Semantify-NN verifies neural network robustness against semantic perturbations.
problem Verifying robustness of neural networks against semantic adversarial attacks.
method Inserting semantic perturbation layers (SP-layers) into neural networks to verify robustness.
result Semantify-NN significantly improves robustness verification performance over ℓp-norm-based methods. Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
Improved generalization with semantic perturbations using normalizing flows.
problem Overfitting in deep neural networks training.
method Use normalizing flows for generating semantically meaningful perturbations in latent space.
result Achieved 96.6% test accuracy on CIFAR-10 with ResNet-18, outperforming existing methods.
While progress has been made in crafting visually imperceptible adversarial examples, constructing semantically meaningful ones remains a challenge. In this paper, we propose a framework to generate semantics preserving adversarial examples. First, we present a manifold learning method to capture the semantics of the i…
Deep neural networks have been demonstrated to be vulnerable to adversarial attacks, where small perturbations intentionally added to the original inputs can fool the classifier. In this paper, we propose a defense method, Featurized Bidirectional Generative Adversarial Networks (FBGAN), to extract the semantic feature…
Machine learning methods in general and Deep Neural Networks in particular have shown to be vulnerable to adversarial perturbations. So far this phenomenon has mainly been studied in the context of whole-image classification. In this contribution, we analyse how adversarial perturbations can affect the task of semantic…
Paper proposes a method to generate adversarial perturbations for black-box attacks without accessing inner states.
problem Generating adversarial perturbations for black-box attacks without accessing inner states of a DNN.
method Matrix-free generation method that requires fewer query trials.
result The proposed method successfully deceives a DNN for semantic segmentation more effectively than random noise.
Introduces PCG for better counterfactual explanations in vision models.
problem Ambiguity in latent-space optimization methods for counterfactual explanations.
method Constructs counterfactuals by tracing geodesics under a perceptually Riemannian metric.
result PCG outperforms baselines and reveals hidden failure modes.
DBPA assesses LLM perturbations using frequentist hypothesis testing.
problem Quantifying input perturbation impacts on LLM outputs.
method DBPA reformulates perturbation analysis as frequentist hypothesis testing, using Monte Carlo sampling for empirical null and alternative distributions.
result DBPA provides interpretable p-values and scalar effect sizes for LLM perturbations.
While deep learning is remarkably successful on perceptual tasks, it was also shown to be vulnerable to adversarial perturbations of the input. These perturbations denote noise added to the input that was generated specifically to fool the system while being quasi-imperceptible for humans. More severely, there even exi…
Convolutional Neural Networks have been a subject of great importance over the past decade and great strides have been made in their utility for producing state of the art performance in many computer vision problems. However, the behavior of deep networks is yet to be fully understood and is still an active area of re…
ScoreAG generates unrestricted adversarial images maintaining semantic integrity.
problem Limited robustness evaluations due to ℓp-norm constraints. method Score-Based Adversarial Generation (ScoreAG) using score-based generative models.
result ScoreAG improves robustness assessments across multiple benchmarks.
Unified framework TSS certifies robustness against semantic transformations.
problem Certifying robustness of ML models against semantic transformations.
method Unified framework TSS categorizes transformations into resolvable and differentially resolvable, proposing randomized smoothing and stratified sampling strategies.
result Significantly outperforms state of the art on over ten types of semantic transformations.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
The paper introduces a method to improve adversarial robustness in neural networks using randomized perturbations.
problem Deep neural networks are sensitive to small perturbations on correctly classified examples, leading to erroneous predictions.
method The approach uses randomized perturbations to optimize the worst case loss function over all possible substitutions of training examples, ensuring that substitution likelihood is weighted by the proximity to the original word.
result The method achieves performance gains and differentially-private model training, improving robustness against adversarial attacks.
This paper proposes a new method to improve adversarial robustness of DNNs by focusing on semantic information.
problem Vulnerability of deep neural networks to adversarial attacks.
method Region adversarial training (RAT) that generates a single adversarial perturbation carrying semantic information.
result RAT greatly improves adversarial robustness with a small dataset and defends against FGSM attacks.
