New attacks on RL agents' action space improve understanding of cyber-physical systems vulnerabilities.
problem Understanding and improving the robustness of RL agents in CPS against action space attacks.
method Proposed white-box MAS and LAS attack algorithms to optimize and temporally couple attack budgets.
result LAS attacks cause significantly more performance degradation than MAS attacks.
Anomaly detection method tackles hidden adversary actions in real-world scenarios.
problem Detecting hidden adversary actions in real-world scenarios where the defender cannot perfectly observe the attacker's actions.
method Extends existing anomaly detection models to handle continuous action spaces and game-theoretic framework. Proposes two algorithms: direct extension and learning-based approach.
result Learning-based approach produces less exploitable strategies and is scalable to higher dimensions.
New action poisoning attacks improve LinUCB's performance by changing action signals.
problem Improving understanding of adversarial attacks on contextual bandit algorithms.
method Proposed action poisoning attacks in white-box and black-box settings.
result Action poisoning attacks can force LinUCB to pull a target arm frequently with low cost.
New attack manipulates UCB algorithm, new defense algorithm reduces pseudo-regret.
problem Adversarial attacks on stochastic bandit algorithms.
method Introducing action-manipulation attacks and proposing a robust defense algorithm.
result Proposed defense algorithm reduces pseudo-regret to O(max{log T, A}).
Attackers can significantly reduce team rewards in cooperative multi-agent reinforcement learning.
problem Robustness of cooperative multi-agent reinforcement learning to adversaries.
method Novel attack method involving training a policy network and using targeted adversarial examples.
result Reduces team reward from 20 to 9.4 by attacking a single agent, reducing winning rate from 98.9% to 0%.
Paper robustifies reinforcement learning agents against action space perturbations.
problem Vulnerability of reinforcement learning agents to action space perturbations (e.g. actuator attacks).
method Adversarial training to robustify DRL agents against perturbations.
result DRL agents can be robustified against action space perturbations through adversarial training.
This paper studies poisoning attacks in episodic RL and discovers their effectiveness depends on reward bounds.
problem Understanding security threats to RL algorithms through poisoning attacks.
method Examined two types of poisoning attacks: reward and action manipulation, in bounded and unbounded reward settings.
result The effectiveness of poisoning attacks depends on reward bounds, with different attack costs and success rates.
A new adversarial attack method using structured search and contextual bandits.
problem Black-box adversarial attacks on deep learning models.
method Structured search space and Bayesian optimization for contextual bandits.
result Achieves state-of-the-art success rates and query efficiencies.
We study adversarial attacks that manipulate the reward signals to control the actions chosen by a stochastic multi-armed bandit algorithm. We propose the first attack against two popular bandit algorithms: ε-greedy and UCB, \emph{without} knowledge of the mean rewards. The attacker is able to spend only logarithmic …
We introduce two tactics to attack agents trained by deep reinforcement learning algorithms using adversarial examples, namely the strategically-timed attack and the enchanting attack. In the strategically-timed attack, the adversary aims at minimizing the agent's reward by only attacking the agent at a small subset of…
Black-box attacks on RL agents using temporal information.
problem Vulnerability of RL agents to adversarial samples.
method Sequence-to-sequence models for predicting future actions.
result Adversarial samples can trigger RL agents to misbehave after a delay.
Defense strategy improves controller robustness against adversarial attacks.
problem Adversarial attacks on learning-enabled controllers in CPS.
method Two-stage defense strategy treating controller and environment as black-boxes with unknown dynamics.
result Defense strategy effectively improves controller robustness in realistic control domains.
Insurance contracts for autonomous AI agents must be actuarially sound and resistant to gaming.
problem Designing insurance contracts for autonomous AI agents that are actuarially sound and resistant to gaming.
method Characterizing a five-attack space and proving the actuarial runtime is gaming-resistant.
result An incentive-compatible layer for actuarial control of autonomous-agent side effects.
