), i.e., the timeliness of information delivery. While mainstream approaches generally rely on the real-time observation of user AoI and channel state, there has been little attention to solve the problem in a complete (or partial) absence of such knowledge. In this article, we present a novel study to address the optimal blind radio resource scheduling problem in orthogonal frequency division multiplexing access (OFDMA) systems towards minimizing long-term average AoI, which is proven to be the composition of time-domain-fair clustered round-robin and frequency-domain-fair intra-cluster sub-carrier assignment. Heuristic solutions that are near-optimal as shown by simulation results are also proposed to effectively improve the performance upon presence of various degrees of extra knowledge, e.g., channel state and AoI.

cs.IT↗