Stochastic defense improves natural classifiers against adversarial attacks.
problem Vulnerability of deep networks to adversarial attacks.
method Long-run MCMC sampling with Energy-Based Model for adversarial purification.
result Balancing memoryless and metastable behavior leads to effective purification and robust classification.
This paper shows diffusion models improve intrusion detection by purifying adversarial examples.
problem Adversarial examples mislead ML intrusion detection systems, leading to false alerts or evasion.
method Used diffusion models to purify adversarial examples in intrusion detection.
result Diffusion models enhance adversarial robustness in intrusion detection without significantly impacting normal performance.
Theoretical study shows adversarial training improves robustness in deep learning models.
problem Ensuring robustness in pre-trained deep learning models.
method Theoretical analysis of adversarial training and feature purification in two-layer neural networks.
result Adversarial training leads to feature purification, making models more robust to attacks.
Adversarial training purifies hidden weights to remove small perturbations.
problem Understanding and removing adversarial perturbations in deep learning models.
method Introducing Feature Purification, a principle that adversarial training aims to remove small dense mixtures in hidden weights.
result Adversarial training can make neural networks robust against small perturbations, even with simple algorithms.
A Bayesian framework models adversarial uncertainty for robust machine learning.
problem Vulnerability of machine learning models to adversarial attacks.
method Formal Bayesian framework that models adversarial uncertainty through a stochastic channel, articulating probabilistic assumptions.
result Explicitly modeling adversarial uncertainty leads to improved robustification strategies.
Machine learning models have demonstrated vulnerability to adversarial attacks, more specifically misclassification of adversarial examples. In this paper, we propose a one-off and attack-agnostic Feature Manipulation (FM)-Defense to detect and purify adversarial examples in an interpretable and efficient manner. The i…
EBM life cycle project improves MCMC for image generation, defense, and density modeling.
problem Improving MCMC for diverse EBM applications.
method Three novel MCMC initialization methods for negative samples.
result State-of-the-art performance gains across three applications.
A new law limits kurtosis contrast in balanced mixtures.
problem Kurtosis-based ICA fails in wide, balanced mixtures.
method Proved a redundancy law and showed purification restores contrast.
result Kurtosis contrast obeys O(κmax/Reff) in balanced mixtures. The state-of-art DNN structures involve high computation and great demand for memory storage which pose intensive challenge on DNN framework resources. To mitigate the challenges, weight pruning techniques has been studied. However, high accuracy solution for extreme structured pruning that combines different types of …
The Riemannian Bures metric on the space of (normalized) complex positive matrices is used for parameter estimation of mixed quantum states based on repeated measurements just as the Fisher information in classical statistics. It appears also in the concept of purifications of mixed states in quantum physics. Here we d…
Models which estimate main effects of individual variables alongside interaction effects have an identifiability challenge: effects can be freely moved between main effects and interaction effects without changing the model prediction. This is a critical problem for interpretability because it permits "contradictory" m…
Trimming helps in conformal prediction when it separates anomaly scores.
problem Effectiveness of trimming in conformal prediction under contamination.
method Analyse fixed-threshold trimming as a replacement of the contaminated calibration law with a retained law.
result Trimming helps when it separates anomaly scores, reducing clean-target coverage to a one-dimensional score-CDF transfer problem.
GAMI-Tree uses model-based trees to fit low-order fANOVA models.
problem Fitting interpretable fANOVA models with low-order interactions.
method GAMI-Tree uses model-based trees and a new interaction filtering method.
result GAMI-Tree outperforms EBM and GAMI-Net in predictive performance and interpretability.
Framework purifies approximate differential privacy to pure differential privacy.
problem Achieving pure differential privacy from approximate differential privacy.
method Randomized post-processing with calibrated noise to eliminate δ parameter.
result First statistically and computationally efficient reduction from approximate DP to pure DP.
Structured weight pruning is a representative model compression technique of DNNs to reduce the storage and computation requirements and accelerate inference. An automatic hyperparameter determination process is necessary due to the large number of flexible hyperparameters. This work proposes AutoCompress, an automatic…
GNN-CL model improves financial fraud detection using graph neural networks and reinforcement learning.
problem Complex financial fraud detection with high false positive rates.
method Combines GNN, CNN, LSTM, and MLPS to analyze transaction patterns and uses reinforcement learning to filter out noise.
result GNN-CL outperforms existing methods in financial fraud detection, reducing false positives.
Machine learning can help us in solving problems in the context big data analysis and classification, as well as in playing complex games such as Go. But can it also be used to find novel protocols and algorithms for applications such as large-scale quantum communication? Here we show that machine learning can be used …
Proposes a new adversarial model to avoid accuracy vs. adversarial accuracy tradeoff.
problem Inherent tradeoff between accuracy and adversarial accuracy in existing adversarial robustness definitions.
method Introduces Voronoi-epsilon adversary that balances perturbation constraints.
result Voronoi-epsilon adversary avoids accuracy vs. adversarial accuracy tradeoff even with large ε. Adversarial consistency depends on the uniqueness of adversarial Bayes classifiers.
problem Consistency of adversarial surrogate losses is not guaranteed.
method Connected consistency of adversarial surrogate losses to the uniqueness of adversarial Bayes classifiers.
result A convex surrogate loss is statistically consistent for adversarial learning if and only if the adversarial Bayes classifier is unique.
