面向图神经网络的对抗攻击与防御综述

陈晋音; 张敦杰; 黄国瀚; 林翔; 鲍亮

doi:10.11959/j.issn.2096-109x.2021051

您当前的位置：

首页 >

文章列表页 >

面向图神经网络的对抗攻击与防御综述

专栏Ⅰ：神经网络技术应用 | 更新时间：2024-06-03

- 面向图神经网络的对抗攻击与防御综述
- Adversarial attack and defense on graph neural networks: a survey
- 网络与信息安全学报 2021年7卷第3期页码：1-28
- 作者机构：
  
  1. 浙江工业大学网络空间安全研究院，浙江杭州 310023
  2. 浙江工业大学信息工程学院，浙江杭州 310023
  3. 信息网络安全公安部重点实验室，上海 200000
- 作者简介：
  
  [ "陈晋音（1982- ），女，浙江象山人，博士，浙江工业大学副教授，主要研究方向为人工智能安全、图数据挖掘和进化计算" ]
  [ "张敦杰（1997- ），男，浙江苍南人，浙江工业大学硕士生，主要研究方向为数据挖掘与应用、智能计算" ]
  [ "黄国瀚（1997- ），男，浙江台州人，浙江工业大学硕士生，主要研究方向为图数据挖掘和人工智能安全" ]
  [ "林翔（1996- ），男，浙江宁波人，浙江工业大学硕士生，主要研究方向为图数据挖掘与应用" ]
  [ "鲍亮（1983- ），男，安徽寿县人，公安部第三研究所助理研究员，主要研究方向为信息网络安全、网络防护技术、网络攻击数据分析" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62072406);浙江省自然科学基金;The Natural Science Foundation of Zhe-jiang Province(LY19F020025);信息网络安全公安部重点实验室开放课题项目;Key Lab of Information Network Security, Ministry of Public Security(C20604)
- DOI：10.11959/j.issn.2096-109x.2021051
  中图分类号： TP29
- 网络首发：2021-06，
  
  纸质出版：2021-06-15
- 稿件说明：
移动端阅览
陈晋音, 张敦杰, 黄国瀚, 等. 面向图神经网络的对抗攻击与防御综述[J]. 网络与信息安全学报, 2021,7(3):1-28.

Jinyin CHEN, Dunjie ZHANG, Guohan HUANG, et al. Adversarial attack and defense on graph neural networks: a survey[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 1-28.
陈晋音, 张敦杰, 黄国瀚, 等. 面向图神经网络的对抗攻击与防御综述[J]. 网络与信息安全学报, 2021,7(3):1-28. DOI： 10.11959/j.issn.2096-109x.2021051.

Jinyin CHEN, Dunjie ZHANG, Guohan HUANG, et al. Adversarial attack and defense on graph neural networks: a survey[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 1-28. DOI： 10.11959/j.issn.2096-109x.2021051.

摘要

面向已有的图神经网络的攻击与防御方法，较全面地综述了图神经网络对抗攻防技术与鲁棒性分析。首先，综述了图神经网络在不同任务下的对抗攻击与基于不同策略的防御方法，并全面介绍了鲁棒性分析技术；随后，介绍了常用的基准数据集与评价指标；最后，提出了未来可能的研究方向和发展趋势。

Abstract

For the numerous existing adversarial attack and defense methods on GNN

the main adversarial attack and defense algorithms of GNN were reviewed comprehensively

as well as robustness analysis techniques.Besides

the commonly used benchmark datasets and evaluation metrics in the security research of GNN were introduced.In conclusion

some insights on the future research direction of adversarial attacks and the trend of development were put forward.

关键词

Keywords

references

DENG L , LIU Y . A joint introduction to natural language processing and to deep learning [C ] // Deep Learning in Natural Language Processing . Springer,Singapore , 2018 : 1 - 22 .

COLLOBERT R , WESTON J , BOTTOU L , et al . Natural language processing (almost) from scratch [J ] . Journal of Machine Learning Research , 2011 , 12 ( 8 ): 2493 - 2537 .

