Neural network grokking – the abrupt memorization-to-generalization transition – challenges our understanding of learning dynamics. Through finite-size scaling of gradient avalanche dynamics across eight model scales, we find that grokking is a dimensional phase transition: effective dimensionality D crosses from sub-diffusive (subcritical, D < 1) to super-diffusive (supercritical, D > 1) at generalization onset, exhibiting self-organized criticality (SOC). Crucially, D reflects gradient field geometry, not network architecture: synthetic i.i.d. Gaussian gradients maintain D ≈ 1 regardless of graph topology, while real training exhibits dimensional excess from backpropagation correlations. The grokking-localized D(t) crossing – robust across topologies – offers new insight into the trainability of overparameterized networks.

Botnets pose a significant threat to Internet information systems, leveraging Domain Generation Algorithm (DGA) for malicious activities such as denial-of-service, spam, and malware distribution. Current research of DGA in machine learning and deep learning has primarily focused on binary classification of known DGAs, resulting in reduced accuracy when confronted with unknown DGAs due to the increasing diversity of DGAs. This paper addresses this challenge by proposing a novel approach utilizing a domain-specific tokenizer and the TextCNN for multi-classification of known DGAs, augmented by Autoencoder (AE) and extreme value theory (EVT) for accurate identification of unknown DGAs. Our method builds upon the insight that AE reconstruction errors are typically higher for unknown DGAs compared to known ones. To further enhance precision, we introduce an EVT-based algorithm to estimate confidence probabilities for recognition outcomes. Our approach aims to accurately identify unknown DGAs in addition to performing multi-class classification of known DGAs using deep learning methods (TextCNN and Autoencoder). Experimental results on real-world DGA datasets suggest improvements in recognition accuracy compared to conventional baseline methods.

According to the World Health Organization and other authorities, falls are one of the main causes of accidental injuries among the elderly population. Therefore, it is essential to detect and predict the fall activities of older persons in indoor environments such as homes, nursing, senior residential centers, and care facilities. Due to non-contact and signal confidentiality characteristics, radar equipment is widely used in indoor care, detection, and rescue. This paper proposes an adaptive channel selection algorithm to separate the activity signals from the background using an ultra-wideband radar and to generalize fused features of frequency- and time-domain images which will be sent to a lightweight convolutional neural network to detect and recognize fall activities. The experimental results show that the method is able to distinguish three types of fall activities (i.e., stand to fall, bow to fall, and squat to fall) and obtain a high recognition accuracy up to 95.7%.

Recently almost all the mainstream deepfake detection methods use Convolutional Neural Networks (CNN) as their backbone. However, due to the overreliance on local texture information which is usually determined by forgery methods of training data, these CNN-based methods cannot generalize well to unseen data. To get out of the predicament of prior methods, in this paper, we propose a novel transformer-based framework to model both global and local information and analyze anomalies of face images. In particular, we design attention leading module, multi-forensics module and variant residual connections for deepfake detection, and leverage token-level contrast loss for more detailed supervision. Experiments on almost all popular public deepfake datasets demonstrate that our method achieves state-of-the-art performance in cross-dataset evaluation and comparable performance in intra-dataset evaluation.

During recent years, image classification through DNN has been applied to various fields, including payment security and image search. DNN in image classification is effective and convenient, yet susceptible to perturbations: non-targeted and targeted adversarial attacks against neural networks, such as FGSM and BIM respectively, exert modifications that are unrecognizable to naked eyes to image inputs, and will probably result in wrong classifications. To ensure the degree of safety of DNN image classification, researchers have been dedicated to the study of defense mechanisms to diminish or even eliminate the effects brought by adversarial attacks. Our proposed approach, aims at increasing the classifier's resistance to perturbations by adding a pseudo-random matrix key generated by Logistic Chaos. Our defense mechanism with Logistic Chaos-generated secret random key utilized 1 key with mere 3 elements and is of high generality. We show empirically that our approach is efficient against most attacks.

