Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
Modern machine learning algorithms perform poorly on adversarially manipulated data. Adversarial risk quantifies the error of classifiers in adversarial settings; adversarial classifiers minimize adversarial risk. In this paper, we analyze adversarial risk and adversarial classifiers from an optimal transport perspecti…
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Paper tackles robustness in adversarial noise with a meta-optimizer.
problem Sensitivity to adversarial noise hinders machine learning deployment.
method Meta-optimizer learns to robustly optimize models using adversarial examples.
result Meta-optimizer transfers adversarial knowledge to new models without generating new examples.
Robust RL with learned optimal adversary improves agent performance under adversarial state observations.
problem Ensuring reinforcement learning agents' robustness against adversarial perturbations of state observations.
method Proposed a framework of alternating training with learned adversaries (ATLA) to find optimal adversarial policies and enhance agent robustness.
result ATLA achieves state-of-the-art performance under strong adversaries in continuous control environments.
Paper improves adversarial training using a learned optimizer.
problem Improving robustness of deep learning models against adversarial attacks.
method Empirically identified PGD attack's limitations and used a learning-to-learn framework to train an adaptive inner optimizer.
result The proposed framework consistently improves model robustness over traditional adversarial training methods.
The paper examines how neural network topology affects adversarial robustness.
problem Understanding how neural network topology influences adversarial robustness.
method Investigated the graph of input traversing all layers of a neural network, comparing clean and adversarial inputs.
result Under-optimized edges in neural network graphs are a source of adversarial vulnerability and can be used to detect adversarial inputs.
New algorithm optimally identifies best arm in both stochastic and adversarial settings.
problem Best arm identification in stochastic and adversarial reward scenarios.
method Parameter-free algorithm designed to be robust to adversarial rewards and optimal in stochastic problems.
result Algorithm's error rate matches optimal bounds in stochastic problems and is robust to adversarial rewards.
Optimal adversarial attacks minimize mutual information, revealing classifier vulnerabilities.
problem Designing optimal attacks to degrade machine learning performance.
method Information-theoretic approach to finding optimal perturbations.
result Optimal attacks minimize mutual information between degraded and original signals.
Free adversarial training reduces the generalization gap compared to vanilla method.
problem Improving generalization in adversarial training.
method Analysis of algorithmic stability in free adversarial training.
result Free adversarial training shows a lower generalization gap.
I describe an optimal control view of adversarial machine learning, where the dynamical system is the machine learner, the input are adversarial actions, and the control costs are defined by the adversary's goals to do harm and be hard to detect. This view encompasses many types of adversarial machine learning, includi…
This paper examines various definitions of adversarial risk and their implications.
problem Quantifying the performance of classifiers under adversarial perturbations.
method Optimal transport, robust statistics, functional analysis, and game theory.
result Generalization of Strassen's theorem and new connections to Choquet capacities and game theory.
Optimizes deep learning training by treating it as an optimal control problem.
problem Fragility of deep neural networks to adversarial inputs.
method Formulates adversarial training as a min-max optimization problem and interprets it as an optimal control problem.
result Provides the first convergence analysis of adversarial training algorithm.
Detecting adversarial examples currently stands as one of the biggest challenges in the field of deep learning. Adversarial attacks, which produce adversarial examples, increase the prediction likelihood of a target class for a particular data point. During this process, the adversarial example can be further optimized…
This study shows how optimizer choice affects adversarial robustness in neural networks.
problem Understanding and improving adversarial robustness in neural networks.
method Revisiting known results linking robust classifiers and minimum norm solutions, combining them with recent optimizer bias findings.
result Achieving both perfect standard accuracy and robustness with certain optimizers under specific conditions.
SOAR improves deep networks' robustness against adversarial examples.
problem Improving deep neural networks' robustness against adversarial examples.
method Formulated adversarial robustness problem under robust optimization framework, approximated loss function using second-order Taylor series expansion.
result SOAR significantly improves robustness of networks against adversarial perturbations.
