Study shows mimicry attacks fail even with ASV-assisted target selection.
problem Can mimicry attacks be successful with ASV-assisted target selection?
method Used ASV to select target speakers for mimicry attacks and tested with x-vector system.
result Mimics did not succeed in spoofing the x-vector system, but relative ordering of targets was consistent.
Study reveals mutual reinforcement between adversarial inputs and poisoned models.
problem Understanding and mitigating vulnerabilities of deep learning models.
method Developed a new attack model to jointly optimize adversarial inputs and poisoned models.
result Mutual reinforcement effects between adversarial inputs and poisoned models significantly amplify each other's effectiveness.
We study offline data poisoning attacks in contextual bandits, a class of reinforcement learning problems with important applications in online recommendation and adaptive medical treatment, among others. We provide a general attack framework based on convex optimization and show that by slightly manipulating rewards i…
Paper addresses robust sparse vector mean estimation under local differential privacy.
problem Challenges in defending poisoning attacks on multi-item users in LDP protocols.
method Randomized Projection with Clipping (RPC) to handle clipping bias and enhance robustness.
result Proposes a method that achieves comparable or better performance than existing methods under trusted environments and significantly enhances robustness under untrusted environments.
LVQ models robustness evaluated against adversarial attacks.
problem Robustness of LVQ models against adversarial attacks.
method Evaluation of three LVQ models: Generalized LVQ, Generalized Matrix LVQ, and Generalized Tangent LVQ.
result Generalized LVQ and Generalized Tangent LVQ are robust, while Generalized Matrix LVQ is not.
This paper examines MEV attacks in dynamic AMMs and proposes new protections.
problem Dynamic AMMs introduce new MEV attack vectors due to inter-block weight changes.
method Analyzed inter-block weight changes as analogous to trades, conducted simulations.
result New inter-block protections are required to guard against multi-block MEV attacks.
Paper tackles adversarial attacks on ANN state estimation in smart grids.
problem Adversarial attacks degrade ANN state estimation accuracy without detection.
method Proposes population-based and gradient-based algorithms to generate attack vectors.
result DE algorithm is more effective than SLSQP in generating attack vectors.
This research secures deployed sentiment analysis models by identifying and defending against attack vectors.
problem Securing deployed machine learning models, particularly sentiment analysis systems, from adversarial attacks.
method BAD (Build, Attack, Defend) Architecture, evaluating two implementations.
result Demonstrated a viable methodology for securing machine learning models in production.
CAVs reveal latent concept distributions, but are vulnerable to adversarial attacks.
problem Understanding latent concept encodings in AI models.
method Probabilistic perspective on CAVs, deriving mean and covariance.
result CAVs can be adversarially manipulated, highlighting a vulnerability.
Proposes new convex relaxations for certifying spatial robustness of neural networks.
problem Lack of provable guarantees for robustness against vector field transformations.
method Novel convex relaxations for certifying robustness against vector field transformations.
result First time providing a certificate of robustness against vector field transformations.
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-…
Bayesian Optimization improves machine learning for detecting network attacks.
problem Detecting network attacks to secure critical information.
method Bayesian Optimization for tuning machine learning algorithms (SVM-RBF, RF, k-NN).
result The proposed framework achieves high accuracy and low false alarms.
secml is a Python library for secure and explainable machine learning.
problem Evaluate and understand security and explainability of machine learning models.
method Implement attacks and explainability methods for various algorithms.
result Demonstrates how quickly models fail under adversarial perturbations and visualizes influential features.
This work develops secure distributed algorithms for machine learning to protect against data poisoning and network attacks.
problem Vulnerability of distributed machine learning algorithms to cyber threats.
method Game-theoretic framework to capture conflicting goals of a learner and an attacker, iterative distributed algorithm.
result Distributed SVM is prone to fail in different types of attacks, with impact depending on network structure and attack capabilities.
Despite the wide use of machine learning in adversarial settings including computer security, recent studies have demonstrated vulnerabilities to evasion attacks---carefully crafted adversarial samples that closely resemble legitimate instances, but cause misclassification. In this paper, we examine the adequacy of the…
Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this …
Paper analyzes neural networks using active subspace for structural analysis and vulnerability, reducing model size and improving attacks.
problem Analyzing and reducing the complexity of neural networks.
method Active subspace method for measuring active neurons, network structure modification, and additive universal adversarial attack vector.
result ASNet achieves significant parameter and flops reduction, and improves universal adversarial attack performance.
Novel defense algorithm improves SVMs against data poisoning attacks.
problem Vulnerability of SVMs to targeted training data manipulations like poisoning attacks.
method Developed a weighted SVM using K-LID to de-emphasize suspicious data samples.
result Significant reduction in classification error rates (10% on average) with the proposed defense.
Paper proposes a robust audio classification method against adversarial attacks.
problem Adversarial attacks can fool machine learning models into making incorrect predictions.
method Proposes a novel SVM-based approach using DWT and SURF features.
result The proposed method provides a good balance between accuracy and resilience against adversarial attacks.
Improved algorithm speeds up generation of universal adversarial perturbations.
problem Slow generation of universal adversarial perturbations.
method Optimized algorithm based on orientation of perturbation vectors.
result Significantly faster generation of universal perturbations with higher fooling rates.
Privacy attacks reveal hidden information in network embeddings after node removal.
problem Privacy concerns in network embeddings after node deletion.
method Analyzed network embeddings and developed an attack to recover removed node information.
result Significant information about removed node's neighbors can be retrieved from remaining embeddings.
