EBM life cycle project improves MCMC for image generation, defense, and density modeling.
problem Improving MCMC for diverse EBM applications.
method Three novel MCMC initialization methods for negative samples.
result State-of-the-art performance gains across three applications.
Paper examines test-time smoothing defenses against adversarial examples.
problem Adversarial examples can mislead neural networks, compromising robustness.
method Evaluates various test-time smoothing defenses on ImageNet.
result Non-monotonic relation between attacks and defenses, large variance among samples.
In this paper, we develop improved techniques for defending against adversarial examples at scale. First, we implement the state of the art version of adversarial training at unprecedented scale on ImageNet and investigate whether it remains effective in this setting - an important open scientific question (Athalye et …
PatchGuard defends against localized adversarial patches with provable robustness.
problem Localized adversarial patches induce misclassification in machine learning models.
method PatchGuard uses CNNs with small receptive fields and robust masking to detect and mask corrupted features.
result PatchGuard achieves state-of-the-art provable robust accuracy and clean accuracy.
New framework evaluates model robustness against diverse, unforeseen attacks.
problem Real-world adversarial robustness is harder to assess than research suggests.
method ImageNet-UA framework for evaluating robustness against diverse, unseen attacks.
result Standard robustness measures fail to capture unforeseen robustness.
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set…
Random Gaussian noise and pixel discretization improve image classifier robustness.
problem Whitebox adversarial attacks decrease classifier accuracy.
method Inject random Gaussian noise, discretize pixels, and use any classifier.
result Reduces KL divergence and lower bound on classifier accuracy.
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
Paper presents a defense framework against adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Cross-layer strategic ensemble defense with input and output transformations.
result Strategic ensemble defense achieves high defense success rates and robustness.
Automates perturbation analysis for neural networks, enabling certified robustness on complex architectures.
problem Limited applicability of existing perturbation analysis methods to complex neural network architectures.
method Developed an automatic framework to generalize LiRPA algorithms to any neural network structure, enabling loss fusion and state-of-the-art certified defense results.
result Demonstrated LiRPA based certified defense on Tiny ImageNet and Downscaled ImageNet.
This paper benchmarks neural network robustness to corruptions and perturbations.
problem Establishing benchmarks for image classifier robustness to corruptions and perturbations.
method Developed ImageNet-C and ImageNet-P datasets to evaluate robustness to corruptions and perturbations, not adversarial attacks.
result There are negligible changes in relative corruption robustness from AlexNet to ResNet classifiers.
Aggregation defenses improve deep learning models' robustness against data poisoning attacks.
problem Data poisoning attacks manipulate deep learning models with malicious training samples.
method Deep Partition Aggregation, efficiency improvements, data-to-complexity ratio, poisoning overfitting phenomenon.
result Aggregation defenses boost poisoning robustness through the poisoning overfitting phenomenon.
New method improves neural network interpretability against adversarial attacks.
problem Adversarial attacks can hide from neural network interpretability methods.
method Develops an interpretability-aware defensive scheme promoting robust interpretation.
result Achieves both robust classification and robust interpretation.
ME-Net defends neural nets against adversarial attacks by reconstructing images.
problem Adversarial attacks on deep neural networks.
method ME-Net uses matrix estimation to preprocess images, destroying adversarial noise while preserving global structure.
result ME-Net consistently outperforms state-of-the-art defenses on various benchmarks.
Low frequency perturbations improve model robustness, contrary to high frequency attacks.
problem Improving model robustness against adversarial attacks.
method Systematic control of frequency components in perturbations.
result Low frequency perturbations improve model robustness, especially in white-box and black-box settings.
TensorShield defends images from adversarial attacks using tensor decomposition.
problem Adversarial attacks on images can fool deep neural networks.
method Tensor decomposition to find low-rank approximations of images, reducing high-frequency perturbations.
result TensorShield outperforms existing methods like SLQ by 14% against FGSM attacks.
Wide adoption of artificial neural networks in various domains has led to an increasing interest in defending adversarial attacks against them. Preprocessing defense methods such as pixel discretization are particularly attractive in practice due to their simplicity, low computational overhead, and applicability to var…
Defends classifiers from adversarial attacks using self-supervised data estimation.
problem Protecting classifiers from adversarial attacks with full attacker access.
method RIDE, a self-supervised learning algorithm for individual data estimation.
result Significant improvement in adversarial defense performance (98%, 76%, 43% test accuracy on MNIST, CIFAR-10, and ImageNet datasets respectively).
Recent work on adversarial attack and defense suggests that PGD is a universal l∞ first-order attack, and PGD adversarial training can significantly improve network robustness against a wide range of first-order l∞-bounded attacks, represented as the state-of-the-art defense method. However, an obvious …
New method defends against unseen threat models using perceptual adversarial training.
problem Lack of precise mathematical characterization of human perception in adversarial attacks.
method Adversarial training against the set of all imperceptible adversarial examples approximated by deep neural networks.
result Perceptual Adversarial Training (PAT) achieves state-of-the-art robustness against multiple diverse adversarial attacks.
