Adversarial machine learning

The source argues that evasion attacks on machine learning systems deserve more concern than their usual treatment suggests. Canonical demonstrations have stayed largely academic for over a decade, and their intellectual appeal has led many to dismiss evasion as having little operational consequence.

Researchers show that balance theory, which signed graph neural networks (SGNNs) use to model positive and negative relationships, creates exploitable weaknesses under closed-box attacks. They propose balance-attack, which targets graph balance degree and is solved with a heuristic for an NP-hard problem, and introduce Balance Augmented-Signed Graph Contrastive Learning (BA-SGCL) to restore robustness by maintaining high balance degree in the latent space. Experiments across multiple SGNN architectures and real-world datasets report both the attack's effectiveness and BA-SGCL's improved resilience.

UAP4MA is a decision-based, problem-space, black-box method for generating universal adversarial perturbations against APT malware attribution models. It uses a multi-agent Multi-Armed Bandit framework that applies functionality-preserving transformations from 13 types. On the AMG43 and APTMalware datasets, it achieves over four times the fooling rate, double the attack success rate, and an 80% reduction in training time compared with state-of-the-art methods.

Stealthy-UAP is a framework for generating universal adversarial perturbations that are harder to detect. It combines a Class-Selective Attack, which targets only semantically consistent classes and keeps predictions for non-target inputs unchanged, with Perceptual Similarity Optimization, which uses high-level deep features to align perturbations with the Human Visual System. The authors report that it outperforms state-of-the-art baselines on ImageNet subsets and the full ImageNet validation set, and remains effective under mainstream adversarial defenses.

The source is a Computers & Security article by Ziting Ren, Yucong Duan and Qi Qi, published online on 16 April 2026, titled "BioGuard: Malicious sample free defense method for biometric classifiers against model extraction attacks." The provided text contains only the title, publication date, source and authors, with no abstract or findings.

Researchers propose Adversarial Spectrum Defense (ASD), which uses Discrete Wavelet Transform (DWT) spectral decomposition to analyze adversarial patterns across multiple frequency scales. Combined with off-the-shelf Adversarial Training (AT), ASD+AT reportedly achieves state-of-the-art performance against patch-based and texture-based attacks, outperforming previous defenses by 21.73% in the AP metric, including against adaptive adversaries designed against ASD.

This work presents the first comprehensive study of adversarial robustness in referring video object segmentation (RVOS) models, which segment text-referred objects in video and matter for safety-critical uses such as autonomous driving. The authors propose xM-ICM, a cross-prompt multimodal attack that jointly corrupts visual and textual embeddings and uses two momentum banks to keep perturbations coherent across clips. Experiments on three benchmarks and five RVOS models report strong white-box attack performance and good black-box transferability.

HENet, a dual-branch generative model, is proposed to build a robust generator-based adversarial attack framework against deep neural networks. Its Adaptive Feature Fusion Module addresses dimension and representativeness mismatches between CNNs and Transformers, while a Dynamic Differentiable JPEG Simulator uses an adaptive quantization mask to improve robustness under JPEG compression. The authors report a better attack success rate, lower perturbation magnitude and higher robustness across target architectures.

Researchers from Shanghai Jiao Tong University and collaborators (Hongying Zhang and others) published ReSLC in the Journal of Information Security and Applications, Volume 100, in July 2026. The source text provided contains only publication metadata (date, journal, volume, authors) and no description of the method, findings or numbers.

This paper presents a theoretical framework for transfer-based black-box adversarial attacks, deriving a transferability bound that links adversarial transferability to flat minima over a surrogate model set and the adversarial model discrepancy. Based on this bound, the authors build a surrogate model set with diverse adversarial vulnerabilities and generate a model-Diversity-compatible Reverse Adversarial Perturbation (DRAP). Experiments on the NIPS2017 and CIFAR-10 datasets against various target models show the proposed attack is effective.

This paper proposes a clean-label backdoor attack on Graph Neural Networks that injects a single trigger node attached to a target node. The attack misclassifies the target and its one-hop neighbors as the target class without changing their features or labels. Across multiple real-world benchmarks and mainstream GNN architectures, the authors report over 95% attack success rate on target nodes and their neighbors in most settings, including under state-of-the-art defenses.

Researchers propose a redundant fully connected layer that can be plugged into existing image classification model backbones to improve adversarial robustness. The layer is trained with a loss function that uses cosine similarity to maximize the difference and diversity among multiple fully connected parts. Tested against 12 representative white-box and black-box attacks on two popular datasets, the approach reportedly gives significant robustness with negligible extra training overhead and hardly degrades clean-sample accuracy.

This research paper analyzes how backdoor attacks work against semi-supervised learning (SSL), finding that attackers exploit pseudo-labeling to build stronger trigger-target correlations and that triggers can appear in low, medium, or high frequency bands. The authors propose Backdoor Invalidator (BI), a defense combining complementary learning, trigger mix-up, and dual domain filtering. Evaluation against state-of-the-art attacks shows BI significantly reduces average attack success rate while keeping comparable clean-data accuracy.

The authors introduce SRAP, a Self-Reversible Adversarial Patch technique for generating reversible adversarial examples to protect images from malicious deep model identification and analysis. Combining small, non-overlapping adversarial patches with prediction error expansion data hiding, the method reports transferability of up to 90% or higher between models and an 88% attack success rate on commercial APIs.

PureDiffusion is a dual-purpose framework for diffusion models that inverts backdoor triggers for defense and reinforces them for attack amplification. Its defense uses two novel loss functions based on trigger-induced distribution shifts across timesteps and denoising consistency, followed by a detection method. Reported results include near-perfect detection accuracy and attack success rates of nearly 100% for existing backdoor attacks, with training time reduced by up to 20x.