The paper shows how imitation learning can be exploited to extract DRL policies.
problem The confidentiality and integrity of DRL policies are vulnerable to model extraction attacks.
method Developed proof-of-concept attacks using imitation learning techniques.
result Demonstrated the feasibility of launching black-box attacks against DRL policies.
New technique crafts imperceivable sparse adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method Proposes a black-box technique to minimize l0-distance, integrating componentwise constraints. result Adversarial examples are almost imperceivable and non-detectable.
Approach to verify neural network training integrity.
problem Poisoning attacks during neural network training.
method Use of cryptographic mechanisms to verify training integrity.
result Provable verification of neural network training integrity.
Investigates the cost-effectiveness of security features in smart card chips.
problem Costs of adding security features to smart card chips.
method Examines production phases, costs, and security features.
result Security features are worth the cost due to potential damages from attacks.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
Enhances deep learning models' robustness against adversarial attacks.
problem Lack of reliable uncertainty estimates and robust defenses for deep learning models.
method Integrates Conformal Prediction principles with adversarial training.
result Introduces OPSA-AT, a defense strategy that enhances robustness and reliability.
Paper tackles fooling deep networks with minimal perturbations.
problem Easily fooling deep neural networks with high confidence predictions.
method Uses integrated adaptive gradients to generate minimal adversarial perturbations.
result Achieves minimal adversarial perturbations for fooling deep networks.
Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversaria…
Paper introduces class-oriented poisoning attacks to improve adversarial availability attacks.
problem Improving adversarial availability attacks on neural networks.
method Gradient-based framework for crafting poisoned images at the class level.
result Demonstrated effectiveness of class-oriented poisoning attacks on various models and datasets.
WM layer improves CNN robustness to noise and adversarial attacks.
problem CNNs' susceptibility to noise and adversarial attacks.
method WM layer as a generic architectural addition to CNNs.
result WM variants enhance robustness to noise and adversarial attacks.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
To promote secure and private artificial intelligence (SPAI), we review studies on the model security and data privacy of DNNs. Model security allows system to behave as intended without being affected by malicious external influences that can compromise its integrity and efficiency. Security attacks can be divided bas…
Graph deep learning models, such as graph convolutional networks (GCN) achieve remarkable performance for tasks on graph data. Similar to other types of deep models, graph deep learning models often suffer from adversarial attacks. However, compared with non-graph data, the discrete features, graph connections and diff…
Poisoning datasets can reveal private details of other users' training points.
problem Integrity and privacy of machine learning training data.
method Active inference attacks that poison a small fraction of the training dataset.
result Poisoning as little as 0.1% of the training dataset can significantly boost inference attacks.
Bayesian Optimization improves machine learning for detecting network attacks.
problem Detecting network attacks to secure critical information.
method Bayesian Optimization for tuning machine learning algorithms (SVM-RBF, RF, k-NN).
result The proposed framework achieves high accuracy and low false alarms.
Adapts IG for better feature attributions and robustness.
problem Reliability concerns in feature attributions for deep learning models.
method Adaptation of path-based feature attribution to Riemannian geometry of data manifolds.
result IG along geodesics generates more intuitive and robust explanations.
Research evaluates data poisoning attacks on regression learning and introduces a new defense strategy.
problem Data poisoning attacks on regression learning threaten model integrity in critical systems.
method Realistic scenarios, novel black-box attack, and evaluation on 26 datasets.
result Mean squared error (MSE) increases to 150% with only 2% poisoned samples.
Adversarial attacks on probabilistic state-space models affect latent state and policy decisions.
problem Robust reinforcement learning under adversarial observability.
method Analyzing adversarial attacks on linear probabilistic state-space models.
result Demonstrating the influence of adversarial observations on latent state and policy decisions.
P-BO reduces black-box adversarial attacks by 10x with Bayesian optimization and function prior.
problem Efficiently generating adversarial examples against black-box models.
method Prior-guided Bayesian Optimization (P-BO) with a function prior initialized from a surrogate model.
result Significantly reduces the number of queries needed for adversarial attacks.
