Bayesian approach helps detect adversarial examples in neural networks.
problem Detecting adversarial examples in deep neural networks.
method Adversarial spheres and approximate Bayesian inference for a linear model.
result Bayesian methods provide better predictions of adversarial points.
The paper analyzes various normalization methods in deep learning.
problem Lack of mathematical tools to analyze normalization methods.
method Proposed a lemma to define tools, analyzed BN, LN, WN, GN.
result Normalization methods can be unified on a sphere, improving training stability and weight norm.
New findings show neural networks can be fooled by adversarial data, but a simple bias fix works.
problem Neural networks can be misled by adversarial data, rendering existing generalization bounds ineffective.
method Extensive theoretical investigation of a specific dataset using infinitely-wide models, focusing on the Neural Tangent Kernel (NTK).
result A sensible choice of output bias completely mitigates the adversarial phenomenon, revealing phase transitions in accuracy.
Research shows how deepfakes can be used to manipulate accounting systems.
problem The vulnerability of CAATs to adversarial attacks.
method Developed a thread model to camouflage anomalies, used adversarial autoencoder neural networks to learn latent factors, demonstrated misuse of model to generate misleading entries.
result Adversarial autoencoder neural networks can learn and manipulate accounting data to deceive CAATs.
This paper debiases KG embeddings by filtering sensitive attributes.
problem Social and cultural biases in KG representations.
method Exploring and filtering popularity and gender biases in KGE.
result Sensitivity of KG embeddings to sensitive attributes like gender.
A new gradient estimator for online optimization with two function evaluations.
problem Online optimization of convex and Lipschitz functions with noisy data.
method L1-randomization approach for gradient estimation.
result Compared or better guarantees than previous methods for canceling noise.
Proposes a new adversarial model to avoid accuracy vs. adversarial accuracy tradeoff.
problem Inherent tradeoff between accuracy and adversarial accuracy in existing adversarial robustness definitions.
method Introduces Voronoi-epsilon adversary that balances perturbation constraints.
result Voronoi-epsilon adversary avoids accuracy vs. adversarial accuracy tradeoff even with large ε. Estimates the upper bound of linear regions in spheres centered at specific data points in ReLU neural networks.
problem Bounding the number of linear regions in specific areas of neural networks using ReLU activations.
method Developed a method to estimate the upper bound of linear regions in any sphere within the input space of a ReLU neural network.
result The boundaries of linear regions move away from training data points during training, and spheres centered at these points contain more regions than arbitrary points.
Adversarial consistency depends on the uniqueness of adversarial Bayes classifiers.
problem Consistency of adversarial surrogate losses is not guaranteed.
method Connected consistency of adversarial surrogate losses to the uniqueness of adversarial Bayes classifiers.
result A convex surrogate loss is statistically consistent for adversarial learning if and only if the adversarial Bayes classifier is unique.
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Adversarial training achieves optimal test error for shallow networks.
problem Achieving optimal adversarial test error for general data distributions.
method Applying new Rademacher complexity bounds and properties of optimal adversarial predictors.
result Adversarial training can achieve optimal adversarial test error for general data distributions.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
New approach improves adversarial robustness without sacrificing natural generalization.
problem Balancing adversarial robustness and natural generalization in machine learning.
method Friendly adversarial training (FAT) using early-stopped PGD to find least adversarial data.
result Early-stopped PGD achieves adversarial robustness without compromising natural generalization.
Adversarial training adds dynamic perturbations to neural networks for robustness.
problem Accuracy trade-off and lack of diversity in adversarial examples.
method Dynamic adversarial perturbations in the parameter space of neural networks, updating perturbation biases during training.
result Adversarial training with negligible cost and reduced accuracy trade-off.
Simple regularization methods mimic adversarial training's robustness.
problem Expensive adversarial training for robustness.
method Label smoothing and logit squeezing.
result Achieves strong adversarial robustness without adversarial examples.
Optimal control theory applied to machine learning adversarial attacks.
problem Adversarial machine learning threats and detection challenges.
method Optimal control theory applied to machine learning systems.
result Advances in control theory and reinforcement learning can enhance adversarial machine learning research.
