A new Frank-Wolfe framework improves efficiency and effectiveness of adversarial attacks.
problem Develop efficient and effective optimization-based adversarial attack algorithms.
method Proposes a Frank-Wolfe algorithm variant for both white-box and black-box adversarial attacks.
result Demonstrates improved efficiency and effectiveness compared to existing methods.
White-box attacks reveal deep learning model training data records.
problem Privacy leakage in deep learning models.
method Design of white-box inference attacks for both centralized and federated learning.
result Deep models, even well-generalized ones, are susceptible to white-box membership inference attacks.
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
Efficiently distills white-box adversarial attacks into black-box models.
problem Generating efficient adversarial examples for robustness.
method Train a model to emulate white-box attack behavior and distill it into a more efficient black-box model.
result Reduces adversarial example generation time by 19x-39x and transfers to black-box settings.
New method calibrates white-box MI attacks, outperforming previous black-box methods.
problem Calibrating membership inference attacks on white-box models.
method Leveraging model memorization and overfitting features.
result Calibrated attack provides high precision in membership inference.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
New action poisoning attacks improve LinUCB's performance by changing action signals.
problem Improving understanding of adversarial attacks on contextual bandit algorithms.
method Proposed action poisoning attacks in white-box and black-box settings.
result Action poisoning attacks can force LinUCB to pull a target arm frequently with low cost.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
Paper finds optimal membership inference strategies for machine learning models.
problem Determining if a sample was part of the training set of a machine learning model.
method Derives optimal strategies for membership inference with assumptions on parameter distribution, showing that black-box attacks are as good as white-box attacks.
result Optimal strategies are not tractable, leading to approximations that outperform existing methods.
Study on how many queries an adversary needs to make to match the best attack in white-box model.
problem Query complexity of adversarial attacks in machine learning models.
method Investigates the number of queries required for an adversary to match the best possible attack in the white-box model, using entropy of decision boundaries as a measure.
result Lower bound on the number of queries required for an adversary to match the best possible attack in the white-box model.
Paper improves ATN for generating adversarial examples.
problem Generating adversarial examples to fool models.
method Improves Adversarial Transformation Networks (ATN).
result Won 2nd place in CAAD 2018 non-target task.
Paper proposes using auto-encoders to efficiently purify adversarial perturbations.
problem Vulnerability of machine learning models to adversarial examples.
method Iterative adversarial training on an auto-encoder to purify perturbations.
result The auto-encoder trained model outperforms other methods in protecting models against white-box attacks.
Defends classifiers from adversarial attacks using self-supervised data estimation.
problem Protecting classifiers from adversarial attacks with full attacker access.
method RIDE, a self-supervised learning algorithm for individual data estimation.
result Significant improvement in adversarial defense performance (98%, 76%, 43% test accuracy on MNIST, CIFAR-10, and ImageNet datasets respectively).
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks. NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
Two attacks reveal vulnerabilities in deep neural network watermarking schemes.
problem Protecting deep learning models from unauthorized redistribution.
method Proposed black-box and white-box attacks to remove backdoor-based watermarks.
result Watermarks can be removed with minimal effort and without sensitive model information.
A statistical test detects adversarial examples with minimal input corruption.
problem Detecting adversarial examples in white-box attacks.
method Randomly corrupt inputs to compute test statistics that exploit adversarial anomalies.
result The test can correct predictions for adversarial attacks with high accuracy.
We study the effectiveness of various approaches that defend against adversarial attacks on deep networks via manipulations based on basis function representations of images. Specifically, we experiment with low-pass filtering, PCA, JPEG compression, low resolution wavelet approximation, and soft-thresholding. We evalu…
Evaluates SHIELD's effectiveness against adaptive adversaries in various threat models.
problem Evaluating SHIELD's efficacy against adaptive adversaries in different threat models.
method Empirical analysis of SHIELD's robustness against adaptive attacks using Projected Gradient Descent (PGD) attacks in various threat models (white-box, gray-box).
result The targeted PGD attack success rate drops from 64.3% to 48.9% when models are trained from scratch instead of retrained.
Deep learning algorithms and networks are vulnerable to perturbed inputs which is known as the adversarial attack. Many defense methodologies have been investigated to defend against such adversarial attack. In this work, we propose a novel methodology to defend the existing powerful attack model. We for the first time…
Paper presents a method to disrupt deep uncertainty estimation without affecting accuracy.
problem Uncertainty estimation in deep neural networks for risk-sensitive applications.
method A novel attack that cripples uncertainty estimation without reducing accuracy.
result The attack causes the network to be more confident in incorrect predictions than correct ones.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.
