New method to predict adversarial perturbation intensity for logistic regression.
problem Adversarial attacks on machine learning models.
method Probabilistic definition of adversarial examples using logistic regression's asymptotic properties.
result Derive a closed-form expression for adversarial perturbation intensity.
SmoothFool efficiently computes smooth adversarial perturbations for deep networks.
problem Vulnerability of deep neural networks to adversarial attacks with specific statistical properties.
method SmoothFool: a general and computationally efficient framework for computing smooth adversarial perturbations.
result Smoothness significantly enhances robustness against adversarial attacks and improves transferability.
PARADE generates provably robust adversarial examples for deep networks.
problem Creating robust adversarial examples for deep neural networks.
method Iterative refinement of adversarial regions using optimization to ensure robustness under various perturbations.
result PARADE finds large, provably robust adversarial regions with high volume under various perturbations.
Proposes a new method to improve deep model security against adversarial deformations.
problem Deep neural networks' resistance to adversarial attacks, especially location perturbations.
method Regularizes flow gradients to provide a tighter bound and improve model resistance.
result Models trained with flow gradient regularization show better resistance to adversarial deformations compared to input gradient regularization and adversarial training.
Paper finds universal speech command perturbations that fool models.
problem Existence of universal adversarial examples in speech command classification.
method Proposed a novel analytical framework for evaluating universal perturbations and a detailed distortion measurement method.
result Universal perturbations can fool speech command classification models across different models.
New framework provides robustness guarantees against adversarial attacks.
problem Adversarial examples lead to different outputs from deep-learning algorithms.
method Connects robustness to additive noise and proposes a training strategy.
result Scalable method improves certified bounds on adversarial perturbation.
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
Study shows transfer of adversarial robustness between different perturbation types is limited.
problem Understanding adversarial robustness across various perturbation types.
method Evaluated 32 attacks of 5 different types on models trained on a subset of ImageNet.
result Adversarial robustness transfer between perturbation types is limited and depends on the specific type of perturbation.
Two quantization-based defenses improve CNN robustness against adversarial attacks.
problem Adversarial examples threaten machine learning, especially CNNs.
method Constant Quantization (CQ) and Trainable Quantization (TQ) to increase CNN robustness.
result Significant increase in classification accuracy of perturbed images.
This paper quantifies privacy-robustness and generalization-robustness trade-offs in adversarial training.
problem Privacy and generalization issues in adversarial training.
method Defines robustified intensity and empirical robustified intensity to measure robustness, proving differential privacy and generalization bounds.
result Proves adversarial training is (ε,δ)-differentially private and provides generalization bounds. Neural networks learn distance-based representations, not just intensity.
problem Understanding how neural networks interpret and learn from internal activations.
method Manipulated ReLU and Absolute Value activations to observe sensitivity to distance and intensity perturbations.
result Neural networks are highly sensitive to small distance-based perturbations, challenging the intensity-based interpretation.
Adversarial training helps classifiers resist universal perturbations.
problem Vulnerability of classifiers to universal perturbations.
method Adversarial training with shared adversarial examples.
result Adversarial training reduces sensitivity to universal perturbations.
The paper studies the asymptotic behavior of adversarial training under ℓ∞-perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under ℓ∞-perturbation could have a positive probability mass at 0 when the true parameter is 0. Universal perturbations misclassify text with high accuracy.
problem Vulnerability of text classifiers to small perturbations.
method Algorithm to compute universal adversarial perturbations.
result Deep neural networks are highly vulnerable to universal adversarial perturbations.
Study shows adversarial robustness and common perturbation robustness are independent.
problem Understanding the relationship between adversarial robustness and common perturbation robustness in neural networks.
method Conducted experiments to benchmark neural network robustness to common perturbations and adversarial examples.
result Adversarial robustness and common perturbation robustness are independent attributes.
