Adversarial robustness of amortized Bayesian inference is studied, showing it can be improved.
problem Adversarial robustness of amortized Bayesian inference.
method Simulation-based estimation, regularization scheme based on Fisher information.
result Adversarial robustness can be improved with a regularization scheme.
ALFI improves likelihood-free inference for black-box generators.
problem Limitations of likelihood-free inference on black-box generators.
method Adversarial Likelihood-Free Inference (ALFI) to estimate posterior distributions.
result ALFI achieves best parameter estimation accuracy with limited simulation.
DALI improves inference for GANs by matching prior and conditional distributions.
problem Effective inference for generative adversarial models (GANs).
method Explicitly matches prior and conditional distributions in data and code spaces, constraining dependency structure.
result Significantly improves reconstruction and generation compared to other GAN inference models.
We introduce the adversarially learned inference (ALI) model, which jointly learns a generation network and an inference network using an adversarial process. The generation network maps samples from stochastic latent variables to the data space while the inference network maps training examples in data space to the sp…
As machine learning (ML) becomes more and more powerful and easily accessible, attackers increasingly leverage ML to perform automated large-scale inference attacks in various domains. In such an ML-equipped inference attack, an attacker has access to some data (called public data) of an individual, a software, or a sy…
Paper assesses adversarial robustness of MCMC and BDK methods for deep Bayesian networks.
problem Assessing adversarial robustness of deep neural networks under MCMC and BDK approximations.
method Characterizes robustness of MCMC and BDK methods to FGSM and PGD attacks.
result Full MCMC-based inference shows excellent robustness, outperforming standard point estimation.
GATSBI uses GANs for SBI, improving posterior estimation in high dimensions.
problem Statistical inference on stochastic models without likelihoods.
method Adversarial approach to variational objective, amortized inference, implicit priors.
result GATSBI returns well-calibrated posterior estimates in high dimensions.
It has been widely recognized that adversarial examples can be easily crafted to fool deep networks, which mainly root from the locally non-linear behavior nearby input examples. Applying mixup in training provides an effective mechanism to improve generalization performance and model robustness against adversarial per…
Adversarial inference on tree models is possible with limited corruption, improving on Kesten-Stigum threshold.
problem Posterior inference on tree-structured graphical models in the presence of adversarial corruption.
method Dynamic programming via belief propagation, constrained adversarial corruption.
result Belief propagation can perform accurate inference with limited adversarial corruption.
AdvMind detects adversary intent in black-box attacks with high accuracy.
problem Detecting adversary intent in black-box adversarial attacks is challenging.
method AdvMind accounts for adversary adaptiveness and synthesizes queries to expose intent.
result AdvMind detects adversary intent with over 75% accuracy after observing less than 3 query batches.
The Importance Weighted Auto Encoder (IWAE) objective has been shown to improve the training of generative models over the standard Variational Auto Encoder (VAE) objective. Here, we derive importance weighted extensions to AVB and AAE. These latent variable models use implicitly defined inference networks whose approx…
Bayesian neural networks are vulnerable to adversarial attacks.
problem Adversarial robustness of Bayesian neural networks.
method Examination of adversarial robustness through three tasks: label prediction, adversarial example detection, and semantic shift detection.
result Bayesian neural networks are highly susceptible to adversarial attacks.
Recently it's been shown that neural networks can use images of human faces to accurately predict Body Mass Index (BMI), a widely used health indicator. In this paper we demonstrate that a neural network performing BMI inference is indeed vulnerable to test-time adversarial attacks. This extends test-time adversarial a…
Log-Loss scores expose membership privacy breaches.
problem Privacy leakage from statistical aggregates like Log-Loss scores.
method Proved that Log-Loss scores enable full accuracy membership inference in a single query.
result Complete membership privacy breach is possible with Log-Loss scores.
APGE protects graph node representations from inference attacks.
problem Privacy leakage in graph embedding methods.
method Adversarial training framework with disentangling and purging mechanisms.
result APGE preserves structural and utility attributes while concealing private information.
AGMs outperform EGMs in generalizing to unseen inference tasks.
problem Training graphical models for inference tasks not seen during training.
method Adversarial training of an ensemble of discrete graphical models.
result AGMs significantly outperform EGMs in generalization to unseen tasks.
