ATHENA builds flexible defenses against adversarial attacks.
problem Extensive research on adversarial attacks is domain-specific and cannot be easily extended.
method Designing an extensible framework based on diverse weak defenses.
result Comprehensive empirical study demonstrates the effectiveness of ATHENA.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks. Paper discusses methods to evaluate defenses against adversarial examples.
problem Difficulty in evaluating adversarial robustness.
method Methodological foundations and best practices for evaluating defenses.
result Suggests new methods to avoid common pitfalls in evaluations.
Study defenses against data poisoning attacks in online learning.
problem Data poisoning attacks on machine learning models.
method Rigorous study of four standard defenses in both a powerful and a realistic threat model.
result The effectiveness of defenses depends on the ease of the learning problem.
Paper analyzes adversarial attacks and defenses using game theory.
problem Unclear conditions for optimal attacks and defenses in adversarial learning.
method Game-theoretic framework with locally linear decision boundary model.
result Fast Gradient Method attack and Randomized Smoothing defense form a Nash Equilibrium.
Topology-aware generative models improve manifold-based defenses against adversarial examples.
problem Adversarial examples compromise the reliability of ML models, especially DNNs.
method Investigate if generative models used in manifold-based defenses need to be topology-aware.
result Topology-aware generative models enhance the robustness of manifold-based defenses.
New defense against DNN model stealing attacks by poisoning predictions.
problem Stealing DNN models through black-box access attacks.
method Active perturbation of predictions to mislead attacker's training.
result Effective against a wide range of DNN stealing attacks, reducing attacker's success rate significantly.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
New adaptive attacks bypass many defenses to adversarial examples.
problem Adversarial example defenses are not adequately evaluated using adaptive attacks.
method Detailed analysis of thirteen defenses, demonstrating their vulnerabilities to adaptive attacks.
result Adversarial example defenses are more vulnerable to adaptive attacks than previously thought.
This study evaluates adversarial attacks and defenses for chest X-ray disease classification.
problem Vulnerability of deep neural networks to adversarial examples in chest X-ray disease detection.
method Detailed introduction and evaluation of various attack and defense methods.
result Attack and defense methods perform poorly with excessive iterations and large perturbations.
Paper presents a defense framework against adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Cross-layer strategic ensemble defense with input and output transformations.
result Strategic ensemble defense achieves high defense success rates and robustness.
Stochastic defense improves natural classifiers against adversarial attacks.
problem Vulnerability of deep networks to adversarial attacks.
method Long-run MCMC sampling with Energy-Based Model for adversarial purification.
result Balancing memoryless and metastable behavior leads to effective purification and robust classification.
Defense against small image patches using occlusions.
problem Vulnerability of deep learning to small adversarial patches.
method Partially occlude image around each patch location.
result Certified security against patch attacks of a certain size.
Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. This work provides a solution to hardening DNNs under adversarial attacks through…
Defense against ASR attacks using dropout uncertainty.
problem Adversarial attacks on ASR systems.
method Dropout uncertainty in neural networks.
result High detection accuracy across various ASR systems and datasets.
Survey of algorithms to correct past mistakes in prediction.
problem Improving prediction accuracy by correcting past errors.
method Defensive Forecasting as a sequential game theory approach to minimize prediction metrics.
result Simple, near-optimal algorithms for various prediction tasks.
This paper evaluates defenses against adversarial attacks on neural networks.
problem Adversarial attacks can trick DNNs into mis-classifying inputs.
method Scientific evaluation methodology for randomized defenses.
result RPENNs outperformed other defenses against adversarial attacks.
This paper benchmarks time-series adversarial defenses and attacks.
problem Adversarial attacks on time-series data.
method Detailed benchmarking of adversarial defense methods in the L∞ threat model. result Adversarial defenses offer robustness against both strong white-box and black-box attacks.
DeepRobust is a PyTorch library for adversarial attacks and defenses.
problem Addressing adversarial attacks and defenses in deep learning.
method Contains over 20 attack and defense algorithms for various deep learning architectures.
result Fosters research in adversarial learning with comprehensive and easy-to-use platform.
New defense method reduces adversarial attacks on neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Sparse coding frontend trained on clean images.
result Significantly attenuates adversarial attacks before reaching classifier.
New defense mechanism RS outperforms existing schemes in protecting against adversarial examples.
problem Adversarial examples trick classifiers into misclassification.
method Proposed a new defense mechanism called Random Spiking (RS) and an evaluation framework.
result Random Spiking (RS) delivers better protection against adversarial examples than many existing schemes.
It has been shown that adversaries can craft example inputs to neural networks which are similar to legitimate inputs but have been created to purposely cause the neural network to misclassify the input. These adversarial examples are crafted, for example, by calculating gradients of a carefully defined loss function w…
New defense improves numerical stability in regression networks.
problem Adversarial attacks on regression neural networks.
method Formulated a stability-inducing regularization defense.
result Defense outperforms prior approaches and improves numerical stability.
Paper proposes HRS to improve neural network robustness without significant accuracy loss.
problem Vulnerability of neural networks to adversarial attacks and performance degradation.
method Hierarchical Random Switching (HRS) for robustness without sacrificing accuracy.
result HRS significantly improves adversarial robustness with minimal accuracy loss.