New reformulations for multiclass classification problems using optimal transport.
problem Adversarial multiclass classification problems.
method Multimarginal optimal transport formulation.
result Reveals geometric structure and extends binary classification results.
Improved online convex optimization bounds between stochastic and adversarial settings.
problem Understanding optimization tasks that are neither i.i.d. nor fully adversarial.
method Establishing novel regret bounds exploiting smoothness of expected losses.
result Regret bounds improve on previous results by reducing dependence on maximum gradient length to variance of gradients.
New bounds for online convex optimization between stochastic and adversarial settings.
problem Understanding optimization tasks that are neither i.i.d. nor fully adversarial.
method Establishing novel regret bounds exploiting smoothness of expected losses.
result Regret bounds match expected rates in the fully i.i.d. case and gracefully deteriorate in the fully adversarial case.
Improved DL models robust against adversarial attacks for wireless signal classification.
problem Adversarial attacks on deep learning-based wireless signal classifiers.
method Knowledge distillation and network pruning followed by adversarial training.
result Proposed models achieve better robustness and higher accuracy than standard models.
Optimizes quantile and semi-adversarial regret with novel root-logarithmic regularizers.
problem Minimizes regret in adversarial and semi-adversarial online learning.
method FTRL with root-logarithmic regularizers for quantile and semi-adversarial settings.
result Achieves minimax optimal regret bounds in both paradigms.
In this paper, we investigate the adversarial robustness of multivariate M-Estimators. In the considered model, after observing the whole dataset, an adversary can modify all data points with the goal of maximizing inference errors. We use adversarial influence function (AIF) to measure the asymptotic rate at which t…
Adversarial CBO optimizes under interventions by adversaries and non-stationarities.
problem Optimizing in the presence of adversaries and non-stationary factors.
method Formalizes CBO as ACBO, introduces CBO-MW algorithm combining online learning and causal modeling.
result First algorithm with bounded regret for ACBO, achieving superior performance in synthetic and real-world environments.
Adversarial training provides a principled approach for training robust neural networks. From an optimization perspective, adversarial training is essentially solving a bilevel optimization problem. The leader problem is trying to learn a robust classifier, while the follower problem is trying to generate adversarial s…
A new method removes policy optimization in adversarial imitation learning.
problem Adversarial imitation learning's delicate alternated optimization.
method Explicitly condition discriminator on two policies, solving generator's optimization problem directly.
result Simpler approach competitive to prevalent methods.
Study statistical guarantees for DRO with OT and OT-regularized divergences.
problem Enhancing adversarial robustness in machine learning models.
method Derive concentration inequalities for supervised learning via DRO-based adversarial training.
result First to cover soft-constraint costs and reweighting mechanisms in adversarial training.
NTK neural networks are robust to adversarial attacks in nonparametric regression.
problem Adversarial robustness of neural networks in nonparametric regression.
method Gradient flow with early stopping for NTK neural networks, proving robustness in Sobolev spaces.
result NTK neural networks achieve optimal adversarial robustness rates in Sobolev spaces.
The study sets limits on how robust classifiers can be against adversarial attacks.
problem Understanding the limits of robustness in classification models against adversarial attacks.
method Utilized optimal transport theory to derive variational formulae and explicit lower-bounds on Bayes-optimal error.
result Explicit lower-bounds on the Bayes-optimal error for distance-based attacks, universal in geometry of class-conditional distributions.
Study on conditions for Bayes optimal classifier in adversarial robustness.
problem Existence of Bayes optimal classifier for adversarial robustness.
method General sufficient conditions for existence of Bayes optimal classifier.
result Guaranteed existence of Bayes optimal classifier under certain conditions.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
New approach optimizes policies in adversarial MDPs using adversarial learning.
problem Optimizing policies in adversarial Markov decision processes.
method Adversarial learning on advantage functions, extending previous reductions.
result Stronger regret criteria and performance guarantees for policy optimization.