Our research tackles robustness to multiple perturbations in adversarial training.
problem Defenses against adversarial examples are tailored to single perturbation types and offer no guarantees for others.
method We analyze and train models robust to multiple ℓp-bounded and spatial perturbations. result No model trained against multiple attacks achieves robustness competitive with individual training.
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
Wide networks learn from adversarial perturbations effectively.
problem Understanding why adversarial examples deceive classifiers and transfer between models.
method Assumed wide two-layer networks, proved with theoretical analysis.
result Adversarial perturbations contain class-specific features for networks to generalize.
A fast method computes class-specific adversarial perturbations for deep networks.
problem Computing robust adversarial perturbations for deep networks.
method Linear function of weights, no training data, no hyper-parameters.
result Obtains 34% to 51% fooling rate on ImageNet, transfers across models.
Generative model creates universal perturbations to fool classifiers.
problem Vulnerability of neural networks to adversarial examples.
method Generative adversarial network approach to create universal perturbations.
result Generative model improves on existing universal adversarial attacks.
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less Lp norm distortion compared to non-local counterparts. BPN defends against adversarial attacks by generating beneficial perturbations.
problem Adversarial attacks cause deep neural networks to misclassify clean inputs.
method BPN generates beneficial perturbations during training to neutralize future adversarial attacks.
result BPN is robust to adversarial examples and more efficient than classical adversarial training.
DIP-FAT improves adversarial training by diversifying perturbations.
problem Adversarial examples fool deep neural networks, leading to overfitting and poor performance.
method DIP-FAT uses random directions to diversify perturbations in adversarial training.
result DIP-FAT reduces overfitting and improves clean data accuracy.
Paper tackles fooling deep networks with minimal perturbations.
problem Easily fooling deep neural networks with high confidence predictions.
method Uses integrated adaptive gradients to generate minimal adversarial perturbations.
result Achieves minimal adversarial perturbations for fooling deep networks.
Defense against Wasserstein adversarial attacks using randomized smoothing.
problem Certified robustness against Wasserstein adversarial attacks.
method Randomized smoothing applied to the space of flows between images, bounding Wasserstein distance by L_1 distance.
result Significantly improved accuracy under Wasserstein adversarial attacks compared to unprotected models.
Paper proposes a method to generate adversarial perturbations for black-box attacks without accessing inner states.
problem Generating adversarial perturbations for black-box attacks without accessing inner states of a DNN.
method Matrix-free generation method that requires fewer query trials.
result The proposed method successfully deceives a DNN for semantic segmentation more effectively than random noise.
Adversarial fog tests autonomous navigation models.
problem Neural networks are fooled by adversarial perturbations, but fog naturally creates similar perturbations.
method Introduced a new type of adversarial perturbation using generative models and Cycle-Consistent Generative Adversarial Networks.
result Generated adversarial fog images help test autonomous navigation models.
EdgeFool generates adversarial images to mislead classifiers.
problem Misleading classifiers with adversarial images.
method Trains a fully convolutional neural network to generate perturbations that enhance image details and mislead classifiers.
result EdgeFool outperforms other adversarial methods on various classifiers and datasets.
Unified analysis of perturbation-based strategies in stochastic and adversarial bandit problems.
problem Optimality of perturbation-based strategies in multi-armed bandit problems.
method Unified regret analysis for stochastic and adversarial settings, using perturbations of sub-Weibull and bounded support.
result Unified bounds for perturbations in both stochastic and adversarial settings, with optimal perturbations of Frechet-type.
Adversarial perturbations fool deepfake detectors with high accuracy.
problem Improving deepfake detection accuracy against adversarial attacks.
method Used adversarial perturbations and two defenses: Lipschitz regularization and Deep Image Prior (DIP).
result Deepfake detectors achieved 27% accuracy on perturbed images, compared to 95% on unperturbed.
CAT improves robustness of neural networks by customizing perturbation levels.
problem Poor generalization of adversarial training on clean and perturbed data.
method CAT adapts perturbation level and label for each sample.
result CAT achieves better clean and robust accuracy than previous methods.
