{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T19:15:08Z","timestamp":1783192508428,"version":"3.54.6"},"reference-count":55,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2022,5,19]],"date-time":"2022-05-19T00:00:00Z","timestamp":1652918400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LZ22F020007"],"award-info":[{"award-number":["LZ22F020007"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["92167203"],"award-info":[{"award-number":["92167203"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["2020YFB1804705, 2018YFB2100400"],"award-info":[{"award-number":["2020YFB1804705, 2018YFB2100400"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["61902082"],"award-info":[{"award-number":["61902082"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Key R&D Program of Zhejiang Province","award":["2022C01085, 2021C01036"],"award-info":[{"award-number":["2022C01085, 2021C01036"]}]},{"name":"Science and Technology Development Funds of China","award":["2021ZY1025"],"award-info":[{"award-number":["2021ZY1025"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2022,8,31]]},"abstract":"<jats:p>Edge intelligence has played an important role in constructing smart cities, but the vulnerability of edge nodes to adversarial attacks becomes an urgent problem. A so-called adversarial example can fool a deep learning model on an edge node for misclassification. Due to the transferability property of adversarial examples, an adversary can easily fool a black-box model by a local substitute model. Edge nodes in general have limited resources, which cannot afford a complicated defense mechanism like that on a cloud data center. To address the challenge, we propose a dynamic defense mechanism, namely EI-MTD. The mechanism first obtains robust member models of small size through differential knowledge distillation from a complicated teacher model on a cloud data center. Then, a dynamic scheduling policy, which builds on a Bayesian Stackelberg game, is applied to the choice of a target model for service. This dynamic defense mechanism can prohibit the adversary from selecting an optimal substitute model for black-box attacks. We also conduct extensive experiments to evaluate the proposed mechanism, and results show that EI-MTD could protect edge intelligence effectively against adversarial attacks in black-box settings.<\/jats:p>","DOI":"10.1145\/3517806","type":"journal-article","created":{"date-parts":[[2022,5,19]],"date-time":"2022-05-19T13:10:35Z","timestamp":1652965835000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":22,"title":["EI-MTD: Moving Target Defense for Edge Intelligence against Adversarial Attacks"],"prefix":"10.1145","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4056-9755","authenticated-orcid":false,"given":"Yaguan","family":"Qian","sequence":"first","affiliation":[{"name":"School of Big-data Science, Zhejiang University of Science and Technology, Hangzhou, Zhejiang Province, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2915-8082","authenticated-orcid":false,"given":"Yankai","family":"Guo","sequence":"additional","affiliation":[{"name":"School of Big-data Science, Zhejiang University of Science and Technology, Hangzhou, Zhejiang Province, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3039-2749","authenticated-orcid":false,"given":"Qiqi","family":"Shao","sequence":"additional","affiliation":[{"name":"School of Big-data Science, Zhejiang University of Science and Technology, Hangzhou, Zhejiang Province, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8078-6247","authenticated-orcid":false,"given":"Jiamin","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Big-data Science, Zhejiang University of Science and Technology, Hangzhou, Zhejiang Province, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3790-2708","authenticated-orcid":false,"given":"Bin","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang Key Laboratory of Multi-dimensional Perception Technology, Application and Cybersecurity, Qianmo Road, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology (CIAT), Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7377-7844","authenticated-orcid":false,"given":"Xiang","family":"Ling","sequence":"additional","affiliation":[{"name":"Institute of Software, Chinese Academy of Sciences, Zhongguancun, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7958-9687","authenticated-orcid":false,"given":"Chunming","family":"Wu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,5,19]]},"reference":[{"key":"e_1_3_1_2_2","unstructured":"Yi Sun Ding Liang Xiaogang Wang and Xiaoou Tang. 2015. DeepID3: Face recognition with very deep neural networks. arXiv:1502.00873. https:\/\/arxiv.org\/pdf\/1502.00873.pdf."},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390177"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.5555\/3295222.3295309"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2017.1600863"},{"key":"e_1_3_1_6_2","unstructured":"Yun Chao Hu Milan Patel Dario Sabella Nurit Sprecher and Valerie Young. 2015. Mobile edge computing - a key technology towards 5G. In ETSI White Paper 11 11 (2015) 1\u201316."},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICECC.2011.6066743"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2017.03.034"},{"key":"e_1_3_1_9_2","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv:1312.6199. https:\/\/arxiv.org\/pdf\/1312.6199.pdf."},{"key":"e_1_3_1_10_2","unstructured":"Nicolas Papernot Patrick McDaniel and Ian Goodfellow. 2016. Transferability in machine learning: From phenomena to black-box attacks using adversarial samples. arXiv:1605.07277. https:\/\/arxiv.org\/pdf\/1605.07277.pdf."},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"e_1_3_1_12_2","unstructured":"Wieland Brendel Jonas Rauber and Matthias Bethge. 2017. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv:1712.04248. https:\/\/arxiv.org\/pdf\/1712.04248.pdf"},{"key":"e_1_3_1_13_2","unstructured":"Andrew Ilyas Logan Engstrom Anish Athalye and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. In Proceedings of the 35th International Conference on Machine Learning (ICML) . 80 2137\u20132146. http:\/\/proceedings.mlr.press\/v80\/ilyas18a\/ilyas18a.pdf."},{"key":"e_1_3_1_14_2","unstructured":"Lei Wu Zhanxing Zhu Cheng Tai and Weinan E. 2018. Understanding and enhancing the transferability of adversarial examples. arXiv:1802.09707. https:\/\/arxiv.org\/pdf\/1802.09707.pdf."