Paper proposes a method to detect adversarial examples that can resist norm-constrained attacks.
problem Vulnerabilities of deep neural networks to adversarial examples in sensitive domains.
method Train K binary classifiers to distinguish between clean data and adversarially perturbed samples, use at test time to classify inputs.
result Proposed method can resist norm-constrained white-box attacks.
Proposes BATer for improved adversarial example detection.
problem Detecting adversarial examples in neural networks.
method Introduces a Bayesian adversarial example detector (BATer) using random components in a Bayesian neural network.
result BATer outperforms state-of-the-art detectors in adversarial example detection.
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
CausAdv detects adversarial examples using causal reasoning.
problem Vulnerability of CNNs to adversarial perturbations.
method Causal framework based on counterfactual reasoning.
result Adversarial examples exhibit different CI distributions compared to clean samples.
Detects adversarial examples using SHAP values from neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Uses SHAP values from internal layers to distinguish normal from adversarial inputs.
result Demonstrates high detection accuracy and strong generalization to various attack methods.
Detects adversarial examples with feature attribution differences.
problem Easily fooled by small adversarial perturbations in deep neural networks.
method Thresholding a scale estimate of feature attribution scores.
result Superior performance in distinguishing adversarial examples.
Detects audio adversarial examples using anomalous pattern detection.
problem Identifies adversarial audio attacks in deep neural networks.
method Applies anomalous pattern detection in activation space of audio models.
result Can detect adversarial examples with up to 0.98 AUC, no degradation on benign samples.
This paper shows diffusion models improve intrusion detection by purifying adversarial examples.
problem Adversarial examples mislead ML intrusion detection systems, leading to false alerts or evasion.
method Used diffusion models to purify adversarial examples in intrusion detection.
result Diffusion models enhance adversarial robustness in intrusion detection without significantly impacting normal performance.
New method bypasses statistical and classifier-based detection of adversarial examples.
problem Vulnerability of deep learning classifiers to adversarial examples.
method Classifier-based adaptation of statistical test method and Logit Mimicry Attack.
result Reduces detection performance to less than 2.2% TPR and 1.6% TPR for statistical test and classifier-based methods, respectively, even at 5% FPR.
Proposes a probabilistic method for generating semantically-aware adversarial examples.
problem Generating adversarial examples that are difficult for humans to detect while preserving semantics.
method Embeds subjective understanding of semantics as a distribution into adversarial example generation.
result Achieves higher success rates in circumventing adversarial defense mechanisms.
Machine Learning (ML) models are applied in a variety of tasks such as network intrusion detection or Malware classification. Yet, these models are vulnerable to a class of malicious inputs known as adversarial examples. These are slightly perturbed inputs that are classified incorrectly by the ML model. The mitigation…
The paper detects adversarial examples in LECs for regression in CPS using variational autoencoder.
problem Detecting adversarial examples in learning-enabled cyber-physical systems (CPS).
method Inductive conformal prediction using a variational autoencoder regression model.
result The method effectively detects adversarial examples with a short delay in an emergency braking system simulation.
Deep Neural Networks (DNNs) have recently led to significant improvements in many fields. However, DNNs are vulnerable to adversarial examples which are samples with imperceptible perturbations while dramatically misleading the DNNs. Moreover, adversarial examples can be used to perform an attack on various kinds of DN…
Detecting adversarial examples is as hard as classifying them.
problem The difficulty of detecting adversarial examples in machine learning models.
method Proved a general hardness reduction between detection and classification of adversarial examples.
result The hardness reduction implies that detecting adversarial examples is computationally infeasible.
Detects adversarial examples using autoencoders at hidden layers.
problem Identifying adversarial examples in deep neural networks.
method Trains autoencoders on intermediate layers to detect deviations from true data.
result Outperforms state-of-the-art methods in both supervised and unsupervised settings.
Deep neural networks are vulnerable to adversarial examples, i.e., carefully-perturbed inputs aimed to mislead classification. This work proposes a detection method based on combining non-linear dimensionality reduction and density estimation techniques. Our empirical findings show that the proposed approach is able to…
Capsule networks detect and diagnose adversarial images better than CNNs.
problem Detecting and diagnosing adversarial images in neural networks.
method Class-conditional capsule reconstruction and reconstructive attack.
result Capsule networks outperform CNNs in detecting and diagnosing adversarial images.
Generative models create indistinguishable adversarial objects for object detection.
problem Creating unrestricted adversarial examples for object detection.
method Search over latent space of GAN for adversarial objects.
result Generated adversarial objects are indistinguishable from non-adversarial objects and transferable.
Method identifies over-optimized adversarial examples using IQR-based logit thresholding.
problem Over-optimized adversarial examples are hard to detect due to model optimization.
method IQR-based logit thresholding method for identifying over-optimized adversarial examples.
result The logits of the model are more useful in detecting over-optimized adversarial examples.
It has been shown that adversaries can craft example inputs to neural networks which are similar to legitimate inputs but have been created to purposely cause the neural network to misclassify the input. These adversarial examples are crafted, for example, by calculating gradients of a carefully defined loss function w…
This paper studies adversarial examples in NIDS, revealing their vulnerability.
problem Vulnerability of machine learning-based NIDS to adversarial examples.
method Used evolutionary computation and deep learning to generate adversarial examples.
result Adversarial examples cause high misclassification rates in various machine learning models.
GraN detects adversarial and misclassified examples efficiently.
problem Detecting adversarial and misclassified examples in deep neural networks.
method GraN uses the layer-wise norm of the DNN's gradient regarding the loss of the current input-output combination.
result GraN achieves state-of-the-art performance on numerous problem set-ups.
