We show that hybrid quantum classifiers based on quantum kernel methods and
support vector machines are vulnerable against adversarial attacks, namely
small engineered perturbations of the input data can deceive the classifier
into predicting the wrong result. Nonetheless, we also show that simple defence
strategies based on data augmentation with a few crafted perturbations can make
the classifier robust against new attacks. Our results find applications in
security-critical learning problems and in mitigating the effect of some forms
of quantum noise, since the attacker can also be understood as part of the
surrounding environment.

基于量子核方法和支持向量机的混合量子分类器容易受到对抗攻击，但基于数据增强的简单防御策略可以使分类器对新攻击具有鲁棒性，这在安全关键学习问题和减轻某些形式的量子噪声的影响中具有应用。

量子对抗学习的核方法

Quantum Adversarial Learning for Kernel Methods

Network Intrusion Detection System (NIDS) is a key component in securing the
computer network from various cyber security threats and network attacks.
However, consider an unfortunate situation where the NIDS is itself attacked
and vulnerable more specifically, we can say, How to defend the defender?. In
Adversarial Machine Learning (AML), the malicious actors aim to fool the
Machine Learning (ML) and Deep Learning (DL) models to produce incorrect
predictions with intentionally crafted adversarial examples. These adversarial
perturbed examples have become the biggest vulnerability of ML and DL based
systems and are major obstacles to their adoption in real-time and
mission-critical applications such as NIDS. AML is an emerging research domain,
and it has become a necessity for the in-depth study of adversarial attacks and
their defence strategies to safeguard the computer network from various cyber
security threads. In this research work, we aim to cover important aspects
related to NIDS, adversarial attacks and its defence mechanism to increase the
robustness of the ML and DL based NIDS. We implemented four powerful
adversarial attack techniques, namely, Fast Gradient Sign Method (FGSM),
Jacobian Saliency Map Attack (JSMA), Projected Gradient Descent (PGD) and
Carlini & Wagner (C&W) in NIDS. We analyzed its performance in terms of various
performance metrics in detail. Furthermore, the three heuristics defence
strategies, i.e., Adversarial Training (AT), Gaussian Data Augmentation (GDA)
and High Confidence (HC), are implemented to improve the NIDS robustness under
adversarial attack situations. The complete workflow is demonstrated in
real-time network with data packet flow. This research work provides the
overall background for the researchers interested in AML and its implementation
from a computer network security point of view.

网络入侵检测系统（NIDS）是保护计算机网络免受各种网络攻击和网络安全威胁的关键组成部分。然而，如果 NIDS 本身受到攻击和漏洞，如何保卫防御者？本研究旨在涵盖与 NIDS、对抗性攻击及其防御机制相关的重要方面，以提高基于机器学习和深度学习的 NIDS 的鲁棒性。我们实施了四种强大的对抗性攻击技术，即快速梯度符号方法（FGSM）、雅可比敏感度图攻击（JSMA）、投影梯度下降（PGD）和 Carlini ＆ Wagner（C＆W）在 NIDS 中。我们详细分析了其在各种性能指标方面的性能。此外，我们实施了三种启发式防御策略，即对抗性训练（AT）、高斯数据增强（GDA）和高置信度（HC），以提高在对抗性攻击情况下的 NIDS 鲁棒性。完整的工作流程在实时网络与数据包流中演示，为对对抗性机器学习感兴趣的研究人员提供了整体背景。

实时深度学习网络入侵检测系统中的白盒非定向攻击与启发式防御方法

Untargeted White-box Adversarial Attack with Heuristic Defence Methods  in Real-time Deep Learning based Network Intrusion Detection System

Natural language processing (NLP) tasks, ranging from text classification to
text generation, have been revolutionised by the pre-trained language models,
such as BERT. This allows corporations to easily build powerful APIs by
encapsulating fine-tuned BERT models for downstream tasks. However, when a
fine-tuned BERT model is deployed as a service, it may suffer from different
attacks launched by malicious users. In this work, we first present how an
adversary can steal a BERT-based API service (the victim/target model) on
multiple benchmark datasets with limited prior knowledge and queries. We
further show that the extracted model can lead to highly transferable
adversarial attacks against the victim model. Our studies indicate that the
potential vulnerabilities of BERT-based API services still hold, even when
there is an architectural mismatch between the victim model and the attack
model. Finally, we investigate two defence strategies to protect the victim
model and find that unless the performance of the victim model is sacrificed,
both model ex-traction and adversarial transferability can effectively
compromise the target models

本文主要研究了如何对 BERT 模型进行攻击，提出了对受害模型进行攻击并窃取模型的攻击方法，以及如何抵御此类攻击的两种防御策略。