Improves black-box adversarial attacks with a transfer-based prior.
problem Low attack success rates and poor query efficiency in black-box adversarial attacks.
method P-RGF method that integrates a transfer-based prior and query information.
result Significantly reduces the number of queries needed for successful attacks.
Reinforcement learning (RL) has advanced greatly in the past few years with the employment of effective deep neural networks (DNNs) on the policy networks. With the great effectiveness came serious vulnerability issues with DNNs that small adversarial perturbations on the input can change the output of the network. Sev…
Detects adversarial examples using attribution methods.
problem Detecting adversarial examples in machine learning models.
method Integrated Gradient method for finding attributions and masking high attribution features to define causal neighborhoods.
result Adversarial inputs are not robust to masking high attribution features, while benign inputs are.
Paper proposes a novel graph recovery attack from node embeddings.
problem Privacy risks of integrating graph embeddings with machine learning pipelines.
method Model-agnostic graph recovery attack exploiting preserved structural information in node embeddings.
result Adversaries can recover graph edges with decent accuracy from node embeddings alone.
This work surveys attacks and defenses on edge neural networks.
problem Security challenges of edge neural networks due to their compute and memory intensity, data-independence, and privacy risks.
method Taxonomy of attacks and defenses on edge-deployed neural networks.
result New security considerations and approaches are needed for edge DNNs.
Detects poisoned training samples in deep neural networks.
problem Data poisoning attacks on deep neural networks.
method Two approaches: parametric probability distributions and Bayesian deep neural networks.
result Uncertainty estimates from trained models can discriminate clean from poisoned samples.
New methods improve black-box adversarial attacks with fewer queries.
problem Efficiently craft adversarial examples without access to gradients.
method Prior-guided random gradient-free algorithms based on biased sampling and gradient averaging.
result Both methods require fewer queries and achieve higher success rates.
BadGD identifies gradient descent vulnerabilities through strategic backdoor attacks.
problem Gradient descent vulnerabilities through malicious data manipulation.
method Introduces Max RiskWarp, Max GradWarp, and Max GradDistWarp triggers to exploit gradient descent.
result Demonstrates how malicious triggers can significantly alter loss landscapes and gradient calculations.
We study the problem of generating adversarial examples in a black-box setting in which only loss-oracle access to a model is available. We introduce a framework that conceptually unifies much of the existing work on black-box attacks, and we demonstrate that the current state-of-the-art methods are optimal in a natura…
Paper tackles MIAs vulnerability by controlling FDR, providing guarantees on false discoveries.
problem Vulnerability of deep learning models to membership inference attacks (MIAs).
method Designs a novel membership inference attack method that provides FDR guarantees.
result Demonstrates the effectiveness of the method in various settings.
APGE protects graph node representations from inference attacks.
problem Privacy leakage in graph embedding methods.
method Adversarial training framework with disentangling and purging mechanisms.
result APGE preserves structural and utility attributes while concealing private information.
Paper proposes NeuroAttack to undermine SNNs security through bit-flips.
problem Security and reliability issues in SNNs.
method Cross-layer attack exploiting low-level reliability issues via adversarial input noise.
result Serious integrity threat to SNNs and DNNs.
Enhancement attacks can falsely improve machine learning model performance in biomedical research.
problem The trustworthiness of machine learning in biomedical research is threatened by enhancement attacks.
method Developed two techniques to enhance prediction performance with minimal changes to features.
result Falsely improved classifiers' accuracy from 50% to almost 100% while maintaining high feature similarities.
Synth-MIA assesses privacy leakage in synthetic tabular data models.
problem Challenges in evaluating privacy leakage in synthetic tabular data.
method Unified threat framework deploying multiple attacks.
result Higher synthetic data quality correlates with greater privacy leakage.
