Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this …
This paper discusses adversarial attacks on cyber security systems using machine learning.
problem Adversarial attacks limit the use of machine learning in cyber security.
method Characterizes adversarial attack methods and their applications in cyber security.
result Highlights unique challenges and future research directions for adversarial attacks in cyber security.
This paper explores evasion attacks against Bayesian models.
problem Bayesian predictive models are vulnerable to evasion attacks.
method Developed gradient-based attacks for specific point predictions and entire posterior distributions.
result Optimal evasion attacks can be designed against Bayesian models.
Generative model creates poisoning attacks against machine learning classifiers.
problem Poisoning attacks degrade machine learning classifier performance.
method Generative Adversarial Net with generator, discriminator, and classifier components.
result Effectively compromises machine learning classifiers, including deep networks.
secml is a Python library for secure and explainable machine learning.
problem Evaluate and understand security and explainability of machine learning models.
method Implement attacks and explainability methods for various algorithms.
result Demonstrates how quickly models fail under adversarial perturbations and visualizes influential features.
This work develops secure distributed algorithms for machine learning to protect against data poisoning and network attacks.
problem Vulnerability of distributed machine learning algorithms to cyber threats.
method Game-theoretic framework to capture conflicting goals of a learner and an attacker, iterative distributed algorithm.
result Distributed SVM is prone to fail in different types of attacks, with impact depending on network structure and attack capabilities.
Machine learning-based IDSs in ICS are vulnerable to adversarial attacks that can bypass them.
problem Adversarial attacks on machine learning-based IDSs in ICS can lead to undetected cyber attacks.
method Used Jacobian-based Saliency Map attack to generate adversarial samples and explored adversarial training to improve model robustness.
result Classification performance of supervised models decreased by 16-20 percentage points with adversarial samples, but improved with adversarial training.
Optimal control theory applied to machine learning adversarial attacks.
problem Adversarial machine learning threats and detection challenges.
method Optimal control theory applied to machine learning systems.
result Advances in control theory and reinforcement learning can enhance adversarial machine learning research.
Survey of game theory methods to secure machine learning against adversarial attacks.
problem Adversarial attacks on machine learning algorithms in cybersecurity.
method Game theory framework to make algorithms robust against adversarial data.
result Survey of state-of-the-art techniques to secure machine learning.
SIGMA improves IDS robustness against new attacks using GAN and metaheuristics.
problem Lack of robustness in IDS against new, unseen attacks.
method SIGMA uses GAN and metaheuristics to generate adversarial examples and retrain IDS.
result SIGMA can improve IDS performance up to 100% after two rounds of improvement.
This study uses cloud telemetry to detect DoS attacks with machine learning.
problem Detecting DoS attacks in cloud environments is challenging.
method Use of machine learning algorithms on cloud telemetry data.
result k-Nearest Neighbors (kNN) and decision tree (CART) accurately identify DoS attacks.
Many machine learning algorithms are vulnerable to almost imperceptible perturbations of their inputs. So far it was unclear how much risk adversarial perturbations carry for the safety of real-world machine learning applications because most methods used to generate such perturbations rely either on detailed model inf…
A cascaded autoencoder defends machine learning models from adversarial attacks.
problem Adversarial attacks on machine learning models.
method Denoising and dimensionality reduction using cascaded autoencoders.
result Preprocessed data with cascaded autoencoder pipeline improves model accuracy against adversarial perturbations.
Regularization can improve machine learning models' robustness against poisoning attacks.
problem Poisoning attacks degrade machine learning models' performance by manipulating a fraction of the training data.
method Proposes a novel optimal attack formulation considering the effect of hyperparameters on regularization, leading to better evaluation of robustness.
result Demonstrates that L2 regularization can help mitigate the impact of poisoning attacks. Poisoning datasets can reveal private details of other users' training points.
problem Integrity and privacy of machine learning training data.
method Active inference attacks that poison a small fraction of the training dataset.
result Poisoning as little as 0.1% of the training dataset can significantly boost inference attacks.
