This paper creates imperceptible, effective audio adversarial examples for speech recognition.
problem Current adversarial examples in speech recognition are easily detectable and ineffective in real-world settings.
method Developed imperceptible audio adversarial examples using psychoacoustic masking and simulated environmental distortions.
result Successfully created imperceptible, targeted adversarial examples for speech recognition that are effective in real-world settings.
Localized uncertainty attacks target uncertain regions to create imperceptible adversarial examples.
problem Adversarial examples that are imperceptible to humans and strong under deterministic classifiers.
method Localized uncertainty attacks by perturbing uncertain regions, using predictive uncertainty or surrogate models.
result Localized uncertainty attacks produce strong adversarial examples that retain input similarity.
CapsAttacks study imperceptible adversarial attacks on Capsule Networks, showing they can fool these networks.
problem Vulnerability of Capsule Networks to imperceptible adversarial attacks.
method Proposed a greedy algorithm for generating targeted imperceptible adversarial examples.
result Capsule Networks can be fooled by imperceptible adversarial attacks, similar to CNNs.
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to aug…
Paper defends against adversarial videos by detecting and reducing imperceptible perturbations.
problem Adversarial videos can fool well-trained video classification models.
method Temporal consistency between frames and spatial denoising to detect and reduce perturbations.
result The proposed method significantly improves robustness against adversarial attacks.
We study the problem of finding a universal (image-agnostic) perturbation to fool machine learning (ML) classifiers (e.g., neural nets, decision tress) in the hard-label black-box setting. Recent work in adversarial ML in the white-box setting (model parameters are known) has shown that many state-of-the-art image clas…
Designing models that are robust to small adversarial perturbations of their inputs has proven remarkably difficult. In this work we show that the reverse problem---making models more vulnerable---is surprisingly easy. After presenting some proofs of concept on MNIST, we introduce a generic tilting attack that injects …
Machine learning methods in general and Deep Neural Networks in particular have shown to be vulnerable to adversarial perturbations. So far this phenomenon has mainly been studied in the context of whole-image classification. In this contribution, we analyse how adversarial perturbations can affect the task of semantic…
Universal audio perturbations fool ASR systems.
problem Speech recognition systems are vulnerable to adversarial attacks.
method Developed an algorithm to create universal perturbations that fool ASR models.
result Universal perturbations can fool ASR systems across different models.
Study on adversarial training's impact on deep neural reinforcement learning policies.
problem Vulnerability of deep neural reinforcement learning policies to imperceptible adversarial perturbations.
method Two parallel approaches: Fourier spectrum analysis and feature sensitivity measurement.
result Adversarially trained policies are more sensitive to low frequency perturbations.
Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art …
Neural networks are vulnerable to adversarial examples and researchers have proposed many heuristic attack and defense mechanisms. We address this problem through the principled lens of distributionally robust optimization, which guarantees performance under adversarial input perturbations. By considering a Lagrangian …
SEP uses checkpoints to protect data from training good models.
problem Protecting data from competitors training high-performance models.
method Forming perturbed examples using model checkpoints' gradients to ensure they are always unrecognized.
result SEP significantly reduces model accuracy when trained on perturbed data, demonstrating its effectiveness.
Despite achieving impressive performance, state-of-the-art classifiers remain highly vulnerable to small, imperceptible, adversarial perturbations. This vulnerability has proven empirically to be very intricate to address. In this paper, we study the phenomenon of adversarial perturbations under the assumption that the…
Game theory improves smart road sign security against small perturbations.
problem Ensuring smart road signs are secure from small-scale adversarial attacks.
method Integrates game theory into smart road sign classification to detect imperceptible perturbations.
result Proposes a randomized detection strategy to ensure robustness against worst-case attackers.
While deep learning is remarkably successful on perceptual tasks, it was also shown to be vulnerable to adversarial perturbations of the input. These perturbations denote noise added to the input that was generated specifically to fool the system while being quasi-imperceptible for humans. More severely, there even exi…
PAC-Bayesian bounds estimate adversarial robustness.
problem Estimating robustness to imperceptible input perturbations.
method PAC-Bayesian framework for averaging over hypotheses.
result General bounds valid for any type of adversarial attacks.
Deep Learning models are vulnerable to adversarial examples, i.e.\ images obtained via deliberate imperceptible perturbations, such that the model misclassifies them with high confidence. However, class confidence by itself is an incomplete picture of uncertainty. We therefore use principled Bayesian methods to capture…
We find ways to make physical signals misclassified by computer vision models.
problem Vulnerability of signal classifiers to adversarial perturbations in physical signals.
method Solving PDE-constrained optimization problems to construct imperceptible perturbations.
result Effective and physically realizable adversarial perturbations can be computed for machine learning models.
New approach to adversarial robustness with non-uniform perturbations.
problem Real-world adversaries craft adversarial examples with non-uniform perturbations.
method Proposes non-uniform perturbations based on feature dependencies and data distribution.
result Shows improved robustness to real-world attacks compared to uniform perturbations.
Paper discusses imperceptible attacks on tabular data models.
problem Security of machine learning models on tabular data.
method Formalizes imperceptibility of adversarial attacks, proposes an approach to generate imperceptible adversarial examples.
result Demonstrates ability to generate imperceptible adversarial examples with high fooling rate.