Lower class selectivity makes networks more robust to natural perturbations but more vulnerable to adversarial attacks.
problem Understanding how class selectivity affects robustness to different types of perturbations in neural networks.
method Investigated the relationship between class selectivity and robustness to natural and adversarial perturbations in neural networks.
result Lower class selectivity increases robustness to natural perturbations but decreases robustness to adversarial attacks.
In this paper, we propose novel generative models for creating adversarial examples, slightly perturbed images resembling natural images but maliciously crafted to fool pre-trained models. We present trainable deep neural networks for transforming images to adversarial perturbations. Our proposed models can produce ima…
Recently, generating adversarial examples has become an important means of measuring robustness of a deep learning model. Adversarial examples help us identify the susceptibilities of the model and further counter those vulnerabilities by applying adversarial training techniques. In natural language domain, small pertu…
Classifiers such as deep neural networks have been shown to be vulnerable against adversarial perturbations on problems with high-dimensional input space. While adversarial training improves the robustness of image classifiers against such adversarial perturbations, it leaves them sensitive to perturbations on a non-ne…
Framework quantifies financial NLP robustness under regime shifts.
problem Semantic and causal drift in financial news narratives.
method Four metrics: FCAS, PCS, TSV, NLICS.
result Transformer models are more affected by semantic drift.
Study makes code models robust to small changes that keep functionality.
problem Vulnerability of deep neural networks to adversarial examples in source code.
method Defined a powerful adversary and adversarial training to learn robust models.
result Significant gains in robustness demonstrated across different languages and architectures.
New approach to adversarial robustness with non-uniform perturbations.
problem Real-world adversaries craft adversarial examples with non-uniform perturbations.
method Proposes non-uniform perturbations based on feature dependencies and data distribution.
result Shows improved robustness to real-world attacks compared to uniform perturbations.
SAVeD detects dataset versions without metadata, improving accuracy and separation.
problem Difficulty in identifying similar versions of structured datasets.
method Contrastive learning with modified SimCLR pipeline, generating and contrasting augmented table views.
result SAVeD achieves higher accuracy and separation scores on unseen tables.
A new method improves language model extrapolation without changing training.
problem Improving language model performance on sequences not seen during training.
method Perturbation-based training procedure for language models.
result The method consistently improves out-of-support prediction.
Recently, Convolutional Neural Networks (CNNs) demonstrate a considerable vulnerability to adversarial attacks, which can be easily misled by adversarial perturbations. With more aggressive methods proposed, adversarial attacks can be also applied to the physical world, causing practical issues to various CNN powered a…
This paper explores tradeoffs between invariance and sensitivity in adversarial examples.
problem Understanding the limitations of existing adversarial defenses.
method Study of invariance-based adversarial examples and their impact on model accuracy.
result Adversarial defenses against sensitivity-based attacks can harm invariance-based attacks, necessitating new approaches.
iGCL preserves graph semantics in latent space augmentations.
problem Manual tuning of augmentation ratios and unexpected graph changes.
method iGCL uses a Variational Graph Auto-Encoder to learn augmentations in the latent space, optimizing an upper bound for contrastive loss.
result iGCL achieves state-of-the-art performance on graph-level and node-level tasks.
Charmer improves character-level adversarial attacks for language models.
problem Efficiency and effectiveness of character-level adversarial attacks for language models.
method Query-based adversarial attack method that maintains semantic similarity.
result Charmer achieves high attack success rate and similar adversarial examples.
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmann…
Speech processing systems rely on robust feature extraction to handle phonetic and semantic variations found in natural language. While techniques exist for desensitizing features to common noise patterns produced by Speech-to-Text (STT) and Text-to-Speech (TTS) systems, the question remains how to best leverage state-…
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
This paper introduces metrics to evaluate robustness of neural networks to natural adversarial examples.
problem Measuring robustness of neural networks to natural adversarial examples.
method Proposes latent space performance metrics based on generative models.
result Latent adversarial perturbations are often perceptually small and associated with classifier accuracy.
