This study uses cloud telemetry to detect DoS attacks with machine learning.
problem Detecting DoS attacks in cloud environments is challenging.
method Use of machine learning algorithms on cloud telemetry data.
result k-Nearest Neighbors (kNN) and decision tree (CART) accurately identify DoS attacks.
Study shows various pixel p-norm measures do not match human perception of adversarial attacks.
problem Understanding human perception of adversarial attacks on image classification systems.
method Performed a behavioral study comparing different p-norm measures and alternative metrics.
result Human perception of adversarial attacks does not align with pixel p-norm measures and other metrics.
Attackers can poison environments to force RL agents to follow target policies.
problem Security threat to reinforcement learning where attackers manipulate environments to force agents into following target policies.
method Optimization framework for finding optimal stealthy attacks under different measures of attack cost.
result Attackers can easily succeed in teaching any target policy to RL agents under mild conditions.
This paper reviews defenses against adversarial learning attacks on statistical classifiers.
problem Adversarial attacks on machine learning systems, particularly statistical classifiers.
method Survey of recent work on test-time evasion, data poisoning, and reverse engineering attacks and defenses.
result Novel insights that challenge conventional AL wisdom and target unresolved issues.
Study defends shallow neural networks from data-poisoning attacks.
problem Protecting shallow neural networks from adversarial attacks during training.
method Developed a non-gradient stochastic algorithm for depth-2 neural networks, proving near-optimal trade-offs.
result Demonstrated improved performance over stochastic gradient descent under various data distributions.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.
Transferability captures the ability of an attack against a machine-learning model to be effective against a different, potentially unknown, model. Empirical evidence for transferability has been shown in previous work, but the underlying reasons why an attack transfers or not are not yet well understood. In this paper…
New attacks inflate earnings while reducing fraud scores, potentially millions at stake.
problem Manipulating financial reports to hide distress and gain.
method Maximum Violated Multi-Objective (MVMO) attacks that adapt search direction.
result Inflation of earnings by 100-200% while reducing fraud scores by 15% in 50% of cases.
A recent line of work has uncovered a new form of data poisoning: so-called \emph{backdoor} attacks. These attacks are particularly dangerous because they do not affect a network's behavior on typical, benign data. Rather, the network only deviates from its expected output when triggered by a perturbation planted by an…
New technique crafts imperceivable sparse adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method Proposes a black-box technique to minimize l0-distance, integrating componentwise constraints. result Adversarial examples are almost imperceivable and non-detectable.
WITCHcraft improves PGD attacks with random step size, enhancing efficiency.
problem Efficiently crafting adversarial attacks on neural networks.
method Variant of PGD using random step size.
result Superior performance to classical PGD without additional computational cost.
Efficient attacks on DRL models without model access and low computation.
problem Vulnerabilities of DRL models to adversarial attacks.
method Adapting black-box attacks, introducing efficient online sequential attacks, exploring perturbations in environment dynamics, and generating robust physical perturbations.
result Demonstrated the effectiveness of proposed attacks on real-world robots.
Deep Neural Networks are vulnerable to adversarial attacks even in settings where the attacker has no direct access to the model being attacked. Such attacks usually rely on the principle of transferability, whereby an attack crafted on a surrogate model tends to transfer to the target model. We show that an ensemble o…
A new fast adversarial attack finds minimal perturbations to change class.
problem Evaluating robustness of neural networks against adversarial attacks.
method White-box adversarial attack minimizing perturbation size.
result Outperforms or matches state-of-the-art attacks.
This paper improves attacks on recommender systems by solving optimization problems more precisely.
problem Adversarial injection attacks on recommender systems.
method Solving optimization problems for generating fake user interactions more accurately.
result The exact solution for generating fake users leads to a much larger impact on recommender systems.