Deepfake aims to swap a face of an image with someone else’s likeness in a reasonable manner. Existing methods usually perform deepfake frame by frame, thus ignoring video consistency and producing incoherent results. To address such a problem, we propose a novel framework Neural Identity Carrier (NICe), which learns identity transformation from an arbitrary face-swapping proxy via a U-Net. By modeling the incoherence between frames as noise, NICe naturally suppresses its disturbance and preserves primary identity information. Concretely, NICe inputs the original frame and learns transformation supervised by swapped pseudo labels. As the temporal incoherence has an uncertain or stochastic pattern, NICe can filter out such outliers and well maintain the target content by uncertainty prediction. With the predicted temporally stable appearance, NICe enhances its details by constraining 3D geometry consistency, making NICe learn fine-grained facial structure across the poses. In this way, NICe guarantees the temporal stableness of deepfake approaches and predicts detailed results against over-smoothness. Extensive experiments on benchmarks demonstrate that NICe significantly improves the quality of existing deepfake methods on video-level. Besides, data generated by our methods can benefit video-level deepfake detection methods.

基于机器学习或深度学习的侧信道建模攻击本质上是一个有监督分类问题,而分类标签的依据是泄露模型,我们经常使用的两种泄露模型是汉明重量(Hamming Weight,HW)和汉明距离(Hamming Distance,HD).当使用HW/HD作为采集轨迹的标签时,会出现数据不平衡的问题.在本文中,我们首次使用条件生成对抗网络(Conditional Generative Adversarial Network,CGAN)来生成轨迹,通过数据扩张的方法来构建平衡的训练集,从而提升模型的攻击效果.我们选取了三种公开数据集来验证该方法的有效性,包括无防护的AES硬件实现、带有一阶掩码防护的AES软件实现以及带有随机延迟防护的AES软件实现.实验结果表明,由重构的平衡训练集所训练出的模型具有更好的攻击效果,有效地减少了成功攻击所需的轨迹条数,并且在具体分析模型的类别预测比例时,能够正确预测更多的少数类别样本.这也表明优化后的模型学习到了更全面的类别.对比Picek等在2019年的相关工作,我们的方法有了更进一步的提升.

In recent years, various deep learning techniques have been exploited in side channel attacks, with the anticipation of obtaining more satisfactory attack results. Most of them concentrate on improving network architectures or putting forward novel metrics, assuming that there are adequate profiling traces available to train an appropriate neural network. However, in practical scenarios, profiling traces are probably insufficient, which makes the network learn deficiently and compromises attack performance. In this paper, we investigate a kind of data augmentation technique, called mixup, and first propose to exploit it in deep-learning based side channel attacks, for the purpose of expanding the profiling set and facilitating the chances of mounting a successful attack. We utilize mixup to generate new traces and perform Correlation Power Analysis for generated traces and original traces. The analysis reveals that the leakage location and leakage intensity between them are consistent. In view of this observation, we consider it feasible to add generated traces to the original profiling set. Our verifying experiments show that mixup is truly capable of enhancing attack performance especially for insufficient profiling traces. Specifically, when the size of the training set is decreased to 30% of the whole set, mixup can almost reduce required attacking traces to half. We test three mixup parameter values and conclude that generally all of them can bring about improvements. Besides, we compare three leakage models and surprisingly discover that least significant bit model, which is less frequently used in previous works, actually surpasses prevalent identity model and hamming weight model in terms of attack results.

Numerous previous works have studied deep learning algorithms applied in the context of side-channel attacks, which demonstrated the ability to perform successful key recoveries. These studies show that modern cryptographic devices are increasingly threatened by side-channel attacks with the help of deep learning. However, the existing countermeasures are designed to resist classical side-channel attacks, and cannot protect cryptographic devices from deep learning based side-channel attacks. Thus, there arises a strong need for countermeasures against deep learning based side-channel attacks. Although deep learning has the high potential in solving complex problems, it is vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrectly. In this paper, we propose a kind of novel countermeasures based on adversarial attacks that is specifically designed against deep learning based side-channel attacks. We estimate several models commonly used in deep learning based side-channel attacks to evaluate the proposed countermeasures. It shows that our approach can effectively protect cryptographic devices from deep learning based side-channel attacks in practice. In addition, our experiments show that the new countermeasures can also resist classical side-channel attacks.

