Image Super-Resolution as a Defense Against Adversarial Attacks

Convolutional Neural Networks have achieved significant success across multiple computer vision tasks. However, they are vulnerable to carefully crafted, human-imperceptible adversarial noise patterns which constrain their deployment in critical security-sensitive systems. This paper proposes a computationally efficient image enhancement approach that provides a strong defense mechanism to effectively mitigate the effect of such adversarial perturbations. We show that deep image restoration networks learn mapping functions that can bring off-the-manifold adversarial samples onto the natural image manifold, thus restoring classification towards correct classes. A distinguishing feature of our approach is that, in addition to providing robustness against attacks, it simultaneously enhances image quality and retains models performance on clean images. Furthermore, the proposed method does not modify the classifier or requires a separate mechanism to detect adversarial images. The effectiveness of the scheme has been demonstrated through extensive experiments, where it has proven a strong defense in gray-box settings. The proposed scheme is simple and has the following advantages: (1) it does not require any model training or parameter optimization, (2) it complements other existing defense mechanisms, (3) it is agnostic to the attacked model and attack type and (4) it provides superior performance across all popular attack algorithms. Our codes are publicly available at https://github.com/aamir-mustafa/super-resolution-adversarial-defense.Comment: Published in IEEE Transactions in Image Processin

Deeply Supervised Discriminative Learning for Adversarial Defense.

Deep neural networks can easily be fooled by an adversary with minuscule perturbations added to an input image. The existing defense techniques suffer greatly under white-box attack settings, where an adversary has full knowledge of the network and can iterate several times to find strong perturbations. We observe that the main reason for the existence of such vulnerabilities is the close proximity of different class samples in the learned feature space of deep models. This allows the model decisions to be completely changed by adding an imperceptible perturbation to the inputs. To counter this, we propose to class-wise disentangle the intermediate feature representations of deep networks, specifically forcing the features for each class to lie inside a convex polytope that is maximally separated from the polytopes of other classes. In this manner, the network is forced to learn distinct and distant decision regions for each class. We observe that this simple constraint on the features greatly enhances the robustness of learned models, even against the strongest white-box attacks, without degrading the classification performance on clean images. We report extensive evaluations in both black-box and white-box attack scenarios and show significant gains in comparison to state-of-the-art defenses

Palatini Formalism of 5-Dimensional Kaluza-Klein Theory

The Einstein field equations can be derived in $n$ dimensions ($n>2$) by the variations of the Palatini action. The Killing reduction of 5-dimensional Palatini action is studied on the assumption that pentads and Lorentz connections are preserved by the Killing vector field. A Palatini formalism of 4-dimensional action for gravity coupled to a vector field and a scalar field is obtained, which gives exactly the same fields equations in Kaluza-Klein theory.Comment: 10 page

Histone/Protein Deacetylase 11 Targeting Promotes Foxp3+ Treg Function.

Current interest in Foxp3+ T-regulatory (Treg) cells as therapeutic targets in transplantation is largely focused on their harvesting pre-transplant, expansion and infusion post-transplantation. An alternate strategy of pharmacologic modulation of Treg function using histone/protein deacetylase inhibitors (HDACi) may allow more titratable and longer-term dosing. However, the effects of broadly acting HDACi vary, such that HDAC isoform-selective targeting is likely required. We report data from mice with constitutive or conditional deletion of HDAC11 within Foxp3+ Treg cells, and their use, along with small molecule HDAC11 inhibitors, in allograft models. Global HDAC11 deletion had no effect on health or development, and compared to WT controls, Foxp3+ Tregs lacking HDAC11 showed increased suppressive function, and increased expression of Foxp3 and TGF-β. Likewise, compared to WT recipients, conditional deletion of HDAC11 within Tregs led to long-term survival of fully MHC-mismatched cardiac allografts, and prevented development of transplant arteriosclerosis in an MHC class II-mismatched allograft model. The translational significance of HDAC11 targeting was shown by the ability of an HDAC11i to promote long-term allograft allografts in fully MHC-disparate strains. These data are powerful stimuli for the further development and testing of HDAC11-selective pharmacologic inhibitors, and may ultimately provide new therapies for transplantation and autoimmune diseases

Lack of allele-specific efficacy of a bivalent AMA1 malaria vaccine

<p>Abstract</p> <p>Background</p> <p>Extensive genetic diversity in vaccine antigens may contribute to the lack of efficacy of blood stage malaria vaccines. Apical membrane antigen-1 (AMA1) is a leading blood stage malaria vaccine candidate with extreme diversity, potentially limiting its efficacy against infection and disease caused by <it>Plasmodium falciparum </it>parasites with diverse forms of AMA1.</p> <p>Methods</p> <p>Three hundred Malian children participated in a Phase 2 clinical trial of a bivalent malaria vaccine that found no protective efficacy. The vaccine consists of recombinant AMA1 based on the 3D7 and FVO strains of <it>P. falciparum </it>adjuvanted with aluminum hydroxide (AMA1-C1). The gene encoding AMA1 was sequenced from <it>P. falciparum </it>infections experienced before and after immunization with the study vaccine or a control vaccine. Sequences of <it>ama1 </it>from infections in the malaria vaccine and control groups were compared with regard to similarity to the vaccine antigens using several measures of genetic diversity. Time to infection with parasites carrying AMA1 haplotypes similar to the vaccine strains with respect to immunologically important polymorphisms and the risk of infection with vaccine strain haplotypes were compared.</p> <p>Results</p> <p>Based on 62 polymorphic AMA1 residues, 186 unique <it>ama1 </it>haplotypes were identified among 315 <it>ama1 </it>sequences that were included in the analysis. Eight infections had <it>ama1 </it>sequences identical to 3D7 while none were identical to FVO. Several measures of genetic diversity showed that <it>ama1 </it>sequences in the malaria vaccine and control groups were comparable both at baseline and during follow up period. Pre- and post-immunization <it>ama1 </it>sequences in both groups all had a similar degree of genetic distance from FVO and 3D7 <it>ama1</it>. No differences were found in the time of first clinical episode or risk of infection with an AMA1 haplotype similar to 3D7 or FVO with respect to a limited set of immunologically important polymorphisms found in the cluster 1 loop of domain I of AMA1.</p> <p>Conclusion</p> <p>This Phase 2 trial of a bivalent AMA1 malaria vaccine found no evidence of vaccine selection or strain-specific efficacy, suggesting that the extreme genetic diversity of AMA1 did not account for failure of the vaccine to provide protection.</p