Bayesian explanations are more resilient to adversarial attacks than deterministic ones.
problem Stability of saliency-based explanations under adversarial attacks in Neural Networks.
method Empirical and theoretical analysis of Bayesian vs deterministic Neural Networks.
result Bayesian explanations are more stable under adversarial perturbations and direct attacks.
Adversarial policies beat superhuman Go AI systems.
problem Vulnerability of superhuman AI systems to adversarial attacks.
method Training adversarial policies to trick KataGo into making blunders.
result Adversarial policies achieve >97% win rate against KataGo at superhuman settings.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
As the prevalence and everyday use of machine learning algorithms, along with our reliance on these algorithms grow dramatically, so do the efforts to attack and undermine these algorithms with malicious intent, resulting in a growing interest in adversarial machine learning. A number of approaches have been developed …
Machine learning models trained on data from the outside world can be corrupted by data poisoning attacks that inject malicious points into the models' training sets. A common defense against these attacks is data sanitization: first filter out anomalous training points before training the model. In this paper, we deve…
Research shows filtering reduces predictability of cyber-attacks.
problem Predicting cyber-attacks from incomplete data.
method Combining external data with machine learning algorithms to learn indicators of cyber-attacks.
result The process of filtering reduces the predictability of cyber-attacks.
New study shows data-oblivious attacks can outperform data-aware ones.
problem Comparing effectiveness of data-oblivious and data-aware poisoning attacks.
method Theoretical study of feature selection with LASSO, focusing on separation between full-information and oblivious attackers.
result Data-oblivious attacks can achieve the same results as full-information attacks for feature selection with LASSO.
Paper improves privacy for language models against reconstruction attacks.
problem Reconstruction attacks can regenerate training data from language models.
method Uses Rényi differential privacy with optimized privacy budgets.
result Better privacy guarantees for extraction of rare secrets.
New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
New approach makes adversarial examples less suspicious without changing perceptual salience.
problem Robustness of deep neural networks to unsuspicious adversarial examples.
method Splitting images into foreground and background, allowing larger perturbations in background while maintaining low cognitive salience.
result Dual-perturbation attacks are effective against classifiers robust to conventional attacks and adversarial training yields more robust classifiers.
Randomized classifiers outperform deterministic ones in robustness against adversarial attacks.
problem Ensuring optimal robustness against all adversarial attacks.
method Game-theoretic approach, focusing on the non-existence of Nash equilibrium in deterministic classifiers and demonstrating the superiority of randomized classifiers.
result Randomized classifiers can outperform deterministic ones in robustness against adversarial attacks.
New method calibrates white-box MI attacks, outperforming previous black-box methods.
problem Calibrating membership inference attacks on white-box models.
method Leveraging model memorization and overfitting features.
result Calibrated attack provides high precision in membership inference.
Attack graphs provide compact representations of the attack paths that an attacker can follow to compromise network resources by analysing network vulnerabilities and topology. These representations are a powerful tool for security risk assessment. Bayesian inference on attack graphs enables the estimation of the risk …
Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate…
Survey finds many adversarial machine learning threats are not critical for most entities.
problem Adversarial machine learning threats and their impact on model accuracy.
method Literature review and analysis of real-world occurrences of adversarial attacks.
result Many adversarial machine learning threats do not warrant the cost of robust models.
Deep neural networks are susceptible to \emph{adversarial} attacks. In computer vision, well-crafted perturbations to images can cause neural networks to make mistakes such as confusing a cat with a computer. Previous adversarial attacks have been designed to degrade performance of models or cause machine learning mode…
New SSIM measure improves adversarial attacks' perceptual quality.
problem Lack of perceptual quality in traditional adversarial attacks.
method Replaced Lp norms with SSIM measure for better quality. result SSIM-constrained attacks achieve better quality and similar success rate.