},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"e_1_3_1_16_2","unstructured":"Song Han Huizi Mao and William J. Dally. 2015. Deep compression: Compressing deep neural networks with pruning trained quantization and Huffman coding. arXiv:1510.00149. https:\/\/arxiv.org\/pdf\/1510.00149.pdf."},{"key":"e_1_3_1_17_2","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083. https:\/\/arxiv.org\/pdf\/1706.06083.pdf."},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01554-1_26"},{"key":"e_1_3_1_19_2","unstructured":"Ali Shafahi Mahyar Najibi Amin Ghiasi Zheng Xu John Dickerson Christoph Studer Larry S. Davis Gavin Taylor and Tom Goldstein. 2019. Adversarial training for free! In Advances in Neural Information Processing Systems (NIPS) . 3353\u20133364."},{"key":"e_1_3_1_20_2","unstructured":"Eric Wong Leslie Rice and J. Zico Kolter. 2020. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_21_2","unstructured":"Ian J. Goodfellow Jonathon Shlens and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-32430-8_28"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3318216.3363338"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3356250.3360025"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_1_26_2","doi-asserted-by":"crossref","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2017. Adversarial examples in the physical world. In International Conference on Learning Representations (ICLR) .","DOI":"10.1201\/9781351251389-8"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"e_1_3_1_28_2","unstructured":"Geoffrey Hinton Oriol Vinyals and Jeff Dean. 2015. Distilling the knowledge in a neural network. In NIPS Deep Learning and Representation Learning Workshop ."},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/1402298.1402348"},{"key":"e_1_3_1_30_2","unstructured":"Mahdieh Abbasi and Christian Gagn\u00e9. 2017. Robustness to adversarial examples through an ensemble of specialists. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.18.5.80"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_8"},{"key":"e_1_3_1_35_2","unstructured":"Forrest N. Iandola Song Han Matthew W. Moskewicz Khalid Ashraf William J. Dally and Kurt Keutzer. 2017. SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and < 0.5 MB model size. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_36_2","unstructured":"Karen Simonyan and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556."},{"key":"e_1_3_1_37_2","unstructured":"Florian Tram\u00e8r Nicolas Papernot Ian Goodfellow Dan Boneh and Patrick McDaniel. 2017. The space of transferable adversarial examples. arXiv:1704.03453. https:\/\/arxiv.org\/pdf\/1704.03453.pdf."},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00023"},{"key":"e_1_3_1_40_2","unstructured":"Andrew Ilyas Logan Engstrom and Aleksander Madry. 2018. Prior convictions: Black-box adversarial attacks with bandits and priors. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_1_43_2","unstructured":"Chuan Guo Mayank Rana Moustapha Cisse and Laurens van der Maaten. 2018. Countering adversarial images using input transformations. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_44_2","unstructured":"Jacob Buckman Aurko Roy Colin Raffel and Ian Goodfellow. 2018. Thermometer encoding: One hot way to resist adversarial examples. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_45_2","unstructured":"Jan Hendrik Metzen Tim Genewein Volker Fischer and Bastian Bischoff. 2017. On detecting adversarial perturbations. In Proceedings of 5th International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_46_2","unstructured":"Reuben Feinman Ryan R. Curtin Saurabh Shintre and Andrew B. Gardner. 2017. Detecting adversarial samples from artifacts. arXiv:1703.00410. https:\/\/arxiv.org\/pdf\/1703.00410.pdf."},{"key":"e_1_3_1_47_2","unstructured":"Eric Wong and Zico Kolter. 2017. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Proceedings of the 35th International Conference on Machine Learning (ICML) . 5286\u20135295."},{"key":"e_1_3_1_48_2","unstructured":"Aditi Raghunathan Jacob Steinhardt and Percy Liang. 2018. Semidefinite relaxations for certifying robustness to adversarial examples. In Advances in Neural Information Processing Systems 31 (NIPS 2018) . 10877\u201310887."},{"key":"e_1_3_1_49_2","unstructured":"Kai Y. Xiao Vincent Tjeng Nur Muhammad Shafiullah and Aleksander Madry. 2018. Training for faster adversarial robustness verification via inducing ReLU stability. In Proceedings of 5th International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_50_2","unstructured":"Francesco Croce Maksym Andriushchenko and Matthias Hein. 2018. Provable robustness of ReLU networks via maximization of linear regions. In Proceedings of Machine Learning Research . 2057\u20132066."},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140449"},{"key":"e_1_3_1_53_2","unstructured":"Cihang Xie Jianyu Wang Zhishuai Zhang Zhou Ren and Alan Yuille. 2018. Mitigating adversarial effects through randomization. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_54_2","unstructured":"Guneet S. Dhillon Kamyar Azizzadenesheli Zachary C. Lipton Jeremy Bernstein Jean Kossaifi Aran Khanna and Anima Anandkumar. 2018. Stochastic activation pruning for robust adversarial defense. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_55_2","unstructured":"Tiange Luo Tianle Cai Mengxiao Zhang Siyu Chen and Liwei Wang. 2019. RANDOM MASK: Towards robust convolutional neural networks. In International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_1_56_2","doi-asserted-by":"crossref","unstructured":"M. Breton and A. Alj. 1988. Sequential Stackelberg equilibria in two-person games. In Journal of Optimization Theory and Applications . 71\u201397.","DOI":"10.1007\/BF00939867"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3517806","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3517806","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:05Z","timestamp":1750182545000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3517806"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,19]]},"references-count":55,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2022,8,31]]}},"alternative-id":["10.1145\/3517806"],"URL":"https:\/\/doi.org\/10.1145\/3517806","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,19]]},"assertion":[{"value":"2020-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-02-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-05-19","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}