Researchers disrupt Gaussian model inference to test adversarial attacks.
problem Disrupting conditional inference in multivariate Gaussian models under adversarial conditions.
method Considered white- and grey-box settings with complete and incomplete knowledge of the Gaussian distribution, respectively. Reduced to quadratic and stochastic quadratic programs. Derived structural properties for solution methods.
result Demonstrated the impact and efficacy of attacks in various applications, including real estate evaluation, interest rate estimation, and signals processing.
Researchers create a flickering attack to fool video recognition networks.
problem Adversarial manipulation of video classification networks.
method Introducing a flickering temporal perturbation to fool video classifiers.
result Achieved high fooling ratio and temporal-invariant perturbation.
When machine learning systems fail because of adversarial manipulation, how should society expect the law to respond? Through scenarios grounded in adversarial ML literature, we explore how some aspects of computer crime, copyright, and tort law interface with perturbation, poisoning, model stealing and model inversion…
New approach detects cyber-attacks in real-time.
problem Real-time detection of cyber-attacks for effective mitigation.
method Aggregates unsupervised anomaly detection algorithms and incorporates delayed feedback.
result Improves anomaly detection performance through theoretical guarantees.
Aave community attack led to irretrievable debt and questioned decentralization in DeFi lending.
problem Decentralization vs. security in large DeFi lending protocols.
method Analyzed Avi Eisenberg's attack on Aave, showing how he artificially deflated CRV price.
result Attack led to irretrievable debt of over $1.5 million and highlighted decentralization vs. security.
Backdoor attacks on DRL-based traffic controllers cause stop-and-go waves or crashes.
problem Vulnerability of DRL-based traffic controllers to machine learning attacks.
method Developed a trigger design methodology based on traffic physics principles.
result Backdoored models can cause stop-and-go traffic waves or AV crashes when triggered.
Adversarial attacks have exposed a significant security vulnerability in state-of-the-art machine learning models. Among these models include deep reinforcement learning agents. The existing methods for attacking reinforcement learning agents assume the adversary either has access to the target agent's learned paramete…
Minimalistic attacks reveal deep RL policies' vulnerabilities with little perturbation.
problem Tackling the vulnerability of deep reinforcement learning policies to minimal perturbations.
method Three key settings: black-box policy access, fractional-state adversary, and tactically-chanced attack. Formulated adversarial attacks on six Atari games.
result Deep RL policies can be significantly fooled by minimal perturbations, even in 0.01% of the input state.
New method improves DRL robustness against adversarial state observations.
problem Adversarial attacks on deep reinforcement learning agents observing state data.
method State-adversarial Markov decision process (SA-MDP) and policy regularization.
result Significant improvement in robustness of DRL algorithms under adversarial attacks.
Paper proposes a framework to assess model robustness against adversarial actions.
problem Ensuring model reliability in deployment with varied adversarial conditions.
method Developed a versatile framework for evaluating SVR and relaxed optimization models' robustness.
result Demonstrates model vulnerability without requiring additional test data.
Starting from the observation that a flying saucer is a nonholonomic mechanical system whose 5-dimensional configuration space is a contact manifold, we show how to enrich this space with a number of geometric structures by imposing further nonlinear restrictions on the saucer's velocity. These restrictions define cert…
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
New method uses Riemannian geometry to improve neural network adversarial attacks.
problem Improving robustness of neural networks against adversarial attacks.
method Proposes a new adversarial attack using Riemannian foliation theory and curvature of data space.
result The new attack is more efficient and accurate compared to existing methods.
Efficiently attacks large-scale graphs without using the whole graph.
problem Vulnerability of graph neural networks to adversarial attacks.
method Simplified Gradient-based Attack (SGA) method for large-scale graphs.
result SGA achieves significant time and memory efficiency improvements.