XIONG W , DROPPO J , HUANG X , et al . Achieving human parity in conversational speech recognition [J ] . arXiv Preprint Arxiv:1610.05256 , 2016 .

LITJENS G , KOOI T , BEJNORDI B E , et al . A survey on deep learning in medical image analysis [J ] . Medical Image Analysis , 2017 , 42 : 60 - 88 .

MOUSAVI A , BARANIUK R G . Learning to invert:signal recovery via deep convolutional networks [C ] // 2017 IEEE International Conference on Acoustics,Speech and Signal Processing (ICASSP) . 2017 : 2272 - 2276 .

KRISHNAMURTHY B , SARKAR M . Deep-learning network architecture for object detection:U.S.Patent 10,152,655 [R ] . 2018 - 12 - 11 .

GOYAL P , FERRARA E . Graph embedding techniques,applications,and performance:a survey [J ] . Knowledge-Based Systems , 2018 , 151 : 78 - 94 .

FRASCONI P , GORI M , SPERDUTI A . A general framework for adaptive processing of data structures [J ] . IEEE Transactions on Neural Networks , 1998 , 9 ( 5 ): 768 - 786 .

SPERDUTI A , STARITA A . Supervised neural networks for the classification of structures [J ] . IEEE Transactions on Neural Networks , 1997 , 8 ( 3 ): 714 - 735 .

GORI M , MONFARDINI G , SCARSELLI F . A new model for learning in graph domains [C ] // 2005 IEEE International Joint Conference on Neural Networks . 2005 : 729 - 734 .

SCARSELLI F , GORI M , TSOI A C , et al . The graph neural network model [J ] . IEEE Transactions on Neural Networks , 2008 , 20 ( 1 ): 61 - 80 .

BRUNA J , ZAREMBA W , SZLAM A , et al . Spectral networks and locally connected networks on graphs [C ] // 2nd International Conference on Learning Representations . 2014 .

DEFFERRARD M , BRESSON X , VANDERGHEYNST P . Convolutional neural networks on graphs with fast localized spectral filtering [C ] // Advances in Neural Information Processing Systems 29 . 2016 : 3837 - 3845 .

VELIČKOVIĆ P , CUCURULL G , CASANOVA A , et al . Graph attention networks [J ] . arXiv preprint arXiv:1710.10903 , 2017 .

CAO S , LU W , XU Q . Deep neural networks for learning graph representations [C ] // Proceedings of the 30th AAAI Conference on Artificial Intelligence . 2016 : 1145 - 1152 .

KIPF T N , WELLING M . Variational graph auto-encoders [J ] . arXiv preprint arXiv:1611.07308 , 2016 .

TANG J , QU M , MEI Q . Pte:Predictive text embedding through large-scale heterogeneous text networks [C ] // Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2015 : 1165 - 1174 .

WANG S , TANG J , AGGARWAL C , et al . Linked document embedding for classification [C ] // Proceedings of the 25th ACM International on Conference on Information and Knowledge Management . 2016 : 115 - 124 .

PEROZZI B , AL-RFOU R , SKIENA S . Deepwalk:Online learning of social representations [C ] // Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2014 : 701 - 710 .

WANG S , TANG J , AGGARWAL C , et al . Signed network embedding in social media [C ] // Proceedings of the 2017 SIAM International Conference on Data Mining . 2017 : 327 - 335 .

TIAN F , GAO B , CUI Q , et al . Learning deep representations for graph clustering [C ] // Proceedings of the Twenty-Eighth AAAI Conference on Artificial Intelligence . 2014 : 1293 - 1299 .

ALLAB K , LABIOD L , NADIF M . A semi-NMF-PCA unified framework for data clustering [J ] . IEEE Transactions on Knowledge and Data Engineering , 2016 , 29 ( 1 ): 2 - 16 .

LEE J B , ROSSI R , KONG X . Graph classification using structural attention [C ] // Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery . 2018 : 1666 - 1674 .

PEI Y , CHAKRABORTY N , SYCARA K . Nonnegative matrix tri-factorization with graph regularization for community detection in social networks [C ] // Proceedings of the Twenty-Fourth International Joint Conference on Artificial Intelligence . 2015 : 2083 - 2089 .

CHEN L , LIU Y , ZHENG Z , et al . Heterogeneous neural attentive factorization machine for rating prediction [C ] // Proceedings of the 27th ACM International Conference on Information and Knowledge Management . 2018 : 833 - 842 .

XIE F , CHEN L , YE Y , et al . Factorization machine based service recommendation on heterogeneous information networks [C ] // 2018 IEEE International Conference on Web Services,ser.ICWS ’18 . 2018 : 115 - 122 .

WANG J , HUANG P , ZHAO H , et al . Billion-scale commodity embedding for e-commerce recommendation in Alibaba [C ] // Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery ＆amp; Data Mining,ser.KDD ’18 . 2018 : 839 - 848 .

ZÜGNER D , AKBARNEJAD A , AND GÜNNEMANN S . Adversarial attacks on neural networks for graph data [C ] // Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery ＆amp; Data Mining,ser.KDD ’18 . 2018 :2847C2856.

DAI H , LI H , TIAN T , et al . Adversarial attack on graph structured data [C ] // Proceedings of the 35th International Conference on Machine Learning,ser.ICML ’18 . 2018 : 1123 - 1132 .

WANG X , EATON J , HSIEH C J , et al . Attack graph convolutional networks by adding fake nodes [J ] . arXiv preprint arXiv:1810.10751 , 2018 .

ZHOU K , MICHALAK T P , WANIEK M , et al . Attacking similarity-based link prediction in social networks [C ] // Proceedings of the 18th International Conference on Autonomous Agents and MultiAgent Systems,ser.AAMAS ’19 . 2019 : 305 - 313 .

BOJCHEVSKI A AND GÜNNEMANN S . Adversarial attacks on node embeddings via graph poisoning [C ] // Proceedings of the 36th International Conference on Machine Learning,ICML 2019 . 2019 : 695 - 704 .

SUN Y , WANG S , TANG X , et al . Node injection attacks on graphs via reinforcement learning [J ] . arXiv preprint arXiv:1909.06543 , 2019 .

CHEN J , WU Y , XU X , et al . Fast gradient attack on network embedding [J ] . arXiv preprint arXiv:1809.02797 , 2018 .

CHEN J , LIN X , SHI Z , et al . Link prediction adversarial attack via iterative gradient attack [J ] . IEEE Transactions on Computational Social Systems , 2020 , 7 ( 4 ): 1081 - 1094 .

CHEN J , CHEN L , CHEN Y , et al . Ga-based Q-attack on community detection [J ] . IEEE Transactions on Computational Social Systems , 2019 , 6 ( 3 ): 491 - 503 .

CHEN J , CHEN Y , CHEN L , et al . Multiscale evolutionary perturbation attack on community detection [J ] . IEEE Transactions on Computational Social Systems , 2021 , 8 ( 1 ): 62 - 75 .

CHANG H , RONG Y , XU T , et al . A restricted black-box adversarial framework towards attacking graph embedding models [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2020 : 3389 - 3396 .

MA Y , WANG S , WU L , et al . Attacking graph convolutional networks via rewiring [J ] . arXiv preprint arXiv:1906.03750 , 2019 .

ZÜGNER D AND GÜNNEMANN S . Adversarial attacks on graph neural networks via meta learning [C ] // 7th International Conference on Learning Representations,ser.ICLR ’19 . 2019 .

SUN M , TANG J , LI H , et al . Data poisoning attack against unsupervised node embedding methods [J ] . arXiv preprint arXiv:1810.12881 , 2018 .

WANIEK M , ZHOU K , VOROBEYCHIK Y , et al . Attack tolerance of link prediction algorithms:How to hide your relations in a social network [J ] . arXiv preprint arXiv:1809.00152 , 2018 .

FARD A M , WANG K , AND YU P . Limiting link disclosure in social network analysis through subgraph-wise perturbation [C ] // 15th International Conference on Extending Database Technology,ser.EDBT ’12 . 2012 : 109 - 119 .

