Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
Study on linear regression robustness to adversarial attacks.
problem Adversarial attacks on linear regression models.
method Analysis of prediction error bounds, asymptotic results, convex optimization.
result Adversarial error can grow to infinity with more features, while test error goes to zero.
Study non-asymptotic bounds for robust estimators under misspecified models.
problem Evaluate performance of robust estimators under adversarial conditions.
method Propose a general approach to adversarial risk analysis, including investigations on generalization and approximation errors.
result Establish non-asymptotic upper bounds for adversarial excess risk under Lipschitz loss functions.
New measure assesses deep neural networks' robustness to adversarial attacks.
problem Deep learning's fragility to adversarial attacks limits its adoption in mission-critical applications.
method Introduces residual error as a new performance measure for assessing adversarial robustness.
result Demonstrates effectiveness of residual error in assessing robustness of deep neural networks.
We propose an approach to distinguish between correct and incorrect image classifications. Our approach can detect misclassifications which either occur unintentionally ("natural errors"), or due to intentional adversarial attacks ("adversarial errors"), both in a single unified framework. Our appr…
Adversarial training augments the training set with perturbations to improve the robust error (over worst-case perturbations), but it often leads to an increase in the standard error (on unperturbed test inputs). Previous explanations for this tradeoff rely on the assumption that no predictor in the hypothesis class ha…
New algorithm optimally identifies best arm in both stochastic and adversarial settings.
problem Best arm identification in stochastic and adversarial reward scenarios.
method Parameter-free algorithm designed to be robust to adversarial rewards and optimal in stochastic problems.
result Algorithm's error rate matches optimal bounds in stochastic problems and is robust to adversarial rewards.
Adversarial robustness has become a central goal in deep learning, both in the theory and the practice. However, successful methods to improve the adversarial robustness (such as adversarial training) greatly hurt generalization performance on the unperturbed data. This could have a major impact on how the adversarial …
Adversarial robust learning improved for transductive setting.
problem Adversarial robust learning in transductive setting.
method Simple transductive learner for bounded VC dimension classes.
result Robust error rate linear in VC dimension, adaptive to perturbation complexity.
Non-convex SGD learns halfspaces with adversarial label noise efficiently.
problem Agnostically learning halfspaces in adversarial label noise settings.
method Non-convex SGD optimization for halfspace learning.
result Non-convex SGD achieves misclassification error close to optimal with adversarial noise.
New gradient coding schemes reduce decoding error in both random and adversarial straggler settings.
problem Creating efficient approximate gradient coding schemes for distributed optimization.
method Introduced novel approximate gradient codes based on expander graphs, achieving optimal decoding coefficients.
result Achieved nearly optimal error in random setting and nearly half the error in adversarial setting compared to existing codes.
AdaBoost improves binary classification in robust one-bit compressed sensing with adversarial errors.
problem Binary classification in robust one-bit compressed sensing with adversarial errors.
method AdaBoost and max-ℓ1-margin-classifier approach, with convergence rates improved under certain feature conditions. result Improved convergence rates and explanation for harmless interpolating adversarial noise.
Develops a method to find costly high-confidence errors in black box models.
problem Finding rare high-confidence errors missed by random sampling.
method Adversarial perturbation-guided search technique to find errors at rates greater than expected given model confidence.
result Our Adversarial Distance search discovers high-confidence errors at a rate greater than expected given model confidence.
Complex autonomous control systems are subjected to sensor failures, cyber-attacks, sensor noise, communication channel failures, etc. that introduce errors in the measurements. The corrupted information, if used for making decisions, can lead to degraded performance. We develop a framework for using adversarial deep r…
The study sets limits on how robust classifiers can be against adversarial attacks.
problem Understanding the limits of robustness in classification models against adversarial attacks.
method Utilized optimal transport theory to derive variational formulae and explicit lower-bounds on Bayes-optimal error.
result Explicit lower-bounds on the Bayes-optimal error for distance-based attacks, universal in geometry of class-conditional distributions.
Paper proposes a robust metric learning algorithm.
problem Robustness of metric learning against adversarial perturbations is insufficient.
method Proposes a novel Mahalanobis distance metric learning algorithm.
result Certifiable robustness improvement over Euclidean distance.