A multi-player bandit system resists adversarial attacks with near-optimal regret.
problem Adversaries attempt to manipulate rewards in a multi-player multi-armed bandit game.
method Players communicate a single bit to resist attacks, achieving near-optimal regret.
result Achieves near-optimal regret of O(log1+δT+W), where W is the total time of adversarial attacks. Robust algorithm optimizes corrupted Gaussian process bandits.
problem Sequential optimization of corrupted, expensive reward functions.
method Robust GP Phased Elimination (RGP-PE) algorithm.
result Algorithm balances robustness to corruptions with exploration and exploitation.
An adversarial machine learning approach is introduced to launch jamming attacks on wireless communications and a defense strategy is presented. A cognitive transmitter uses a pre-trained classifier to predict the current channel status based on recent sensing results and decides whether to transmit or not, whereas a j…
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
Defense against Wasserstein adversarial attacks using randomized smoothing.
problem Certified robustness against Wasserstein adversarial attacks.
method Randomized smoothing applied to the space of flows between images, bounding Wasserstein distance by L_1 distance.
result Significantly improved accuracy under Wasserstein adversarial attacks compared to unprotected models.
Recent developments have established the vulnerability of deep reinforcement learning to policy manipulation attacks via intentionally perturbed inputs, known as adversarial examples. In this work, we propose a technique for mitigation of such attacks based on addition of noise to the parameter space of deep reinforcem…
Bullseye Polytope improves clean-label poisoning attacks in transfer learning.
problem Poisoning neural networks with correctly labeled data.
method Creates poison images with centers close to target images in feature space.
result Improves attack success rate by 26.75% in end-to-end transfer learning.
Regularizes predictions to encourage beneficial user actions.
problem Learning models affect user actions, but provide no guarantees.
method Introduces look-ahead regularization to anticipate and encourage beneficial actions.
result Effective in promoting beneficial user actions in real and synthetic data.
This paper optimizes cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
problem Optimizing cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
method Combining strategic behavior of players with contagion dynamics, a method is extended to determine optimal resource allocation based on simple network metrics weighted by risk profiles.
result The asymmetry between attacker and defender valuations drives optimal attack and defense strategies, shaping system resilience.
The problem of spoofing attacks is increasingly relevant as digital systems are becoming more ubiquitous. Thus the detection of such attacks and the localisation of attackers have been objects of recent study. After an attack has been detected, various algorithms have been proposed in order to localise the attacker. In…
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
Adversarial training was introduced as a way to improve the robustness of deep learning models to adversarial attacks. This training method improves robustness against adversarial attacks, but increases the models vulnerability to privacy attacks. In this work we demonstrate how model inversion attacks, extracting trai…
New methods combat data poisoning attacks in bandit algorithms using limited verification.
problem Data poisoning attacks on bandit algorithms, especially in the UCB and ETC types.
method Verification-based mechanisms to restore optimal regret with limited verifications.
result A simple modified ETC type bandit algorithm can restore optimal regret with O(logT) verifications. New research shows that the dimension gap between intrinsic and ambient dimensions affects adversarial vulnerability of machine learning models.
problem The mystery of adversarial attacks on machine learning models.
method Introducing two types of adversarial attacks and proving their relationship to the dimension gap.
result The dimension gap between intrinsic and ambient dimensions makes clean-trained models more vulnerable to off-manifold adversarial perturbations.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Paper presents first model extraction attack against DRL models.
problem Stealing DRL models from interaction with environment.
method Imitation learning approach to recover DRL models from predicted actions.
result Successfully recovers DRL models with high fidelity and accuracy.
Cyber threat intelligence is one of the emerging areas of focus in information security. Much of the recent work has focused on rule-based methods and detection of network attacks using Intrusion Detection algorithms. In this paper we propose a framework for inspecting and modelling the behavioural aspect of an attacke…
This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
Adversarial attacks on probabilistic state-space models affect latent state and policy decisions.
problem Robust reinforcement learning under adversarial observability.
method Analyzing adversarial attacks on linear probabilistic state-space models.
result Demonstrating the influence of adversarial observations on latent state and policy decisions.