This paper explores evasion attacks against Bayesian models.
problem Bayesian predictive models are vulnerable to evasion attacks.
method Developed gradient-based attacks for specific point predictions and entire posterior distributions.
result Optimal evasion attacks can be designed against Bayesian models.
Study robustness of split conformal prediction under adversarial attacks.
problem Ensuring distribution-free coverage guarantees in CP under adversarial conditions.
method Theoretical analysis and extensive experiments on split conformal prediction robustness.
result Prediction coverage varies with calibration-time attack strength, enabling control over coverage under adversarial tests.
Research shows filtering reduces predictability of cyber-attacks.
problem Predicting cyber-attacks from incomplete data.
method Combining external data with machine learning algorithms to learn indicators of cyber-attacks.
result The process of filtering reduces the predictability of cyber-attacks.
High-performance Deep Neural Networks (DNNs) are increasingly deployed in many real-world applications e.g., cloud prediction APIs. Recent advances in model functionality stealing attacks via black-box access (i.e., inputs in, predictions out) threaten the business model of such applications, which require a lot of tim…
New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
Adversarial tweets can fool stock prediction models, causing financial loss.
problem Vulnerability of stock prediction models to adversarial attacks on social media.
method Solving combinatorial optimization problems with semantic and budget constraints to generate adversarial tweets.
result Adversarial tweets can fool stock prediction models and cause significant financial loss.
Paper examines adversarial attacks on weather forecasting models, focusing on TC trajectory prediction.
problem Adversarial attacks can mislead downstream TC trajectory predictions in DLWF models.
method Proposes Cyc-Attack, a method using a surrogate model and skewness-aware loss function to generate adversarial TC paths.
result Cyc-Attack achieves higher true positive rates and lower false alarm rates compared to conventional methods.
Proposes a query-efficient blackbox attack method.
problem Adversarial attacks on machine learning models, especially deep neural networks.
method QEBA: Query-Efficient Boundary-based blackbox Attack, using only final prediction labels.
result QEBA achieves 100% attack success rate with fewer queries and lower perturbation.
We describe an optimal adversarial attack formulation against autoregressive time series forecast using Linear Quadratic Regulator (LQR). In this threat model, the environment evolves according to a dynamical system; an autoregressive model observes the current environment state and predicts its future values; an attac…
Cyber attacks are growing in frequency and severity. Over the past year alone we have witnessed massive data breaches that stole personal information of millions of people and wide-scale ransomware attacks that paralyzed critical infrastructure of several countries. Combating the rising cyber threat calls for a multi-p…
This paper shows how cyber-attacks can undermine predictive maintenance systems.
problem Cyber-attacks on IoT sensors and DL algorithms in predictive maintenance systems.
method Used LSTM, GRU, and CNN for RUL prediction; modeled false data injection attacks; evaluated impact on accuracy and resilience.
result False data injection attacks can severely impact RUL prediction, but GRU-based models are more resilient.
Bayesian neural networks are vulnerable to adversarial attacks.
problem Adversarial robustness of Bayesian neural networks.
method Examination of adversarial robustness through three tasks: label prediction, adversarial example detection, and semantic shift detection.
result Bayesian neural networks are highly susceptible to adversarial attacks.
Enhances deep learning models' robustness against adversarial attacks.
problem Lack of reliable uncertainty estimates and robust defenses for deep learning models.
method Integrates Conformal Prediction principles with adversarial training.
result Introduces OPSA-AT, a defense strategy that enhances robustness and reliability.
Paper presents a method to disrupt deep uncertainty estimation without affecting accuracy.
problem Uncertainty estimation in deep neural networks for risk-sensitive applications.
method A novel attack that cripples uncertainty estimation without reducing accuracy.
result The attack causes the network to be more confident in incorrect predictions than correct ones.
Generative model attacks CNN on MNIST by subtly replacing input patterns.
problem Adversarial attacks on neural networks.
method Generative model that replaces input patterns with generated ones.
result Demonstrated effectiveness on MNIST dataset.
Adversarial attacks reduce deep learning beam selection performance in mmWave 5G.
problem Adversarial attacks degrade deep learning-based beam selection in mmWave 5G.
method Generates adversarial perturbations to RSS inputs to manipulate DNN predictions.
result Significant reduction in IA performance due to adversarial perturbations.