By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversa…
Paper analyzes adversarial risk using optimal transport.
problem Poor performance of machine learning on adversarial data.
method Optimal transport perspective, optimal transport plans (couplings), convexity, smoothness assumptions.
result Fundamental limits on adversarial risk calculated for various datasets.
Aims to make neural networks robust to small, imperceptible perturbations.
problem Neural networks can be fooled by small, imperceptible changes.
method Proposes a Generative Adversarial Networks (GAN) framework to learn robust classifiers.
result Our method outperforms adversarial training in robustness.
New method makes neural networks more secure by protecting latent layers from adversarial attacks.
problem Vulnerability of latent layers in adversarially trained models to small perturbations.
method Latent Adversarial Training (LAT) and Latent Attack (LA) algorithms.
result Improves adversarial accuracy by 1-2% on MNIST, CIFAR-10, CIFAR-100 datasets.
Paper bounds convergence rate of adversarial surrogate risk.
problem Vulnerability of binary classification models to adversarial attacks.
method Characterizes conditions for adversarial consistency and provides surrogate risk bounds.
result Surrogate risk bounds quantify the rate of convergence of adversarial classification risk.
Study on robustness in linear regression models, focusing on adversarial perturbations.
problem Understanding and improving robustness in linear regression models to adversarial perturbations.
method Developed a two-stage adversarial learning framework that incorporates model structure information.
result Proved the consistency and developed the Bahadur representation of the adversarially robust estimator.
Free adversarial training improves robustness without generating adversarial examples.
problem Training robust models against adversarial attacks is costly and impractical for large-scale datasets.
method Recycles gradient information from parameter updates to generate adversarial examples.
result Free adversarial training achieves comparable robustness to PGD training at negligible cost.
Localized adversarial training improves image classifiers' robustness.
problem State-of-the-art image classifiers fail on carefully manipulated adversarial images.
method Developed a localized adversarial attack and used it to train a robust classifier.
result Localized adversarial training increases robustness against adversarial inputs.
Adversarial training improves gradient interpretability, reducing misinterpretations.
problem Improving gradient interpretability in adversarially trained deep networks.
method Identified and demonstrated that adversarial training restricts gradients closer to the image manifold, making them more interpretable.
result Adversarial training leads to more meaningful loss gradients, aligning better with human perception.
A Bayesian framework models adversarial uncertainty for robust machine learning.
problem Vulnerability of machine learning models to adversarial attacks.
method Formal Bayesian framework that models adversarial uncertainty through a stochastic channel, articulating probabilistic assumptions.
result Explicitly modeling adversarial uncertainty leads to improved robustification strategies.
Study evaluates adversarial attacks on speech emotion recognition systems.
problem Adversarial examples challenge the robustness of speech emotion recognition systems.
method Proposes adversarial training and GAN as defenses.
result Demonstrates effective use of adversarial examples for robustness.
Adversarial training improves audio classifier robustness.
problem Improving robustness of audio classifiers against adversarial attacks.
method Adversarial training of deep neural networks on audio data.
result Adversarially trained models can resist higher perturbations and fooling rates.
Paper tackles robustness in adversarial noise with a meta-optimizer.
problem Sensitivity to adversarial noise hinders machine learning deployment.
method Meta-optimizer learns to robustly optimize models using adversarial examples.
result Meta-optimizer transfers adversarial knowledge to new models without generating new examples.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
Survey of adversarial examples in visual machine learning models.
problem Vulnerability of machine learning models to adversarial examples.
method Exploration of various adversarial attack and defense methods.
result Understanding of adversarial attack and defense mechanisms.
Robust RL with learned optimal adversary improves agent performance under adversarial state observations.
problem Ensuring reinforcement learning agents' robustness against adversarial perturbations of state observations.
method Proposed a framework of alternating training with learned adversaries (ATLA) to find optimal adversarial policies and enhance agent robustness.
result ATLA achieves state-of-the-art performance under strong adversaries in continuous control environments.