Denoised smoothing defends pretrained classifiers against adversarial attacks.
problem Adversarial attacks on pretrained classifiers.
method Prepending a denoiser to any off-the-shelf classifier using randomized smoothing.
result Guaranteed ℓp-robustness to adversarial examples without modifying the pretrained classifier. The existence of adversarial data examples has drawn significant attention in the deep-learning community; such data are seemingly minimally perturbed relative to the original data, but lead to very different outputs from a deep-learning algorithm. Although a significant body of work on developing defensive models has …
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Free adversarial training improves robustness without generating adversarial examples.
problem Training robust models against adversarial attacks is costly and impractical for large-scale datasets.
method Recycles gradient information from parameter updates to generate adversarial examples.
result Free adversarial training achieves comparable robustness to PGD training at negligible cost.
Certifiable defense method improves robustness of deep learning interpretation.
problem Vulnerability of gradient-based saliency maps to adversarial attacks.
method Sparsified SmoothGrad method, extending certifiably robust smooth classifier bounds.
result Sparsified SmoothGrad method is certifiably robust against adversarial perturbations.
Transform images with adversarial examples for robust classification.
problem Adversarial examples mislead deep neural networks in image classification.
method Transform input images with adversarial examples from a pre-trained model.
result Significantly more robust against a wide range of attacks compared to state-of-the-art methods.
We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ℓ2 norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robu…
Study shows transfer of adversarial robustness between different perturbation types is limited.
problem Understanding adversarial robustness across various perturbation types.
method Evaluated 32 attacks of 5 different types on models trained on a subset of ImageNet.
result Adversarial robustness transfer between perturbation types is limited and depends on the specific type of perturbation.
A novel method using saliency maps detects adversarial attacks effectively.
problem Vulnerability of neural networks to adversarial attacks.
method Combining saliency maps with additional noises and inconsistency strategy.
result High detection success rate of adversarial attacks on various datasets.
Advances AT with HE to improve model robustness.
problem Improving robustness of adversarially trained models.
method Regularizes features onto compact manifolds using hypersphere embedding.
result Integrating HE consistently enhances model robustness across various AT frameworks.
During the last years, a remarkable breakthrough has been made in AI domain thanks to artificial deep neural networks that achieved a great success in many machine learning tasks in computer vision, natural language processing, speech recognition, malware detection and so on. However, they are highly vulnerable to easi…
Study shows dataset properties impact adversarial machine learning robustness.
problem Vulnerability of DNNs to adversarial attacks.
method Examined five datasets, analyzed input size and contrast effects.
result Input size and contrast significantly influence adversarial success.
Advances adversarial training of smoothed classifiers for robust deep learning.
problem Building neural network classifiers robust to adversarial attacks.
method Adversarial training of randomized smoothed classifiers with an adapted attack.
result Significantly outperforms existing provably robust classifiers on ImageNet and CIFAR-10.
New method certifies robustness to sparse adversarial attacks.
problem Ensuring robustness of classifiers to sparse adversarial attacks.
method Randomized ablation of input features to provide robustness guarantees.
result Certifies robustness to sparse adversarial attacks with up to 31 pixels of distortion.
Making neural networks robust against adversarial inputs has resulted in an arms race between new defenses and attacks. The most promising defenses, adversarially robust training and verifiably robust training, have limitations that restrict their practical applications. The adversarially robust training only makes the…
Unify gradients to improve deep networks' robustness against black-box attacks.
problem Defending against score-based query attacks (SQAs) in deep neural networks.
method Unifying Gradients (UniG) to provide universal attack perturbations.
result Significantly improves real-world robustness of deep networks without sacrificing clean accuracy.
New method improves robustness of smoothed classifiers.
problem Improving accuracy and robustness of smoothed classifiers.
method Regularized risk with adaptive regularization.
result Tighter robustness bounds with high probability.
A new method aggregates generative classifiers to resist adversarial attacks.
problem Adversarial attacks on deep neural networks.
method Rank-aggregating ensemble of generative classifiers trained on intermediate layer responses.
result The ensemble of generative classifiers shows robustness to adversarial attacks.
Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model'…
Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black…
Paper proposes AoA, a new adversarial attack method that significantly increases transferability.
problem Developing universal adversarial attacks on deep neural networks.
method AoA attacks the semantic property of attention in DNNs, enhancing transferability by altering the loss function.
result AoA generates adversarial samples that defeat 13 well-trained DNNs, achieving over 85% error rate.
CLEVER (Cross-Lipschitz Extreme Value for nEtwork Robustness) is an Extreme Value Theory (EVT) based robustness score for large-scale deep neural networks (DNNs). In this paper, we propose two extensions on this robustness score. First, we provide a new formal robustness guarantee for classifier functions that are twic…
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
ATHENA builds flexible defenses against adversarial attacks.
problem Extensive research on adversarial attacks is domain-specific and cannot be easily extended.
method Designing an extensible framework based on diverse weak defenses.
result Comprehensive empirical study demonstrates the effectiveness of ATHENA.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
Simple noise training improves image recognition robustness.
problem Modern neural networks struggle with unseen image corruptions.
method Additive Gaussian and Speckle noise training, adversarial training against worst-case noise.
result Significant improvement in robustness on ImageNet-C and MNIST-C benchmarks.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks.