New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
A new model for sequential prediction handles adversarial examples by allowing abstention.
problem Sequential prediction algorithms fail with adversarial examples, leading to incorrect predictions.
method Proposes a new model that allows abstention from predictions on adversarial examples, scaling error with VC dimension.
result A learner's error scales with the VC dimension of the hypothesis class, matching the stochastic setting.
New framework for understanding adversarial and stochastic learning.
problem Understanding the continuum from adversarial to stochastic settings in online learning.
method Distributionally constrained adversaries framework.
result Characterization of learnable distribution classes for various function classes.
Paper analyzes adversarial risk using optimal transport.
problem Poor performance of machine learning on adversarial data.
method Optimal transport perspective, optimal transport plans (couplings), convexity, smoothness assumptions.
result Fundamental limits on adversarial risk calculated for various datasets.
Modern deep neural network models suffer from adversarial examples, i.e. confidently misclassified points in the input space. It has been shown that Bayesian neural networks are a promising approach for detecting adversarial points, but careful analysis is problematic due to the complexity of these models. Recently Gil…
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
Study robustness of split conformal prediction under adversarial attacks.
problem Ensuring distribution-free coverage guarantees in CP under adversarial conditions.
method Theoretical analysis and extensive experiments on split conformal prediction robustness.
result Prediction coverage varies with calibration-time attack strength, enabling control over coverage under adversarial tests.
We present heuristics for solving the maximin problem induced by the generative adversarial privacy setting for linear and convolutional neural network (CNN) adversaries. In the linear adversary setting, we present a greedy algorithm for approximating the optimal solution for the privatizer, which performs better as th…
Study proves existence of robust classifiers in multiclass adversarial training.
problem Proves existence of robust classifiers in multiclass adversarial training.
method Three models of adversarial training in multiclass classification, proving existence of Borel measurable robust classifiers.
result Proves existence of Borel measurable robust classifiers in each model.
This paper examines various definitions of adversarial risk and their implications.
problem Quantifying the performance of classifiers under adversarial perturbations.
method Optimal transport, robust statistics, functional analysis, and game theory.
result Generalization of Strassen's theorem and new connections to Choquet capacities and game theory.
This paper analyzes how machine learning models resist adversarial attacks in nonparametric regression.
problem Adversarial attacks on machine learning models in nonparametric regression.
method Theoretical analysis of minimax rates of convergence under adversarial sup-norm.
result The minimax rate under adversarial attacks is the sum of two terms: standard rate and deviation of true function.
Study efficient learning of robust halfspaces with noise.
problem Learning robust halfspaces in the presence of adversarial perturbations and random label noise.
method Provides conditions for robust learnability and a simple algorithm for any ℓ_p perturbation.
result Simple computationally efficient algorithm for robust learning with random label noise.
We improve adversarial robustness calibration analysis for broader hypothesis sets.
problem Improving calibration for adversarial robustness in machine learning.
method A finer definition of calibration for adversarial robustness.
result Our results cover most common hypothesis sets in machine learning.
Improved online convex optimization bounds between stochastic and adversarial settings.
problem Understanding optimization tasks that are neither i.i.d. nor fully adversarial.
method Establishing novel regret bounds exploiting smoothness of expected losses.
result Regret bounds improve on previous results by reducing dependence on maximum gradient length to variance of gradients.
Gödel's sentence is an adversarial example but unsolvable.
problem The existence and unsolvability of adversarial examples.
method Analysis of non-isomorphic natural explanations and computability theory.
result Gödel's sentence is an adversarial example that cannot be solved.
Adversarial robust learning improved for transductive setting.
problem Adversarial robust learning in transductive setting.
method Simple transductive learner for bounded VC dimension classes.
result Robust error rate linear in VC dimension, adaptive to perturbation complexity.