FARD A AND WANG K . Neighborhood randomization for link privacy in social network analysis [J ] . World Wide Web , 2015 , 18 ( 1 ): 9 - 32 .

LI J , ZHANG H , HAN Z , et al . Adversarial attack on community detection by hiding individuals [C ] // WWW ’20:The Web Conference 2020 . 2020 : 917 - 927 .

FENG F , HE X , TANG J , et al . Graph adversarial training:Dynamically regularizing based on graph structure [J ] . IEEE Transactions on Knowledge and Data Engineering . 2019 .

CHEN J , LIN X , XIONG H , et al . Smoothing adversarial training for gnn [J ] . IEEE Transactions on Computational Social Systems , 2020 .

SUN K , LIN Z , GUO H , et al . Virtual adversarial training on graph convolutional networks in node classification [C ] // Pattern Recognition and Computer Vision - Second Chinese Conference,PRCV 2019 . 2019 : 431 - 443 .

ZHANG Y , KHAN S , AND COATES M . Comparing and detecting adversarial attacks for graph deep learning [C ] // Proc Representation Learning on Graphs and Manifolds Workshop,Int Conf Learning Representations . 2019 .

ENTEZARI N , AL-SAYOURI S A , DARVISHZADEH A , et al . All you need is low (rank):Defending against adversarial attacks on graphs [C ] // WSDM ’20:The Thirteenth ACM International Conference on Web Search and Data Mining . 2020 : 169 - 177 .

TANG X , LI Y , SUN Y , et al . Transferring robustness for graph neural network against poisoning attacks [C ] // WSDM ’20:The Thirteenth ACM International Conference on Web Search and Data Mining . 2020 : 600 - 608 .

ZHU D , ZHANG Z , CUI P , et al . Robust graph convolutional networks against adversarial attacks [C ] // Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery ＆Data Mining . 2019 : 1399 - 1407 .

JIN M , CHANG H , ZHU W , et al . Power up! robust graph convolutional network against evasion attacks based on graph powering [J ] . arXiv preprint arXiv:1905.10029 , 2019 .

IOANNIDIS V N AND GIANNAKIS G B . Edge dithering for robust adaptive graph convolutional networks [J ] . arXiv preprint arXiv:1910.09590 , 2019 .

MILLER B A , ÇAMURCU M , GOMEZ A J , et al . Improving robustness to attacks against vertex classification [C ] // 15th International Workshop on Mining and Learning with Graphs . 2019 .

WU H , WANG C , TYSHETSKIY Y , et al . Adversarial examples for graph data:Deep insights into attack and defense [C ] // Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence . 2019 : 4816 - 4823 .

JIN W , LI Y , XU H , et al . Adversarial attacks and defenses on graphs:a review and empirical study [J ] . arXiv preprint arXiv:2003.00653 , 2020 .

SUN L , DOU Y , YANG C , et al . Adversarial attack and defense on graph data:A survey [J ] . arXiv preprint arXiv:1812.10528 , 2018 .

CHEN L , LI J , PENG J , et al . A survey of adversarial learning on graph [J ] . arXiv preprint arXiv:2003.05730 , 2020 .

DOMENICO M , LIMA A , MOUGEL P , et al . The anatomy of a scientific rumor [J ] . Scientific Reports , 2013 , 3 ( 10 ): 65 .

LESKOVEC J , KLEINBERG J , FALOUTSOS C . Graph evolution:Densification and shrinking diameters [J ] . ACM Transactions on Knowledge Discovery from Data (TKDD) . 2006 ,1.

LI Y , YU R , SHAHAB CI , et al . Diffusion convolutional recurrent neural network:Data-driven traffic forecasting [C ] // 6th International Conference on Learning Representations . 2018 .

GONG Y , ZHU Y , DUAN L , et al . Exact-k recommendation via maximal clique optimization [C ] // Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery ＆Data Mining,KDD 2019 . 2019 : 617 - 626 .