Recently, many profiling side-channel attacks based on Machine Learning and Deep Learning have been proposed. Most of them focus on reducing the number of traces required for successful attacks by optimizing the modeling algorithms. In previous work, relatively sufficient traces need to be used for training a model. However, in the practical profiling phase, it is difficult or impossible to collect sufficient traces due to the constraint of various resources. In this case, the performance of profiling attacks is inefficient even if proper modeling algorithms are used. In this paper, the main problem we consider is how to conduct more efficient profiling attacks when sufficient profiling traces cannot be obtained. To deal with this problem, we first introduce the Conditional Generative Adversarial Network (CGAN) in the context of side-channel attacks. We show that CGAN can generate new traces to enlarge the size of the profiling set, which improves the performance of profiling attacks. For both unprotected and protected cryptographic algorithms, we find that CGAN can effectively learn the leakage of traces collected in their implementations. We also apply it to different modeling algorithms. In our experiments, the model constructed with the augmented profiling set can reduce the required attack traces by more than half, which means the generated traces can provide useful information as the real traces.

Numerous previous works have studied deep learning algorithms applied in the context of side-channel attacks,which demonstrated the ability to perform successful key recoveries.These studies show that modern cryptographic devices are increasingly threatened by side-channel attacks with the help of deep learning.However,the existing countermeasures are designed to resist classical side-channel attacks,and cannot protect cryptographic devices from deep learning based side-channel attacks.Thus,there arises a strong need for countermeasures against deep learning based side-channel attacks.Although deep learning has the high potential in solving complex problems,it is vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to give wrong pedictions.In this paper,a kind of novel countermeasures is proposed based on adversarial attacks that is specifically designed against deep learning based side-channel attacks.We estimate several models commonly used in deep learning based side-channel attacks to evaluate the proposed countermeasures.It is shown that our approach can effectively protect cryptographic devices from deep learning based side-channel attacks in practice.In addition,our experiments show that the new countermeasures can also resist classical side-channel attacks.

侧信道攻击利用密码算法在物联网设备上执行时产生的时间、功耗、电磁辐射和故障输出等泄露来恢复密钥或者其他敏感信息,它已经成为了加密安全设备的重要威胁之一.近年来,建模类侧信道攻击在加密算法安全性评估中发挥着重要的作用,它被认为是现阶段最强大的攻击方法.随后,深度学习技术应用于建模类侧信道攻击,并且在公开数据集上取得了良好的效果.在本文中,我们提出了一种优化的卷积神经网络侧信道攻击方法,该方法将一种新的网络结构SincNet应用于侧信道攻击,SincNet卷积层只需要学习滤波器的高和低两个截止频率,相比于传统的卷积层,学习的参数量更少.为了检验该攻击方法的有效性,我们使用公开的ASCAD数据集和DPA contest v4.1数据集对其进行评估.实验结果表明,我们在ASCAD.h5上仅需要170条能量轨迹就能恢复出正确的子密钥.另外,我们也在ASCAD_desync50.h5和ASCAD_desync100.h5这两个轨迹非对齐的数据集上进行评估,该方法有效地缓解了轨迹非对齐造成的影响,得到了优于Prouff等人在2018年的实验结果.对于DPA contest v4.1数据集,我们使用了CNN网络和SincNet网络对其进行训练和测试,均可以达到很好的攻击效果,仅需要一条能量轨迹就可以恢复出子密钥,为了证明SincNet网络的有效性,我们减少训练轨迹的条数,发现SincNet网络能够使用更少的训练轨迹条数恢复出子密钥,然后我们对经过SincNet层处理之后的能量轨迹作了相关性分析,发现相关性得到了一定的提升.

Deep neural network (DNN) is being adopted in many security-critical and privacy-sensitive smart Internet of Things areas, such as smart city, smart home and intelligent transportation. Therefore, the data privacy of these DNN systems is of great concern. In this paper, we present a new timing side-channel attack, called FPMT attack, to recover the input images of a DNN implemented on microcontrollers. The proposed approach is the first to attack a DNN by exploiting the running time of floating-point multiplications. A passive attacker can obtain the running time from the power consumption trace and then use the time to infer the pixel values without knowing the detailed parameters of the network. Our results show that the FPMT attack can achieve 96.20% recognition accuracy for the MNIST dataset. When the inputs are handwritten digits or letters, attackers can even know what you write with the recovered images. This work puts forward a new direction of attacks on DNN and can be extended to more scenarios.