Perturbative GAN reduces training complexity and improves image quality.
problem Training complexity and image quality in GANs.
method Replaces convolution layers with perturbation layers that add fixed noise masks.
result Higher inception score and faster convergence of generated images.
Minimal token perturbations reveal how Transformer models process information.
problem Understanding information propagation in Transformer models for interpretability.
method Study of minimal token perturbations on embedding space.
result Rare tokens cause larger shifts, and input information mixes deeper.
This work presents a novel approach to train invertible linear layers by adding rank-one perturbations.
problem Training invertible linear layers during optimization with gradient-based methods is challenging.
method Train rank-one perturbations and add them to weight matrices infrequently, keeping track of inverses and determinants.
result Invertible linear layers improve mixing and mode separation in normalizing flows.
Semantify-NN verifies neural network robustness against semantic perturbations.
problem Verifying robustness of neural networks against semantic adversarial attacks.
method Inserting semantic perturbation layers (SP-layers) into neural networks to verify robustness.
result Semantify-NN significantly improves robustness verification performance over ℓp-norm-based methods. Wide networks learn from adversarial perturbations effectively.
problem Understanding why adversarial examples deceive classifiers and transfer between models.
method Assumed wide two-layer networks, proved with theoretical analysis.
result Adversarial perturbations contain class-specific features for networks to generalize.
New method μP2 improves neural network training by scaling perturbations layerwise.
problem Improving neural network performance as models scale up.
method Layerwise perturbation scaling in the infinite-width limit of neural networks.
result Layerwise perturbation scaling ensures all layers are effectively perturbed in the limit.
In this paper, we take the first steps towards a novel unified framework for the analysis of perturbations in both the Time and Frequency domains. The identification of type and source of such perturbations is fundamental for monitoring reactor cores and guarantee safety while running at nominal conditions. A 3D Convol…
Adversarial training has been shown to regularize deep neural networks in addition to increasing their robustness to adversarial examples. However, its impact on very deep state of the art networks has not been fully investigated. In this paper, we present an efficient approach to perform adversarial training by pertur…
Paper analyzes GCNN sensitivity to probabilistic graph perturbations.
problem Investigating how GCNNs handle probabilistic graph errors.
method Establishes error bounds and linear relationships between GSO perturbations and GCNN outputs.
result GCNNs maintain stability under graph edge perturbations if GSO errors are bounded.
A new framework explains GNN predictions by simulating graph structure and feature changes.
problem Lack of transparency in GNN predictions hinders understanding.
method TraP2 framework using a three-layer architecture: Translation, Perturbation, and Paraphrase layers.
result TraP2 achieves 10.2% higher explanation accuracy than state-of-the-art methods.
Two-layer networks trained on low-dimensional subspaces are vulnerable to adversarial examples.
problem Vulnerability of two-layer neural networks to adversarial examples on low-dimensional subspaces.
method Analysis of gradient behavior and effect of initialization scale and regularization.
result Decreasing initialization scale or adding L2 regularization can improve robustness to adversarial perturbations orthogonal to the data.
This work uses Lyapunov theory to improve the robustness of deep neural networks against adversarial attacks.
problem Vulnerability of deep neural networks to subtle adversarial perturbations.
method Treated each layer as a nonlinear dynamical system and used Lyapunov theory for stability and robustness.
result Developed empirically tight bounds on adversarial perturbations and proved stability and robustness globally.
State-of-the-art machine learning models frequently misclassify inputs that have been perturbed in an adversarial manner. Adversarial perturbations generated for a given input and a specific classifier often seem to be effective on other inputs and even different classifiers. In other words, adversarial perturbations s…
Inserts proximal mapping into deep networks for better regularization.
problem Effective regularization of deep learning models to handle adversarial perturbations and correlations between modalities.
method Proposes a new layer that directly produces regularized hidden layer outputs using proximal mapping.
result Outperforms state-of-the-art methods in robust temporal learning and multiview modeling.
Detects adversarial perturbations in DNNs with minimum uncertainty metrics.
problem Limited safety in DNNs due to small adversarial perturbations.
method Randomized approach using minimum uncertainty metrics at hidden layers.
result Developed a novel detector with no extra training overhead.
