Universal perturbations misclassify text with high accuracy.
problem Vulnerability of text classifiers to small perturbations.
method Algorithm to compute universal adversarial perturbations.
result Deep neural networks are highly vulnerable to universal adversarial perturbations.
A fast method computes class-specific adversarial perturbations for deep networks.
problem Computing robust adversarial perturbations for deep networks.
method Linear function of weights, no training data, no hyper-parameters.
result Obtains 34% to 51% fooling rate on ImageNet, transfers across models.
Classifiers such as deep neural networks have been shown to be vulnerable against adversarial perturbations on problems with high-dimensional input space. While adversarial training improves the robustness of image classifiers against such adversarial perturbations, it leaves them sensitive to perturbations on a non-ne…
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
Neural networks are known to be vulnerable to adversarial examples, inputs that have been intentionally perturbed to remain visually similar to the source input, but cause a misclassification. It was recently shown that given a dataset and classifier, there exists so called universal adversarial perturbations, a single…
Simple technique turns any adversarial attack into a universal one using few test examples.
problem Creating universal adversarial attacks with minimal data.
method Universalization technique using few adversarial test examples and spectral properties.
result Simple universalization technique achieves comparable fooling rates to state-of-the-art methods.
Improved algorithm speeds up generation of universal adversarial perturbations.
problem Slow generation of universal adversarial perturbations.
method Optimized algorithm based on orientation of perturbation vectors.
result Significantly faster generation of universal perturbations with higher fooling rates.
Paper finds universal speech command perturbations that fool models.
problem Existence of universal adversarial examples in speech command classification.
method Proposed a novel analytical framework for evaluating universal perturbations and a detailed distortion measurement method.
result Universal perturbations can fool speech command classification models across different models.
Universal audio perturbations fool multiple classification models.
problem Creating audio adversarial perturbations that work across different models.
method Two methods: greedy iterative approach and novel penalty formulation.
result The penalty method produces more successful attacks with limited training data.
While deep learning is remarkably successful on perceptual tasks, it was also shown to be vulnerable to adversarial perturbations of the input. These perturbations denote noise added to the input that was generated specifically to fool the system while being quasi-imperceptible for humans. More severely, there even exi…
DCNs are fooled by Gabor noise patterns similar to adversarial perturbations.
problem Sensitivity of DCNs to Gabor noise patterns.
method Examined different DCN architectures and their sensitivity to Gabor noise.
result DCNs are fooled by Gabor noise patterns similar to adversarial perturbations.
Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art …
GCNNs gain rotation invariance with more training augmentation, making SVD-Universal more effective.
problem Improving robustness of GCNNs to adversarial attacks.
method SVD-Universal technique applied to GCNNs trained with larger rotations.
result SVD-Universal becomes more effective as GCNNs gain rotation invariance.
We study the problem of finding a universal (image-agnostic) perturbation to fool machine learning (ML) classifiers (e.g., neural nets, decision tress) in the hard-label black-box setting. Recent work in adversarial ML in the white-box setting (model parameters are known) has shown that many state-of-the-art image clas…
New method generates universal adversarial perturbations across different image sources.
problem Certifying robustness of deep learning models with universal adversarial perturbations across various image sources.
method Few-shot learning approach using bilevel optimization and learning-to-optimize techniques.
result Improved attack success rate and faster performance compared to existing methods.
In this work, we demonstrate the existence of universal adversarial audio perturbations that cause mis-transcription of audio signals by automatic speech recognition (ASR) systems. We propose an algorithm to find a single quasi-imperceptible perturbation, which when added to any arbitrary speech signal, will most likel…
Deep Convolutional Networks (DCNs) have been shown to be vulnerable to adversarial examples---perturbed inputs specifically designed to produce intentional errors in the learning algorithms at test time. Existing input-agnostic adversarial perturbations exhibit interesting visual patterns that are currently unexplained…
DEceit constructs effective universal pixel-restricted perturbations for deep image classifiers.
problem Creating effective universal pixel-restricted perturbations for deep neural networks.
method DEceit algorithm for black-box feedback, targeting 10% of pixels in images.
result Perturbing only 10% of pixels achieves high Fooling Rate and visual similarity.
New method creates universal perturbations to fool neural network interpretations.
problem Vulnerability of gradient-based saliency maps to adversarial perturbations.
method Gradient-based optimization and PCA-based approach to create UPI.
result Existence and successful application of Universal Perturbation for Interpretation (UPI).
We study the problem of learning classifiers robust to universal adversarial perturbations. While prior work approaches this problem via robust optimization, adversarial training, or input transformation, we instead phrase it as a two-player zero-sum game. In this new formulation, both players simultaneously play the s…
Study on low-dimensional adversarial perturbations in classification models.
problem Understanding and quantifying the effectiveness of low-dimensional adversarial perturbations.
method Analytical lower-bounds for fooling rate, considering binary classifiers under generic regularity conditions.
result Rigorous explanation for the success of heuristic methods in generating low-dimensional adversarial perturbations.
Researchers create a flickering attack to fool video recognition networks.
problem Adversarial manipulation of video classification networks.
method Introducing a flickering temporal perturbation to fool video classifiers.
result Achieved high fooling ratio and temporal-invariant perturbation.