Infer-AVAE infers missing user attributes from incomplete data using a novel adversarial approach.
problem Incomplete user attributes in social networks.
method Infer-AVAE combines MLP and GNNs with adversarial training to infer missing attributes.
result Infer-AVAE outperforms baselines by 7.0% in accuracy on real-world datasets.
While the last few decades have witnessed a huge body of work devoted to inference and learning in distributed and decentralized setups, much of this work assumes a non-adversarial setting in which individual nodes---apart from occasional statistical failures---operate as intended within the algorithmic framework. In r…
Develops robust ML systems for predictive uncertainties and adversarial examples.
problem Uncertainties and vulnerabilities in ML predictions and adversarial examples.
method Bayesian structural time series models, SG-MCMC, SVGD, Markov chain samplers, reinforcement learning.
result Improved robustness and efficiency in Bayesian inference and adversarial machine learning.
The arms race between attacks and defenses for machine learning models has come to a forefront in recent years, in both the security community and the privacy community. However, one big limitation of previous research is that the security domain and the privacy domain have typically been considered separately. It is t…
In this paper, we investigate the adversarial robustness of multivariate M-Estimators. In the considered model, after observing the whole dataset, an adversary can modify all data points with the goal of maximizing inference errors. We use adversarial influence function (AIF) to measure the asymptotic rate at which t…
Improved neural network robustness to adversarial attacks through smoothed inference.
problem Vulnerability of deep neural networks to adversarial attacks.
method Randomized smoothing applied to adversarial training, improving both robustness and performance.
result Significant improvement in accuracy on adversarial attacks (e.g., 60.4% on CIFAR-10 with ResNet-20, outperforming previous methods by 11.7%).
Modern deep neural network models suffer from adversarial examples, i.e. confidently misclassified points in the input space. It has been shown that Bayesian neural networks are a promising approach for detecting adversarial points, but careful analysis is problematic due to the complexity of these models. Recently Gil…
The paper proposes a bio-inspired framework for better compression and adversarial robustness in machine learning models.
problem Machine learning models are vulnerable to adversarial examples.
method The paper introduces a bio-inspired classification framework that conditions model inference on label hypothesis and uses an information bottleneck regularizer.
result The framework enables better compression and adversarial robustness without loss of natural accuracy.
Quantum mechanics is inherently probabilistic in light of Born's rule. Using quantum circuits as probabilistic generative models for classical data exploits their superior expressibility and efficient direct sampling ability. However, training of quantum circuits can be more challenging compared to classical neural net…
As online systems based on machine learning are offered to public or paid subscribers via application programming interfaces (APIs), they become vulnerable to frequent exploits and attacks. This paper studies adversarial machine learning in the practical case when there are rate limitations on API calls. The adversary …
Bayesian inference on structured models typically relies on the ability to infer posterior distributions of underlying hidden variables. However, inference in implicit models or complex posterior distributions is hard. A popular tool for learning implicit models are generative adversarial networks (GANs) which learn pa…
Unified framework analyzes privacy risks from gradients in distributed learning.
problem Analyzing inference privacy risks from gradients in machine learning.
method Unified game-based framework for various attacks, including attribute, property, distributional, and user disclosures.
result Demonstrates inefficacy of data aggregation for privacy against inference attacks.
VERA uses variational inference to jailbreak LLMs without manual optimization.
problem Lack of principled objective for gradient-based optimization in jailbreaking LLMs.
method VERA casts black-box jailbreak prompting as a variational inference problem, training a small attacker LLM to approximate the target LLM's posterior over adversarial prompts.
result VERA achieves strong performance across various target LLMs, demonstrating the value of probabilistic inference for adversarial prompt generation.
Bayesian models can be tricked into believing false data.
problem Vulnerability of Bayesian inference to data poisoning attacks.
method Developed attacks to manipulate Bayesian posterior through deletion and replication of data.
result Demonstrated that Bayesian inference can be steered to target distributions.
The study sets lower bounds on MMSE for inferring sensitive features from noisy data.
problem Estimating sensitive features from noisy observations of correlated features.
method Adversarial evaluation framework based on MMSE estimation with theoretical lower bounds.
result Derives closed-form bounds for linear models, showing optimality in noise variance.
