We introduce a new metric to evaluate corruption robustness of ML classifiers.
problem Evaluating corruption robustness of machine learning classifiers.
method We propose a test data augmentation method using minimal class separation distance to derive a robustness distance ε and a metric MSCR.
result The MSCR metric allows interpretable comparison of classifier robustness on different datasets.
Regularization improves robustness of smoothed classifiers.
problem Certifying robustness of smoothed classifiers.
method Regularizing prediction consistency over Gaussian noise.
result Significantly improved certified robustness with less training costs.
Develops fair classifiers robust to training distribution perturbations.
problem Ensuring fairness in classifiers robust to training data perturbations.
method Formulates a min-max objective function to minimize distributionally robust training loss while maintaining fairness for perturbed distributions. Uses an iterative online learning algorithm to find a fair and robust classifier.
result Our classifier maintains fairness and accuracy for a wide range of perturbations compared to state-of-the-art fair classifiers.
Simple classifiers can't be robust to adversarial perturbations, but more complex ones can.
problem The gap between standard accuracy and robustness to adversarial attacks.
method Theoretical examples and quantitative analysis of classification tasks.
result There is a trade-off between robustness and standard accuracy among simple classifiers.
New method improves robustness of smoothed classifiers against adversarial attacks.
problem Improving robustness of smoothed classifiers against adversarial attacks.
method Proposes worst-case adversarial loss over input distributions as a robustness certificate, and uses duality and smoothness properties to provide an easy-to-compute upper bound.
result Shows superior robustness performance over state-of-the-art certified or heuristic methods.
Study improves image classifier robustness to random p-norm corruptions.
problem Improving robustness of image classifiers to real-world imperceptible corruptions.
method Training and testing with random p-norm corruptions, evaluating robustness against different p-norms.
result Training with a combination of p-norm corruptions significantly improves robustness.
New robustness metric helps select reliable classifiers.
problem Evaluating reliability of classifier predictions.
method Proposed new robustness metric for any classifier and feature type.
result Demonstrated ability to distinguish reliable from unreliable predictions.
This paper benchmarks neural network robustness to corruptions and perturbations.
problem Establishing benchmarks for image classifier robustness to corruptions and perturbations.
method Developed ImageNet-C and ImageNet-P datasets to evaluate robustness to corruptions and perturbations, not adversarial attacks.
result There are negligible changes in relative corruption robustness from AlexNet to ResNet classifiers.
Study shows computational limits for robust classification tasks, leading to cryptographic implications.
problem Computational limitations in learning robust classifiers for classification tasks.
method Extending previous work on statistical/computational tradeoffs, using average-case hard functions and one-way functions.
result Computational hardness of learning robust classifiers even when efficient non-robust classifiers exist.
Advances adversarial training of smoothed classifiers for robust deep learning.
problem Building neural network classifiers robust to adversarial attacks.
method Adversarial training of randomized smoothed classifiers with an adapted attack.
result Significantly outperforms existing provably robust classifiers on ImageNet and CIFAR-10.
New AM regularization improves both accuracy and robustness.
problem Lack of robustness in deep neural networks.
method Average margin (AM) regularization for margin classifiers or deep neural networks.
result AM regularization can improve both accuracy and robustness to adversarial attacks.
The paper verifies the robustness of classifier ensembles against randomized attacks.
problem Ensuring classifier ensembles are robust against arbitrary randomized attacks.
method Formal verification procedure using SMT and MILP encodings to assess robustness.
result Proves the NP-hardness of the robustness-checking problem and provides upper bounds on attack sets.
Motivated by safety-critical applications, test-time attacks on classifiers via adversarial examples has recently received a great deal of attention. However, there is a general lack of understanding on why adversarial examples arise; whether they originate due to inherent properties of data or due to lack of training …
New defense method for non-parametric classifiers robust against adversarial attacks.
problem Lack of robustness in non-parametric classifiers against adversarial attacks.
method Adversarial pruning method to preprocess datasets and a novel attack.
result Adversarial pruning provides a robust defense for non-parametric classifiers.
We study the robustness of classifiers to various kinds of random noise models. In particular, we consider noise drawn uniformly from the ℓ_p ball for p∈[1,∞] and Gaussian noise with an arbitrary covariance matrix. We characterize this robustness to random noise in terms of the distance to the decisio…
Proposes a new method to measure classifier robustness.
problem Measuring robustness of classifiers is crucial but challenging.
method Weighting sample importance based on difficulty and using logistic regression as a theoretical case study.
result The proposed score is independent of sample choice and measures robustness effectively.