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set…
BUZz defends images from adversarial attacks using simple transformations.
problem Adversarial attacks on deep neural networks for image classification.
method Combination of deep neural networks and simple image transformations.
result Achieves significant improvement over state-of-the-art defenses with a modest drop in clean accuracy.
Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
This paper reviews defenses against adversarial learning attacks on statistical classifiers.
problem Adversarial attacks on machine learning systems, particularly statistical classifiers.
method Survey of recent work on test-time evasion, data poisoning, and reverse engineering attacks and defenses.
result Novel insights that challenge conventional AL wisdom and target unresolved issues.
Unified framework for analyzing model stealing attacks and defenses.
problem Vulnerability of ML applications to model stealing attacks.
method Developed a rigorous threat model and evaluation criteria, proposed methods to quantify attack and defense strategies.
result Demonstrated the importance of attack-specific perturbations for effective defenses.
The paper evaluates machine learning cyber defenses using log data against adversarial attacks.
problem Evaluating the robustness of machine learning cyber defenses against adversarial attacks.
method Developed a testing framework using deep reinforcement learning and adversarial natural language processing.
result Higher dropout levels increase robustness, with 90% dropout probability showing the highest robustness.
A Bayesian framework models adversarial uncertainty for robust machine learning.
problem Vulnerability of machine learning models to adversarial attacks.
method Formal Bayesian framework that models adversarial uncertainty through a stochastic channel, articulating probabilistic assumptions.
result Explicitly modeling adversarial uncertainty leads to improved robustification strategies.
Interpreting machine learning models helps understand adversarial attacks and defenses.
problem Understanding model vulnerability to adversarial attacks.
method Model interpretation techniques to explore adversarial attacks and defenses.
result Interpretation methods can be applied to adversarial attacks and defenses.
New defense method protects client data privacy in federated learning.
problem Gradient leakage attacks in federated learning.
method Learning to obscure data to generate synthetic samples.
result Synthetic samples preserve predictive features and protect privacy.
Defensive distillation fails against targeted adversarial attacks, forcing a tradeoff between learning and security.
problem Defensive distillation's limitations in blocking targeted adversarial attacks.
method Systematic exploration of defensive distillation's effectiveness and limitations.
result Defensive distillation is effective against non-targeted attacks but fails against targeted attacks, necessitating a tradeoff between learning and security.
Recently, researchers have discovered that the state-of-the-art object classifiers can be fooled easily by small perturbations in the input unnoticeable to human eyes. It is also known that an attacker can generate strong adversarial examples if she knows the classifier parameters. Conversely, a defender can robustify …
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
Aggregation defenses improve deep learning models' robustness against data poisoning attacks.
problem Data poisoning attacks manipulate deep learning models with malicious training samples.
method Deep Partition Aggregation, efficiency improvements, data-to-complexity ratio, poisoning overfitting phenomenon.
result Aggregation defenses boost poisoning robustness through the poisoning overfitting phenomenon.
Research evaluates adversarial attacks and defenses on 3D point cloud classifiers.
problem Robustness of 3D object classifiers against adversarial attacks.
method Extending 2D adversarial attacks to 3D point clouds and proposing new defenses.
result 3D point cloud classifiers are weak to adversarial attacks but more defensible.
In recent years, deep neural network approaches have been widely adopted for machine learning tasks, including classification. However, they were shown to be vulnerable to adversarial perturbations: carefully crafted small perturbations can cause misclassification of legitimate images. We propose Defense-GAN, a new fra…
The paper improves neural network robustness against multiple norm types of adversarial attacks.
problem Defending neural networks against adversarial attacks with different norms.
method Combining existing defense mechanisms to train neural networks robust against both ℓ∞ and ℓ2 attacks. result New defense mechanisms offer better protection against both ℓ∞ and ℓ2 attacks. Random Gaussian noise and pixel discretization improve image classifier robustness.
problem Whitebox adversarial attacks decrease classifier accuracy.
method Inject random Gaussian noise, discretize pixels, and use any classifier.
result Reduces KL divergence and lower bound on classifier accuracy.
New research evaluates various perturbation methods for improving neural network robustness.
problem Understanding and improving robustness of Convolutional Neural Networks (CNNs) against adversarial attacks.
method Detailed evaluation of five main perturbation-based defenses, comparing random and deterministic approaches.
result Perturbation-based defenses are equivalent in efficacy, and attacks transfer between them.
Paper examines test-time smoothing defenses against adversarial examples.
problem Adversarial examples can mislead neural networks, compromising robustness.
method Evaluates various test-time smoothing defenses on ImageNet.
result Non-monotonic relation between attacks and defenses, large variance among samples.
New defense method for non-parametric classifiers robust against adversarial attacks.
problem Lack of robustness in non-parametric classifiers against adversarial attacks.
method Adversarial pruning method to preprocess datasets and a novel attack.
result Adversarial pruning provides a robust defense for non-parametric classifiers.
FDA3 defends IIoT applications against adversarial attacks by federating defense knowledge.
problem Adversarial attacks on DNNs in IIoT applications can cause devastating consequences.
method Federated learning approach to aggregate defense knowledge from different sources.
result FDA3 can resist more attacks than existing methods and prevent new attacks.
Paper defends iris recognition from adversarial examples using wavelet decomposition.
problem Adversarial examples threaten deep neural networks in biometric applications.
method Wavelet domain denoising of input examples to detect and mitigate adversarial attacks.
result Proposed defense strategies improve recognition accuracy against adversarial attacks.