Interpolated adversarial training improves robustness without sacrificing accuracy.
problem Improving adversarial robustness without degrading generalization performance.
method Interpolated adversarial training using interpolation-based methods.
result Retains adversarial robustness while achieving a standard test error of 6.45%.
Enhances single-step adversarial training to defend against iterative adversarial examples.
problem Defending against iterative adversarial examples in neural networks.
method Identified and leveraged empirical properties of Iter-Adv to improve Single-Adv.
result Enhanced Single-Adv to defend against iterative adversarial examples with improved accuracy and reduced training cost.
In recent years, deep neural networks have demonstrated outstanding performance in many machine learning tasks. However, researchers have discovered that these state-of-the-art models are vulnerable to adversarial examples: legitimate examples added by small perturbations which are unnoticeable to human eyes. Adversari…
The paper studies the asymptotic behavior of adversarial training under ℓ∞-perturbation.
problem Theoretical guarantees for sparsity-recovery in adversarial training.
method Investigation of the asymptotic distribution of the adversarial training estimator in generalized linear models.
result The asymptotic distribution of the adversarial training estimator under ℓ∞-perturbation could have a positive probability mass at 0 when the true parameter is 0. Detects adversarial examples using SHAP values from neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Uses SHAP values from internal layers to distinguish normal from adversarial inputs.
result Demonstrates high detection accuracy and strong generalization to various attack methods.
Develops robust few-shot learning models resistant to adversarial attacks.
problem Adversarial vulnerability in few-shot learning models.
method Adversarial Querying (AQ) algorithm for robust meta-learners.
result Achieves superior robust performance on few-shot image classification tasks.
This paper explores tradeoffs between standard and adversarial risks in distributionally adversarial training.
problem Understanding the impact of adversarial training on standard risk and adversarial risk.
method Study of distributionally adversarial training with different learning settings and models.
result Derives Pareto-optimal tradeoff curves between standard and adversarial risks.
Paper proposes a new black-box adversarial attack using normalizing flows.
problem Adversarial vulnerability of deep neural networks.
method Proposes a novel black-box adversarial attack using normalizing flows.
result Demonstrates competitive performance against well-known black-box adversarial attack methods.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
This paper improves adversarial robustness of deep learning models.
problem Vulnerability of machine learning models to adversarial perturbations.
method Analyzes adversarial training for linear regression and neural networks, incorporating L1 penalty.
result Incorporating L1 penalty leads to consistent adversarially robust estimation in high-dimensional settings.
Framework to mitigate adversarial attacks by allowing classifiers to abstain.
problem Vulnerability of classifiers to adversarial examples.
method Adversarial training with a rejection option.
result ATRO framework improves classifier reliability against adversarial attacks.
A new method reduces adversarial training time without overfitting.
problem Catastrophic overfitting in single-step adversarial training.
method FGSMPR: FGSM with PGD Regularization.
result Reduces the gap to multi-step adversarial training.
New method improves DNN robustness against adversarial attacks.
problem Adversarial vulnerability of neural networks.
method Enforcing linearity in DNN in transformed input and feature space, and augmenting with Local Lipschitz regularizer.
result Significantly improved robustness of DNN models on various datasets.
CCAT improves model robustness to various adversarial attacks.
problem Robustness to adversarial attacks does not generalize to unseen threat models.
method CCAT biases models towards low confidence predictions on adversarial examples.
result CCAT increases robustness against multiple adversarial attack norms and types.
ADT improves model robustness by learning adversarial distributions.
problem Ineffective robustness against unseen attacks due to specific attack algorithms.
method Formulates adversarial distributional training as a minimax optimization problem, learning adversarial distributions and training robust models.
result Empirical validation of ADT's effectiveness compared to state-of-the-art methods.
Adversarial samples are perturbed inputs crafted to mislead the machine learning systems. A training mechanism, called adversarial training, which presents adversarial samples along with clean samples has been introduced to learn robust models. In order to scale adversarial training for large datasets, these perturbati…