Paper explores why overfitted DNNs in adversarial training can generalize.
problem Understanding why overfitted DNNs in adversarial training can generalize despite poor robust generalization.
method An approximation viewpoint to analyze the robust overfitting of over-parameterized DNNs.
result Existence of infinitely many overfitted DNNs that achieve good robust generalization under certain conditions.
Adversarial training improves robustness of halfspaces in noisy data.
problem Learning robust halfspaces in the presence of label noise.
method Adversarial training with binary cross-entropy or nonconvex sigmoidal loss.
result Adversarial training yields robust halfspaces with improved classification error.
Unified approach for robust low rank matrix estimation with adversaries.
problem Robust low rank matrix estimation in the presence of adversaries.
method Unified approach combining Huber loss and nuclear norm penalization.
result Sharp estimation error bounds for matrix compressed sensing and completion.
The paper examines how adversarial training and noise affect neural network performance.
problem Overfitting in adversarial training and data augmentation.
method Adversarial training and data augmentation with noise in the context of regularized regression in RKHS.
result Appropriate regularization can prevent overfitting and improve performance.
Efficiently learns a single neuron with adversarial noise, improving on prior work.
problem Learning a single neuron with adversarial label noise.
method Efficient algorithm using local error bounds from optimization theory.
result Approximates optimal L22-error within a constant factor. Study linear regression with missing or corrupted data, showing error bounds.
problem Linear regression under missing or corrupted data.
method Information-theoretic lower bounds and efficient algorithms.
result Error bounds match in missing and corruption settings.
Study reveals how neural network smoothness affects their vulnerability to adversarial attacks.
problem Understanding adversarial vulnerability in deep learning networks.
method Analysis of manifold smoothness and generalization capability of deep neural networks trained with local errors.
result High generalization accuracy requires a fast power-law decay of eigen-spectrum of hidden representations.
Paper proposes methods to estimate minimal adversarial perturbations for deep neural networks.
problem Quantifying robustness of deep neural networks against adversarial attacks.
method Proposes two lightweight strategies to find minimal adversarial perturbation.
result Approximates theoretical distance for samples close to classification boundary, providing robustness guarantees.
Paper designs optimal ECOCs using IP for robust multiclass classification.
problem Designing robust ECOCs for multiclass classification.
method Integer Programming formulation to minimize codebooks with desirable error-correcting properties, leveraging graph-theoretic structure and edge clique covers.
result IP-generated codebooks achieve high nominal and robust adversarial accuracy.
This paper examines various definitions of adversarial risk and their implications.
problem Quantifying the performance of classifiers under adversarial perturbations.
method Optimal transport, robust statistics, functional analysis, and game theory.
result Generalization of Strassen's theorem and new connections to Choquet capacities and game theory.
We derive bounds for a notion of adversarial risk, designed to characterize the robustness of linear and neural network classifiers to adversarial perturbations. Specifically, we introduce a new class of function transformations with the property that the risk of the transformed functions upper-bounds the adversarial r…
We identify a trade-off between robustness and accuracy that serves as a guiding principle in the design of defenses against adversarial examples. Although this problem has been widely studied empirically, much remains unknown concerning the theory underlying this trade-off. In this work, we decompose the prediction er…
Paper analyzes adversarial training's performance in binary classification.
problem Understanding the generalization performance of adversarial training.
method Derives precise theoretical predictions for adversarial training performance.
result Provides exact asymptotics for test errors of adversarial training.
A new method for estimating adversarial strategies in nonlinear systems.
problem Inferring an intelligent adversarial agent's strategy in highly nonlinear systems.
method Formulated inverse cognition as a nonlinear Gaussian state-space model and developed an inverse UKF (IUKF) system.
result The estimation error of IUKF converges and closely follows the recursive Cramér-Rao lower bound.
The study analyzes robustness of estimators in linear models with adversarial errors.
problem Analyzing robustness of estimators in linear models with adversarial errors.
method Develops a general theory for minimum norm interpolating estimators and RERM in linear models without conditions on errors.
result Quantitative bound for the prediction error relating it to Rademacher complexity, norm of minimum norm interpolator of errors, and subdifferential size.
Adversarial consistency depends on the uniqueness of adversarial Bayes classifiers.
problem Consistency of adversarial surrogate losses is not guaranteed.
method Connected consistency of adversarial surrogate losses to the uniqueness of adversarial Bayes classifiers.
result A convex surrogate loss is statistically consistent for adversarial learning if and only if the adversarial Bayes classifier is unique.