Poisoning attacks can undermine fairness in machine learning models.
problem Poisoning attacks can introduce classification disparities among different groups in data.
method Developed a gradient-based poisoning attack framework to target algorithmic fairness.
result Demonstrated the effectiveness of poisoning attacks in both white-box and black-box scenarios.
Adversarial edit attacks improve machine learning model security for tree data.
problem Improving security of machine learning models for tree-structured data.
method Extends adversarial attacks to tree-structured data using tree edit distance and black-box queries.
result Many tree classifiers can be effectively attacked, demonstrating the vulnerability of these models.
This paper reviews adversarial attacks on ML and DL models.
problem Adversarial attacks on ML and DL models.
method Review of existing adversarial attacks and perturbations.
result Comprehensive understanding of adversarial security attacks on ML and DL.
Bayesian Optimization improves machine learning for detecting network attacks.
problem Detecting network attacks to secure critical information.
method Bayesian Optimization for tuning machine learning algorithms (SVM-RBF, RF, k-NN).
result The proposed framework achieves high accuracy and low false alarms.
As the prevalence and everyday use of machine learning algorithms, along with our reliance on these algorithms grow dramatically, so do the efforts to attack and undermine these algorithms with malicious intent, resulting in a growing interest in adversarial machine learning. A number of approaches have been developed …
This work explores limits of machine learning robustness against adversarial attacks.
problem Fundamental limits of adversarial learning without specific attack methods.
method Information-theoretic analysis of learning from noisy data.
result General bounds on adversarial learning without assuming specific attack methods.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Interpreting machine learning models helps understand adversarial attacks and defenses.
problem Understanding model vulnerability to adversarial attacks.
method Model interpretation techniques to explore adversarial attacks and defenses.
result Interpretation methods can be applied to adversarial attacks and defenses.
Defends against ML inference attacks using adversarial examples.
problem Automated inference attacks using ML classifiers pose privacy and security threats.
method Turns ML classifier vulnerabilities into defenses by adding adversarial noise to public data.
result Adversarial examples can mislead ML classifiers and protect private data.
Paper proposes a new method to attack Bayesian forecasting models.
problem Lack of research on adversarial attacks against time series forecasting systems.
method Decision analysis based attacking strategy for Bayesian forecasting models.
result Demonstrates the vulnerability of Bayesian forecasting models to adversarial attacks.
Survey of adversarial examples in visual machine learning models.
problem Vulnerability of machine learning models to adversarial examples.
method Exploration of various adversarial attack and defense methods.
result Understanding of adversarial attack and defense mechanisms.
Machine learning has become an important component for many systems and applications including computer vision, spam filtering, malware and network intrusion detection, among others. Despite the capabilities of machine learning algorithms to extract valuable information from data and produce accurate predictions, it ha…
Paper tackles Byzantine attacks in Federated Learning by clustering and robustifying.
problem Adversarial attacks from Byzantine machines in Federated Learning.
method Iterative Federated Clustering Algorithm (IFCA) with trimmed mean and median aggregation.
result Improved convergence rate for strongly convex loss functions in Byzantine-Robust IFCA.
This research secures deployed sentiment analysis models by identifying and defending against attack vectors.
problem Securing deployed machine learning models, particularly sentiment analysis systems, from adversarial attacks.
method BAD (Build, Attack, Defend) Architecture, evaluating two implementations.
result Demonstrated a viable methodology for securing machine learning models in production.
Study adversarial attacks on automated trading systems.
problem Robustness of deep learning models in algorithmic trading.
method New attacks with size constraints to evaluate model robustness.
result Realistic adversarial attacks can fool automated trading systems.
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
Paper assesses holistic risks of inference attacks on ML models.
problem Lack of comprehensive risk assessment of inference attacks on ML models.
method Presented a threat model taxonomy for four inference attacks on five model architectures and four image datasets.
result Complexity of training dataset influences attack performance; model stealing and membership inference attacks are negatively correlated.
