BN helps learn fragile features, which can improve adversarial robustness.
problem The role of batch normalization in adversarial training and its impact on robustness.
method Investigated the expressiveness of BN in learning robust features compared to random features.
result Adversarially fine-tuning BN layers can result in non-trivial adversarial robustness.
Paper analyzes if GANs with adversarial features outperform standard supervised learning.
problem Whether adversarial features improve performance over standard supervised learning.
method Theoretical analysis and empirical risk comparison.
result Supervised learning with adversarial features can outperform sole supervision under certain conditions.
We provide a methodology, resilient feature engineering, for creating adversarially resilient classifiers. According to existing work, adversarial attacks identify weakly correlated or non-predictive features learned by the classifier during training and design the adversarial noise to utilize these features. Therefore…
Defense against adversarial attacks by manipulating feature thickness.
problem Vulnerability of machine learning models to adversarial attacks.
method Feature Manipulation (FM)-Defense using a combo-variational autoencoder.
result Detection and purification of adversarial examples with high accuracy.
AFD learns features resistant to adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method AFD learns features invariant to adversarial perturbations through a game of predictive and robust features.
result AFD effectively resists a wide range of attack types and strengths.
New adversarial attack method based on deep feature distributions.
problem Adversarial attacks on CNN classifiers using output layer information.
method Modeling and exploiting class-wise and layer-wise deep feature distributions.
result Achieves state-of-the-art transfer-based attack results for undefended ImageNet models.
RTFE provides adversarial robustness to multiple models.
problem Adversarial examples can transfer to other models, compromising robustness.
method Proposes RTFE, a deep learning-based pre-processing mechanism.
result RTFE provides adversarial robustness to multiple independently trained classifiers.
Detects out-of-distribution and adversarial samples using deep feature distributions.
problem Detecting out-of-distribution and adversarial samples in deep neural networks.
method Modeling deep features with parametric probability distributions and calculating likelihoods at inference.
result Improves detection of out-of-distribution and adversarial samples, up to 12 percentage points in AUPR and AUROC metrics.
Given the apparent difficulty of learning models that are robust to adversarial perturbations, we propose tackling the simpler problem of developing adversarially robust features. Specifically, given a dataset and metric of interest, the goal is to return a function (or multiple functions) that 1) is robust to adversar…
A new method transfers adversarial robustness from teacher to student using feature distillation.
problem Adversarial robustness transfer across different models and tasks.
method Guided Adversarial Contrastive Distillation (GACD) with contrastive learning and sample reweighted estimation.
result GACD effectively transfers adversarial robustness from teacher to student, achieving comparable or better results.
In recent years, it has been found that neural networks can be easily fooled by adversarial examples, which is a potential safety hazard in some safety-critical applications. Many researchers have proposed various method to make neural networks more robust to white-box adversarial attacks, but an effective method have …
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
Dual adversarial co-learning improves multi-domain text classification.
problem Improving text classification across multiple domains.
method Dual adversarial co-learning with shared-private networks and dual adversarial regularizations.
result Achieves state-of-the-art performance on multi-domain sentiment classification datasets.
Overparameterized linear model shows strong classification but weak regression, susceptible to adversarial perturbations.
problem Adversarial vulnerability of overparameterized linear models.
method Lifted Fourier feature map, analyzing overparameterized linear ensemble.
result Spatial localization leads to adversarial vulnerability in an intermediate classification regime.
Deep neural networks have been demonstrated to be vulnerable to adversarial attacks, where small perturbations intentionally added to the original inputs can fool the classifier. In this paper, we propose a defense method, Featurized Bidirectional Generative Adversarial Networks (FBGAN), to extract the semantic feature…
New model improves classifier security against evasion attacks by selecting features.
problem Security of machine learning classifiers against evasion attacks.
method Adversary-aware feature selection model incorporating specific adversary assumptions.
result Classifier security worsens with feature selection, but new model improves it.