This paper proposes CSADA to make DNNs cost-sensitive.
problem Over-parameterization challenges cost-sensitive classification in DNNs.
method CSADA framework using adversarial data augmentation.
result CSADA effectively minimizes overall cost and reduces critical errors.
The study sets lower bounds on MMSE for inferring sensitive features from noisy data.
problem Estimating sensitive features from noisy observations of correlated features.
method Adversarial evaluation framework based on MMSE estimation with theoretical lower bounds.
result Derives closed-form bounds for linear models, showing optimality in noise variance.
Modern machine learning models with very high accuracy have been shown to be vulnerable to small, adversarially chosen perturbations of the input. Given black-box access to a high-accuracy classifier f, we show how to construct a new classifier g that has high accuracy and is also robust to adversarial ℓ2-bou…
Despite remarkable success in practice, modern machine learning models have been found to be susceptible to adversarial attacks that make human-imperceptible perturbations to the data, but result in serious and potentially dangerous prediction errors. To address this issue, practitioners often use adversarial training …
Certified calibration methods protect model confidence from adversarial attacks.
problem Adversarial attacks degrade model calibration, reducing confidence in predictions.
method Developed certified calibration methods to provide worst-case bounds on calibration under adversarial perturbations.
result Certified calibration methods produce analytic and approximate bounds for the Brier score and expected calibration error.
Study reveals how high-dimensional models are vulnerable to consistent adversarial attacks.
problem Understanding the vulnerability of high-dimensional linear classifiers to adversarial attacks.
method Introducing a new error metric to quantify model vulnerability, and rigorously characterizing these metrics in asymptotic settings.
result As models become more overparameterized, their vulnerability to label-preserving perturbations increases.
Study on conditions for Bayes optimal classifier in adversarial robustness.
problem Existence of Bayes optimal classifier for adversarial robustness.
method General sufficient conditions for existence of Bayes optimal classifier.
result Guaranteed existence of Bayes optimal classifier under certain conditions.
Machine learning models are vulnerable to adversarial inputs that induce seemingly unjustifiable errors. As automated classifiers are increasingly used in industrial control systems and machinery, these adversarial errors could grow to be a serious problem. Despite numerous studies over the past few years, the field of…
Proposes using mode connectivity to improve adversarial robustness of neural networks.
problem Improving adversarial robustness of deep neural networks.
method Employing mode connectivity in loss landscapes to study adversarial robustness and propose methods for improvement.
result Path connection learned using limited bonafide data can effectively mitigate adversarial effects while maintaining original accuracy.
Adversarial examples pose a threat to deep neural network models in a variety of scenarios, from settings where the adversary has complete knowledge of the model and to the opposite "black box" setting. Black box attacks are particularly threatening as the adversary only needs access to the input and output of the mode…
This research analyzes the error convergence rate of GAN models.
problem Understanding the error convergence rate of GAN models.
method Applying Talagrand inequality and Borel-Cantelli lemma to establish a tight convergence rate.
result Established a tight convergence rate for the error of GAN models.
We study nonzero-sum hypothesis testing games that arise in the context of adversarial classification, in both the Bayesian as well as the Neyman-Pearson frameworks. We first show that these games admit mixed strategy Nash equilibria, and then we examine some interesting concentration phenomena of these equilibria. Our…
Study on adversarial robustness in neural networks across initialization and training phases.
problem Understanding adversarial robustness in neural networks during different learning stages.
method Analyzes adversarial robustness in various scenarios of over-parameterized networks with quadratic targets and infinite samples.
result Robustness can worsen when test error improves, and vice versa, revealing new tradeoffs.
We study adversarial perturbations when the instances are uniformly distributed over {0,1}n. We study both "inherent" bounds that apply to any problem and any classifier for such a problem as well as bounds that apply to specific problems and specific hypothesis classes. As the current literature contains multiple…
Polynomial-time tester-learner for general halfspaces with Gaussian adversarial noise.
problem Learning general halfspaces with adversarial label noise.
method Reduction to testable learning of nearly homogeneous halfspaces.
result First polynomial time tester-learner for general halfspaces with dimension-independent misclassification error.
Adversarial attacks on deep neural networks (DNNs) have been found for several years. However, the existing adversarial attacks have high success rates only when the information of the victim DNN is well-known or could be estimated by the structure similarity or massive queries. In this paper, we propose to Attack on A…