This paper is concerned with the defense of deep models against adversarial attacks. Inspired by the certificate defense approach, we propose a maximal adversarial distortion (MAD) optimization method for robustifying deep networks. MAD captures the idea of increasing separability of class clusters in the embedding spa…
New method enhances adversarial robustness of deep learning models.
problem Improving the robustness of deep learning models against adversarial attacks.
method Optimal transport regularized divergences applied to distributionally robust optimization.
result Improved adversarial robustness on CIFAR-10 and CIFAR-100 datasets.
Smoothness analysis of adversarial training reveals L∞ constraints cause more non-smoothness.
problem Non-smoothness of adversarial training loss function.
method Analyzed the smoothness of adversarial training loss function using optimal attacks for model parameters.
result The L∞ constraint causes more non-smoothness than L2 constraint. This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
Paper shows MoM is optimal under adversarial contamination for certain distributions.
problem Optimality of MoM under adversarial contamination.
method Upper and lower bounds for MoM's error under adversarial contamination.
result MoM is (minimax) optimal for distributions with finite variance and infinite variance with finite absolute moments.
Study on Pareto optimality in multi-objective bandit problems.
problem Pareto optimality in multi-objective multi-armed bandit problems.
method Formulated adversarial multi-objective multi-armed bandit, defined Pareto regrets, presented algorithms, established upper and lower bounds.
result New algorithms are optimal in adversarial settings and nearly optimal in stochastic settings.
Efficient algorithms speed up adversarial training for linear models.
problem Adversarial training for linear models is computationally expensive.
method Tailored optimization algorithms for regression and classification.
result Significantly faster convergence rates for large-scale problems.
Paper provides optimal statistical guarantees for adversarial robustness in Gaussian classification.
problem Understanding statistical risks for adversarial robustness in Gaussian classification models.
method Established minimax lower bounds and designed an efficient estimator for excess risk.
result Optimal minimax guarantees for excess risk under Gaussian mixture model with AdvSNR.
Analyzes adversarial training's impact on loss landscape, proposing PAS to improve model performance.
problem Challenges in optimizing models under adversarial training due to loss landscape properties.
method Analytical studies of adversarial loss functions, numerical analyses, PAS strategy.
result Adversarial training impairs optimization, but PAS strategy improves model performance.
AdvImmune improves certifiable robustness of GNNs against adversarial attacks.
problem Vulnerability of graph neural networks to adversarial attacks.
method Proposes AdvImmune, an algorithm that optimizes with meta-gradient to improve certifiable robustness.
result Remarkably improves the ratio of robust nodes by 12%, 42%, 65% with an affordable immune budget of only 5% edges.
Study stabilizes adversarial training in neural networks over infinite-dimensional spaces.
problem Stability issues in adversarial training of neural networks.
method Functional analysis of minimax optimization over infinite-dimensional spaces of continuous functions and probability measures.
result Convergence property of minimax problems under certain conditions, interpreted as stabilization techniques.
New algorithm achieves both static and dynamic regret optimally against an oblivious adversary for deterministic losses.
problem Achieving optimal static and dynamic regret simultaneously in adversarial bandits.
method Extends impossibility result to deterministic losses, uses negative static regret and Blackwell approachability.
result First algorithm achieving optimal static and dynamic regret simultaneously against an oblivious adversary.
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
New algorithms improve robust estimation in contaminated Gaussian models.
problem Simultaneous estimation of location and variance matrix in contaminated Gaussian models.
method Tractable adversarial algorithms with spline discriminators for robust estimation.
result Achieve minimax optimal rates or near-optimal rates under Huber's contamination model.
We focus on the problem of black-box adversarial attacks, where the aim is to generate adversarial examples using information limited to loss function evaluations of input-output pairs. We use Bayesian optimization~(BO) to specifically cater to scenarios involving low query budgets to develop query efficient adversaria…
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
This paper investigates recently proposed approaches for defending against adversarial examples and evaluating adversarial robustness. We motivate 'adversarial risk' as an objective for achieving models robust to worst-case inputs. We then frame commonly used attacks and evaluation metrics as defining a tractable surro…