The attack intensity of distributed denial of service (DDoS) attacks is increasing every year. Botnets based on internet of things (IOT) devices are now being used to conduct DDoS attacks. The estimation of direct and indirect economic damages caused by these attacks is a complex problem. One of the indirect damage of …
Most of the data manipulation attacks on deep neural networks (DNNs) during the training stage introduce a perceptible noise that can be catered by preprocessing during inference or can be identified during the validation phase. Therefore, data poisoning attacks during inference (e.g., adversarial attacks) are becoming…
New algorithm robust to probabilistic unbounded adversarial attacks in bandit problems.
problem Powerful adversaries that can catastrophically perturb the revealed reward in bandit problems.
method Proposes med-E-UCB and med-ε-greedy algorithms based on sample median for robustness. result Achieves O(logT) pseudo-regret under arbitrary and unbounded reward perturbation. New method makes neural networks robust to various adversarial attacks.
problem Neural networks are vulnerable to specific adversarial attacks.
method Proposed MMR-Universal regularization scheme for ReLU networks.
result First provably robust models against any lp-norm for p≥1. Simple technique turns any adversarial attack into a universal one using few test examples.
problem Creating universal adversarial attacks with minimal data.
method Universalization technique using few adversarial test examples and spectral properties.
result Simple universalization technique achieves comparable fooling rates to state-of-the-art methods.
EI-MTD defends edge intelligence against adversarial attacks with dynamic scheduling.
problem Adversarial attacks on edge intelligence models.
method EI-MTD uses differential knowledge distillation to create robust member models and a dynamic scheduling policy based on a Bayesian Stackelberg game.
result EI-MTD effectively protects edge intelligence from black-box adversarial attacks.
Bayesian framework robustifies classifiers against malicious attacks.
problem Adversarial attacks on classification algorithms in security and business.
method Adversarial risk analysis and approximate Bayesian computation.
result Robustifies statistical classification algorithms against attacks.
This paper analyzes the limits of neural networks under adversarial attacks.
problem Understanding how neural networks perform under adversarial noise.
method Defined the adversarial VC-dimension and combined it with the VC-dimension of halfspace classifiers.
result Concluded the adversarial VC-dimension of neural networks with sign activation functions.
Deep learning models for graphs have advanced the state of the art on many tasks. Despite their recent success, little is known about their robustness. We investigate training time attacks on graph neural networks for node classification that perturb the discrete graph structure. Our core principle is to use meta-gradi…
Study shows unequal success of membership inference attacks across different groups.
problem Unequal success of membership inference attacks across different groups.
method Established conditions for preventing MIAs and derived connections to fairness and differential privacy.
result Estimating disparate vulnerability to MIAs can lead to overestimation; suitable attacks and statistical framework provided.
New neural networks without weight transport are more robust to adversarial attacks.
problem Existing neural networks are easily fooled by adversarial attacks.
method Trained neural networks using feedback alignment instead of weight transport.
result Neural networks without weight transport are significantly harder to fool (98% adversarial accuracy vs 0.03%).
DBCL defends collaborative learning by sketching parameters to prevent gradient-based privacy inference attacks.
problem Privacy leaks in collaborative machine learning due to gradient-based attacks.
method Random matrix sketching applied to parameters, followed by re-generation of sketching after each iteration.
result DBCL prevents effective gradient-based privacy inference attacks without significant computational or accuracy costs.
Recently, advances in machine learning techniques have attracted the attention of the research community to build intrusion detection systems (IDS) that can detect anomalies in the network traffic. Most of the research works, however, do not differentiate among different types of attacks. This is, in fact, necessary fo…
New algorithm improves robustness by more regularization on less robust samples.
problem Improving robustness against adversarial attacks.
method Proposes a new adversarial training algorithm that applies more regularization to data vulnerable to adversarial attacks.
result Empirically superior to other existing algorithms, achieving state-of-the-art performance in generalization and robustness.
It has recently been shown that neural networks but also other classifiers are vulnerable to so called adversarial attacks e.g. in object recognition an almost non-perceivable change of the image changes the decision of the classifier. Relatively fast heuristics have been proposed to produce these adversarial inputs bu…
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks.