PGD-trained models have a preferential direction in their gradients, which improves robustness.
problem Mathematical lack of clarity in the direction of preferential gradient alignment after adversarial training.
method Proposed a novel definition of preferential direction and evaluated it using a metric based on GANs.
result PGD-trained models have higher alignment with the proposed preferential direction than baseline models.
Geometric insights reveal transferable adversarial directions across classifiers and models.
problem Adversarial perturbations transfer between different inputs, models, and architectures.
method Geometric analysis of linear classifiers and two-layer ReLU networks.
result Transferable adversarial directions exist for linear separators and ReLU networks with high probability.
Detects adversarial directions to make reinforcement learning policies more robust.
problem Adversarial attacks exploit non-robust directions in reinforcement learning policies, leading to instability.
method Local quadratic approximation of deep neural policy loss to identify non-robust directions.
result Provides a theoretical basis for distinguishing safe from adversarial observations.
DIP-FAT improves adversarial training by diversifying perturbations.
problem Adversarial examples fool deep neural networks, leading to overfitting and poor performance.
method DIP-FAT uses random directions to diversify perturbations in adversarial training.
result DIP-FAT reduces overfitting and improves clean data accuracy.
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
MixUp explained as a special adversarial training technique.
problem Improving model robustness against adversarial attacks.
method Introducing directional adversarial training (DAT) and proving MixUp's equivalence to a specific subclass of DAT.
result The family of Untied MixUp schemes is equivalent to the entire class of DAT schemes and can improve upon MixUp.
This article presents a summary of a keynote lecture at the Deep Learning Security workshop at IEEE Security and Privacy 2018. This lecture summarizes the state of the art in defenses against adversarial examples and provides recommendations for future research directions on this topic.
Gradient descent-based adversarial training converges to robust classifiers on linearly separable data.
problem Understanding the inductive bias of adversarial training for robustness.
method Gradient descent on binary classification tasks with linearly separable data, focusing on inductive bias and convergence rates.
result Gradient descent-based adversarial training converges to the maximum margin classifier at a faster rate than clean data training.
Deep RL policies are vulnerable to adversarial perturbations, but vanilla training yields more robust policies.
problem Vulnerability of deep reinforcement learning policies to adversarial perturbations.
method Analysis of deep reinforcement learning policy landscape and comparison of vanilla vs. adversarial training.
result Vanilla training yields more robust policies compared to adversarial training.
Two-layer networks trained on low-dimensional subspaces are vulnerable to adversarial examples.
problem Vulnerability of two-layer neural networks to adversarial examples on low-dimensional subspaces.
method Analysis of gradient behavior and effect of initialization scale and regularization.
result Decreasing initialization scale or adding L2 regularization can improve robustness to adversarial perturbations orthogonal to the data.
New method improves interpretability of text adversarial examples.
problem Generating interpretable adversarial examples in text is challenging.
method Sparse Projected Gradient Descent (SPGD) with directional and sparsity constraints.
result Improves interpretability and likelihood of adversarial examples compared to state-of-the-art methods.
We propose a new regularization method based on virtual adversarial loss: a new measure of local smoothness of the conditional label distribution given input. Virtual adversarial loss is defined as the robustness of the conditional label distribution around each input data point against local perturbation. Unlike adver…
Proposes WPGD for cost-sensitive adversarial training in deep learning.
problem Balancing robustness and accuracy in adversarial training.
method WPGD solves an optimal transport problem on the output space of the network.
result WPGD provides finer control over robustness-accuracy trade-off.
New method trims network data to resist adversarial contamination.
problem Adversarial contamination in network data affects statistical and algorithmic performance.
method Proposes a new trimming method operating in model space to address both block and white noise contamination.
result Demonstrates superior performance in simulations compared to direct trimming.
This paper discusses adversarial attacks on cyber security systems using machine learning.
problem Adversarial attacks limit the use of machine learning in cyber security.
method Characterizes adversarial attack methods and their applications in cyber security.
result Highlights unique challenges and future research directions for adversarial attacks in cyber security.
Adversarial examples are maliciously perturbed inputs designed to mislead machine learning (ML) models at test-time. They often transfer: the same adversarial example fools more than one model. In this work, we propose novel methods for estimating the previously unknown dimensionality of the space of adversarial inputs…
SAG is a scalable method for adversarial attacks on GNNs.
problem Scalability and robustness of GNNs to adversarial attacks.
method Decomposing large graphs into smaller partitions, using ADMM for optimization.
result SAG reduces computation and memory overhead for large graphs.
HopSkipJumpAttack efficiently generates adversarial examples with fewer queries.
problem Developing efficient adversarial attacks on trained models.
method A family of algorithms based on a gradient direction estimate using binary decision boundary information.
result Significantly fewer model queries required compared to previous methods.
Mirror descent linked to information ratio via Bayesian regret bounds.
problem Understanding stability in mirror descent and its relation to information ratio.
method Developed a connection between mirror descent and information ratio using Bayesian regret bounds.
result Mirror descent with suitable estimators and distributions achieves bounds similar to information-directed sampling.
Adversarial reinforcement learning optimizes microswimmers' path-planning in turbulent flows.
problem Optimizing microswimmers' paths in turbulent flows for efficient target reach.
method Adversarial-reinforcement learning scheme applied to 2D and 3D turbulent flows.
result Microswimmers can reach targets faster than a naive approach in turbulent flows.
Several recent papers have discussed utilizing Lipschitz constants to limit the susceptibility of neural networks to adversarial examples. We analyze recently proposed methods for computing the Lipschitz constant. We show that the Lipschitz constant may indeed enable adversarially robust neural networks. However, the m…
This work studies adversarial training in high dimensions, revealing key feature trade-offs.
problem Understanding adversarial robustness in high-dimensional settings.
method Introduces a tractable model to study the geometry of data and adversarial attacks.
result Characterizes directions in data associated with robustness vs. usefulness trade-offs.
Novel Bayesian neural network method for robustness.
problem Adversarial robustness without online training.
method Distributes uncertainty across all inputs.
result Demonstrates robustness on benchmark datasets.
New insights into adversarial vulnerability linked to manifold separability issues.
problem Adversarial vulnerability in machine learning models.
method Characterized data distribution as a low-dimensional manifold, focusing on on/off manifold directions and the impact of first-order vs. second-order optimization methods.
result First-order optimization methods lead to poor convergence in the off-manifold direction, causing adversarial vulnerability in inseparable datasets.
This paper examines how adversarial perturbations affect model performance and equilibrium learning.
problem Adversarial perturbations and covariate shifts impact model performance and equilibrium learning.
method Characterizes the extrapolation region in regression and classification, analyzes dynamics of adversarial learning games.
result Establishes two directional convergence results: a blessing in regression and a curse in classification.
Diffusion LLMs can efficiently generate harmful prompts for adversarial testing.
problem Generating harmful prompts for adversarial testing is resource-intensive and costly.
method Transformed adversarial prompt optimization into an efficient inference task using pretrained Diffusion LLMs.
result Only a few conditional samples are required to generate harmful prompts with high reward.
Novel technique detects adversarial samples in face recognition models.
problem Widespread adversarial sample attacks on DNN models.
method Bi-directional correspondence inference between attributes and internal neurons to identify critical neurons.
result 94% detection accuracy for 7 different kinds of attacks with 9.91% false positives.
New algorithm learns sub-task policies from unsegmented demonstrations.
problem Challenges in learning hierarchical policies from unsegmented demonstrations.
method Generative adversarial imitation learning framework with directed information maximization.
result Automatic learning of sub-task policies from unsegmented demonstrations.
A multilayer perceptron can behave as a generative classifier by applying bidirectional learning (BL). It consists of training an undirected neural network to map input to output and vice-versa; therefore it can produce a classifier in one direction, and a generator in the opposite direction for the same data. The lear…
Machine learning models, especially based on deep architectures are used in everyday applications ranging from self driving cars to medical diagnostics. It has been shown that such models are dangerously susceptible to adversarial samples, indistinguishable from real samples to human eye, adversarial samples lead to in…
Empirical study shows interpretable gradients improve adversarial robustness.
problem Connecting adversarial robustness and model interpretability.
method Introduced Interpretation Regularization (IR) to encourage interpretable gradients.
result Training models to have interpretable gradients improves adversarial robustness.
New method GSAT improves robustness against structured perturbations.
problem Structured perturbations in biological data.
method Formulates GSAT as a non-convex concave minimax optimization problem and solves it with GDADMM.
result Improves robustness against group-sparse and rank-constrained perturbations.
Paper tackles catastrophic overfitting in single-step adversarial training.
problem Catastrophic overfitting leads to sudden drop in robust accuracy.
method Proposes a method to prevent overfitting by using all adversarial examples.
result Demonstrates prevention of catastrophic overfitting and improves robustness.
Adversarial attacks on probabilistic state-space models affect latent state and policy decisions.
problem Robust reinforcement learning under adversarial observability.
method Analyzing adversarial attacks on linear probabilistic state-space models.
result Demonstrating the influence of adversarial observations on latent state and policy decisions.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
Unified deep architecture for domain-invariant network alignment.
problem Eliminate domain representation bias in network alignment.
method DANA (Domain Adversarial Network Alignment) using graph convolutional networks and semi-supervised learning.
result Achieves state-of-the-art alignment results on real-world social networks.
A framework for federated adversarial learning with convergence analysis.
problem Unique vulnerabilities to adversarial attacks in federated learning.
method Formulates a general federated adversarial learning framework with inner and outer loops for client-side adversarial training and server-side model aggregation.
result The minimum loss under the proposed algorithm can converge to ε with chosen learning rate and communication rounds.
New method lures adversaries to choose false directions in black-box attacks.
problem Improving robustness against black-box transfer attacks.
method Incorporates a removable neural network to induce a luring effect.
result Demonstrates effectiveness in thwarting state-of-the-art attacks.
We consider the problem of influence maximization in fixed networks for contagion models in an adversarial setting. The goal is to select an optimal set of nodes to seed the influence process, such that the number of influenced nodes at the conclusion of the campaign is as large as possible. We formulate the problem as…
This paper benchmarks time-series adversarial defenses and attacks.
problem Adversarial attacks on time-series data.
method Detailed benchmarking of adversarial defense methods in the L∞ threat model. result Adversarial defenses offer robustness against both strong white-box and black-box attacks.
GCNNs gain rotation invariance with more training augmentation, making SVD-Universal more effective.
problem Improving robustness of GCNNs to adversarial attacks.
method SVD-Universal technique applied to GCNNs trained with larger rotations.
result SVD-Universal becomes more effective as GCNNs gain rotation invariance.
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
Geometric analysis reveals how adversarial examples arise from model boundaries.
problem Adversarial examples cause misclassifications in machine learning models.
method Geometric framework using manifold reconstruction tools.
result Adversarial examples are a consequence of model boundaries on low-dimensional data manifolds.
New method detects adversarial images by exploiting their density.
problem Detecting adversarial images that are hard to find with gradient methods.
method Develop a test based on the density of adversarial directions.
result Unprecedented accuracy in detecting adversarial attacks under white-box setting.
Bayesian adversaries can outsmart traditional adversarial attacks.
problem Bayesian adversaries can manipulate machine learning models through small perturbations.
method Developed a continuous-time particle system (Abram) to approximate the gradient flow of the Bayesian adversarial robustness problem.
result Abram approximates the minimizer of the Bayesian adversarial robustness problem under certain assumptions.
MMA training maximizes margins for adversarial robustness.
problem Adversarial robustness of neural networks.
method Directly maximizes margins through adaptive adversarial training.
result MMA training improves adversarial robustness compared to fixed ε adversarial training.
Paper improves adversarial training using a learned optimizer.
problem Improving robustness of deep learning models against adversarial attacks.
method Empirically identified PGD attack's limitations and used a learning-to-learn framework to train an adaptive inner optimizer.
result The proposed framework consistently improves model robustness over traditional adversarial training methods.
This work introduces adversarial sparsity to measure robustness beyond adversarial accuracy.
problem Evaluating robustness to adversarial attacks beyond just accuracy.
method Adversarial sparsity, which quantifies the difficulty of finding perturbations.
result Sparsity provides valuable insights into neural networks and suggests improvements in robustness.