A new efficient PGD method generates smaller perturbation adversarial examples.
problem Adversarial examples in deep neural networks.
method Modified Project Gradient Descent (PGD) method for ensemble models.
result Generates smaller perturbation adversarial examples than PGD method.
Even todays most advanced machine learning models are easily fooled by almost imperceptible perturbations of their inputs. Foolbox is a new Python package to generate such adversarial perturbations and to quantify and compare the robustness of machine learning models. It is build around the idea that the most comparabl…
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
Improved algorithm speeds up generation of universal adversarial perturbations.
problem Slow generation of universal adversarial perturbations.
method Optimized algorithm based on orientation of perturbation vectors.
result Significantly faster generation of universal perturbations with higher fooling rates.
This paper analyzes β-Variational Classifiers for robustness and adversarial perturbation detection.
problem Limited robustness of deep neural networks in predictions.
method An analysis of β-Variational Classifiers, focusing on their robustness and adversarial perturbation detection. result Novel insights into the generative component of β-Variational Classifiers. Machine learning models have been shown vulnerable to adversarial attacks launched by adversarial examples which are carefully crafted by attacker to defeat classifiers. Deep learning models cannot escape the attack either. Most of adversarial attack methods are focused on success rate or perturbations size, while we a…
Develops new methods to create imperceptible image changes that fool classifiers.
problem Improving the robustness of image classifiers by creating subtle changes undetectable to humans.
method Two methods: Edge-Aware and Color-Aware, designed to reduce detectability of image perturbations.
result Demonstrated that the new methods effectively cause misclassification and are computationally efficient.
DIP-FAT improves adversarial training by diversifying perturbations.
problem Adversarial examples fool deep neural networks, leading to overfitting and poor performance.
method DIP-FAT uses random directions to diversify perturbations in adversarial training.
result DIP-FAT reduces overfitting and improves clean data accuracy.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
New approach makes adversarial examples less suspicious without changing perceptual salience.
problem Robustness of deep neural networks to unsuspicious adversarial examples.
method Splitting images into foreground and background, allowing larger perturbations in background while maintaining low cognitive salience.
result Dual-perturbation attacks are effective against classifiers robust to conventional attacks and adversarial training yields more robust classifiers.
Given the ability to directly manipulate image pixels in the digital input space, an adversary can easily generate imperceptible perturbations to fool a Deep Neural Network (DNN) image classifier, as demonstrated in prior work. In this work, we propose ShapeShifter, an attack that tackles the more challenging problem o…
Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
Paper defends against signal modulation detection attacks.
problem Minimizing intruder accuracy while maintaining receiver reliability.
method Adversarial perturbation of channel input symbols.
result Approach makes wireless communication secure with minimal performance loss.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
Detects adversarial examples with feature attribution differences.
problem Easily fooled by small adversarial perturbations in deep neural networks.
method Thresholding a scale estimate of feature attribution scores.
result Superior performance in distinguishing adversarial examples.
AdversarialPSO uses fewer queries to create high-success-rate adversarial examples.
problem Creating imperceptible adversarial examples with high success rates in black-box settings.
method AdversarialPSO, a black-box attack using Particle Swarm Optimization.
result Achieved high success rates (99.6% on CIFAR-10, 96.3% on MNIST, 82.0% on Imagenet) with fewer queries.
STRATA generates code adversarial examples efficiently without gradients.
problem Generating adversarial examples for code that retains functional meaning.
method Uses token frequency statistics to construct gradient-free adversarial examples.
result Empirically outperforms gradient-based methods with less information and effort.
AI-GAN generates realistic adversarial examples efficiently.
problem Efficient generation of perceptually realistic adversarial examples.
method A joint training of a generator, discriminator, and attacker.
result Achieves high attack success rates and reduces generation time.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
Low frequency perturbations improve model robustness, contrary to high frequency attacks.
problem Improving model robustness against adversarial attacks.
method Systematic control of frequency components in perturbations.
result Low frequency perturbations improve model robustness, especially in white-box and black-box settings.
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Pre-training deep RF classifiers with autoencoders mitigates adversarial attacks.
problem Adversarial examples in RF deep learning cause targeted misclassifications.
method Pre-training the classifier using an autoencoder.
result Pre-training method validates as a viable mitigation against adversarial attacks.
Classifiers fail to classify correctly input images that have been purposefully and imperceptibly perturbed to cause misclassification. This susceptability has been shown to be consistent across classifiers, regardless of their type, architecture or parameters. Common defenses against adversarial attacks modify the cla…
3D point cloud attacks examine how neural networks can be fooled.
problem Understanding how 3D neural networks can be exploited by attackers.
method Examined two categories of attacks: distributional and shape attacks.
result Some shape attacks can fool 3D point cloud classification models even after preprocessing.
TensorShield defends images from adversarial attacks using tensor decomposition.
problem Adversarial attacks on images can fool deep neural networks.
method Tensor decomposition to find low-rank approximations of images, reducing high-frequency perturbations.
result TensorShield outperforms existing methods like SLQ by 14% against FGSM attacks.
Adversarial examples are perturbed inputs designed to fool machine learning models. Most recent works on adversarial examples for image classification focus on directly modifying pixels with minor perturbations. A common requirement in all these works is that the malicious perturbations should be small enough (measured…
The susceptibility of deep learning to adversarial attack can be understood in the framework of the Renormalisation Group (RG) and the vulnerability of a specific network may be diagnosed provided the weights in each layer are known. An adversary with access to the inputs and outputs could train a second network to clo…