TANG J , ZHANG J , YAO L , et al . Arnetminer:extraction and mining of academic social networks [C ] // Proceedings of the 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2008 : 990 - 998 .

ADAMIC L A AND GLANCE N . The political blogosphere and the 2004 us election:divided they blog [C ] // Proceedings of the 3rd International Workshop on Link Discovery . 2005 : 36 - 43 .

DEBNATH A K , COMPADRE R L , DEBNATH G , et al . Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds.correlation with molecular orbital energies and hydrophobicity [J ] . Journal of Medicinal Chemistry , 1991 , 34 ( 2 ): 786 - 797 .

GOODFELLOW I , POUGET-ABADIE J , MIRZA M , et al . Generative adversarial nets [C ] // Advances in Neural Information Processing Systems 27:Annual Conference on Neural Information Processing Systems 2014 . 2014 : 2672 - 2680 .

KIPF T N , WELLING M . Semi-supervised classification with graph convolutional networks [C ] // International Conference on Learning Representations,ser.ICLR ’17 . 2017 .

WANG B AND WANG N . Attacking graphbased classification via manipulating the graph structure [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 2023 - 2040 .

AVISHEK J , CIANFLFLONE A , HAMILTION W . Generalizable adversarial attacks using generative models [J ] . arXiv preprint arXiv:1905.10864 , 2019 .

WU H , WANG C , TYSHETSKIY Y , et al . Adversarial examples for graph data:deep insights into attack and defense [C ] // Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence,IJCAI 2019 . 2019 : 4816 - 4823 .

XU K , CHEN H , LIU S , et al . Topology attack and defense for graph neural networks:An optimization perspective [C ] // Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence,IJCAI 2019 . 2019 : 3961 - 3967 .

ZANG X , XIE Y , CHEN J , et al . Graph universal adversarial attacks:A few bad actors ruin graph learning models [J ] . arXiv preprint arXiv:2002.04784 , 2020 .

TAKAHASHI T , . Indirect adversarial attacks via poisoning neighbors for graph convolutional networks [C ] // 2019 IEEE International Conference on Big Data (Big Data) . 2019 : 1395 - 1400 .

CHEN J , CHEN Y , ZHENG H , et al . Mga:Momentum gradient attack on network [J ] . arXiv preprint arXiv:2002.11320 , 2020 .

WANIEK M , ZHOU K , VOROBEYCHIK Y , et al . Attack tolerance of link prediction algorithms:How to hide your relations in a social network [J ] . arXiv preprint arXiv:1809.00152 , 2018 .

QIU J , DONG Y , MA H , et al . Network embedding as matrix factorization [C ] // Proceedings of the Eleventh ACM International Conference on Web Search and Data Mining,WSDM 2018 . 2018 : 459 - 467 .

CHEN J , ZHANG J , CHEN Z , et al . Time-aware gradient attack on dynamic network link prediction [J ] . arXiv preprint arXiv:1911.10561 , 2019 .

TANG H , MA G , CHEN Y , et al . Adversarial attack on hierarchical graph pooling neural networks [J ] . arXiv preprint arXiv:2005.11560 , 2020 .

BÁLEK M , GOODALL A . Large networks and graph limits [J ] . Comput Sci Rev , 2013 , 10 : 35 - 46 .

FALOUTSOS C , KOUTRA D , VOGELSTEIN J . Deltacon:A principled massive-graph similarity function [C ] // Proceedings of the 13th SIAM International Conference on Data Mining . 2013 : 162 - 170 .

ZHANG Z , JIA J , WANG B , et al . Backdoor attacks to graph neural networks [J ] . arXiv preprint arXiv:2006.11165 , 2020 .

XI Z , PANG R , JI S , et al . Graph backdoor [C ] // USENIX Security . 2021 .

CORDELLA L , FOGGIA P , SANSONE C , et al . A (sub)graph isomorphism algorithm for matching large graphs [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2004 , 26 ( 10 ): 1367 - 1372 .

YU S , ZHENG J , CHEN J , et al . Unsupervised euclidean distance attack on network embedding [C ] // 5th IEEE International Conference on Data Science in Cyberspace . 2020 : 71 - 77 .

LI J , ZHANG H , HAN Z , et al . Adversarial attack on community detection by hiding individuals [C ] // WWW ’20:The Web Conference 2020 . 2020 : 917 - 927 .

WANIEK M , MICHALAK T , WOOLDRIDGE M , et al . Hiding individuals and communities in a social network [J ] . Nature Human Behaviour , 2018 , 2 ( 2 ): 139 - 147 .

DENG Z , DONG Y , ZHU J . Batch virtual adversarial training for graph convolutional networks [J ] . arXiv preprint arXiv:1902.09192 , 2019 .

WANG X , LIU X , HSIEH C . Graphdefense:Towards robust graph convolutional networks [J ] . arXiv preprint arXiv:1911.04429 , 2019 .

IOANNIDIS V , BERBERIDIS D AND GIANNAKIS B . Graphsac:Detecting anomalies in large-scale graphs [J ] . arXiv preprint arXiv:1910.09589 , 2019 .

ZHOU K , MICHALAK T , VOROBEYCHIK Y , et al . Adversarial robustness of similarity-based link prediction [J ] . arXiv preprint arXiv:1909.01432 , 2019 .

PEZESHKPOUR P , IRVINE C , TIAN Y , et al . Investigating robustness and interpretability of link prediction via adversarial modifications [C ] // Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics:Human Language Technologies . 2019 : 3336 - 3347 .

JIN W , MA Y , LIU X , et al . Graph structure learning for robust graph neural networks [C ] // KDD ’20:The 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,Virtual Even . 2020 : 66 - 74 .

SUN M , TANG J , LI H , et al . Data poisoning attack against unsupervised node embedding methods [J ] . arXiv preprint arXiv:1810.12881 , 2018 .

SEN P , NAMATA G , BILGIC M , et al . Collective classification in network data [J ] . AI Magazine , 2008 , 29 ( 3 ): 93 .

MCCALLUM A , NIGAM K , RENNIE J , et al . Automating the construction of internet portals with machine learning [J ] . Information Retrieval , 2000 , 3 ( 2 ): 127 - 163 .

HAMILTON W , YING Z ,AND LESKOVEC J . Inductive representation learning on large graphs [C ] // Advances in Neural Information Processing Systems 30:Annual Conference on Neural Information Processing Systems 2017 . 2017 : 1024 - 1034 .

LUSSEAU D , SCHNEIDER K , BOISSEAU O , et al . The bottlenose dolphin community of doubtful sound features a large proportion of long-lasting associations [J ] . Behavioral Ecology and Sociobiology , 2003 , 54 ( 4 ): 396 - 405 .

ZACHARY W . An information flow model for conflict and fission in small groups [J ] . Journal of anthropological research , 1977 , 33 ( 4 ): 452 - 473 .

GIRVAN M AND NEWMAN M . Community structure in social and biological networks [C ] // Proceedings of the National Academy of Sciences . 2002 : 7821 - 7826 .

BORGWARDT K , ONG C , SCHOENAUER S , et al . Protein function prediction via graph kernels [J ] . Bioinformatics , 2005 , 21 ( 1 ): 47 - 56 .

WALE N , KARYPIS G . Comparison of descriptor spaces for chemical compound retrieval and classification [C ] // Proceedings of the 6th IEEE International Conference on Data Mining (ICDM 2006) . 2006 : 678 - 689 .

DOBSON P , DOIG A . Distinguishing enzyme structures from non-enzymes without alignments [J ] . Journal of molecular biology , 2003 , 330 ( 4 ): 771 - 783 .

ZUGNER D AND GUNNEMANN DS . Certifiable robustness and robust training for graph convolutional networks [C ] // Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery ＆ Data Mining . 2019 : 246 - 256 .

浏览量

1957

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于光学的物理域对抗攻防综述

针对车牌识别系统的双重对抗攻击

纵向联邦学习方法及其隐私和安全综述

基于RSA的图像可识别对抗攻击方法