Proposes a method to extract robust features that improve classifier robustness.
problem Improving classifier robustness to small perturbations in input space.
method Introduces an additional penalty term in the information bottleneck framework to minimize Fisher information, optimizing a variational bound using stochastic gradient descent.
result Optimally robust features are jointly Gaussian, and the method produces classifiers with increased robustness to perturbations.
Detecting adversarial examples is as hard as classifying them.
problem The difficulty of detecting adversarial examples in machine learning models.
method Proved a general hardness reduction between detection and classification of adversarial examples.
result The hardness reduction implies that detecting adversarial examples is computationally infeasible.
Study proves existence of robust classifiers in multiclass adversarial training.
problem Proves existence of robust classifiers in multiclass adversarial training.
method Three models of adversarial training in multiclass classification, proving existence of Borel measurable robust classifiers.
result Proves existence of Borel measurable robust classifiers in each model.
A single robust classifier handles complex image synthesis tasks.
problem Challenging image synthesis tasks.
method Adversarial robustness training of a single classifier.
result Direct manipulation of salient features in input images.
Paper benchmarks neural network robustness to corruptions and surface variations.
problem Establishing benchmarks for image classifier robustness to corruptions and surface variations.
method Developed ImageNet-C and Icons-50 datasets to evaluate and improve robustness.
result Negligible changes in relative corruption robustness from AlexNet to ResNet, but methods to enhance robustness were discovered.
New method improves robustness of smoothed classifiers.
problem Improving accuracy and robustness of smoothed classifiers.
method Regularized risk with adaptive regularization.
result Tighter robustness bounds with high probability.
Several recent works have shown that state-of-the-art classifiers are vulnerable to worst-case (i.e., adversarial) perturbations of the datapoints. On the other hand, it has been empirically observed that these same classifiers are relatively robust to random noise. In this paper, we propose to study a \textit{semi-ran…
This work introduces new ways to compare adversarial robustness of classifiers globally.
problem The limitations of point-wise measures in comparing adversarial robustness.
method Robustness curves and scale analysis to uncover global properties of robustness.
result Point-wise measures fail to capture important global properties of adversarial robustness.
A new approach to make classifiers safer by allowing them to abstain from making decisions on adversarial inputs.
problem Making machine learning systems robust against adversarial attacks, especially in safety-critical applications.
method Introducing a novel objective function and a simple baseline for adversarial robustness with abstention, followed by CARL (Combined Abstention Robustness Learning) for joint classifier and abstention region learning.
result Training with CARL results in a more accurate, robust, and efficient classifier than a simple baseline.
Paper develops robust SVM classifiers for uncertain data.
problem Sensitivity of SVM classifiers to data uncertainty.
method Two probabilistic approaches: Single Perturbation and Extreme Empirical Loss.
result Both methods reduce data uncertainty effects efficiently.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
Work on making classifiers robust against adversarial attacks for top-k predictions.
problem Vulnerability of classifiers to adversarial perturbations, especially for top-k predictions.
method Randomized smoothing to turn any classifier into a robust one, using Gaussian noise.
result Derives a tight robustness in ℓ2 norm for top-k predictions, achieving 62.8% certified top-5 accuracy on ImageNet.
RS-Del provides robustness for sequence classifiers against edit distance attacks.
problem Certifying robustness of discrete sequence classifiers against edit distance attacks.
method Randomized deletion (RS-Del) for discrete sequence classifiers, focusing on edit distance-bounded adversaries.
result Achieved a certified accuracy of 91% at an edit distance radius of 128 bytes on malware detection.
The goal of this paper is to analyze an intriguing phenomenon recently discovered in deep networks, namely their instability to adversarial perturbations (Szegedy et. al., 2014). We provide a theoretical framework for analyzing the robustness of classifiers to adversarial perturbations, and show fundamental upper bound…
New finding: Perceptually-aligned gradients occur in adversarially-robust classifiers.
problem Understanding adversarial robustness in neural networks.
method Investigated perceptual alignment in adversarially-trained and smoothed classifiers.
result Perceptually-aligned gradients are a general property of robust classifiers.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
Framework improves text classification under budget constraints.
problem Building robust text classifiers with limited computational resources.
method Jointly trains a selector to identify relevant words and passes them to a classifier, with a data aggregation scheme.
result Improves classifier performance and speeds up model with minimal accuracy loss.