We propose a novel adversarial training method in feature space that improves model robustness and computational efficiency.
problem Improving model robustness against adversarial input perturbations with computational efficiency.
method Shift from input to feature-space perturbations, reformulating the adversarial training problem in reproducing kernel Hilbert spaces, enabling exact solution of inner maximization and efficient optimization.
result The feature-perturbed formulation is a relaxation of the original problem and provides a regularized estimator that adapts to noise and function smoothness.
Despite the remarkable performance of deep neural networks on various computer vision tasks, they are known to be susceptible to adversarial perturbations, which makes it challenging to deploy them in real-world safety-critical applications. In this paper, we conjecture that the leading cause of adversarial vulnerabili…
The paper examines how to protect LASSO-based feature selection from adversarial attacks.
problem Adversarial attacks on LASSO-based feature selection.
method Formulated as a bi-level optimization problem, reformulated LASSO with linear inequality constraints, solved using interior-point method, and modified using projected gradient descent.
result Demonstrated the effectiveness of the proposed method in protecting LASSO-based feature selection from adversarial attacks.
New approach to adversarial robustness with non-uniform perturbations.
problem Real-world adversaries craft adversarial examples with non-uniform perturbations.
method Proposes non-uniform perturbations based on feature dependencies and data distribution.
result Shows improved robustness to real-world attacks compared to uniform perturbations.
Deep neural networks obtain state-of-the-art performance on a series of tasks. However, they are easily fooled by adding a small adversarial perturbation to input. The perturbation is often human imperceptible on image data. We observe a significant difference in feature attributions of adversarially crafted examples f…
This research examines how data transformations affect adversarial robustness in recurrent neural networks.
problem Adversarial examples reduce machine learning accuracy, especially in high-dimensional datasets.
method Analysis of feature selection, dimensionality reduction, and trend extraction techniques on recurrent neural networks.
result Data transformations may increase vulnerability to adversarial samples, but only if they approximate intrinsic dimensionality and maintain manifold coverage.
VPFD uses vocoder features for adversarial training in VC.
problem Adversarial training on waveform data is time-consuming and memory-intensive.
method VPFD employs vocoder features for adversarial training.
result VPFD achieves VC performance comparable to waveform discriminators with reduced training time and memory.
Adversarial training has been successfully applied to build robust models at a certain cost. While the robustness of a model increases, the standard classification accuracy declines. This phenomenon is suggested to be an inherent trade-off. We propose a model that employs feature prioritization by a nonlinear attention…
Feature Squeezing is a recently proposed defense method which reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. It has been shown that feature squeezing defenses can be combined in a joint detection fram…
This work studies adversarial training in high dimensions, revealing key feature trade-offs.
problem Understanding adversarial robustness in high-dimensional settings.
method Introduces a tractable model to study the geometry of data and adversarial attacks.
result Characterizes directions in data associated with robustness vs. usefulness trade-offs.
RNNs are vulnerable to adversarial attacks, especially in network traffic.
problem Adversarial attacks on RNNs for IDSs in network traffic.
method Developed new explainability techniques and ARS for comparing IDSs.
result RNNs are vulnerable to adversarial attacks, even in sequential data.
Existing deep neural networks, say for image classification, have been shown to be vulnerable to adversarial images that can cause a DNN misclassification, without any perceptible change to an image. In this work, we propose shock absorbing robust features such as binarization, e.g., rounding, and group extraction, e.g…
AAT separates robust and non-robust features without supervision.
problem Adversarial vulnerability and accuracy reduction in machine learning models.
method Adversarial Asymmetric Training (AAT) algorithm.
result Preserves accuracy and achieves better disentanglement than previous methods.
Local convolutions bias neural networks towards high-frequency adversarial examples.
problem High-frequency adversarial examples in neural networks.
method Analysis of different linear and nonlinear architectures, focusing on the impact of local convolution operations.
result Local convolutions induce an implicit bias towards high frequency features, leading to high-frequency adversarial examples.
Although deep neural networks have shown promising performances on various tasks, even achieving human-level performance on some, they are shown to be susceptible to incorrect predictions even with imperceptibly small perturbations to an input. There exists a large number of previous works which proposed to defend agai…
Theoretical study shows adversarial training improves robustness in deep learning models.
problem Ensuring robustness in pre-trained deep learning models.
method Theoretical analysis of adversarial training and feature purification in two-layer neural networks.
result Adversarial training leads to feature purification, making models more robust to attacks.