Lower class selectivity makes networks more robust to natural perturbations but more vulnerable to adversarial attacks.
problem Understanding how class selectivity affects robustness to different types of perturbations in neural networks.
method Investigated the relationship between class selectivity and robustness to natural and adversarial perturbations in neural networks.
result Lower class selectivity increases robustness to natural perturbations but decreases robustness to adversarial attacks.
New method improves blackbox attack transferability by perturbing feature hierarchy.
problem Improving transferability of blackbox attacks across different models and datasets.
method Perturbs representations throughout feature hierarchy to mimic other classes.
result Achieves 10x increase in targeted success rate compared to other methods.
Improved neural network convergence with causal Bayesian modeling in retail performance.
problem Improving neural network convergence in retail performance models.
method Causal Bayesian neural network implementation, removal of weakest SEM path, Flipout layers, Vadam optimizer.
result Neural network convergence improved with removal of the weakest SEM path.
New research evaluates various perturbation methods for improving neural network robustness.
problem Understanding and improving robustness of Convolutional Neural Networks (CNNs) against adversarial attacks.
method Detailed evaluation of five main perturbation-based defenses, comparing random and deterministic approaches.
result Perturbation-based defenses are equivalent in efficacy, and attacks transfer between them.
New SAM method improves model robustness with spectral inner perturbation and Muon optimizer.
problem Improving model robustness to small parameter perturbations.
method Introducing a spectral inner perturbation step in SAM combined with Muon optimizer.
result Spectral inner perturbation combined with Muon optimizer achieves best validation accuracy on ImageNet-1K.
One pixel can significantly alter deep neural network outputs, revealing propagation patterns and vulnerability hotspots.
problem Understanding how a single pixel modification affects deep neural networks.
method Propagation Maps and locality analysis to visualize and understand the impact of pixel modifications.
result One pixel modifications can propagate through deep networks, affecting the final output and revealing vulnerability patterns.
Most random ReLU networks are vulnerable to small, Euclidean adversarial perturbations.
problem Vulnerability of ReLU networks to adversarial attacks.
method Analysis of random ReLU networks with decreasing dimensions, using gradient flow and descent.
result Most examples can be perturbed by small Euclidean distances via gradient methods.
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
A new approach to maximum likelihood learning of discrete graphical models and RBM in particular is introduced. Our method, Perturb and Descend (PD) is inspired by two ideas (I) perturb and MAP method for sampling (II) learning by Contrastive Divergence minimization. In contrast to perturb and MAP, PD leverages trainin…
Despite their impressive performance, deep convolutional neural networks (CNNs) have been shown to be sensitive to small adversarial perturbations. These nuisances, which one can barely notice, are powerful enough to fool sophisticated and well performing classifiers, leading to ridiculous misclassification results. In…
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
The paper introduces extremal perturbations for better attribution analysis in deep networks.
problem Identifying input parts responsible for model outputs.
method Extremal perturbations, smooth masks, and technical innovations for computation.
result Demonstrates excellent sensitivity to spatial properties of deep neural networks.
Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples may be overfit to exploit the particular architecture and …
Noise injection before gradient steps helps in regularization for neural networks.
problem Improving generalization in overparametrized neural networks.
method Injecting small noise perturbations before computing gradient steps, especially in layer-wise fashion.
result Small noise perturbations can explicitly regularize neural networks without variance explosion.
New method improves adversarial training robustness.
problem Lack of tight upper bounds for adversarial training.
method Holistic expansion of the network for upper bound minimization.
result RUB and aRUB methods are more robust than state-of-the-art methods.
We consider a classifier whose test set is exposed to various perturbations that are not present in the training set. These test samples still contain enough features to map them to the same class as their unperturbed counterpart. Current architectures exhibit rapid degradation of accuracy when trained on standard data…
Study reveals conditions for neural networks to forget learned features.
problem Understanding feature unlearning in neural networks.
method Infinite-width limit analysis with stochastic gradient descent, fast-slow dynamics.
result Conditions for feature unlearning are determined by the strength of nonlinear terms and initial weights.