This work analyzes how different forms of compressibility affect adversarial robustness in neural networks.
problem Understanding the interaction between compressibility and adversarial robustness in neural networks.
method Developed a principled framework to analyze the effects of neuron-level sparsity and spectral compressibility on adversarial robustness.
result Identified that different forms of compression can induce highly sensitive directions in the representation space that adversaries can exploit.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
New method makes neural networks robust to various adversarial attacks.
problem Neural networks are vulnerable to specific adversarial attacks.
method Proposed MMR-Universal regularization scheme for ReLU networks.
result First provably robust models against any lp-norm for p≥1. New method GSAT improves robustness against structured perturbations.
problem Structured perturbations in biological data.
method Formulates GSAT as a non-convex concave minimax optimization problem and solves it with GDADMM.
result Improves robustness against group-sparse and rank-constrained perturbations.
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
Adversarial attacks can fool algorithmic trading systems.
problem Adversarial perturbations can manipulate algorithmic trading models.
method Real-time adversarial attacks on trading algorithms using universal perturbations.
result Perturbations can fool trading algorithms at unseen data points.
New approach makes adversarial examples less suspicious without changing perceptual salience.
problem Robustness of deep neural networks to unsuspicious adversarial examples.
method Splitting images into foreground and background, allowing larger perturbations in background while maintaining low cognitive salience.
result Dual-perturbation attacks are effective against classifiers robust to conventional attacks and adversarial training yields more robust classifiers.
Sparse-RS framework efficiently attacks models with sparse perturbations.
problem Efficiently attacking models with sparse perturbations in the black-box setting.
method Random search-based Sparse-RS framework for score-based attacks.
result Sparse-RS achieves state-of-the-art success rate and query efficiency.
New insights into model robustness for random features and NTK models.
problem Understanding and distinguishing robustness in machine learning models.
method Analyzing empirical risk minimization in random features and NTK models.
result Random features models are not robust under any degree of over-parameterization, even when satisfying the universal law of robustness.
Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-b…
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
Recent work on adversarial attack has shown that Projected Gradient Descent (PGD) Adversary is a universal first-order adversary, and the classifier adversarially trained by PGD is robust against a wide range of first-order attacks. It is worth noting that the original objective of an attack/defense model relies on a d…
We study adversarial perturbations when the instances are uniformly distributed over {0,1}n. We study both "inherent" bounds that apply to any problem and any classifier for such a problem as well as bounds that apply to specific problems and specific hypothesis classes. As the current literature contains multiple…
Recently, deep learning based natural language processing techniques are being extensively used to deal with spam mail, censorship evaluation in social networks, among others. However, there is only a couple of works evaluating the vulnerabilities of such deep neural networks. Here, we go beyond attacks to investigate,…
Deep networks have recently been shown to be vulnerable to universal perturbations: there exist very small image-agnostic perturbations that cause most natural images to be misclassified by such classifiers. In this paper, we propose the first quantitative analysis of the robustness of classifiers to universal perturba…
It is becoming increasingly clear that many machine learning classifiers are vulnerable to adversarial examples. In attempting to explain the origin of adversarial examples, previous studies have typically focused on the fact that neural networks operate on high dimensional data, they overfit, or they are too linear. H…
Study proves existence of robust classifiers in multiclass adversarial training.
problem Proves existence of robust classifiers in multiclass adversarial training.
method Three models of adversarial training in multiclass classification, proving existence of Borel measurable robust classifiers.
result Proves existence of Borel measurable robust classifiers in each model.
We study the transfer of adversarial robustness of deep neural networks between different perturbation types. While most work on adversarial examples has focused on L∞ and L2-bounded perturbations, these do not capture all types of perturbations available to an adversary. The present work evaluates 32 attack…
Neural networks are vulnerable to adversarial attacks -- small visually imperceptible crafted noise which when added to the input drastically changes the output. The most effective method of defending against these adversarial attacks is to use the methodology of adversarial training. We analyze the adversarially train…
Unified framework for adversarial attacks using min-max optimization.
problem Improving adversarial robustness and attack generation.
method General framework of min-max optimization over multiple domains.
result Substantial attack improvement and robustness improvement.
SmoothFool efficiently computes smooth adversarial perturbations for deep networks.
problem Vulnerability of deep neural networks to adversarial attacks with specific statistical properties.
method SmoothFool: a general and computationally efficient framework for computing smooth adversarial perturbations.
result Smoothness significantly enhances robustness against adversarial attacks and improves transferability.
The paper studies the asymptotic behavior of adversarial training under ℓ∞-perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under ℓ∞-perturbation could have a positive probability mass at 0 when the true parameter is 0. Study shows adversarial robustness and common perturbation robustness are independent.
problem Understanding the relationship between adversarial robustness and common perturbation robustness in neural networks.
method Conducted experiments to benchmark neural network robustness to common perturbations and adversarial examples.
result Adversarial robustness and common perturbation robustness are independent attributes.
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
Wide networks learn from adversarial perturbations effectively.
problem Understanding why adversarial examples deceive classifiers and transfer between models.
method Assumed wide two-layer networks, proved with theoretical analysis.
result Adversarial perturbations contain class-specific features for networks to generalize.
MAT combines meta-learning and adversarial training to defend against universal patches.
problem Defending against universal patches that fool models in various contexts.
method Meta adversarial training (MAT) integrates meta-learning with adversarial training.
result MAT increases robustness against universal patch attacks on image classification and traffic-light detection.