Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
Topology-aware generative models improve manifold-based defenses against adversarial examples.
problem Adversarial examples compromise the reliability of ML models, especially DNNs.
method Investigate if generative models used in manifold-based defenses need to be topology-aware.
result Topology-aware generative models enhance the robustness of manifold-based defenses.
Research evaluates model extraction attacks on complex ML models and introduces a defense.
problem Model extraction attacks steal functionality of ML models through prediction APIs.
method Evaluation of Knockoff nets and introduction of a defense.
result Realistic adversaries can effectively steal complex ML models and evade known defenses.
Unified framework for analyzing model stealing attacks and defenses.
problem Vulnerability of ML applications to model stealing attacks.
method Developed a rigorous threat model and evaluation criteria, proposed methods to quantify attack and defense strategies.
result Demonstrated the importance of attack-specific perturbations for effective defenses.
New defense DMP preserves ML model utility while enhancing membership privacy.
problem Membership inference attacks (MIAs) on machine learning models.
method Knowledge distillation to train ML models with membership privacy.
result DMP provides significantly better tradeoffs between membership privacy and classification accuracies.
EBM life cycle project improves MCMC for image generation, defense, and density modeling.
problem Improving MCMC for diverse EBM applications.
method Three novel MCMC initialization methods for negative samples.
result State-of-the-art performance gains across three applications.
Randomized smoothing reduces accuracy in ML models, especially at higher noise levels.
problem Adversarial attacks on ML models, especially randomized smoothing's accuracy drop.
method Theoretical and empirical analysis of randomized smoothing's effect on feasible hypotheses space.
result For some noise levels, randomized smoothing shrinks the set of feasible hypotheses, leading to accuracy drops.
Paper examines how adversarial ML attacks and defenses impact civil liberties and human rights.
problem Impact of adversarial machine learning on civil liberties and human rights.
method Uses insights from STS, anthropology, and human rights literature.
result Adversarial defenses can be used to suppress dissent and limit investigation of ML systems.
The DoD needs a robust process to evaluate AI/ML model performance and robustness.
problem AI/ML models are brittle and nonrobust, posing risks in national security.
method Reviews AI/ML development process and best practices for evaluation.
result Recommendations for DoD evaluators to ensure robust AI/ML capabilities.
This paper analyzes how data and model properties affect membership inference attacks.
problem Understanding and mitigating the vulnerability of machine learning models to membership inference attacks.
method Empirical analysis of data and model properties on MIA success.
result Data and model properties, not just model overfitting, influence MIA success.
Explores security challenges of machine learning in real-world systems.
problem Vulnerabilities in machine learning models deployed in safety-critical systems.
method Broadens systems security view of ML vulnerabilities, identifies novel challenges, proposes mitigation suggestions.
result Highlights novel challenges and proposes mitigation strategies for securing ML systems.
AI attacks threaten insurance systems, requiring new defenses.
problem Adversarial attacks on AI in insurance.
method Categorize and discuss various types of attacks and defense methods.
result Need for improved AI systems to resist attacks.
Paper assesses holistic risks of inference attacks on ML models.
problem Lack of comprehensive risk assessment of inference attacks on ML models.
method Presented a threat model taxonomy for four inference attacks on five model architectures and four image datasets.
result Complexity of training dataset influences attack performance; model stealing and membership inference attacks are negatively correlated.
PAD offers a principled approach to malware detection against evasion attacks.
problem Machine Learning techniques for malware detection are vulnerable to evasion attacks.
method PAD proposes a new adversarial training framework with convergence guarantees for robust optimization.
result PAD significantly outperforms state-of-the-art defenses and can harden ML-based malware detection against 27 evasion attacks.
Law responds to adversarial machine learning threats.
problem Adversarial machine learning attacks and their legal implications.
method Scenarios and legal analysis of adversarial ML attacks.
result Some attacks are more likely to result in liability.
VarDetect monitors API queries to detect model extraction attacks.
problem Attackers can extract ML models through API queries.
method VarDetect uses a modified variational autoencoder to track and detect attacker samples.
result VarDetect successfully detects and raises alarms for model extraction attacks.
This paper analyzes FL privacy risks and defensive strategies.
problem Privacy leakage in federated learning.
method Literature review of attack methods and defensive strategies.
result No single defensive strategy is sufficient for all attacks.
This paper tackles security challenges in CAVs using ML, proposing defenses against adversarial attacks.
problem Security threats posed by adversarial machine learning in CAVs.
method An in-depth analysis of ML pipeline in CAVs, identifying security issues and proposing defenses.
result Proposes solutions to defend against adversarial attacks in CAVs.
ART is a Python library for defending ML models against adversarial threats.
problem Vulnerability of ML models to adversarial examples.
method Pre-processing, adversarial data augmentation, runtime detection.
result Provides tools to certify and verify model robustness.
Adversarial attacks can manipulate ML-aided visualizations, tricking analysts.
problem Adversarial attacks on ML-aided visualizations.
method Identifying attack surface and exemplifying five adversarial attacks.
result Adversaries can induce various attacks, like creating arbitrary and deceptive visualizations.
New dynamic backdoor attacks bypass current defenses.
problem Vulnerability of machine learning models to backdoor attacks.
method Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN).
result Dynamic backdoors can bypass current detection and defense mechanisms.
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Defends against ML inference attacks using adversarial examples.
problem Automated inference attacks using ML classifiers pose privacy and security threats.
method Turns ML classifier vulnerabilities into defenses by adding adversarial noise to public data.
result Adversarial examples can mislead ML classifiers and protect private data.