New method preserves privacy while detecting communities in distributed networks.
problem Privacy-preserving community detection in locally distributed multi-layer networks.
method Privacy-preserving Distributed Spectral Clustering (ppDSC) using randomized response mechanism.
result Developed a novel algorithm that maintains community structure while protecting privacy.
Adding node feature kernels improves GCN robustness to graph perturbations.
problem GCNs' robustness to graph perturbations is a concern.
method Introduced random GCN and added node feature kernels to message passing.
result Perturbations of the graph structure can significantly degrade GCN performance.
Analyzes how ReLU affects neural network capacity and solution space geometry.
problem Understanding the effects of ReLU on neural network capacity and solution space.
method Analytical and numerical studies of two-layer neural networks with ReLU activations.
result The capacity of ReLU networks remains finite as the number of hidden neurons increases, unlike for threshold units.
Machine Learning models are vulnerable to adversarial attacks that rely on perturbing the input data. This work proposes a novel strategy using Autoencoder Deep Neural Networks to defend a machine learning model against two gradient-based attacks: The Fast Gradient Sign attack and Fast Gradient attack. First we use an …
A two-layer network corrects logits to defend adversarial attacks.
problem Detecting and defending adversarial attacks on deep learning models.
method A two-layer network trained on mixed logits to recover original predictions.
result Shows promising results in defense with high accuracy and interpretability.
A hierarchical model shows how scaling laws emerge from sequential feature recovery.
problem Emergence of scaling laws from feature learning in multi-layer networks.
method Layer-wise spectral algorithm adapted to compositional structure, sequential feature detection.
result Sequential detection of latent features, leading to explicit power-law decay of prediction error.
New method makes neural networks more secure by protecting latent layers from adversarial attacks.
problem Vulnerability of latent layers in adversarially trained models to small perturbations.
method Latent Adversarial Training (LAT) and Latent Attack (LA) algorithms.
result Improves adversarial accuracy by 1-2% on MNIST, CIFAR-10, CIFAR-100 datasets.
Enhances robustness of AT frameworks to multiple perturbations without increasing training complexity.
problem Defending against the union of multiple perturbations in adversarial training.
method SNAP technique that augments a network with shaped noise to enhance robustness.
result 14%-to-20% improvement in adversarial accuracy for ResNet-18 on CIFAR-10.
Given the ability to directly manipulate image pixels in the digital input space, an adversary can easily generate imperceptible perturbations to fool a Deep Neural Network (DNN) image classifier, as demonstrated in prior work. In this work, we propose ShapeShifter, an attack that tackles the more challenging problem o…
Recent research showed that deep neural networks are highly sensitive to so-called adversarial perturbations, which are tiny perturbations of the input data purposely designed to fool a machine learning classifier. Most classification models, including deep learning models, are highly vulnerable to adversarial attacks.…
Layer-wise Relevance Propagation (LRP) and saliency maps have been recently used to explain the predictions of Deep Learning models, specifically in the domain of text classification. Given different attribution-based explanations to highlight relevant words for a predicted class label, experiments based on word deleti…
The study examines neural networks with random weights and biases, finding that depth-to-width ratio controls fluctuations and correlations.
problem Exploring the exploding and vanishing gradient problem in neural networks with random weights and biases.
method Sharp estimates of joint cumulants and solving cumulant recursions in powers of 1/n.
result The depth-to-width ratio L/n plays a crucial role in controlling fluctuations and correlations, leading to the occurrence of exploding and vanishing gradients. This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
Enhances adversarial example transferability by fine-tuning existing examples.
problem Adversarial examples are often overfit to a source model, limiting black-box transferability.
method Intermediate Level Attack (ILA) fine-tunes adversarial examples on a pre-specified layer of the source model.
result ILAs achieve high transferability to target models without knowledge of their architecture.
Finite-width neural networks use non-Gaussian priors, extending Gaussian process theory.
problem Understanding the behavior of neural networks with finite width.
method Perturbative extension of Gaussian process theory to finite-width neural networks, tracking preactivation distributions.
result Non-Gaussian processes as priors in finite-width neural networks.
Paper presents a defense framework against adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Cross-layer strategic ensemble defense with input and output transformations.
result Strategic ensemble defense achieves high defense success rates and robustness.