Author name cluster

Jinbao Li

Possible papers associated with this exact author name in Arrow. This page groups case-insensitive exact name matches and is not a full identity disambiguation profile.

5 papers

1 author row

JBHI Journal 2026 Journal Article

Multimodal Contrastive Prototype Learning for Resilient Brain Tumor Segmentation With Missing Modalities

Heran Xi
Yu Ye
Jinghua Zhu
Jinbao Li

Multimodal fusion is an effective solution for holistic brain tumor diagnosis; however, it faces challenges under missing modalities. Traditional multi-encoder architectures can easily capture modality-specific features, while single-encoder architectures readily obtain modality-shared features. The reverse, however, is challenging. In this paper, we propose a two-stage dual-view prototype learning framework to extract the modality-specific feature and the class-specific feature simultaneously. In the first stage, we utilize the Transformer decoder to learn the modality-prototypes that are used to optimize the modality reconstruction task. A masked autoencoder is introduced to generate shared features of incomplete modalities. The learned modality-prototypes that contain modality-specific features are blended with the modality-share features for the reconstruction process. In the second stage, we learn the class-prototypes through the Transformer decoder to generate a segmentation mask through voxel-to-prototype comparison. A masked modality strategy is introduced to handle random modality absence during training. Furthermore, modality-view and class-view contrastive learning strategies are developed to enhance prototype learning. We conduct experiments on BraTS2020 and BraTS2018; the experimental results demonstrate the superior performance of our model under various missing modality scenarios. On BraTS2020, our model achieves DSC improvements of 5. 9% for ET, 0. 5% for TC, and 0. 2% for WT compared to state-of-the-art methods. Notably, in the challenging T1C modality missing scenario, our model achieved clinically significant gains of 9. 5% for ET and 1. 8% for TC. The code is available at https://github.com/Xiheran/MCPL.

Details DOI

AAAI Conference 2025 Conference Paper

CAMH: Advancing Model Hijacking Attack in Machine Learning

Xing He
Jiahao Chen
Yuwen Pu
Qingming Li
Chunyi Zhou
Yingcai Wu
Jinbao Li
Shouling Ji

In the burgeoning domain of machine learning, the reliance on third-party services for model training and the adoption of pre-trained models have surged. However, this reliance introduces vulnerabilities to model hijacking attacks, where adversaries manipulate models to perform unintended tasks, leading to significant security and ethical concerns, like turning an ordinary image classifier into a tool for detecting faces in pornographic content, all without the model owner’s knowledge. This paper introduces Category-Agnostic Model Hijacking (CAMH), a novel model hijacking attack method capable of addressing the challenges of class number mismatch, data distribution divergence, and performance balance between the original and hijacking tasks. CAMH incorporates synchronized training layers, random noise optimization, and a dual-loop optimization approach to ensure minimal impact on the original task’s performance while effectively executing the hijacking task. We evaluate CAMH across multiple benchmark datasets and network architectures, demonstrating its potent attack effectiveness while ensuring minimal degradation in the performance of the original task.

PDF Details DOI

AAAI Conference 2025 Conference Paper

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Jiahao Chen
Zhou Feng
Rui Zeng
Yuwen Pu
Chunyi Zhou
Yi Jiang
Yuyou Gan
Jinbao Li

Deep neural networks (DNNs) are vulnerable to adversarial examples (AEs) that mislead the model while appearing benign to human observers. A critical concern is the transferability of AEs, which enables black-box attacks without direct access to the target model. However, many previous attacks have failed to explain the intrinsic mechanism of adversarial transferability, lacking a unified and representative metric for transferability as well. In this paper, we rethink the property of transferable AEs and develop a novel metric to measure transferability from the perspective of generalization. Building on insights from this metric, we analyze the generalization of AEs across models with different architectures and prove that we can find a local perturbation to mitigate the gap between surrogate and target models. We further establish the inner connections between model smoothness and flat local maxima, both of which contribute to the transferability of AEs. Further, we propose a new adversarial attack algorithm, Adversarial Weight Tuning (AWT), which adaptively adjusts the parameters of the surrogate model using generated AEs to optimize the flat local maxima and model smoothness simultaneously, without the need for extra data. AWT is a data-free tuning method that combines gradient-based and model-related attack methods to enhance the transferability of AEs. Extensive experiments on a variety of models with different architectures on ImageNet demonstrate that AWT yields superior performance over other attacks, with an average increase of nearly 5% and 10% attack success rates on CNN-based and Transformer-based models, respectively, compared to state-of-the-art attacks.

PDF Details DOI

AAAI Conference 2024 Conference Paper

Integer Is Enough: When Vertical Federated Learning Meets Rounding

Pengyu Qiu
Yuwen Pu
Yongchao Liu
Wenyan Liu
Yun Yue
Xiaowei Zhu
Lichun Li
Jinbao Li

Vertical Federated Learning (VFL) is a solution increasingly used by companies with the same user group but differing features, enabling them to collaboratively train a machine learning model. VFL ensures that clients exchange intermediate results extracted by their local models, without sharing raw data. However, in practice, VFL encounters several challenges, such as computational and communication overhead, privacy leakage risk, and adversarial attack. Our study reveals that the usage of floating-point (FP) numbers is a common factor causing these issues, as they can be redundant and contain too much information. To address this, we propose a new architecture called rounding layer, which converts intermediate results to integers. Our theoretical analysis and empirical results demonstrate the benefits of the rounding layer in reducing computation and memory overhead, providing privacy protection, preserving model performance, and mitigating adversarial attacks. We hope this paper inspires further research into novel architectures to address practical issues in VFL.

PDF Details DOI

IJCAI Conference 2024 Conference Paper

Protecting Object Detection Models from Model Extraction Attack via Feature Space Coverage

Zeyu Li
Yuwen Pu
Xuhong Zhang
Yu Li
Jinbao Li
Shouling Ji

The model extraction attack is an attack pattern aimed at stealing well-trained machine learning models' functionality or privacy information. With the gradual popularization of AI-related technologies in daily life, various well-trained models are being deployed. As a result, these models are considered valuable assets and attractive to model extraction attackers. Currently, the academic community primarily focuses on defense for model extraction attacks in the context of classification, with little attention to the more commonly used task scenario of object detection. Therefore, we propose a detection framework targeting model extraction attacks against object detection models in this paper. The framework first locates suspicious users based on feature coverage in query traffic and uses an active verification module to confirm whether the identified suspicious users are attackers. Through experiments conducted in multiple task scenarios, we validate the effectiveness and detection efficiency of the proposed method.

PDF Details DOI