Decomposes adversarial examples into three components.
problem Vulnerability of deep neural networks to adversarial perturbations.
method Adversarial examples are decomposed into architecture, dataset, and noise-dependent components.
result Components behave intuitively and can be recombined to improve transferability.
CASS separates mixed signals using autoencoders and adversarial learning.
problem Separating mixed signals into individual components.
method Cross adversarial source separation via autoencoder framework.
result State-of-the-art performance in separating components with similar data structures.
New model for display advertising with stochastic and adversarial components.
problem Display advertising with stochastic and adversarial click-through-rates.
method Adversarial scaling model; two algorithms tested: action elimination and mirror descent.
result Two algorithms are robust to adversarial scaling.
This work reveals the relationship between DNN generalization and adversarial behavior.
problem Understanding the relationship between DNN generalization and adversarial behavior.
method Introducing a metric to disentangle non-robust and robust components in DNN performance.
result Current DNNs rely heavily on the non-robust component for decent performance.
New metric detects adversarial samples with high accuracy.
problem Vulnerability of deep neural networks to adversarial samples.
method Analyzed adversarial samples through their contributions to principal components of images.
result Proposed new metric (k,p) point for measuring robustness to adversarial samples.
Proposes BATer for improved adversarial example detection.
problem Detecting adversarial examples in neural networks.
method Introduces a Bayesian adversarial example detector (BATer) using random components in a Bayesian neural network.
result BATer outperforms state-of-the-art detectors in adversarial example detection.
SPGD improves adversarial training efficiency and accuracy.
problem Improving adversarial training efficiency and accuracy with fewer steps.
method Adversarial-sample generation from a frequency domain perspective, extending PGD to the frequency domain.
result SPGD achieves greater adversarial accuracy compared to PGD with fewer attack steps.
Post-averaging improves neural network robustness against adversarial attacks.
problem Adversarial attacks on neural networks.
method Post-averaging technique to smooth high frequency components.
result Post-averaging method successfully defends over 95% of adversarial samples without significant performance degradation.
We introduce a Noise-based prior Learning (NoL) approach for training neural networks that are intrinsically robust to adversarial attacks. We find that the implicit generative modeling of random noise with the same loss function used during posterior maximization, improves a model's understanding of the data manifold …
This work analyzes how frequency components affect CNN predictions and robustness.
problem Lack of frequency-based explanation for CNNs leading to vulnerabilities.
method Frequency component analysis and quantification of their contribution to CNN predictions.
result Adversarial attacks exploit high-frequency features, while robustness comes from low-frequency associations.
We propose a framework for training GANs on composed data, improving model modularity and interpretability.
problem Training GANs on complex, composed data.
method Composition/decomposition framework for adversarially training GANs on composed data.
result Improves modularity, extensibility, and interpretability of GANs.
Half-AVAE enhances VAE for underdetermined ICA with adversarial training.
problem Challenges in ICA under underdetermined conditions.
method Encoder-free VAE with adversarial networks and EE terms.
result Half-AVAE outperforms baseline models in underdetermined ICA.
Improves deep learning robustness by enforcing local and global compactness.
problem Deep neural networks' vulnerability to adversarial attacks.
method Proposes Adversary Divergence Reduction Network (ADRN) that enforces local/global compactness and clustering assumption.
result Augmenting adversarial training with ADRN components improves robustness.
Study on deep learning IDS resistance against adversarial attacks.
problem Vulnerabilities in deep learning-based IDS against adversarial attacks.
method Apply min-max optimization to train IDS against adversarial samples.
result Adversarial attack methods can be used in continuous domains and boost IDS robustness.
Recent advances in Representation Learning and Adversarial Training seem to succeed in removing unwanted features from the learned representation. We show that demographic information of authors is encoded in -- and can be recovered from -- the intermediate representations learned by text-based neural classifiers. The …
Study robust estimation of principal components under adversarial perturbations.
problem Estimating principal components in high-dimensional data under adversarial perturbations.
method Design of a computationally efficient algorithm for recovering the top-r principal subspace.
result The algorithm recovers an estimate of the top-r principal subspace with error depending on the robustness parameter κ.