Robust RL with learned optimal adversary improves agent performance under adversarial state observations.
problem Ensuring reinforcement learning agents' robustness against adversarial perturbations of state observations.
method Proposed a framework of alternating training with learned adversaries (ATLA) to find optimal adversarial policies and enhance agent robustness.
result ATLA achieves state-of-the-art performance under strong adversaries in continuous control environments.
New bounds for online convex optimization between stochastic and adversarial settings.
problem Understanding optimization tasks that are neither i.i.d. nor fully adversarial.
method Establishing novel regret bounds exploiting smoothness of expected losses.
result Regret bounds match expected rates in the fully i.i.d. case and gracefully deteriorate in the fully adversarial case.
Study improves resilience against adversarial clean-label attacks in real and noisy settings.
problem Ensuring accurate predictions in the presence of adversarial clean-label samples.
method Sequential learning from a stream of i.i.d. data, allowing abstention for uncertain predictions.
result Theoretical analysis and adaptations for the agnostic setting with a clean-label adversary and noise.
Paper examines Go AI robustness against adversarial attacks.
problem Superhuman Go AIs are vulnerable to simple adversarial strategies.
method Three defenses tested: adversarial training, iterated adversarial training, and changing network architecture.
result No defense is robust against newly trained adversaries, and attacks are similar to cyclic attacks.
Adversarial attacks against neural networks in a regression setting are a critical yet understudied problem. In this work, we advance the state of the art by investigating adversarial attacks against regression networks and by formulating a more effective defense against these attacks. In particular, we take the perspe…
New controller reduces regret in non-stochastic control with adversarial perturbations.
problem Non-stochastic control with adversarial perturbations and partially observed states.
method Denoised observations and online gradient descent.
result Sublinear regret bounds, optimal for known and unknown systems.
Study robust regression learning under adversarial attacks.
problem Understanding which function classes are learnable in the presence of adversarial attacks.
method Introduced a novel agnostic sample compression scheme and used fat-shattering dimension to construct adversarially robust sample compression schemes.
result Finite fat-shattering dimension classes are learnable in both realizable and agnostic settings.
Study robust learning without knowing perturbation sets, using interactions with attackers.
problem Learning robust predictors against unknown adversarial perturbations.
method Examined different interaction models with adversarial attackers, derived bounds on sample complexity and interactions.
result Upper bounds on sample complexity and lower bounds on interactions in various models.
Paper bounds convergence rate of adversarial surrogate risk.
problem Vulnerability of binary classification models to adversarial attacks.
method Characterizes conditions for adversarial consistency and provides surrogate risk bounds.
result Surrogate risk bounds quantify the rate of convergence of adversarial classification risk.
The paper sets lower bounds for adversarial robustness in multiclass classification.
problem Adversarial robustness in multiclass classification with arbitrary loss functions.
method Dual and barycentric reformulations for robust risk minimization.
result Sharp lower bounds for adversarial risks are computed efficiently.
Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
Study on Pareto optimality in multi-objective bandit problems.
problem Pareto optimality in multi-objective multi-armed bandit problems.
method Formulated adversarial multi-objective multi-armed bandit, defined Pareto regrets, presented algorithms, established upper and lower bounds.
result New algorithms are optimal in adversarial settings and nearly optimal in stochastic settings.
Adversarial examples pose a threat to deep neural network models in a variety of scenarios, from settings where the adversary has complete knowledge of the model and to the opposite "black box" setting. Black box attacks are particularly threatening as the adversary only needs access to the input and output of the mode…
We consider the problem of influence maximization in fixed networks for contagion models in an adversarial setting. The goal is to select an optimal set of nodes to seed the influence process, such that the number of influenced nodes at the conclusion of the campaign is as large as possible. We formulate the problem as…
Improved FPL algorithms for adversarial MDPs with better regret bounds.
problem Adversarial rewards and unknown transitions in MDPs.
method Refined analysis of FPL algorithms, matching current best regret bounds.
result Improved regret bounds for FPL algorithms in adversarial MDPs.