Proposes a query-efficient blackbox attack method.
problem Adversarial attacks on machine learning models, especially deep neural networks.
method QEBA: Query-Efficient Boundary-based blackbox Attack, using only final prediction labels.
result QEBA achieves 100% attack success rate with fewer queries and lower perturbation.
Establishing unique identities for both humans and end systems has been an active research problem in the security community, giving rise to innovative machine learning-based authentication techniques. Although such techniques offer an automated method to establish identity, they have not been vetted against sophistica…
Efficient framework for training machine learning models at edge without data movement.
problem Lack of privacy-preserving and computationally efficient methods for deep learning model training.
method Privacy preserving FedCollabNN framework for federated learning.
result Framework is computationally efficient and robust against adversarial attacks.
Enhancement attacks can falsely improve machine learning model performance in biomedical research.
problem The trustworthiness of machine learning in biomedical research is threatened by enhancement attacks.
method Developed two techniques to enhance prediction performance with minimal changes to features.
result Falsely improved classifiers' accuracy from 50% to almost 100% while maintaining high feature similarities.
Study shows flipping a small subset of labels can severely damage machine learning models.
problem Adversarial attacks on distributed machine learning models.
method Formalized label flipping attacks, proposed a greedy algorithm, demonstrated with logistic regression models.
result A budget of only 0.1% of labels at each training step can reduce model accuracy by 6%, and some models can perform worse than random guessing when up to 25% of labels are flipped.
Enhanced attacks quantify machine learning data leakage.
problem Quantifying how much machine learning models reveal about their training data.
method Hypothesis testing framework for membership inference attacks.
result New attacks achieve higher true positive rates with lower false positive rates.
Study shows AmI attacks are not robust to adversarial examples.
problem Robustness of AmI attacks to adversarial examples.
method Evaluation of AmI attacks on adversarial examples.
result AmI attacks are not robust to adversarial examples.
PASE method protects machine learning models from membership inference attacks without significant accuracy loss.
problem Membership inference attacks on machine learning models.
method Switching ensembles approach to mitigate privacy leakage.
result PASE method provides effective privacy protection with minimal accuracy penalty.
Regularization helps protect machine learning models from poisoning attacks.
problem Mitigating the impact of poisoned data on machine learning models.
method Distributionally-robust optimization using Wasserstein distance to find an upper bound for worst-case fitness.
result The regularizer is equal to the dual norm of the model parameters for regression models.
Fair machine learning models can be vulnerable to adversarial attacks that reduce their accuracy and fairness.
problem Fairness constraints in machine learning models can compromise their robustness against adversarial attacks.
method Analysis of data poisoning attacks on group-based fair machine learning models, focusing on equalized odds.
result Adversaries can significantly reduce the test accuracy of fair machine learning models and widen their fairness gap.
Adversarial attacks can manipulate ML-aided visualizations, tricking analysts.
problem Adversarial attacks on ML-aided visualizations.
method Identifying attack surface and exemplifying five adversarial attacks.
result Adversaries can induce various attacks, like creating arbitrary and deceptive visualizations.
Paper presents strong black-box attacks on unsupervised clustering models.
problem Adversarial attacks on unsupervised machine learning models.
method Iterative black-box attack on clustering algorithms.
result Adversarial samples can fool clustering algorithms irrespective of the algorithm used.
VarDetect monitors API queries to detect model extraction attacks.
problem Attackers can extract ML models through API queries.
method VarDetect uses a modified variational autoencoder to track and detect attacker samples.
result VarDetect successfully detects and raises alarms for model extraction attacks.
Machine learning has become one of the main components for task automation in many application domains. Despite the advancements and impressive achievements of machine learning, it has been shown that learning algorithms can be compromised by attackers both at training and test time. Machine learning systems are especi…
New research shows that the dimension gap between intrinsic and ambient dimensions affects adversarial vulnerability of machine learning models.
problem The mystery of adversarial attacks on machine learning models.
method Introducing two types of adversarial attacks and proving their relationship to the dimension gap.
result The dimension gap between intrinsic and ambient dimensions makes clean-trained models more vulnerable to off-manifold adversarial perturbations.