Adversarial tweets can fool stock prediction models, causing financial loss.
problem Vulnerability of stock prediction models to adversarial attacks on social media.
method Solving combinatorial optimization problems with semantic and budget constraints to generate adversarial tweets.
result Adversarial tweets can fool stock prediction models and cause significant financial loss.
Semantic paraphrases can fool financial sentiment classifiers due to geometric shifts in model representations.
problem Semantic paraphrase attacks on financial sentiment classifiers
method Developing a continuous local model of semantic paraphrase perturbations
result The worst-case local displacement of the target representation is governed by the largest generalised eigenvalue of a matrix pencil constructed from the Jacobians of the two embedding maps.
Class selectivity affects robustness to corruptions but not to adversarial attacks.
problem Understanding the relationship between class selectivity and robustness in neural networks.
method Investigated the impact of class selectivity on robustness to natural corruptions and adversarial attacks using Tiny ImageNetC and CIFAR10C datasets.
result Decreasing class selectivity increases robustness to both natural corruptions and adversarial attacks.
FHBI enhances generalization in Bayesian inference with iterative steps in functional spaces.
problem Improving generalization in Bayesian inference models.
method Iterative two-step procedure with adversarial and functional descent steps in a reproducing kernel Hilbert space.
result FHBI consistently outperforms nine baseline methods on the VTAB-1K benchmark.
The state-of-the-art performance of deep learning algorithms has led to a considerable increase in the utilization of machine learning in security-sensitive and critical applications. However, it has recently been shown that a small and carefully crafted perturbation in the input space can completely fool a deep model.…
Generating and eliminating adversarial examples has been an intriguing topic in the field of deep learning. While previous research verified that adversarial attacks are often fragile and can be defended via image-level processing, it remains unclear how high-level features are perturbed by such attacks. We investigate…
Improved genetic programming by optimizing mutation operators for continuous program search.
problem Small syntactic mutations in genetic programming can lead to unpredictable behavioral shifts.
method Learned a compact trading-strategy DSL, created a block-factorized embedding, and designed geometry-compiled mutation operators.
result Geometry-compiled mutation operators discover strong strategies using fewer evaluations and achieve higher Sharpe ratios.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
Recent research has made the surprising finding that state-of-the-art deep learning models sometimes fail to generalize to small variations of the input. Adversarial training has been shown to be an effective approach to overcome this problem. However, its application has been limited to enforcing invariance to analyti…
Study assesses deep neural networks' robustness in mammogram images.
problem Understanding deep neural networks' robustness in mammogram images for breast cancer screening.
method Measuring sensitivity to four perturbations and analyzing low-pass filtering effects.
result Mammogram image classifiers are sensitive to perturbations similar to natural images, but low-pass filtering degrades clinically meaningful features.
The paper shows how to learn causal representations with few environments and finite samples.
problem Learning causal representations from limited data and environments.
method Explicit, finite-sample guarantees with a logarithmic number of interventions.
result Consistent recovery of latent causal graph, mixing matrix, and unknown intervention targets.
New robustness measure accounts for task-specific symmetries.
problem Traditional robustness measures fail for tasks with inherent symmetries.
method Sound notion of adversarial robustness for equivariant tasks, using randomized smoothing and graph edit distance certificates.
result Provable robustness can be achieved for various tasks with inherent symmetries.
AIB method improves robustness against adversarial perturbations.
problem Optimizing the IB principle for better robustness and understanding compression effects.
method Proposes adversarial information bottleneck (AIB) method to optimize IB principle without explicit distribution assumptions.
result Demonstrates effectiveness in learning more invariant representations and mitigating adversarial perturbations.
Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Advers…
Layer-wise Relevance Propagation (LRP) and saliency maps have been recently used to explain the predictions of Deep Learning models, specifically in the domain of text classification. Given different attribution-based explanations to highlight relevant words for a predicted class label, experiments based on word deleti…