Adversarial training, in which a network is trained on both adversarial and clean examples, is one of the most trusted defense methods against adversarial attacks. However, there are three major practical difficulties in implementing and deploying this method - expensive in terms of extra memory and computation costs; …
On-device research index
arXiv research
A locally-built, LLM-digested index of recent arXiv papers in quant finance, geometry/topology, and statistical ML — keyword search served straight from SQLite on this machine.
168,742 papers · 148 categories
Trend · papers per month
48 results for “Adversarial Perturbations”
We study the transfer of adversarial robustness of deep neural networks between different perturbation types. While most work on adversarial examples has focused on and -bounded perturbations, these do not capture all types of perturbations available to an adversary. The present work evaluates 32 attack…
Classifiers such as deep neural networks have been shown to be vulnerable against adversarial perturbations on problems with high-dimensional input space. While adversarial training improves the robustness of image classifiers against such adversarial perturbations, it leaves them sensitive to perturbations on a non-ne…
The paper studies the asymptotic behavior of adversarial training under -perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under -perturbation could have a positive probability mass at 0 when the true parameter is 0.
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
Deep neural networks are susceptible to adversarial manipulations in the input domain. The extent of vulnerability has been explored intensively in cases of -bounded and -minimal adversarial perturbations. However, the vulnerability of DNNs to adversarial perturbations with specific statistical properti…
Wide networks learn from adversarial perturbations effectively.
problem Understanding why adversarial examples deceive classifiers and transfer between models.
method Assumed wide two-layer networks, proved with theoretical analysis.
result Adversarial perturbations contain class-specific features for networks to generalize.
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less norm distortion compared to non-local counterparts.
BPN defends against adversarial attacks by generating beneficial perturbations.
problem Adversarial attacks cause deep neural networks to misclassify clean inputs.
method BPN generates beneficial perturbations during training to neutralize future adversarial attacks.
result BPN is robust to adversarial examples and more efficient than classical adversarial training.
DIP-FAT improves adversarial training by diversifying perturbations.
problem Adversarial examples fool deep neural networks, leading to overfitting and poor performance.
method DIP-FAT uses random directions to diversify perturbations in adversarial training.
result DIP-FAT reduces overfitting and improves clean data accuracy.
Given a state-of-the-art deep neural network text classifier, we show the existence of a universal and very small perturbation vector (in the embedding space) that causes natural text to be misclassified with high probability. Unlike images on which a single fixed-size adversarial perturbation can be found, text is of …
Paper proposes a method to generate adversarial perturbations for black-box attacks without accessing inner states.
problem Generating adversarial perturbations for black-box attacks without accessing inner states of a DNN.
method Matrix-free generation method that requires fewer query trials.
result The proposed method successfully deceives a DNN for semantic segmentation more effectively than random noise.
Adversarial fog tests autonomous navigation models.
problem Neural networks are fooled by adversarial perturbations, but fog naturally creates similar perturbations.
method Introduced a new type of adversarial perturbation using generative models and Cycle-Consistent Generative Adversarial Networks.
result Generated adversarial fog images help test autonomous navigation models.
Adversarial perturbations fool deepfake detectors with high accuracy.
problem Improving deepfake detection accuracy against adversarial attacks.
method Used adversarial perturbations and two defenses: Lipschitz regularization and Deep Image Prior (DIP).
result Deepfake detectors achieved 27% accuracy on perturbed images, compared to 95% on unperturbed.
Neural Networks have been shown to be sensitive to common perturbations such as blur, Gaussian noise, rotations, etc. They are also vulnerable to some artificial malicious corruptions called adversarial examples. The adversarial examples study has recently become very popular and it sometimes even reduces the term "adv…
CAT improves robustness of neural networks by customizing perturbation levels.
problem Poor generalization of adversarial training on clean and perturbed data.
method CAT adapts perturbation level and label for each sample.
result CAT achieves better clean and robust accuracy than previous methods.
Defenses against adversarial examples, such as adversarial training, are typically tailored to a single perturbation type (e.g., small -noise). For other perturbations, these defenses offer no guarantees and, at times, even increase the model's vulnerability. Our aim is to understand the reasons underlying…
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
AWP improves robustness by flattening weight loss landscape.
problem Improving robustness of deep neural networks against adversarial examples.
method Explicitly regularizes the flatness of weight loss landscape through adversarial weight perturbation.
result AWP forms a double-perturbation mechanism in adversarial training, leading to flatter weight loss landscape.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to aug…
This paper introduces metrics to evaluate robustness of neural networks to natural adversarial examples.
problem Measuring robustness of neural networks to natural adversarial examples.
method Proposes latent space performance metrics based on generative models.
result Latent adversarial perturbations are often perceptually small and associated with classifier accuracy.
Paper defends deep learning classifiers against channel-aware adversarial attacks.
problem Deep learning classifiers are vulnerable to adversarial attacks.
method Channel-aware adversarial attacks are presented and defended against.
result Certified defense based on randomized smoothing makes classifiers robust.
Adversarial perturbations are more effective in Y-channel of YCbCr color space.
problem Vulnerability of deep models to adversarial perturbations in images.
method Proposed ResUpNet defense that removes perturbations only from the Y-channel of YCbCr color space.
result ResUpNet achieves the best balance between defense and maintaining original image accuracy.
New method defends deep nets against large perturbations perceptible to humans.
problem Vulnerability of deep nets to adversarial attacks with perceptible but not changing predictions.
method Oracle-Aligned Adversarial Training (OA-AT) to align network predictions with Oracle's.
result Achieves state-of-the-art performance at large perturbation bounds (L-inf of 16/255 on CIFAR-10).