Previous studies have found that an adversary attacker can often infer unintended input information from intermediate-layer features. We study the possibility of preventing such adversarial inference, yet without too much accuracy degradation. We propose a generic method to revise the neural network to boost the challe…
ORAT improves model robustness against outliers and adversarial attacks.
problem Challenges of training data like outliers and adversarial samples.
method Bi-level optimization with robust rank-based loss function.
result ORAT achieves theoretical consistency and uniform convergence rates.
New method reduces bias in NLI models using ensemble adversarial training.
problem Spurious correlations between hypotheses and entailment classes in NLI datasets.
method Adversarial training with an ensemble of classifiers to reduce bias in sentence representations.
result Ensemble adversarial training produces more robust NLI models, outperforming previous methods.
Researchers disrupt Gaussian model inference to test adversarial attacks.
problem Disrupting conditional inference in multivariate Gaussian models under adversarial conditions.
method Considered white- and grey-box settings with complete and incomplete knowledge of the Gaussian distribution, respectively. Reduced to quadratic and stochastic quadratic programs. Derived structural properties for solution methods.
result Demonstrated the impact and efficacy of attacks in various applications, including real estate evaluation, interest rate estimation, and signals processing.
Generalizes adversarial learning for better latent variable inference in GANs.
problem Improving latent variable inference in GANs for diverse applications.
method Adversarial learning with multiple feedback layers, self-supervision, and auxiliary tasks.
result Achieves global optimum matching multiple joint distributions.
Deep neural networks are widely used and exhibit excellent performance in many areas. However, they are vulnerable to adversarial attacks that compromise the network at the inference time by applying elaborately designed perturbation to input data. Although several defense methods have been proposed to address specific…
New deep learning model robust to adversarial attacks using stochastic LWTA units.
problem Adversarial robustness in deep learning networks.
method Introduces deep networks with stochastic LWTA activations, combining them with Bayesian non-parametric tools.
result Achieves high robustness to adversarial perturbations, outperforming state-of-the-art methods.
Complex computer simulators are increasingly used across fields of science as generative models tying parameters of an underlying theory to experimental observations. Inference in this setup is often difficult, as simulators rarely admit a tractable density or likelihood function. We introduce Adversarial Variational O…
Recent methods for generating novel molecules use graph representations of molecules and employ various forms of graph convolutional neural networks for inference. However, training requires solving an expensive graph isomorphism problem, which previous approaches do not address or solve only approximately. In this wor…
Paper shows how to infer hidden states in neural networks analytically.
problem Intractability of Bayesian inference for neural networks.
method Leverage tractable approximate Gaussian inference (TAGI) for hidden states inference.
result Demonstrates inference of hidden states through constraints for various applications.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
This paper introduces a new method to deceive causal structure learning by omitting data.
problem Deceiving causal structure learning algorithms with incompletely observed data.
method Adversarial missingness attack to bias the learned causal structures.
result Theoretical and practical attack mechanisms are developed for various SCMs.
Paper defends sensitive attributes in GNNs from inference attacks.
problem Protecting sensitive attributes in GNNs from inference attacks.
method Proposes adversarial training with TV and Wasserstein distance to locally filter sensitive attributes.
result Framework creates strong defense against inference attacks with minimal performance loss.
ATPF combines PF and EnKF for better inference in complex systems.
problem Weight degeneracy in PF and approximation errors in EnKF.
method Adversarial learning to improve posterior matching and incorporate kernel methods for optimization.
result ATPF provides theoretical guarantees and practical advantages over PF and EnKF.
Generative adversarial networks are a novel method for statistical inference that have achieved much empirical success; however, the factors contributing to this success remain ill-understood. In this work, we attempt to analyze generative adversarial learning -- that is, statistical inference as the result of a game b…
Bayesian methods improve adversarial machine learning robustness.
problem Improving machine learning systems' security against adversarial manipulation.
method Integrating Bayesian perspectives to relax unrealistic assumptions in game-theoretic models.
result Bayesian approach provides more robust inferences about opponent's beliefs and interests.
CANs improve GANs by enforcing structured constraints during training.
problem Generating valid structured objects like molecules and game maps from examples alone.
method Constrained Adversarial Networks (CANs) embed constraints into the model during training, penalizing invalid structures.
result CANs efficiently generate high-quality and novel valid structures.