Paper presents a statistical method for detecting adversarial inputs.
problem Adversarial attacks on deep learning models.
method Statistical approach based on per-class feature distribution comparison.
result Approach achieves good adversarial detection performance on MNIST and CIFAR-10 datasets.
Proposes a framework for extracting consistent physiological features across users.
problem Variability of biosignals across different users and tasks.
method Adversarial feature extractor for disentangled universal representations.
result Up to 8.8% improvement in average accuracy of classification.
Study on adversarial training's impact on deep neural reinforcement learning policies.
problem Vulnerability of deep neural reinforcement learning policies to imperceptible adversarial perturbations.
method Two parallel approaches: Fourier spectrum analysis and feature sensitivity measurement.
result Adversarially trained policies are more sensitive to low frequency perturbations.
Wide networks learn from adversarial perturbations effectively.
problem Understanding why adversarial examples deceive classifiers and transfer between models.
method Assumed wide two-layer networks, proved with theoretical analysis.
result Adversarial perturbations contain class-specific features for networks to generalize.
PatchGuard defends against localized adversarial patches with provable robustness.
problem Localized adversarial patches induce misclassification in machine learning models.
method PatchGuard uses CNNs with small receptive fields and robust masking to detect and mask corrupted features.
result PatchGuard achieves state-of-the-art provable robust accuracy and clean accuracy.
Machine learning has become one of the main components for task automation in many application domains. Despite the advancements and impressive achievements of machine learning, it has been shown that learning algorithms can be compromised by attackers both at training and test time. Machine learning systems are especi…
DADI framework dynamically discovers fair information using reinforcement learning.
problem Discovering fair information from third-party features with unknown objectives.
method Adversarial reinforcement learning agent that balances accuracy and fairness.
result Achieves group fairness by rewarding the agent with the adversary's loss.
Attribution methods have been developed to explain the decision of a machine learning model on a given input. We use the Integrated Gradient method for finding attributions to define the causal neighborhood of an input by incrementally masking high attribution features. We study the robustness of machine learning model…
Adversarial examples have attracted significant attention in machine learning, but the reasons for their existence and pervasiveness remain unclear. We demonstrate that adversarial examples can be directly attributed to the presence of non-robust features: features derived from patterns in the data distribution that ar…
HRFA generates high-resolution, realistic adversarial examples for DNNs.
problem Revealing vulnerabilities of DNNs with imperceptible, semantic attacks.
method Modifies latent feature representation, backpropagating through generative model.
result Generates adversarial examples with up to 1024x1024 resolution, evading denoising defenses.
This work uses adversarial learning to detect and correct feature shifts in various datasets.
problem Detecting and correcting feature shifts in real-world datasets.
method Adversarial learning applied to multiple discriminators to detect and correct feature shifts.
result Mainstream classifiers can effectively localize and correct feature shifts, outperforming existing techniques.
Adversarial robustness in multi-index models is as easy as standard learning.
problem Adversarial robustness in high-dimensional multi-index models.
method Proves that hidden directions of multi-index models offer a Bayes optimal low-dimensional projection for robustness against ℓ2-bounded adversarial perturbations. result Adversarially robust learning is as easy as standard learning, requiring no additional samples.
We present heuristics for solving the maximin problem induced by the generative adversarial privacy setting for linear and convolutional neural network (CNN) adversaries. In the linear adversary setting, we present a greedy algorithm for approximating the optimal solution for the privatizer, which performs better as th…
Though Convolutional Neural Networks (CNNs) have surpassed human-level performance on tasks such as object classification and face verification, they can easily be fooled by adversarial attacks. These attacks add a small perturbation to the input image that causes the network to misclassify the sample. In this paper, w…
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
TRAIL improves robot imitation learning by focusing on task-relevant features.
problem Discriminator networks learn spurious associations, providing poor reward signals.
method Constrained discriminator optimization to learn task-relevant rewards.
result TRAIL outperforms GAIL and behaviour cloning in robotic manipulation tasks.