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
Adversarial training, in which a network is trained on both adversarial and clean examples, is one of the most trusted defense methods against adversarial attacks. However, there are three major practical difficulties in implementing and deploying this method - expensive in terms of extra memory and computation costs; …
By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversa…
Paper bounds convergence rate of adversarial surrogate risk.
problem Vulnerability of binary classification models to adversarial attacks.
method Characterizes conditions for adversarial consistency and provides surrogate risk bounds.
result Surrogate risk bounds quantify the rate of convergence of adversarial classification risk.
Study on robustness in linear regression models, focusing on adversarial perturbations.
problem Understanding and improving robustness in linear regression models to adversarial perturbations.
method Developed a two-stage adversarial learning framework that incorporates model structure information.
result Proved the consistency and developed the Bahadur representation of the adversarially robust estimator.
Adversarial training based on the minimax formulation is necessary for obtaining adversarial robustness of trained models. However, it is conservative or even pessimistic so that it sometimes hurts the natural generalization. In this paper, we raise a fundamental question---do we have to trade off natural generalizatio…
Ideally, what confuses neural network should be confusing to humans. However, recent experiments have shown that small, imperceptible perturbations can change the network prediction. To address this gap in perception, we propose a novel approach for learning robust classifier. Our main idea is: adversarial examples for…
Modern machine learning algorithms perform poorly on adversarially manipulated data. Adversarial risk quantifies the error of classifiers in adversarial settings; adversarial classifiers minimize adversarial risk. In this paper, we analyze adversarial risk and adversarial classifiers from an optimal transport perspecti…
Adversarial training improves audio classifier robustness.
problem Improving robustness of audio classifiers against adversarial attacks.
method Adversarial training of deep neural networks on audio data.
result Adversarially trained models can resist higher perturbations and fooling rates.
Neural networks are vulnerable to adversarial attacks -- small visually imperceptible crafted noise which when added to the input drastically changes the output. The most effective method of defending against these adversarial attacks is to use the methodology of adversarial training. We analyze the adversarially train…
Paper tackles robustness in adversarial noise with a meta-optimizer.
problem Sensitivity to adversarial noise hinders machine learning deployment.
method Meta-optimizer learns to robustly optimize models using adversarial examples.
result Meta-optimizer transfers adversarial knowledge to new models without generating new examples.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
Robust RL with learned optimal adversary improves agent performance under adversarial state observations.
problem Ensuring reinforcement learning agents' robustness against adversarial perturbations of state observations.
method Proposed a framework of alternating training with learned adversaries (ATLA) to find optimal adversarial policies and enhance agent robustness.
result ATLA achieves state-of-the-art performance under strong adversaries in continuous control environments.
In recent years, deep neural networks have demonstrated outstanding performance in many machine learning tasks. However, researchers have discovered that these state-of-the-art models are vulnerable to adversarial examples: legitimate examples added by small perturbations which are unnoticeable to human eyes. Adversari…
The paper studies the asymptotic behavior of adversarial training under ℓ∞-perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under ℓ∞-perturbation could have a positive probability mass at 0 when the true parameter is 0. Adversarial training is one of the strongest defenses against adversarial attacks, but it requires adversarial examples to be generated for every mini-batch during optimization. The expense of producing these examples during training often precludes adversarial training from use on complex image datasets. In this study…
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
Paper proposes a new black-box adversarial attack using normalizing flows.
problem Adversarial vulnerability of deep neural networks.
method Proposes a novel black-box adversarial attack using normalizing flows.
result Demonstrates competitive performance against well-known black-box adversarial attack methods.
This paper improves adversarial robustness of deep learning models.
problem Vulnerability of machine learning models to adversarial perturbations.
method Analyzes adversarial training for linear regression and neural networks, incorporating L1 penalty.
result Incorporating L1 penalty leads to consistent adversarially robust estimation in high-dimensional settings.
Framework to mitigate adversarial attacks by allowing classifiers to abstain.
problem Vulnerability of classifiers to adversarial examples.
method Adversarial training with a rejection option.
result ATRO framework improves classifier reliability against adversarial attacks.
Today's state-of-the-art image classifiers fail to correctly classify carefully manipulated adversarial images. In this work, we develop a new, localized adversarial attack that generates adversarial examples by imperceptibly altering the backgrounds of normal images. We first use this attack to highlight the unnecessa…
A new method reduces adversarial training time without overfitting.
problem Catastrophic overfitting in single-step adversarial training.
method FGSMPR: FGSM with PGD Regularization.
result Reduces the gap to multi-step adversarial training.
Adversarial samples are perturbed inputs crafted to mislead the machine learning systems. A training mechanism, called adversarial training, which presents adversarial samples along with clean samples has been introduced to learn robust models. In order to scale adversarial training for large datasets, these perturbati…
I describe an optimal control view of adversarial machine learning, where the dynamical system is the machine learner, the input are adversarial actions, and the control costs are defined by the adversary's goals to do harm and be hard to detect. This view encompasses many types of adversarial machine learning, includi…
This paper investigates how network width and depth affect adversarially robust DNNs.
problem Understanding architectural configurations for adversarially robust DNNs.
method Comprehensive investigation on the impact of network width and depth on adversarial robustness.
result Optimal architectural configuration for adversarial robustness exists and can improve robustness.
Study non-asymptotic bounds for robust estimators under misspecified models.
problem Evaluate performance of robust estimators under adversarial conditions.
method Propose a general approach to adversarial risk analysis, including investigations on generalization and approximation errors.
result Establish non-asymptotic upper bounds for adversarial excess risk under Lipschitz loss functions.
3D adversarial logos can fool object detectors in real-world settings.
problem Creating robust adversarial attacks in 3D rendering views.
method Constructing 3D adversarial logos via texture mapping and differentiable rendering.
result 3D adversarial logos are more versatile and robust than traditional adversarial patches.