Bayes-optimal classifiers are robust to adversarial attacks, unlike CNNs trained on the same data.
problem The vulnerability of modern CNN classifiers to adversarial examples.
method Constructing realistic image datasets and deriving analytic conditions for Bayes-optimal classifiers.
result Bayes-optimal classifiers are robust to adversarial attacks, unlike CNNs trained on the same data.
Simpler classifiers are more robust to adversarial perturbations.
problem Vulnerability of deep neural networks to small adversarial perturbations.
method Investigating the connection between simplicity and robustness in classifiers.
result Simpler classifiers (fewer output classes) are less susceptible to adversarial perturbations.
There is a rising interest in studying the robustness of deep neural network classifiers against adversaries, with both advanced attack and defence techniques being actively developed. However, most recent work focuses on discriminative classifiers, which only model the conditional distribution of the labels given the …
Guarantees robustness of Gaussian process classifiers against adversarial attacks.
problem Protecting machine learning classifiers from adversarial perturbations.
method Developed an adversarial bound (AB) for Gaussian process classifiers, providing a formal guarantee of robustness.
result Proves that the proposed method produces a practical, useful, and provably robust classifier.
Robust GQDA improves classification accuracy in non-Normal data.
problem Non-robustness of GQDA under data contamination.
method Introduced robust estimators for mean vector and dispersion matrix.
result Robust GQDA classifiers perform significantly better in real data applications.
Unhinged loss minimization fails to improve classifier accuracy for simple data.
problem Accuracy of classifiers minimizing the unhinged loss.
method Minimizing the unhinged loss function.
result Minimizing the unhinged loss yields classifiers with accuracy no better than random guessing for simple data.
This study examines when non-parametric methods are robust to adversarial examples.
problem Understanding when non-parametric methods are robust to adversarial examples.
method Examined general non-parametric methods and established conditions for r-consistency.
result Non-parametric methods like nearest neighbors and kernel classifiers are r-consistent when data is well-separated, while histograms are not.
Certified robustness for ImageNet models with randomized smoothing.
problem Creating robust models against adversarial attacks.
method Randomized smoothing with Gaussian noise.
result Certified top-1 accuracy of 49% on ImageNet under small ℓ2 perturbations. Generates confident out-of-distribution samples to improve classifier robustness.
problem Overconfidence in deep learning models on out-of-distribution inputs.
method Uses a GAN to generate out-of-distribution samples that the classifier is confident on, maximizing entropy.
result Shows effectiveness on handwritten characters and natural images datasets.
A new method combines classifiers using possibility distributions and adaptive t-norms.
problem Aggregating predictions from multiple classifiers trained on overlapping datasets.
method Proposes a new approach to aggregate classifier predictions using possibility theory and adaptive t-norms.
result Proves the proposed approach possesses desirable robustness properties.
The paper provides robustness guarantees for classifiers under Gaussian noise and discrete adversaries.
problem Ensuring robustness of classifiers against adversarial attacks.
method Explores robustness guarantees for ensembles of classifiers under Gaussian noise and discrete adversaries, tightening the guarantees with specific assumptions.
result The paper offers robustness guarantees and associated algorithms for discrete adversaries, demonstrating their effectiveness on image and molecule datasets.
The paper explores robust classifiers for imbalanced Gaussian data.
problem Adversarial robustness in machine learning with imbalanced data.
method Developed exact and approximate Bayes-optimal robust classifiers for Gaussian classification problems.
result Revealed fundamental tradeoffs between standard and robust accuracy.
Randomized classifiers outperform deterministic ones in robustness against adversarial attacks.
problem Ensuring optimal robustness against all adversarial attacks.
method Game-theoretic approach, focusing on the non-existence of Nash equilibrium in deterministic classifiers and demonstrating the superiority of randomized classifiers.
result Randomized classifiers can outperform deterministic ones in robustness against adversarial attacks.
Denoised smoothing defends pretrained classifiers against adversarial attacks.
problem Adversarial attacks on pretrained classifiers.
method Prepending a denoiser to any off-the-shelf classifier using randomized smoothing.
result Guaranteed ℓp-robustness to adversarial examples without modifying the pretrained classifier. Recent work has shown that state-of-the-art classifiers are quite brittle, in the sense that a small adversarial change of an originally with high confidence correctly classified input leads to a wrong classification again with high confidence. This raises concerns that such classifiers are vulnerable to attacks and ca…