New adversarial training methods generate multiplicative perturbations for robust DNN training.
problem Training Deep Neural Networks with adversarial examples to improve robustness.
method Proposes xAT and xVAT, generating multiplicative perturbations for robust training.
result xAT and xVAT match or outperform state-of-the-art classification accuracies and are faster.
New method UADs improves transferability of adversarial perturbations.
problem Transferability of adversarial perturbations across different DNN architectures.
method Proposes Universal Adversarial Directions (UADs) to improve transferability.
result UADs can achieve a Nash equilibrium, indicating potential transferability.
AWP improves robustness by flattening weight loss landscape.
problem Improving robustness of deep neural networks against adversarial examples.
method Explicitly regularizes the flatness of weight loss landscape through adversarial weight perturbation.
result AWP forms a double-perturbation mechanism in adversarial training, leading to flatter weight loss landscape.
Ensemble methods improve neural networks' accuracy and robustness against adversarial perturbations.
problem Adversarial perturbations can cause deep learning models to misclassify.
method Used ensemble methods to defend against adversarial perturbations.
result Ensemble methods improve accuracy and robustness of neural networks against adversarial attacks.
New definition shows no trade-off between adversarial and standard accuracy.
problem Inexact definition of adversarial perturbation causes confusion.
method Proposed a slight modification to adversarial perturbation definition.
result Existence of classifiers that are robust and achieve high standard accuracy.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
State-of-the-art classifiers are vulnerable to small adversarial perturbations.
problem Vulnerability of state-of-the-art classifiers to adversarial perturbations.
method Assumed smooth generative model, derived upper bounds on robustness, proved adversarial perturbation transfer.
result Existence of adversarial perturbations that transfer well across different classifiers with small risk.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
FineFool attacks deep models by focusing on object contours, improving attack performance.
problem Adversarial attacks on deep learning models, especially those that focus on perturbation size and success rate.
method FineFool uses attention to focus on object contours, producing more efficient and imperceptible perturbations.
result FineFool achieves better attack performance compared to state-of-the-art attacks, including higher success rate and smaller perturbations.
This paper introduces metrics to evaluate robustness of neural networks to natural adversarial examples.
problem Measuring robustness of neural networks to natural adversarial examples.
method Proposes latent space performance metrics based on generative models.
result Latent adversarial perturbations are often perceptually small and associated with classifier accuracy.
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to aug…
Framework for generating adversarial examples from learning algorithms.
problem Adversarial perturbations leading to erroneous classification.
method Perturbation analysis framework based on convex programming.
result Closed-form solutions for new adversarial attacks.
Paper defends deep learning classifiers against channel-aware adversarial attacks.
problem Deep learning classifiers are vulnerable to adversarial attacks.
method Channel-aware adversarial attacks are presented and defended against.
result Certified defense based on randomized smoothing makes classifiers robust.
A new adversarial attack improves model perturbation efficiency.
problem Improving adversarial attacks to better perturb images.
method LogBarrier method for solving constrained minimization problem.
result LogBarrier attack performs better on challenging images.
Adversarial perturbations are more effective in Y-channel of YCbCr color space.
problem Vulnerability of deep models to adversarial perturbations in images.
method Proposed ResUpNet defense that removes perturbations only from the Y-channel of YCbCr color space.
result ResUpNet achieves the best balance between defense and maintaining original image accuracy.
Generative models create image perturbations to fool AI models.
problem Creating adversarial examples that fool pre-trained models.
method Trainable deep neural networks for image perturbation generation.
result High fooling rates with small perturbation norms, faster than current methods.
A new efficient PGD method generates smaller perturbation adversarial examples.
problem Adversarial examples in deep neural networks.
method Modified Project Gradient Descent (PGD) method for ensemble models.
result Generates smaller perturbation adversarial examples than PGD method.