Paper evaluates ML's resilience in detecting ransomware.
problem Resilience of ML algorithms for ransomware detection.
method Used GAN to generate dynamic features to test ML models.
result ML models degrade in performance when faced with GAN-generated samples.
This paper explores RL for cyber defense in SDN, resisting poisoning attacks.
problem Adversaries exploit ML adaptability to poison training and evade classification.
method Investigates RL algorithms for autonomous cyber defense in SDN, studying various attack types.
result RL agents can effectively react to poisoning attacks in SDN.
Framework classifies machine learning failures into intentional and unintentional.
problem Understanding and preventing failures in machine learning systems.
method Developed a taxonomy of machine learning failure modes.
result Stakeholders found the framework useful for discussing machine learning failures.
MLCapsule protects sensitive data by executing models locally.
problem Protecting sensitive data and model security in MLaaS.
method Local execution of models on client side, coupled with security measures.
result Models executed locally without data leaving the client, protecting against attacks.
Paper builds ML classifier to detect crypto-ransomware.
problem Detecting crypto-ransomware with high accuracy and low false positives.
method Behavior-based detection using input/output activities and file-content entropy. Deep-learning classifier with adversarial research and Integrated Gradient method for explanation.
result Deep-learning classifier achieves high accuracy and low false positive rate in detecting crypto-ransomware.
This thesis enhances ML reliability by selectively abstaining from predictions when uncertain.
problem Improving reliability in machine learning systems, especially in high-stakes domains.
method Exploiting uncertainty signals from training trajectories to develop lightweight, post-hoc abstention methods compatible with differential privacy.
result A robust trajectory-based approach to selective prediction that maintains high accuracy under privacy noise.
This paper finds universal perturbations to fool black-box ML classifiers.
problem Breaking security through obscurity in black-box ML settings.
method Zeroth-order optimization for finding universal adversarial perturbations in a black-box setting.
result State-of-the-art ML classifiers can be fooled with a single imperceptible image perturbation.
This paper improves AI defenses against network attacks using ML and adversarial learning.
problem Protecting personal data from sophisticated network attacks.
method Unified multi-modal dataset, machine learning for detection, adversarial learning for synthetic data generation.
result Stable ML models for intrusion detection and high-fidelity synthetic data.
FoolsGold defends federated learning from sybil-based poisoning attacks.
problem Sybil-based poisoning attacks in federated learning.
method Identifies poisoning sybils based on client update diversity.
result Exceeds state-of-the-art approaches in countering sybil-based attacks.
ATHENA builds flexible defenses against adversarial attacks.
problem Extensive research on adversarial attacks is domain-specific and cannot be easily extended.
method Designing an extensible framework based on diverse weak defenses.
result Comprehensive empirical study demonstrates the effectiveness of ATHENA.
New method detects adversarial attacks in industrial systems.
problem Adversarial attacks compromise machine learning models in industrial control systems.
method Introduces domain adaptation layer and Monte Carlo simulation for proactive defense.
result Approximates Bayes optimal mitigation for improved detection model health.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
New contest evaluates machine learning robustness against unrestricted adversarial examples.
problem Evaluating machine learning robustness against arbitrary adversarial inputs.
method Two-player contest with a prize pool, focusing on unconstrained adversarial examples.
result Demonstrates the need for comprehensive evaluation of machine learning models' worst-case adversarial risk.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks. Paper discusses methods to evaluate defenses against adversarial examples.
problem Difficulty in evaluating adversarial robustness.
method Methodological foundations and best practices for evaluating defenses.
result Suggests new methods to avoid common pitfalls in evaluations.
Study defenses against data poisoning attacks in online learning.
problem Data poisoning attacks on machine learning models.
method Rigorous study of four standard defenses in both a powerful and a realistic threat model.
result The effectiveness of defenses depends on the ease of the learning problem.
Paper analyzes adversarial attacks and defenses using game theory.
problem Unclear conditions for optimal attacks and defenses in adversarial learning.
method Game-theoretic framework with locally linear decision boundary model.
result Fast Gradient Method attack and Randomized Smoothing defense form a Nash Equilibrium.
New defense against DNN model stealing attacks by poisoning predictions.
problem Stealing DNN models through black-box access attacks.
method Active perturbation of predictions to mislead attacker's training.
result Effective against a wide range of DNN stealing attacks, reducing attacker's success rate significantly.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
New adaptive attacks bypass many defenses to adversarial examples.
problem Adversarial example defenses are not adequately evaluated using adaptive attacks.
method Detailed analysis of thirteen defenses, demonstrating their vulnerabilities to adaptive attacks.
result Adversarial example defenses are more vulnerable to adaptive attacks than previously thought.
This study evaluates adversarial attacks and defenses for chest X-ray disease classification.
problem Vulnerability of deep neural networks to adversarial examples in chest X-ray disease detection.
method Detailed introduction and evaluation of various attack and defense methods.
result Attack and defense methods perform poorly with excessive iterations and large perturbations.
Paper presents a defense framework against adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Cross-layer strategic ensemble defense with input and output transformations.
result Strategic ensemble defense achieves high defense success rates and robustness.
Stochastic defense improves natural classifiers against adversarial attacks.
problem Vulnerability of deep networks to adversarial attacks.
method Long-run MCMC sampling with Energy-Based Model for adversarial purification.
result Balancing memoryless and metastable behavior leads to effective purification and robust classification.
Defense against small image patches using occlusions.
problem Vulnerability of deep learning to small adversarial patches.
method Partially occlude image around each patch location.
result Certified security against patch attacks of a certain size.