Adversaries reprogram text classification models without changing the original network.
problem Reprogramming neural networks trained on discrete input spaces like text classification.
method Context-based vocabulary remapping model for white-box and black-box settings.
result Successfully repurposed various text-classification models for new tasks.
Reprogram deep models to resist adversarial attacks without changing parameters.
problem Improving deep learning models' robustness against adversarial and noisy inputs.
method Proposes a non-linear robust pattern matching technique and three reprogramming paradigms.
result Demonstrates effective reprogramming of deep models for robustness without altering parameters.
New attacks reprogram neural networks to perform new tasks.
problem Neural networks are vulnerable to adversarial attacks that can cause mistakes or specific outputs.
method Develops attacks that reprogram models to perform tasks chosen by the attacker, without specifying outputs.
result Demonstrates reprogramming on six models, including counting and classification tasks.
BAR reprograms black-box ML models for transfer learning with scarce data.
problem Transfer learning with limited data and resources.
method Zeroth-order optimization and multi-label mapping techniques to reprogram black-box models.
result BAR outperforms state-of-the-art methods and baseline transfer learning approaches.
Paper proposes HRS to improve neural network robustness without significant accuracy loss.
problem Vulnerability of neural networks to adversarial attacks and performance degradation.
method Hierarchical Random Switching (HRS) for robustness without sacrificing accuracy.
result HRS significantly improves adversarial robustness with minimal accuracy loss.
VSML unifies meta learning concepts and enables simple backpropagation.
problem Improving and unifying meta learning concepts for neural networks.
method Unified approach using variable shared meta learning and simple weight-sharing.
result Simple backpropagation can be implemented and meta learned without gradient calculation.
Proposes a new adversarial model to avoid accuracy vs. adversarial accuracy tradeoff.
problem Inherent tradeoff between accuracy and adversarial accuracy in existing adversarial robustness definitions.
method Introduces Voronoi-epsilon adversary that balances perturbation constraints.
result Voronoi-epsilon adversary avoids accuracy vs. adversarial accuracy tradeoff even with large ε. Adversarial consistency depends on the uniqueness of adversarial Bayes classifiers.
problem Consistency of adversarial surrogate losses is not guaranteed.
method Connected consistency of adversarial surrogate losses to the uniqueness of adversarial Bayes classifiers.
result A convex surrogate loss is statistically consistent for adversarial learning if and only if the adversarial Bayes classifier is unique.
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
New approach improves adversarial robustness without sacrificing natural generalization.
problem Balancing adversarial robustness and natural generalization in machine learning.
method Friendly adversarial training (FAT) using early-stopped PGD to find least adversarial data.
result Early-stopped PGD achieves adversarial robustness without compromising natural generalization.
Improves adversarial training generalization with domain adaptation.
problem Weak generalization of adversarial training due to lack of representative adversarial samples.
method Adversarial Training with Domain Adaptation (ATDA) method.
result ATDA greatly improves adversarial training generalization and model smoothness.
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
Simple regularization methods mimic adversarial training's robustness.
problem Expensive adversarial training for robustness.
method Label smoothing and logit squeezing.
result Achieves strong adversarial robustness without adversarial examples.
Optimal control theory applied to machine learning adversarial attacks.
problem Adversarial machine learning threats and detection challenges.
method Optimal control theory applied to machine learning systems.
result Advances in control theory and reinforcement learning can enhance adversarial machine learning research.
Paper analyzes adversarial risk using optimal transport.
problem Poor performance of machine learning on adversarial data.
method Optimal transport perspective, optimal transport plans (couplings), convexity, smoothness assumptions.
result Fundamental limits on adversarial risk calculated for various datasets.
Aims to make neural networks robust to small, imperceptible perturbations.
problem Neural networks can be fooled by small, imperceptible changes.
method Proposes a Generative Adversarial Networks (GAN) framework to learn robust classifiers.
result Our method outperforms adversarial training in robustness.
New method makes neural networks more secure by protecting latent layers from adversarial attacks.
problem Vulnerability of latent layers in adversarially trained models to small perturbations.
method Latent Adversarial Training (LAT) and Latent Attack (LA) algorithms.
result Improves adversarial accuracy by 1-2% on MNIST, CIFAR-10, CIFAR-100 datasets.
Paper bounds convergence rate of adversarial surrogate risk.
problem Vulnerability of binary classification models to adversarial attacks.
method Characterizes conditions for adversarial consistency and provides surrogate risk bounds.
result Surrogate risk bounds quantify the rate of convergence of adversarial classification risk.
Study on robustness in linear regression models, focusing on adversarial perturbations.
problem Understanding and improving robustness in linear regression models to adversarial perturbations.
method Developed a two-stage adversarial learning framework that incorporates model structure information.
result Proved the consistency and developed the Bahadur representation of the adversarially robust estimator.
Free adversarial training improves robustness without generating adversarial examples.
problem Training robust models against adversarial attacks is costly and impractical for large-scale datasets.
method Recycles gradient information from parameter updates to generate adversarial examples.
result Free adversarial training achieves comparable robustness to PGD training at negligible cost.
Localized adversarial training improves image classifiers' robustness.
problem State-of-the-art image classifiers fail on carefully manipulated adversarial images.
method Developed a localized adversarial attack and used it to train a robust classifier.
result Localized adversarial training increases robustness against adversarial inputs.
Adversarial training improves gradient interpretability, reducing misinterpretations.
problem Improving gradient interpretability in adversarially trained deep networks.
method Identified and demonstrated that adversarial training restricts gradients closer to the image manifold, making them more interpretable.
result Adversarial training leads to more meaningful loss gradients, aligning better with human perception.
Paper tackles adversarial attacks on A3C path finding, proposing Gradient Band-based Adversarial Training.
problem Adversarial attacks on A3C path finding.
method Gradient Band-based Adversarial Training with CDG method.
result Gradient Band-based Adversarial Training achieves high attack immunity.
A two-step defense method generates strong adversarial examples at low cost.
problem Vulnerability of deep neural networks to adversarial attacks.
method Develops a two-step defense approach that generates strong adversarial examples using FGSM at a lower computational cost compared to traditional multi-step adversarial training.
result Demonstrates effectiveness of the two-step defense approach against various attack methods with comparable robustness to traditional multi-step adversarial training.
New method improves model robustness against adversarial attacks.
problem Models trained with adversarial samples can be vulnerable to simple attacks.
method Graybox Adversarial Training using intermediate models to seed adversaries.
result Models trained with Graybox Adversarial Training are more robust to simple attacks.
A Bayesian framework models adversarial uncertainty for robust machine learning.
problem Vulnerability of machine learning models to adversarial attacks.
method Formal Bayesian framework that models adversarial uncertainty through a stochastic channel, articulating probabilistic assumptions.
result Explicitly modeling adversarial uncertainty leads to improved robustification strategies.
Study evaluates adversarial attacks on speech emotion recognition systems.
problem Adversarial examples challenge the robustness of speech emotion recognition systems.
method Proposes adversarial training and GAN as defenses.
result Demonstrates effective use of adversarial examples for robustness.
Generative Adversarial Privacy (GAP) learns privacy mechanisms from data.
problem Learning optimal privacy mechanisms from data.
method Formulates privacy as a constrained minimax game between privatizer and adversary.
result GAP provides privacy guarantees against strong adversaries.
Adversarial training improves audio classifier robustness.
problem Improving robustness of audio classifiers against adversarial attacks.
method Adversarial training of deep neural networks on audio data.
result Adversarially trained models can resist higher perturbations and fooling rates.
Paper tackles robustness in adversarial noise with a meta-optimizer.
problem Sensitivity to adversarial noise hinders machine learning deployment.
method Meta-optimizer learns to robustly optimize models using adversarial examples.
result Meta-optimizer transfers adversarial knowledge to new models without generating new examples.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
Survey of adversarial examples in visual machine learning models.
problem Vulnerability of machine learning models to adversarial examples.
method Exploration of various adversarial attack and defense methods.
result Understanding of adversarial attack and defense mechanisms.
Robust RL with learned optimal adversary improves agent performance under adversarial state observations.
problem Ensuring reinforcement learning agents' robustness against adversarial perturbations of state observations.
method Proposed a framework of alternating training with learned adversaries (ATLA) to find optimal adversarial policies and enhance agent robustness.
result ATLA achieves state-of-the-art performance under strong adversaries in continuous control environments.
Interpolated adversarial training improves robustness without sacrificing accuracy.
problem Improving adversarial robustness without degrading generalization performance.
method Interpolated adversarial training using interpolation-based methods.
result Retains adversarial robustness while achieving a standard test error of 6.45%.
Enhances single-step adversarial training to defend against iterative adversarial examples.
problem Defending against iterative adversarial examples in neural networks.
method Identified and leveraged empirical properties of Iter-Adv to improve Single-Adv.
result Enhanced Single-Adv to defend against iterative adversarial examples with improved accuracy and reduced training cost.
Rob-GAN combines generator, discriminator, and adversarial attack for improved robustness and quality.
problem Improving robustness and quality of GAN-generated images under adversarial attacks.
method Rob-GAN framework that jointly optimizes generator and discriminator in the presence of adversarial attacks.
result Rob-GAN improves convergence speed, image quality, and robustness of discriminators under strong adversarial attacks.
The paper studies the asymptotic behavior of adversarial training under ℓ∞-perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under ℓ∞-perturbation could have a positive probability mass at 0 when the true parameter is 0. Detects adversarial examples using SHAP values from neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Uses SHAP values from internal layers to distinguish normal from adversarial inputs.
result Demonstrates high detection accuracy and strong generalization to various attack methods.
Develops robust few-shot learning models resistant to adversarial attacks.
problem Adversarial vulnerability in few-shot learning models.
method Adversarial Querying (AQ) algorithm for robust meta-learners.
result Achieves superior robust performance on few-shot image classification tasks.
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
Paper proposes a new black-box adversarial attack using normalizing flows.
problem Adversarial vulnerability of deep neural networks.
method Proposes a novel black-box adversarial attack using normalizing flows.
result Demonstrates competitive performance against well-known black-box adversarial attack methods.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
This paper improves adversarial robustness of deep learning models.
problem Vulnerability of machine learning models to adversarial perturbations.
method Analyzes adversarial training for linear regression and neural networks, incorporating L1 penalty.
result Incorporating L1 penalty leads to consistent adversarially robust estimation in high-dimensional settings.
Framework to mitigate adversarial attacks by allowing classifiers to abstain.
problem Vulnerability of classifiers to adversarial examples.
method Adversarial training with a rejection option.
result ATRO framework improves classifier reliability against adversarial attacks.
A new method reduces adversarial training time without overfitting.
problem Catastrophic overfitting in single-step adversarial training.
method FGSMPR: FGSM with PGD Regularization.
result Reduces the gap to multi-step adversarial training.
New method improves DNN robustness against adversarial attacks.
problem Adversarial vulnerability of neural networks.
method Enforcing linearity in DNN in transformed input and feature space, and augmenting with Local Lipschitz regularizer.
result Significantly improved robustness of DNN models on various datasets.