Deep neural networks (DNN)-based machine learning (ML) algorithms have recently emerged as the leading ML paradigm particularly for the task of classification due to their superior capability of learning efficiently from large datasets. The discovery of a number of well-known attacks such as dataset poisoning, adversar…
Fusion of robustness and uncertainty techniques improves adversarial defense.
problem Adversarial attacks on deep neural networks.
method Integrating uncertainty quantification into randomized smoothing for robustness guarantees.
result Improved robustness guarantees for uncertainty aware classifiers.
OTAD uses optimal transport to create robust models against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial perturbations.
method OTAD combines optimal transport and Lipschitz networks to create a robust model.
result OTAD outperforms other robust models on diverse datasets.
CheckNet verifies neural network inference on untrusted devices.
problem Ensuring secure and tamper-proof inference on untrusted devices.
method A checksum-based approach for neural network inference verification.
result Excellent attack detection and success bounds on various models.
New method generates universal adversarial perturbations across different image sources.
problem Certifying robustness of deep learning models with universal adversarial perturbations across various image sources.
method Few-shot learning approach using bilevel optimization and learning-to-optimize techniques.
result Improved attack success rate and faster performance compared to existing methods.
Efficient method defends privacy in federated learning without accuracy loss.
problem Privacy attacks on federated learning by reconstructing and identifying local data.
method Random noise perturbation method that allows recovery of true gradients.
result Strong privacy protection without sacrificing learning accuracy.
StealthRank subtly boosts LLM rankings without detectable anomalies.
problem Adversarial manipulation of LLM-driven ranking systems.
method Energy-based optimization with Langevin dynamics for stealthy prompt generation.
result StealthRank outperforms existing methods in covertly boosting rankings.
Advances AT with HE to improve model robustness.
problem Improving robustness of adversarially trained models.
method Regularizes features onto compact manifolds using hypersphere embedding.
result Integrating HE consistently enhances model robustness across various AT frameworks.
Generates multimodal safety-critical scenarios for robustness evaluation of decision-making algorithms.
problem Lack of comprehensive evaluation of neural network robustness under real-world scenarios.
method Proposes a flow-based multimodal scenario generator using weighted likelihood maximization and gradient-based sampling.
result Demonstrates improved testing efficiency and multimodal modeling capability compared to traditional methods.
Article evaluates AI security threats and proposes multiple measures.
problem Threats to AI integrity and security.
method Literature review, analysis of AI supply chain, discussion of mitigations.
result Multiple protective measures are necessary for AI security.
Recent studies have revealed the vulnerability of deep neural networks: A small adversarial perturbation that is imperceptible to human can easily make a well-trained deep neural network misclassify. This makes it unsafe to apply neural networks in security-critical applications. In this paper, we propose a new defense…
VERA-V uses variational inference to discover vulnerabilities in multimodal vision-language models.
problem Existing methods for jailbreaking vision-language models are brittle, limited, and focus on single attacks.
method VERA-V recasts jailbreak discovery as learning a joint posterior distribution over text-image prompts, using variational inference and three complementary strategies.
result VERA-V consistently outperforms state-of-the-art baselines, achieving up to 53.75% higher attack success rate.
ScoreAG generates unrestricted adversarial images maintaining semantic integrity.
problem Limited robustness evaluations due to ℓp-norm constraints. method Score-Based Adversarial Generation (ScoreAG) using score-based generative models.
result ScoreAG improves robustness assessments across multiple benchmarks.
ODENets are more robust to perturbations and adversarial attacks compared to CNNs.
problem Robustness of neural ODEs in the face of perturbations and adversarial attacks.
method Empirical study and theoretical analysis of ODENets' robustness properties.
result ODENets are more robust to random Gaussian perturbations and adversarial attacks compared to CNNs.
This paper detects multi-stage Feint Attacks using Bi-RNN and few-shot learning.
problem Detecting multi-stage Feint Attacks due to lack of professional datasets and semantic relationships.
method Fuzzy clustering for attack chain mining, few-shot deep learning, Bi-RNN for feature extraction.
result Accurately detected Feint Attacks using Bi-RNN and few-shot learning.