Neural networks are known to be vulnerable to adversarial examples, inputs that have been intentionally perturbed to remain visually similar to the source input, but cause a misclassification. It was recently shown that given a dataset and classifier, there exists so called universal adversarial perturbations, a single…
Machine learning models have been shown vulnerable to adversarial attacks launched by adversarial examples which are carefully crafted by attacker to defeat classifiers. Deep learning models cannot escape the attack either. Most of adversarial attack methods are focused on success rate or perturbations size, while we a…
This work introduces adversarial sparsity to measure robustness beyond adversarial accuracy.
problem Evaluating robustness to adversarial attacks beyond just accuracy.
method Adversarial sparsity, which quantifies the difficulty of finding perturbations.
result Sparsity provides valuable insights into neural networks and suggests improvements in robustness.
Adversarial examples are intentionally perturbed images that mislead classifiers. These images can, however, be easily detected using denoising algorithms, when high-frequency spatial perturbations are used, or can be noticed by humans, when perturbations are large. In this paper, we propose EdgeFool, an adversarial im…
Study shows current metrics for audio adversarial examples are unreliable for human perception.
problem The reliability of metrics for evaluating audio adversarial examples.
method Analytical framework and human evaluation experiment.
result Current metrics for audio adversarial examples are not reliable for human perception.
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
We present an algorithm for computing class-specific universal adversarial perturbations for deep neural networks. Such perturbations can induce misclassification in a large fraction of images of a specific class. Unlike previous methods that use iterative optimization for computing a universal perturbation, the propos…
Study on learning halfspaces under adversarial perturbations, finding computational hardness.
problem Learning halfspaces in the presence of adversarial noise.
method Introduced an efficient learning algorithm and proved a nearly matching computational hardness result.
result The perturbations case is provably computationally harder than .
New approach to adversarial robustness with non-uniform perturbations.
problem Real-world adversaries craft adversarial examples with non-uniform perturbations.
method Proposes non-uniform perturbations based on feature dependencies and data distribution.
result Shows improved robustness to real-world attacks compared to uniform perturbations.
Meta framework generates noise to improve multi-attack robustness.
problem Extraneous defense against single type of adversarial perturbation.
method Meta-learning framework with Meta Noise Generator (MNG).
result Significantly outperforms baselines across multiple perturbations.
Study robust learning without knowing perturbation sets, using interactions with attackers.
problem Learning robust predictors against unknown adversarial perturbations.
method Examined different interaction models with adversarial attackers, derived bounds on sample complexity and interactions.
result Upper bounds on sample complexity and lower bounds on interactions in various models.
Adversarial training has been shown to regularize deep neural networks in addition to increasing their robustness to adversarial examples. However, its impact on very deep state of the art networks has not been fully investigated. In this paper, we present an efficient approach to perform adversarial training by pertur…
Study on low-dimensional adversarial perturbations in classification models.
problem Understanding and quantifying the effectiveness of low-dimensional adversarial perturbations.
method Analytical lower-bounds for fooling rate, considering binary classifiers under generic regularity conditions.
result Rigorous explanation for the success of heuristic methods in generating low-dimensional adversarial perturbations.
Revisiting Adversarial Riskstat.ML
Recent works on adversarial perturbations show that there is an inherent trade-off between standard test accuracy and adversarial accuracy. Specifically, they show that no classifier can simultaneously be robust to adversarial perturbations and achieve high standard test accuracy. However, this is contrary to the stand…
Most random ReLU networks are vulnerable to small, Euclidean adversarial perturbations.
problem Vulnerability of ReLU networks to adversarial attacks.
method Analysis of random ReLU networks with decreasing dimensions, using gradient flow and descent.
result Most examples can be perturbed by small Euclidean distances via gradient methods.
New method GSAT improves robustness against structured perturbations.
problem Structured perturbations in biological data.
method Formulates GSAT as a non-convex concave minimax optimization problem and solves it with GDADMM.
result Improves robustness against group-sparse and rank-constrained perturbations.
Proposes a new video attack method that multiplies perturbation to improve model robustness.
problem Challenges existing defense methods for video recognition models against additive adversarial attacks.
method Introduces Multiplicative Adversarial Videos (MultAV) to impose perturbation by multiplication.
result Model trained against additive attacks is less robust to MultAV.
ALPS improves neural network robustness and generalization.
problem Challenges in designing effective regularization schemes for adversarial robustness.
method Adversarial Labelling of Perturbed Samples (ALPS) using synthetic samples and min-max formulation.
result ALPS achieves state-of-the-art regularization performance and adversarial robustness.
Recently, it has been shown that deep neural networks (DNN) are subject to attacks through adversarial samples. Adversarial samples are often crafted through adversarial perturbation, i.e., manipulating the original sample with minor modifications so that the DNN model labels the sample incorrectly. Given that it is al…
Adversarial attacks add perturbations to the input features with the intent of changing the classification produced by a machine learning system. Small perturbations can yield adversarial examples which are misclassified despite being virtually indistinguishable from the unperturbed input. Classifiers trained with stan…
Study on adversarial training's impact on deep neural reinforcement learning policies.
problem Vulnerability of deep neural reinforcement learning policies to imperceptible adversarial perturbations.
method Two parallel approaches: Fourier spectrum analysis and feature sensitivity measurement.
result Adversarially trained policies are more sensitive to low frequency perturbations.
Maximal adversarial perturbations for obfuscation: Hiding certain attributes while preserving restcs.LG
In this paper we investigate the usage of adversarial perturbations for the purpose of privacy from human perception and model (machine) based detection. We employ adversarial perturbations for obfuscating certain variables in raw data while preserving the rest. Current adversarial perturbation methods are used for dat…