Finger vein recognition technology has become one of the primary solutions for high-security identification systems. However, traditional finger vein recognition methods face several limitations, such as the risk of permanent identity loss due to biometric data leakage. Through designing cancelable biometrics, users' privacy and security can be further protected, and the risk of biometric data misuse can be reduced. In this paper, we propose Deep Bio-Hashing Network (DBHN) for privacy-preserving finger vein recognition, achieving end-to-end cancelable recognition. Specifically, we design a class center alignment module to improve feature alignment, which aligns the variations of all potential finger views with the finger center view via a learnable transformation. Furthermore, to tackle the security problem caused by stolen tokenized random numbers, a Deep Bio-Hashing layer is proposed, which utilizes a system-level token instead of assigning unique tokens to each user. To supervise the learning process of DBHN, we design a hybrid loss function including classification loss, consistency-based localization loss, and class center triplet loss. Finally, we conduct experiments and analysis on three publicly available datasets. Experimental results show that our method has favorable recognition performance and achieves competitive results compared to state-of-the-art hash-based methods. The analysis verifies the cancelable biometrics attributes and justifies the resilience of the method against existing security and privacy attacks.
Jie Gui, Yifan Wang, Minjing Dong et al.· IEEE Transactions on Image P...· 0 citations
Query-based Vision-Language-Action (VLA) models offer low-latency inference that is attractive for bimanual robotic manipulation, but we observe that they can still exhibit discontinuous actions and execution failures in complex dual-arm tasks. We hypothesize that unstable multi-view and language fusion is one contributing factor in these failures, often coinciding with attention spreading to distracting regions. To improve robustness, we introduce the Modality Masking Mechanism (M3), an embarrassingly simple, training-only strategy that requires no architectural changes or large-scale robot pretraining. M3 stochastically masks subsets of modality channels during training, exposing the policy to controlled partial observations and encouraging it to rely less on distracting cues and more on evidence that remains reliable. We evaluate M3 on ten bimanual tasks from RoboTwin 2.0 and on three long-horizon real-world tasks. Compared with the Adapter baseline, M3 improves average success by 21.7% in the Clean setting and 11.4% in Clean2Rand, where policies are trained on clean demonstrations and evaluated on randomized scenes, while also improving averaged real-world full-task success by over 30%. These results suggest that structured training-time masking is a practical way to improve the robustness of query-based VLA policies for bimanual manipulation.
Dongzhou Cheng, Ziang Li, Yixiao Zhou et al.· 0 citations
Self-supervised learning (SSL) encoders are vulnerable to backdoor attacks, posing threats to both visual SSL encoders and vision-language encoders. Existing defenses are typically designed for only one of these paradigms and rely on restrictive assumptions such as access to uninfected in-distribution data or precomputed pseudo-labels, which are difficult to satisfy in practice. To address these limitations, we propose DEFUSE, a generalizable backdoor detection framework for SSL encoders. Inspired by Bayesian posterior inference, we reformulate backdoor detection as a representation-conditioned image likelihood estimation problem parameterized by a conditional diffusion generative model. Uninfected representations tend to yield semantically consistent reconstructions, whereas backdoored ones are more likely to be mapped to the attacker's target class or semantically meaningless images, deviating from the original semantics and thereby exposing the backdoor. However, we find that the exact likelihood is intractable, because highly abstracted representations discard the low-level information necessary for pixel-faithful reconstruction. We therefore relax the objective to semantic reconstruction and evaluate it in a well-separated representation space provided by a reference encoder. Rather than training from scratch, we fine-tune a pretrained diffusion model, leveraging its generative prior to map data onto the natural image manifold while preserving semantic content. Extensive experiments demonstrate that DEFUSE substantially outperforms existing detectors across diverse attack settings, generalizing to both visual SSL and vision-language encoders. Notably, our method greatly reduces the reliance on prior knowledge about the victim encoder or the attack strategy. The source code is available at https://github.com/jsrdcht/DEFUSE .
Tuo Chen, Jie Gui, Minjing Dong et al.· 0 citations
Deep learning models for point cloud classification are highly vulnerable to adversarial attacks, while recent advances in diffusion-based purification have shown promising defensive performance. However, existing diffusion-based purification methods harbor two fundamental limitations. First, a distributional gap arises from their training on clean-to-clean paths, which fails to generalize to the required adversarial-to-clean transition. Second, a semantic mismatch occurs because the fixed victim classifier cannot adapt to the decision boundaries of the purified data distribution. To address this, we propose PANDA, a two-stage framework that combines robust purification with classifier adaptation. For purification, we introduce PANDA-P, a novel dual-branch diffusion training strategy that simultaneously optimizes on both clean-to-clean and adversarial-to-clean paths. This unified formulation boosts the purification effectiveness while preserving fidelity. For adaptation, we design PANDA-A, a fine-tuning scheme that leverages a consistency-driven learning objective to reshape the classifier’s feature space and recalibrate a robust decision boundary for the purified data. Extensive experiments show that PANDA achieves consistently superior robustness over existing purification-based defenses on both synthetic and real-world benchmarks.
Yu-Xin Zhang, Xiaofeng Cong, Minjing Dong et al.· IEEE Transactions on Informa...· 0 citations
A new attack-agnostic, model-agnostic, and modality-agnostic black-box test-time defense paradigm, inspired by the Platonic Representation Hypothesis, that can perform both representation detection and purification, and achieves substantial performance gains across multiple attacks.
Tuo Chen, Minjing Dong, Benlei Cui et al.· arXiv.org· 0 citations