Paper bounds convergence rate of adversarial surrogate risk.
problem Vulnerability of binary classification models to adversarial attacks.
method Characterizes conditions for adversarial consistency and provides surrogate risk bounds.
result Surrogate risk bounds quantify the rate of convergence of adversarial classification risk.
Adversarial Reprogramming has demonstrated success in utilizing pre-trained neural network classifiers for alternative classification tasks without modification to the original network. An adversary in such an attack scenario trains an additive contribution to the inputs to repurpose the neural network for the new clas…
New reformulations for multiclass classification problems using optimal transport.
problem Adversarial multiclass classification problems.
method Multimarginal optimal transport formulation.
result Reveals geometric structure and extends binary classification results.
Bayesian optimisation method targets graph classification models against adversarial attacks.
problem Adversarial attacks on graph classification models, especially for graph-level tasks.
method Bayesian optimisation-based attack method for graph classification models.
result Effectiveness and flexibility of the proposed method validated on various graph classification tasks.
Classification problems in security settings are usually contemplated as confrontations in which one or more adversaries try to fool a classifier to obtain a benefit. Most approaches to such adversarial classification problems have focused on game theoretical ideas with strong underlying common knowledge assumptions, w…
Paper provides optimal statistical guarantees for adversarial robustness in Gaussian classification.
problem Understanding statistical risks for adversarial robustness in Gaussian classification models.
method Established minimax lower bounds and designed an efficient estimator for excess risk.
result Optimal minimax guarantees for excess risk under Gaussian mixture model with AdvSNR.
Study proves existence of robust classifiers in multiclass adversarial training.
problem Proves existence of robust classifiers in multiclass adversarial training.
method Three models of adversarial training in multiclass classification, proving existence of Borel measurable robust classifiers.
result Proves existence of Borel measurable robust classifiers in each model.
Previous work on adversarially robust neural networks for image classification requires large training sets and computationally expensive training procedures. On the other hand, few-shot learning methods are highly vulnerable to adversarial examples. The goal of our work is to produce networks which both perform well a…
Adversarial consistency depends on the uniqueness of adversarial Bayes classifiers.
problem Consistency of adversarial surrogate losses is not guaranteed.
method Connected consistency of adversarial surrogate losses to the uniqueness of adversarial Bayes classifiers.
result A convex surrogate loss is statistically consistent for adversarial learning if and only if the adversarial Bayes classifier is unique.
Paper analyzes adversarial training's performance in binary classification.
problem Understanding the generalization performance of adversarial training.
method Derives precise theoretical predictions for adversarial training performance.
result Provides exact asymptotics for test errors of adversarial training.
New method improves neural network interpretability against adversarial attacks.
problem Adversarial attacks can hide from neural network interpretability methods.
method Develops an interpretability-aware defensive scheme promoting robust interpretation.
result Achieves both robust classification and robust interpretation.
Study improves adversarial classification using distributionally robust models.
problem Improving robustness against adversarial attacks in classification models.
method Distributionally robust chance constraints with Wasserstein ambiguity, reformulated as a regularized ramp loss minimization problem.
result Standard descent methods can converge to the global minimizer for the distributionally robust adversarial classification model.
Paper proposes transforming ATN to attack multivariate time series models.
problem Generating adversarial samples for multivariate time series classification models.
method Proposes using a distilled model as a surrogate to mimic attacked models and applies 1-NN DTW and FCN attacks.
result Both models were susceptible to attacks on all 18 datasets.
Adversarial robustness improved by abstaining from decisions.
problem Improving classification accuracy in the presence of adversarial perturbations.
method Introducing an abstain option in binary classification problems, using metrics to quantify performance and robustness.
result There is a tradeoff between nominal performance and adversarial robustness.
Study adversarial classification with data corruption up to ε, deriving geometric flows.
problem Optimizing classifiers against adversarial data corruption.
method Variational analysis, geometric flows, mean curvature equations.
result Rigorous proof of initial value problem for small ε, global minimizer of adversarial problem.
Graphs can be fooled by small edge changes, but this work protects them.
problem Adversaries can manipulate graph data to mislead graph classification models.
method We introduce a smoothed graph classification model with a robustness guarantee.
result The smoothed model maintains consistent predictions under small adversarial perturbations.
Time series classification models have been garnering significant importance in the research community. However, not much research has been done on generating adversarial samples for these models. These adversarial samples can become a security concern. In this paper, we propose utilizing an adversarial transformation …
We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiven…
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
Adversarial training can lead to overfitting without compromising robustness.
problem Explaining benign overfitting in adversarially robust linear classification.
method Theoretical analysis and numerical experiments on adversarial training.
result Adversarially trained linear classifiers can achieve near-optimal risks despite overfitting noisy data.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
The paper sets lower bounds for adversarial robustness in multiclass classification.
problem Adversarial robustness in multiclass classification with arbitrary loss functions.
method Dual and barycentric reformulations for robust risk minimization.
result Sharp lower bounds for adversarial risks are computed efficiently.
The paper analyzes adversarial training effects on classification accuracy.
problem Understanding adversarial training's impact on standard and robust accuracy.
method Derived precise statistical analysis for binary classification problems with Gaussian data.
result Theoretical explanation of standard and robust accuracy trends for adversarial training.
Adversarial training improves robustness of halfspaces in noisy data.
problem Learning robust halfspaces in the presence of label noise.
method Adversarial training with binary cross-entropy or nonconvex sigmoidal loss.
result Adversarial training yields robust halfspaces with improved classification error.
Framework to mitigate adversarial attacks by allowing classifiers to abstain.
problem Vulnerability of classifiers to adversarial examples.
method Adversarial training with a rejection option.
result ATRO framework improves classifier reliability against adversarial attacks.
