Estimates robustness of BNNs with statistical guarantees.
problem Measuring robustness of BNNs against adversarial examples.
method Statistical verification techniques for probabilistic models.
result Quantifies uncertainty of BNN predictions in adversarial settings.
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Proposes OC-NN for anomaly detection in complex data.
problem Detect anomalies in complex data sets.
method Combines deep learning and one-class objective for anomaly detection.
result OC-NN performs on par with state-of-the-art methods and outperforms conventional methods.
Defense against backdoor attacks by clustering incompatible data subsets.
problem Backdoor poisoning attacks on deep neural networks.
method Incompatibility clustering of data subsets during training.
result Successfully reduces attack success rate to below 1%.
Proposes a knowledge-guided semantic computing network for better neural network performance.
problem Difficulties in designing, interpreting, and predicting neural network performance.
method Knowledge-guided semantic tree and data-driven neural network modules.
result Improved performance with fewer training samples and lower complexity.
COLEP improves robustness of conformal prediction via probabilistic circuits.
problem Adversarial perturbations can undermine the coverage guarantees of conformal prediction.
method COLEP uses probabilistic circuits to learn and reason about different semantic concepts, providing certifiable coverage guarantees.
result COLEP achieves higher prediction coverage and accuracy than a single model, especially with non-trivial knowledge models.
New method bounds membership inference attack success using mutual information.
problem Vulnerability of deep neural networks to membership inference attacks.
method Extended Fano's inequality to measure mutual information between inputs and activations.
result Empirical evaluation shows strong correlation between mutual information and model susceptibility.
This work makes deep neural networks more resilient to adversarial attacks.
problem Making deep neural networks more resilient to adversarial attacks in real-time systems.
method Used GTSRB dataset to craft adversarial samples, then attacked a Deep Convolutional Neural Network to build a more resilient network.
result Built a more robust deep neural network that can resist adversarial attacks.
CapsAttacks study imperceptible adversarial attacks on Capsule Networks, showing they can fool these networks.
problem Vulnerability of Capsule Networks to imperceptible adversarial attacks.
method Proposed a greedy algorithm for generating targeted imperceptible adversarial examples.
result Capsule Networks can be fooled by imperceptible adversarial attacks, similar to CNNs.
Capsule networks improve traffic sign detection accuracy.
problem Inability of CNNs to capture pose, view, orientation of traffic signs.
method Proposes capsule networks for traffic sign detection.
result Achieves 97.6% accuracy on GTSRB dataset.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
This paper explores security threats in ML systems and proposes mitigation techniques.
problem Security vulnerabilities in ML-based systems during training and inference.
method Overview of security threats, demonstrations using LeNet and VGGNet, proposed attack.
result Demonstrated security threats and proposed mitigation techniques.
Paper detects Trojan neural networks with limited or no data.
problem Robustness of DNNs against Trojan attacks in data-scarce scenarios.
method Proposes data-limited and data-free TrojanNet detectors.
result Demonstrates effectiveness of detectors on various datasets.
Novel 'strong neuron' improves deep learning efficiency and robustness.
problem Improving deep learning efficiency and robustness against adversarial attacks.
method Introducing a novel 'strong neuron' model and a constructive training algorithm.
result Achieved 10x-100x reduction in operations count and hardware requirements.
The Lethal Dose Conjecture limits how much poisoned data can be tolerated.
problem Limiting the impact of poisoned data in machine learning models.
method Theoretical analysis and provable defenses (DPA, FA) based on majority voting.
result DPA and FA are asymptotically optimal defenses against data poisoning.
ViTaX provides formal guarantees for targeted explanations in safety-critical systems.
problem Need trustworthy explanations for safety-critical deep neural networks.
method Formal reachability analysis for targeted, semifactual explanations.
result First method to provide formally guaranteed explanations of model resilience.
New loss function reduces adversarial examples by controlling Fisher information matrix eigenvalues.
problem Defending against adversarial attacks in neural networks.
method Adding a term to the loss function representing the trace of the Fisher information matrix.
result Effective and robust defensive capability, reducing adversarial example fooling ratio.
FAdeML shows pre-processing noise filters can mitigate adversarial attacks.
problem Lack of security in DNN-based ML systems due to adversarial attacks.
method Proposes FAdeML, a novel pre-processing noise Filter-aware Adversarial ML attack.
result Demonstrates that pre-processing noise filters can render ineffective most adversarial attacks.
A technique finds adversarial examples for deep neural networks using human perception.
problem Finding adversarial examples for deep neural networks without access to internal structure.
method Covariance Matrix Adaptation Evolution Strategy (CMA-ES) with perception-in-the-loop.
result CMA-ES can find adversarial examples with human feedback, showing favorable performance.