This paper defends SVMs against poisoning attacks using DBSCAN and hardness proofs.
problem Adversarial injection of specially crafted samples into training data to misclassify SVMs.
method Two strategies: robust SVM algorithms and data sanitization (DBSCAN).
result Proves hardness of simple SVM problem and effectiveness of DBSCAN for poisoning attacks.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
Graph embedding leaks sensitive graph properties and subgraphs.
problem Privacy risks in graph embedding sharing.
method Three inference attacks and a defense mechanism.
result High accuracy in inferring graph properties and subgraphs.
Researchers develop a method to trick deep generative models with adversarial inputs.
problem Deep generative models can be misled by attackers to produce arbitrary data.
method The study introduces an adversarial attack technique to manipulate pre-trained generative models.
result Adversarial latent vectors can be crafted to resemble genuine inputs and fool generative models.
Paper detects adversarial attacks in sound classification models.
problem Adversarial attacks threaten data-driven models, especially in sound classification.
method Detects adversarial subspaces in unitary vector domain using chordal distance and generalized Schur decomposition.
result Regularized logistic regression detector outperforms other approaches on benchmark datasets.
This paper explores adversarial examples in malware detection.
problem Malware detectors are vulnerable to adversarial interference.
method Training an existing model on a production-scale dataset to test adversarial attacks.
result Some previous attacks are less effective than initially reported.
Active learning improves network intrusion detection with minimal labeled data.
problem Finding new attack vectors in low-volume traffic.
method Proposes an active learning framework to minimize labeled data while improving detection quality.
result Active learning with minimal labeled data significantly improves anomaly detection in network traffic.
Machine learning-based IDSs in ICS are vulnerable to adversarial attacks that can bypass them.
problem Adversarial attacks on machine learning-based IDSs in ICS can lead to undetected cyber attacks.
method Used Jacobian-based Saliency Map attack to generate adversarial samples and explored adversarial training to improve model robustness.
result Classification performance of supervised models decreased by 16-20 percentage points with adversarial samples, but improved with adversarial training.
Simple technique turns any adversarial attack into a universal one using few test examples.
problem Creating universal adversarial attacks with minimal data.
method Universalization technique using few adversarial test examples and spectral properties.
result Simple universalization technique achieves comparable fooling rates to state-of-the-art methods.
This paper evaluates and compares gradient leakage attacks in federated learning.
problem Gradient leakage attacks compromise client privacy in federated learning.
method Formal and experimental analysis of gradient leakage attacks, evaluation of attack effectiveness and cost.
result Gradient leakage attacks can reconstruct private local training data from shared parameter updates.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Simple method for black-box adversarial attacks with low query efficiency.
problem Efficient construction of adversarial images in the black-box setting.
method Randomly sampling from an orthonormal basis and adjusting images.
result Demonstrated unprecedented query efficiency in both untargeted and targeted attacks.
Feature Squeezing is a recently proposed defense method which reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. It has been shown that feature squeezing defenses can be combined in a joint detection fram…
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
Embeddings leak sensitive information about input data, which can be recovered or inferred.
problem Information leakage in embedding models.
method Developed three classes of attacks to study information leakage.
result Embeddings leak sensitive information about input data, which can be partially recovered or inferred.
The paper analyzes how adversarial attacks affect sparse regression models.
problem Effects of adversarial attacks on sparse regression models.
method Primal-dual witness paradigm to analyze support of estimated regression parameter vector.
result Adversaries can influence sample complexity by corrupting irrelevant features.
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
RESTA defends LLMs against jailbreaking attacks by adding random noise to embeddings.
problem Vulnerability of LLMs to jailbreaking attacks that generate harmful outputs.
method Adds random noise to embedding vectors and aggregates during token generation.
result RESTA achieves superior robustness versus utility tradeoffs compared to baseline defenses.
Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-…
New attacks exploit neural network energy and latency, increasing costs by 10-200x.
problem Energy and latency vulnerabilities in neural networks.
method Crafted sponge examples to maximize energy and latency.
result Adversaries can increase energy consumption by 10-200x and delay decisions.
Paper introduces techniques to enhance time series data robustness against adversarial attacks.
problem Vulnerability of deep learning time series classifiers to adversarial attacks.
method Two local gradient based and one spectral density based data augmentation techniques.
result Trained models with augmented data achieve state-of-the-art classification accuracy and robustness.
Susceptibility of deep neural networks to adversarial attacks poses a major theoretical and practical challenge. All efforts to harden classifiers against such attacks have seen limited success. Two distinct categories of samples to which deep networks are vulnerable, "adversarial samples" and "fooling samples", have b…
Though deep neural networks have achieved state-of-the-art performance in visual classification, recent studies have shown that they are all vulnerable to the attack of adversarial examples. Small and often imperceptible perturbations to the input images are sufficient to fool the most powerful deep neural networks. Va…
This paper tackles security issues in deep reinforcement learning.
problem Security risks and issues in deep reinforcement learning algorithms.
method Formulated security requirements, threat model, and reviewed current literature.
result Identified vulnerabilities, attack vectors, and adversarial capabilities in deep RL.
PRISM-FCP improves federated prediction robustness against Byzantine attacks.
problem Byzantine attacks in federated learning.
method Partial model sharing and distance-based maliciousness scores.
result Maintains nominal coverage guarantees under Byzantine attacks.
Machine learning (ML) models may be deemed confidential due to their sensitive training data, commercial value, or use in security applications. Increasingly often, confidential ML models are being deployed with publicly accessible query interfaces. ML-as-a-service ("predictive analytics") systems are an example: Some …
Poisoning attack is identified as a severe security threat to machine learning algorithms. In many applications, for example, deep neural network (DNN) models collect public data as the inputs to perform re-training, where the input data can be poisoned. Although poisoning attack against support vector machines (SVM) h…