The vulnerabilities of deep neural networks against adversarial examples have become a significant concern for deploying these models in sensitive domains. Devising a definitive defense against such attacks is proven to be challenging, and the methods relying on detecting adversarial samples are only valid when the att…
More training data can hurt the generalization of adversarially robust models.
problem The challenge of balancing adversarial robustness and generalization in machine learning models.
method Investigation of three regimes based on adversary strength and empirical studies on various models.
result More training data can hurt the generalization of adversarially robust models in different regimes.
Overparameterized linear model shows strong classification but weak regression, susceptible to adversarial perturbations.
problem Adversarial vulnerability of overparameterized linear models.
method Lifted Fourier feature map, analyzing overparameterized linear ensemble.
result Spatial localization leads to adversarial vulnerability in an intermediate classification regime.
Existing deep neural networks, say for image classification, have been shown to be vulnerable to adversarial images that can cause a DNN misclassification, without any perceptible change to an image. In this work, we propose shock absorbing robust features such as binarization, e.g., rounding, and group extraction, e.g…
There is a growing body of literature showing that deep neural networks are vulnerable to adversarial input modification. Recently this work has been extended from image classification to malware classification over boolean features. In this paper we present several new methods for training restricted networks in this …
This paper explores vulnerabilities in hierarchical graph pooling neural networks for graph classification.
problem Vulnerability of hierarchical graph pooling neural networks in graph classification tasks.
method Proposes an adversarial attack framework using a surrogate model to generate adversarial samples.
result Adversarial samples can fool hierarchical GNN-based graph classification models, demonstrating their vulnerability.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
A CAE improves DNN's outlier and adversary defense.
problem Improving DNN's robustness against outliers and adversaries.
method Proposes a classification-autoencoder (CAE) that compresses samples into disjoint spaces and uses a decoder to classify and defend against adversaries.
result The CAE achieves state-of-the-art outlier recognition and near-lossless classification of adversaries.
In this paper we propose a novel method for detecting adversarial examples by training a binary classifier with both origin data and saliency data. In the case of image classification model, saliency simply explain how the model make decisions by identifying significant pixels for prediction. A model shows wrong classi…
Detects adversaries in crowdsourcing to improve accuracy.
problem Adversaries can skew results in crowdsourced classification.
method Analyzes second-order moments of annotator responses to identify and mitigate adversaries.
result The approach can identify and mitigate adversaries in crowdsourcing tasks.
Paper generates diverse, readable adversarial texts from scratch.
problem Text classification models are easily fooled by adversarial examples.
method Trained a conditional variational autoencoder (VAE) with adversarial loss and utilized GANs to generate consistent adversarial texts.
result Successfully generates adversarial texts with higher success rate and acceptable quality.
Improved DL models robust against adversarial attacks for wireless signal classification.
problem Adversarial attacks on deep learning-based wireless signal classifiers.
method Knowledge distillation and network pruning followed by adversarial training.
result Proposed models achieve better robustness and higher accuracy than standard models.
Artificial neural networks have been successfully used for many different classification tasks including malware detection and distinguishing between malicious and non-malicious programs. Although artificial neural networks perform very well on these tasks, they are also vulnerable to adversarial examples. An adversari…
We propose an approach to distinguish between correct and incorrect image classifications. Our approach can detect misclassifications which either occur unintentionally ("natural errors"), or due to intentional adversarial attacks ("adversarial errors"), both in a single unified framework. Our appr…
Paper develops a robust classifier for Gaussian mixture models under sparse adversarial perturbations.
problem Classifying data under sparse adversarial perturbations for Gaussian mixture models.
method Develops FilTrun algorithm with filtration and truncation modules.
result Characterizes optimal robust classifier and robust classification error.
Domain knowledge helps detect adversarial examples in multi-label classification.
problem Detecting adversarial examples in multi-label classification.
method Convert domain knowledge into constraints and inject them into a semi-supervised learning problem.
result Domain-knowledge constraints help detect adversarial examples effectively.
New framework for fair classification in adversarial settings with provable guarantees.
problem Fairness in classification with adversarial perturbations of protected attributes.
method Optimization framework for learning fair classifiers with provable guarantees.
result Near-tightness of accuracy and fairness guarantees for multiple protected attributes and various hypothesis classes.
Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing …
Paper improves candlestick classification model's resistance to adversarial attacks.
problem Adversarial attacks on deep learning models for candlestick classification.
method Constructs perturbed examples to enhance model robustness.
result Boosted stability of DL models for candlestick classification.
AdaBoost improves binary classification in robust one-bit compressed sensing with adversarial errors.
problem Binary classification in robust one-bit compressed sensing with adversarial errors.
method AdaBoost and max-ℓ1-margin-classifier approach, with convergence rates improved under certain feature conditions. result Improved convergence rates and explanation for harmless interpolating adversarial noise.
In this paper we propose a novel dual adversarial co-learning approach for multi-domain text classification (MDTC). The approach learns shared-private networks for feature extraction and deploys dual adversarial regularizations to align features across different domains and between labeled and unlabeled data simultaneo…
This research analyzes the consistency of convex and nonconvex surrogate losses for adversarially robust classification.
problem Ensuring classifiers are robust to adversarial perturbations.
method Analysis of convex and nonconvex surrogate losses through the lens of calibration.
result No convex surrogate loss is calibrated with respect to the adversarial 0-1 loss for linear models, but nonconvex losses can be calibrated under certain conditions.
Adversarial approach has been widely used for data generation in the last few years. However, this approach has not been extensively utilized for classifier training. In this paper, we propose an adversarial framework for classifier training that can also handle imbalanced data. Indeed, a network is trained via an adve…