Adversarial machine learning

The paper asks whether a network intrusion detection system's model can be extracted using only hard-label black-box queries. The source text provided gives only the title, publication date (December 2026), journal (Journal of Information Security and Applications, Volume 103), and authors (Donguk Min, Seungsoo Nam, Daeseon Choi), with no method description or findings.

Liu, Wen and Yu published an article in the Journal of Information Security and Applications, Volume 103, dated December 2026. The source text provided contains only the publication metadata and author list, with no abstract, method or findings.

This paper proposes a detection-aware stochastic optimization framework for industrial control systems facing asynchronous, unreliable feedback and adversarial data poisoning. It uses the SWaT dataset to model poisoning behavior and an adaptive acknowledgment (ACK) bundling mechanism, driven by a multi-objective stochastic gradient descent (SGD) algorithm with a residual-based anomaly indicator, to adjust feedback timing. Numerical experiments on an autonomous surface vehicle (ASV) benchmark show closed-loop recovery under AI-driven data poisoning attacks.

Existing evaluations of AI-based Windows malware detectors differ in training and test data, lack temporal analysis, skip adversarial content-injection tests, and ignore deployment compute costs, so they cannot show which detector to deploy. The authors introduce EXE-Bench, which assesses performance, temporal and adversarial robustness, and computational overhead, combining them into one score for direct comparison. Their analysis finds that feature-engineered domain knowledge remains highly useful, resisting both time and adversarial attacks, while most deep networks excel only right after deployment.

The paper presents the Advanced Cross-attack Backdoor Detector (ACBD), which detects trigger-injected samples by solving a labeled binary classification task based on disturbance immunity, rather than unlabeled feature clustering. ACBD is trained on one class of a poisoned dataset (1/100 of CIFAR-100) with two classic attacks, using a small LSTM with 53 K parameters and at most 10 clean images for perturbation. The authors report state-of-the-art detection with cross-attack generalization, including on unseen triggers and different target labels.

Adapdoor is an attack framework that injects action-level backdoors into deep reinforcement learning models during training, so that adversaries can manipulate action outputs at deployment. It initializes the backdoor reward from benign reward statistics and iteratively fine-tunes it using performance feedback from benign and backdoor tasks. Across 3 DRL algorithms, 11 environments and 53 backdoor tasks, it outperforms existing baselines by 42.0% to 144.2%.

GECOMP is a generative textual adversarial attack that uses reinforcement learning for policy optimization. An LLM-based generator rewrites input sequences using an extensible library of compositional perturbations, constrained by semantic similarity and edit magnitude. Across four public datasets and five victim models, it achieved higher attack success rates than ten baseline methods while using fewer queries and less edit magnitude.

WPEBA is a frequency-driven ensemble black-box adversarial attack for visual recognition systems that uses wavelet packet decomposition to split images into frequency sub-bands. It adjusts sub-band weights from internal gradient feedback and updates surrogate-model weights from target-model query feedback, reaching an average attack success rate of nearly 99% with one or two queries across six standard architectures. The authors report it also remains effective against defended models and the Google Cloud Vision API.

Researchers present 3DGAA, a framework for physical adversarial attacks on camera-based perception in autonomous vehicles. It uses 3D multi-view optimization with a 3D Gaussian splatting surrogate to produce print-only vehicle wraps that keep geometry unchanged. In CARLA simulations and miniature-vehicle tests, the wraps substantially reduced detection confidence and average precision across multiple modern detectors.

Researchers study whether universal adversarial perturbations (UAPs) can be generated when an attacker controls only the edge portion of a split model, meaning its initial network layers. They introduce edge-only untargeted and targeted UAP formulations that manipulate intermediate features before the split point. On ImageNet, the attacks transfer strongly to the unknown cloud component and compare favorably with classical white-box and black-box techniques.

Researchers introduce the Textual Dynamic Outputs Attack (TDOA), a text adversarial attack for settings where the number and content of model labels vary, such as LLM outputs and multi-label classification. TDOA trains a clustering-based surrogate model that approximates dynamic fine-grained outputs with static coarse-grained labels, and uses a farthest-label targeted strategy to induce larger output changes. Evaluated on five datasets and ten victim models including GPT-4o and GPT-4.1, it reaches an 80.8% maximum attack success rate with five queries per text.

PREFed is a static-anchor backdoor attack for federated learning that pre-optimizes trigger patterns on clean data before training, removing the need for round-wise adaptation. The authors report that it reaches over 80% backdoor accuracy within five communication rounds while cutting main task accuracy by less than 2%, versus more than 15% degradation in prior methods, across six defenses on image benchmarks and SST-2.

NEO is a closed-box adversarial attack on deep learning video recognition systems that uses information-entropy guidance to cut query costs. The authors model query-based attacks as an open-box approximation and find that queries near decision boundaries carry the most information. NEO combines diffusion-based perturbation initialization with mutual-information-driven optimization and reports significantly higher efficiency and stealthiness than existing methods on four benchmark datasets.

Researchers examine why single-step adversarial training, a cheaper alternative to standard adversarial training, often suffers catastrophic overfitting under larger perturbations. They identify "fakers," single-step adversarial examples that are learned and correctly classified yet fail to expose true model vulnerabilities, and that degrade robustness, resist learning and diverge strongly from their clean counterparts. They propose FAST, which adjusts label smoothing by learning difficulty and adds a weak-effect auxiliary sample, reporting superior clean accuracy and robustness across various attacks.

Researchers propose Spa, a backdoor attack framework for federated learning that aims to be both stealthy and persistent. Instead of training a conflicting secondary task, Spa uses feature-space alignment to fold backdoor features into the primary objective, and it uses adversarial dynamic trigger optimization that co-evolves with the global model. Experiments report attack success rates near 100% with minimal utility loss, and the backdoor stays effective around 900 FL rounds after attacks stop.