arXiv research

ATHENA builds flexible defenses against adversarial attacks.

Paper presents a defense framework against adversarial examples.

Despite being popularly used in many applications, neural network models have been found to be vulnerable to adversarial examples, i.e., carefully crafted examples aiming to mislead machine learning models. Adversarial examples can pose potential risks on safety and security critical applications. However, existing def…

This paper benchmarks time-series adversarial defenses and attacks.

Deep neural networks (DNNs) have demonstrated impressive performance on many challenging machine learning tasks. However, DNNs are vulnerable to adversarial inputs generated by adding maliciously crafted perturbations to the benign inputs. As a growing number of attacks have been reported to generate adversarial inputs…

New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.

XEnsemble improves DNN robustness against adversarial and out-of-distribution inputs.

Survey of adversarial examples in visual machine learning models.

This study improves scalability of randomized smoothing for certifying classifier robustness.

This work develops agents to learn generalizable policies for dynamic network environments.

Deep Neural Networks are vulnerable to adversarial attacks even in settings where the attacker has no direct access to the model being attacked. Such attacks usually rely on the principle of transferability, whereby an attack crafted on a surrogate model tends to transfer to the target model. We show that an ensemble o…

This paper studies backdoor attacks in federated learning and proposes defenses.

3D object classification and segmentation using deep neural networks has been extremely successful. As the problem of identifying 3D objects has many safety-critical applications, the neural networks have to be robust against adversarial changes to the input data set. There is a growing body of research on generating h…

Paper proposes an ensemble of attacks to evaluate adversarial robustness more reliably.

A financial market is called "diverse" if no single stock is ever allowed to dominate the entire market in terms of relative capitalization. In the context of the standard Ito-process model initiated by Samuelson (1965) we formulate this property (and the allied, successively weaker notions of "weak diversity" and "asy…

Adversarial robustness research primarily focuses on L_p perturbations, and most defenses are developed with identical training-time and test-time adversaries. However, in real-world applications developers are unlikely to have access to the full range of attacks or corruptions their system will face. Furthermore, wors…

Voting ensemble of robust models improves robustness.

New attacks and defenses for GNNs on large graphs.

Paper examines Go AI robustness against adversarial attacks.

Though deep neural networks have achieved significant progress on various tasks, often enhanced by model ensemble, existing high-performance models can be vulnerable to adversarial attacks. Many efforts have been devoted to enhancing the robustness of individual networks and then constructing a straightforward ensemble…

New method certifies joint adversarial robustness of model ensembles.

This paper investigates recently proposed approaches for defending against adversarial examples and evaluating adversarial robustness. We motivate 'adversarial risk' as an objective for achieving models robust to worst-case inputs. We then frame commonly used attacks and evaluation metrics as defining a tractable surro…

Deep neural networks (DNN) are known to be vulnerable to adversarial attacks. Numerous efforts either try to patch weaknesses in trained models, or try to make it difficult or costly to compute adversarial examples that exploit them. In our work, we explore a new "honeypot" approach to protect DNN models. We intentiona…

Naive Bayes spam filters are highly susceptible to data poisoning attacks. Here, known spam sources/blacklisted IPs exploit the fact that their received emails will be treated as (ground truth) labeled spam examples, and used for classifier training (or re-training). The attacking source thus generates emails that will…

Proposes RPG-RT for red-teaming T2I models without internal access.

Novel Bayesian neural network method for robustness.

Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black…

Despite their impressive performance on diverse tasks, neural networks fail catastrophically in the presence of adversarial inputs---imperceptibly but adversarially perturbed versions of natural inputs. We have witnessed an arms race between defenders who attempt to train robust networks and attackers who try to constr…

Reviews spams are prevalent in e-commerce to manipulate product ranking and customers decisions maliciously. While spams generated based on simple spamming strategy can be detected effectively, hardened spammers can evade regular detectors via more advanced spamming strategies. Previous work gave more attention to evas…

AutoWS-Bench-101 evaluates automated weak supervision methods for diverse domains.

The classical notion of comonotonicity has played a pivotal role when solving diverse problems in economics, finance, and insurance. In various practical problems, however, this notion of extreme positive dependence structure is overly restrictive and sometimes unrealistic. In the present paper, we put forward a notion…

Recent work on adversarial attack and defense suggests that PGD is a universal $l_\infty$ first-order attack, and PGD adversarial training can significantly improve network robustness against a wide range of first-order $l_\infty$-bounded attacks, represented as the state-of-the-art defense method. However, an obvious …

New defense method inspired by encryption improves visual classification accuracy.

Automated discovery of adaptive attacks improves adversarial defense evaluation.

This work introduces adversarial sparsity to measure robustness beyond adversarial accuracy.

New method defends against unseen threat models using perceptual adversarial training.

New method detects adversarial images by exploiting their density.

Strongly log-concave (SLC) distributions are a rich class of discrete probability distributions over subsets of some ground set. They are strictly more general than strongly Rayleigh (SR) distributions such as the well-known determinantal point process. While SR distributions offer elegant models of diversity, they lac…

Paper analyzes adversarial attacks and defenses using game theory.

Paper presents certified defenses against adversarial patch attacks.

New adaptive attacks bypass many defenses to adversarial examples.

This study evaluates adversarial attacks and defenses for chest X-ray disease classification.

Stochastic defense improves natural classifiers against adversarial attacks.

Defense against small image patches using occlusions.

Unified approach for learning with weak labels across various tasks.

Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. This work provides a solution to hardening DNNs under adversarial attacks through…

Defense against ASR attacks using dropout uncertainty.

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model'…