Defense against adversarial attacks by manipulating feature thickness.
problem Vulnerability of machine learning models to adversarial attacks.
method Feature Manipulation (FM)-Defense using a combo-variational autoencoder.
result Detection and purification of adversarial examples with high accuracy.
ATOM improves robust OOD detection by mining informative auxiliary examples.
problem Robust OOD detection in open-world settings is challenging due to adversarial inputs.
method ATOM combines adversarial training with outlier mining to improve robustness.
result ATOM achieves state-of-the-art performance in OOD detection, reducing FPR by up to 57.99%.
Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to a…
Detects misclassifications and adversarial examples using neural network logits.
problem Unable to detect misclassifications and adversarial examples in neural networks.
method Introspection using pretrained neural network logits.
result Simple 3-layer neural network trained on logits detects misclassifications competitively.
Study Fisher information for detecting neural network adversarial attacks.
problem Detecting and understanding adversarial examples in neural networks.
method Compute Fisher information quantities efficiently and analyze their behavior on adversarial examples.
result Fisher information can highlight important input neurons and reveal unreasonable network behavior.
Study evaluates predictive uncertainty in malware detection.
problem Detecting dataset shift and adversarial examples in malware detection.
method Re-designed and built 24 Android malware detectors, quantified their uncertainties with nine metrics.
result Predictive uncertainty helps reliable malware detection but not adversarial evasion attacks.
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
Though deep neural networks have achieved state-of-the-art performance in visual classification, recent studies have shown that they are all vulnerable to the attack of adversarial examples. Small and often imperceptible perturbations to the input images are sufficient to fool the most powerful deep neural networks. Va…
Deep neural networks are vulnerable to adversarial examples. Prior defenses attempted to make deep networks more robust by either changing the network architecture or augmenting the training set with adversarial examples, but both have inherent limitations. Motivated by recent research that shows outliers in the traini…
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
Method detects adversarial samples using influence functions and nearest neighbors.
problem Detecting adversarial attacks on deep neural networks.
method Influence functions and k-NN model on activation layers.
result Successfully distinguishes adversarial examples with state-of-the-art results.
Adversarial examples are considered a serious issue for safety critical applications of AI, such as finance, autonomous vehicle control and medicinal applications. Though significant work has resulted in increased robustness of systems to these attacks, systems are still vulnerable to well-crafted attacks. To address t…
In this paper we propose a novel method for detecting adversarial examples by training a binary classifier with both origin data and saliency data. In the case of image classification model, saliency simply explain how the model make decisions by identifying significant pixels for prediction. A model shows wrong classi…
Many deep learning algorithms can be easily fooled with simple adversarial examples. To address the limitations of existing defenses, we devised a probabilistic framework that can generate an exponentially large ensemble of models from a single model with just a linear cost. This framework takes advantage of neural net…
We investigate conditions under which test statistics exist that can reliably detect examples, which have been adversarially manipulated in a white-box attack. These statistics can be easily computed and calibrated by randomly corrupting inputs. They exploit certain anomalies that adversarial attacks introduce, in part…
Paper detects adversarial attacks in sound classification models.
problem Adversarial attacks threaten data-driven models, especially in sound classification.
method Detects adversarial subspaces in unitary vector domain using chordal distance and generalized Schur decomposition.
result Regularized logistic regression detector outperforms other approaches on benchmark datasets.
A novel method using saliency maps detects adversarial attacks effectively.
problem Vulnerability of neural networks to adversarial attacks.
method Combining saliency maps with additional noises and inconsistency strategy.
result High detection success rate of adversarial attacks on various datasets.
New method detects malware through obfuscation using adversarial risk analysis.
problem Insufficient malware detection in obfuscated binaries.
method Hybrid framework and adversarial risk analysis.
result Improved detection of malware through obfuscation.
Machine-learning models for security-critical applications such as bot, malware, or spam detection, operate in constrained discrete domains. These applications would benefit from having provable guarantees against adversarial examples. The existing literature on provable adversarial robustness of models, however, exclu…
New method improves robustness of OOD detection models.
problem Detecting out-of-distribution inputs is critical for deep learning models.
method Proposes ALOE algorithm for robust training with adversarially crafted examples.
result ALOE substantially improves robustness of OOD detection on CIFAR-10 and CIFAR-100 datasets.
Adversarial attacks can fool copyright detection systems.
problem Vulnerability of copyright detection systems to adversarial attacks.
method Used gradient methods to create adversarial music that fooled detection systems.
result Adversarial attacks can successfully deceive industrial copyright detection tools.
Paper shows how to hide individuals in graphs to fool community detection models.
problem Adversarial attack on community detection models by hiding individuals.
method Iterative learning framework that updates a graph generator and a community detection model.
result Adversarial graphs generated by the method can fool multiple community detection models.
Extract class-specific subnetworks from neural models for better understanding and improved explanations.
problem Understanding and explaining the complex behavior of deep neural networks.
method For each semantic class, extract a class-specific subnetwork with a compressed structure that maintains comparable performance.
result Extracted subnetworks improve explanation saliency and adversarial example detection.
Adversarial attacks hide cyber-physical attacks in ICS.
problem Hiding cyber-physical attacks in industrial control systems.
method Modeling an attacker compromising sensors, manipulating data, and evaluating attacks on both continuous and mixed data.
result Successfully hides cyber-physical attacks with 2.87 out of 12 sensors compromised on average.
Attribution methods have been developed to explain the decision of a machine learning model on a given input. We use the Integrated Gradient method for finding attributions to define the causal neighborhood of an input by incrementally masking high attribution features. We study the robustness of machine learning model…
New datasets make AI models fail reliably, highlighting weaknesses.
problem AI models' vulnerabilities to adversarial examples.
method Created challenging datasets with adversarial filtering, tested on various models.
result Existing models perform poorly on new datasets, revealing shared weaknesses.