New method detects adversarial images by exploiting their density.
problem Detecting adversarial images that are hard to find with gradient methods.
method Develop a test based on the density of adversarial directions.
result Unprecedented accuracy in detecting adversarial attacks under white-box setting.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
RayS attack improves hard-label adversarial attacks by reducing query complexity and identifying false robust models.
problem Challenges in hard-label adversarial attacks, especially in terms of effectiveness and efficiency.
method Reformulates continuous problem into discrete problem without gradient estimation and uses a fast check step to eliminate unnecessary searches.
result Significantly reduces the number of queries needed for hard-label attacks and identifies false robust models.
New attacks on RL agents' action space improve understanding of cyber-physical systems vulnerabilities.
problem Understanding and improving the robustness of RL agents in CPS against action space attacks.
method Proposed white-box MAS and LAS attack algorithms to optimize and temporally couple attack budgets.
result LAS attacks cause significantly more performance degradation than MAS attacks.
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
This paper reduces the number of queries needed for black-box attacks on DNNs.
problem Efficiently conducting black-box attacks on deep neural networks.
method Active learning strategy combined with state-of-the-art white-box attack methods.
result Significantly reduces the number of queries needed for black-box attacks.
Paper proposes a black-box adversarial attack method for graph embedding models.
problem Robustness of graph embedding models against adversarial attacks.
method GF-Attack constructs a generalized adversarial attacker by the graph filter and feature matrix, performing the attack on the graph filter in a black-box fashion.
result GF-Attack can consistently make strong attacks on different graph embedding models even with small perturbations.
Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-b…
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
Defensive distillation fails against targeted adversarial attacks, forcing a tradeoff between learning and security.
problem Defensive distillation's limitations in blocking targeted adversarial attacks.
method Systematic exploration of defensive distillation's effectiveness and limitations.
result Defensive distillation is effective against non-targeted attacks but fails against targeted attacks, necessitating a tradeoff between learning and security.
Capsule models detect adversarial images by reconstructing from top-level capsules.
problem Detecting adversarial images that look like a typical member of the predicted class.
method Capsule models trained to reconstruct images from pose parameters and identity of the correct top-level capsule.
result Setting a threshold on reconstruction error effectively detects adversarial images.
Despite being popularly used in many applications, neural network models have been found to be vulnerable to adversarial examples, i.e., carefully crafted examples aiming to mislead machine learning models. Adversarial examples can pose potential risks on safety and security critical applications. However, existing def…
V-BAD is a first black-box video attack framework that successfully fools deep video recognition models.
problem Vulnerability of video recognition models to black-box adversarial attacks.
method Tentative perturbations transferred from image models and partition-based rectifications for patches of tentative perturbations.
result V-BAD can craft both untargeted and targeted attacks with high success rates using a manageable number of queries.
Optimal attack against autoregressive models by manipulating environment states.
problem Manipulating autoregressive forecasts to track a target trajectory.
method Linear Quadratic Regulator (LQR) for linear models, Model Predictive Control (MPC) for nonlinear models.
result Optimal attack formulations for both white-box and black-box settings.
MARGINATTACK improves zero-confidence adversarial attacks' accuracy and efficiency.
problem Improving zero-confidence adversarial attacks' accuracy and efficiency.
method Proposes MARGINATTACK, a zero-confidence attack framework that computes margin with improved accuracy and efficiency.
result MARGINATTACK computes a smaller margin than state-of-the-art zero-confidence attacks and matches state-of-the-art fix-perturbation attacks.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
A new fast adversarial attack finds minimal perturbations to change class.
problem Evaluating robustness of neural networks against adversarial attacks.
method White-box adversarial attack minimizing perturbation size.
result Outperforms or matches state-of-the-art attacks.
A new attack for probabilistic classifiers adapts to noise levels.
problem Adversarial examples can mislead probabilistic classifiers.
method Adapts HopSkipJump attack for probabilistic classifiers, adjusting queries based on noise levels.
result Decision-based attacks are effective against probabilistic classifiers, even with noise.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Timber targets decision trees, outperforming existing attacks.
problem Poisoning decision trees to manipulate model predictions.
method Greedy attack strategy using sub-tree retraining for efficiency.
result Timber outperforms existing attacks in effectiveness and efficiency.
ATHENA builds flexible defenses against adversarial attacks.
problem Extensive research on adversarial attacks is domain-specific and cannot be easily extended.
method Designing an extensible framework based on diverse weak defenses.
result Comprehensive empirical study demonstrates the effectiveness of ATHENA.
Tricks adversarial attacks to target specific classes, improving classifier accuracy.
problem Recent adversarial defense approaches have failed to protect classifiers from untargeted attacks.
method Target Training defense tricks untargeted attacks into targeted attacks on designated classes, then derives the real class.
result 86.2% accuracy for CW-L2 (confidence=0) in CIFAR10, outperforming unsecured classifiers.