We propose a novel method for imputing missing data by adapting the well-known Generative Adversarial Nets (GAN) framework. Accordingly, we call our method Generative Adversarial Imputation Nets (GAIN). The generator (G) observes some components of a real data vector, imputes the missing components conditioned on what …
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
The paper detects adversarial examples in LECs for regression in CPS using variational autoencoder.
problem Detecting adversarial examples in learning-enabled cyber-physical systems (CPS).
method Inductive conformal prediction using a variational autoencoder regression model.
result The method effectively detects adversarial examples with a short delay in an emergency braking system simulation.
AugmentedPCA improves PCA with supervised or adversarial objectives.
problem Lack of reproducible linear analogs for deep latent factor models.
method Augments PCA with supervised or adversarial objectives.
result Improves downstream classification performance and identifies cancer-related genes.
Low frequency perturbations improve model robustness, contrary to high frequency attacks.
problem Improving model robustness against adversarial attacks.
method Systematic control of frequency components in perturbations.
result Low frequency perturbations improve model robustness, especially in white-box and black-box settings.
AdaGCN transfers labels across networks via adversarial domain adaptation and graph convolution.
problem Cross-network node classification with limited labeled data.
method Adversarial domain adaptation and graph convolution.
result AdaGCN successfully transfers labels with low labeled data on source networks and significant domain divergence.
A new framework detects anomalous inputs to DNNs.
problem Detecting adversarial and out-of-distribution inputs in DNNs.
method Unsupervised meta-algorithm with configurable components based on statistical testing.
result The proposed method effectively detects adversarial and OOD inputs.
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
PPD defends deep learning models against adversarial attacks using image permutations and Fourier phases.
problem Adversarial examples can mislead deep learning models.
method Combines random image permutation with Fourier phase components.
result Demonstrated state-of-the-art robustness against adversarial attacks.
Paper proposes a method to test and verify control systems with machine learning components.
problem Testing and verifying control systems with machine learning components is challenging.
method Gradient-based method combined with randomized search to find adversarial samples.
result Method outperforms Simulated Annealing optimization in finding adversarial samples.
Decentralized learning reduces regret by sharing model updates, especially with stochastic components.
problem Achieve better online problem solving without sharing private data.
method Characterize loss functions as adversarial and stochastic components, analyze DOG algorithm's regret bound.
result Decentralized online gradient (DOG) achieves a new regret bound with communication, benefiting from private data randomness.
Adaptive PCA algorithms for changing environments.
problem Static adversarial regret is not suitable for changing environments.
method Online adaptive algorithms for PCA and variance minimization with sub-linear adaptive regret guarantees.
result The proposed algorithms adapt to changing environments.
Improved acoustic modeling with attentive adversarial learning.
problem Domain variability in acoustic modeling.
method Proposes an attentive ADIT method with an attention mechanism to improve domain-invariance of deep features.
result Improves deep feature domain-invariance and senone-discriminativity over ADIT.
LSDAT reduces query efficiency for decision-based adversarial attacks.
problem Improving query efficiency for decision-based adversarial attacks.
method Low-rank and sparse decomposition (LSD) to craft perturbations.
result LSDAT achieves superior fooling rates with fewer queries.
Generative models with an encoding component such as autoencoders currently receive great interest. However, training of autoencoders is typically complicated by the need to train a separate encoder and decoder model that have to be enforced to be reciprocal to each other. To overcome this problem, by-design reversible…
A structured approach to generating adversarial attacks for ML systems.
problem Vulnerability of ML systems to adversarial perturbations.
method Developed an 'attack generator' to systematically create adversarial attacks.
result Summarized and extended existing adversarial perturbation taxonomies.
MMD test detects adversarial attacks by addressing kernel limitations and non-independence issues.
problem MMD test's failure to detect adversarial attacks.
method Replaced Gaussian kernel with deep kernel, maximized test power, and used wild bootstrap for non-independence.
result MMD test is aware of adversarial attacks.
We present a new autoencoder-type architecture that is trainable in an unsupervised mode, sustains both generation and inference, and has the quality of conditional and unconditional samples boosted by adversarial learning. Unlike previous hybrids of autoencoders and adversarial networks, the adversarial game in our ap…
Susceptibility of deep neural networks to adversarial attacks poses a major theoretical and practical challenge. All efforts to harden classifiers against such attacks have seen limited success. Two distinct categories of samples to which deep networks are vulnerable, "adversarial samples" and "fooling samples", have b…
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
Interpolating label noise makes models vulnerable to adversarial attacks.
problem Adversarial vulnerability of models trained on noisy labels.
method Theoretical analysis of label noise and adversarial risk relationship.
result Uniform label noise induces adversarial risk similar to worst-case poisoning.
SEAL improves AL on attributed graphs by combining deep learning and adversarial strategies.
problem Efficient AL on attributed graphs with label sparsity issues.
method SEAL framework using adversarial components for graph embedding and semi-supervised discriminator.
result Superior performance improvements over state-of-the-art baselines.
This work introduces a new threat model for adversarial attacks using perceptual metrics.
problem Insufficient threat models for capturing imperceivable adversarial examples.
method Leverage quantitative perceptual metrics (LPIPS, SSIM) to define a novel threat model.
result Combined attacks retain perceptual distortion but induce higher misclassification rates.
This paper introduces a new method to deceive causal structure learning by omitting data.
problem Deceiving causal structure learning algorithms with incompletely observed data.
method Adversarial missingness attack to bias the learned causal structures.
result Theoretical and practical attack mechanisms are developed for various SCMs.
Gradient-based explanations correlate with Android malware classifier robustness.
problem Evasion attacks on Android malware classifiers using sparse perturbations.
method Investigated gradient-based attribution methods for explaining classifier decisions and their evenness, proposing metrics to assess adversarial robustness.
result Gradient-based explanations, especially Integrated Gradients, correlate with adversarial robustness of malware classifiers.
Study reveals how neural network biases align with adversarial attack frequencies.
problem Correlation between neural network biases and adversarial attacks.
method Fourier transform analysis of network implicit bias and adversarial perturbations.
result Network bias and adversarial attack frequencies are highly correlated.
COLEP improves robustness of conformal prediction via probabilistic circuits.
problem Adversarial perturbations can undermine the coverage guarantees of conformal prediction.
method COLEP uses probabilistic circuits to learn and reason about different semantic concepts, providing certifiable coverage guarantees.
result COLEP achieves higher prediction coverage and accuracy than a single model, especially with non-trivial knowledge models.
Paper defends machine learning models from adversarial attacks using GLRT.
problem Adversarial attacks on machine learning models leading to misclassification.
method Generalized likelihood ratio test (GLRT) for robust classification.
result GLRT yields performance competitive with minimax approach under worst-case attacks, and better trade-off under weaker attacks.
Paper defends iris recognition from adversarial examples using wavelet decomposition.
problem Adversarial examples threaten deep neural networks in biometric applications.
method Wavelet domain denoising of input examples to detect and mitigate adversarial attacks.
result Proposed defense strategies improve recognition accuracy against adversarial attacks.
A new model combines VAE and GAN for better anomaly detection in imbalanced datasets.
problem Anomaly detection in imbalanced datasets, especially in medical applications.
method β-VAEGAN model combining VAE and GAN, kernelized SVM for anomaly scores, and deviation from Gaussian prior.
result Improved F1 score from 0.85 to 0.92 on MITBIH Arrhythmia Database. New controller reduces regret in non-stochastic control with adversarial perturbations.
problem Non-stochastic control with adversarial perturbations and partially observed states.
method Denoised observations and online gradient descent.
result Sublinear regret bounds, optimal for known and unknown systems.
QGAA learns latent quantum states, reducing errors in quantum data generation.
problem Learning latent representations for quantum data generation.
method Quantum Generative Adversarial Autoencoder (QGAA) combining QAE and QGAN.
result Average errors in energies for H2 and LiH are 0.02 Ha and 0.06 Ha respectively, demonstrating QGAA's potential.