Algorithm learns expert weights to minimize regret in adversarial setting.
problem Learning to aggregate expert forecasts with no-regret guarantee in adversarial conditions.
method Online mirror descent algorithm for logarithmic pooling of expert forecasts.
result Achieves O ( T log T ) O(\sqrt{T} \log T) O ( T log T ) expected regret compared to best weights. New framework for fair classification in adversarial settings with provable guarantees.
problem Fairness in classification with adversarial perturbations of protected attributes.
method Optimization framework for learning fair classifiers with provable guarantees.
result Near-tightness of accuracy and fairness guarantees for multiple protected attributes and various hypothesis classes.
Paper provides robustness bounds for GNNs against adversarial attacks.
problem Adversarial robustness of GNNs for graph-related tasks.
method PAC-Bayesian framework applied to GCN and MP-GNN.
result Spectral norms of diffusion matrix and weights govern robustness.
The paper shows how policy regularization acts like an adversary to improve robustness.
problem Improving robustness of learned policies in reinforcement learning.
method Using convex duality, the paper characterizes adversarial reward perturbations and provides generalization guarantees.
result Policy regularization acts as an adversary to improve robustness against worst-case reward perturbations.
New gradient coding schemes reduce decoding error in both random and adversarial straggler settings.
problem Creating efficient approximate gradient coding schemes for distributed optimization.
method Introduced novel approximate gradient codes based on expander graphs, achieving optimal decoding coefficients.
result Achieved nearly optimal error in random setting and nearly half the error in adversarial setting compared to existing codes.
Deep neural networks are vulnerable to adversarial examples. Prior defenses attempted to make deep networks more robust by either changing the network architecture or augmenting the training set with adversarial examples, but both have inherent limitations. Motivated by recent research that shows outliers in the traini…
Deep neural networks (DNNs) have set benchmarks on a wide array of supervised learning tasks. Trained DNNs, however, often lack robustness to minor adversarial perturbations to the input, which undermines their true practicality. Recent works have increased the robustness of DNNs by fitting networks using adversarially…
New insights link no-regret learning to online conformal prediction in adversarial settings.
problem Understanding the relationship between no-regret learning and online conformal prediction in adversarial environments.
method Analysis of existing algorithms and new connections between no-regret learning and conformal prediction.
result No-regret learning algorithms can provide group-conditional coverage guarantees in adversarial settings.
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmann…
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
Adapting Hedge algorithm for semi-adversarial data with root-entropy regularization.
problem Minimizing regret in prediction with expert advice under varying distributions.
method Follow-the-Regularized-Leader (FTRL) with root-entropy regularization.
result Adaptive minimax optimal regret across all levels of constraint sets.
Paper provides optimal statistical guarantees for adversarial robustness in Gaussian classification.
problem Understanding statistical risks for adversarial robustness in Gaussian classification models.
method Established minimax lower bounds and designed an efficient estimator for excess risk.
result Optimal minimax guarantees for excess risk under Gaussian mixture model with AdvSNR.
Many machine learning models are vulnerable to adversarial attacks; for example, adding adversarial perturbations that are imperceptible to humans can often make machine learning models produce wrong predictions with high confidence. Moreover, although we may obtain robust models on the training dataset via adversarial…
Note that this paper is superceded by "Black-Box Adversarial Attacks with Limited Queries and Information." Current neural network-based image classifiers are susceptible to adversarial examples, even in the black-box setting, where the attacker is limited to query access without access to gradients. Previous methods -…
Adversarial training shows promise as an approach for training models that are robust towards adversarial perturbation. In this paper, we explore some of the practical challenges of adversarial training. We present a sensitivity analysis that illustrates that the effectiveness of adversarial training hinges on the sett…
This paper optimizes attacks on stochastic bandits and proposes defenses against them.
problem Optimizing adversarial attacks on stochastic bandit algorithms.
method Designs optimal attack strategies and proposes defense algorithms.
result Optimal attack strategies and defense algorithms achieve near perfect performance.