Deep learning on graph structures has shown exciting results in various applications. However, few attentions have been paid to the robustness of such models, in contrast to numerous research work for image or text adversarial attack and defense. In this paper, we focus on the adversarial attacks that fool the model by…
With the great success of graph embedding model on both academic and industry area, the robustness of graph embedding against adversarial attack inevitably becomes a central problem in graph learning domain. Regardless of the fruitful progress, most of the current works perform the attack in a white-box fashion: they n…
Paper detects Trojan neural networks with limited or no data.
problem Robustness of DNNs against Trojan attacks in data-scarce scenarios.
method Proposes data-limited and data-free TrojanNet detectors.
result Demonstrates effectiveness of detectors on various datasets.
Bayesian explanations are more resilient to adversarial attacks than deterministic ones.
problem Stability of saliency-based explanations under adversarial attacks in Neural Networks.
method Empirical and theoretical analysis of Bayesian vs deterministic Neural Networks.
result Bayesian explanations are more stable under adversarial perturbations and direct attacks.
PRISM-FCP improves federated prediction robustness against Byzantine attacks.
problem Byzantine attacks in federated learning.
method Partial model sharing and distance-based maliciousness scores.
result Maintains nominal coverage guarantees under Byzantine attacks.
Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing …
We study data poisoning attacks in the online setting where training items arrive sequentially, and the attacker may perturb the current item to manipulate online learning. Importantly, the attacker has no knowledge of future training items nor the data generating distribution. We formulate online data poisoning attack…
Defends against ML inference attacks using adversarial examples.
problem Automated inference attacks using ML classifiers pose privacy and security threats.
method Turns ML classifier vulnerabilities into defenses by adding adversarial noise to public data.
result Adversarial examples can mislead ML classifiers and protect private data.
A system predicts future malicious behavior of network entities.
problem Prioritizing alert data and understanding attack recurrence.
method Machine learning-based network entity reputation database system.
result It is possible to precisely estimate future attack probabilities.
GGA improves untrustworthy prediction detection in neural networks without retraining.
problem Susceptibility of neural networks to untrustworthy predictions, especially adversarial attacks and out-of-distribution data.
method Geometric Gradient Analysis (GGA) analyzes the geometry of neural network loss landscapes based on saliency maps.
result GGA outperforms existing methods in detecting untrustworthy predictions, including adversarial and out-of-distribution data.
A new method detects and corrects adversarial attacks on classifiers.
problem Detecting and correcting adversarial attacks on machine learning models.
method Unsupervised autoencoder trained with KL divergence loss to match predictions.
result Almost completely neutralizes powerful attacks on MNIST and Fashion-MNIST.
A new method aggregates generative classifiers to resist adversarial attacks.
problem Adversarial attacks on deep neural networks.
method Rank-aggregating ensemble of generative classifiers trained on intermediate layer responses.
result The ensemble of generative classifiers shows robustness to adversarial attacks.
Enhancement attacks can falsely improve machine learning model performance in biomedical research.
problem The trustworthiness of machine learning in biomedical research is threatened by enhancement attacks.
method Developed two techniques to enhance prediction performance with minimal changes to features.
result Falsely improved classifiers' accuracy from 50% to almost 100% while maintaining high feature similarities.
Backdoor attacks make models predict a specific class near triggers, smoothing their decision function.
problem Understanding and mitigating backdoor attacks on deep neural networks.
method Defined a measure to quantify backdoor smoothing and detected other smoothing patterns.
result Backdoor attacks induce a smoother decision function around triggered samples.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
Paper proposes B3D method for black-box backdoor detection.
problem Detecting backdoor attacks in black-box models without access to training data.
method Gradient-free optimization to reverse-engineer triggers, simple strategy for reliable predictions.
result Effectiveness of B3D method corroborated on hundreds of DNN models.
Domain knowledge helps detect adversarial examples in multi-label classification.
problem Detecting adversarial examples in multi-label classification.
method Convert domain knowledge into constraints and inject them into a semi-supervised learning problem.
result Domain-knowledge constraints help detect adversarial examples effectively.
Neural models often incorrectly predict the same answer to subtly changed questions, even when they should not.
problem Neural models' oversensitivity to adversarial question changes.
method Formulated a noisy adversarial attack to identify and exploit undersensitivity, tested with data augmentation and adversarial training.
result Undersensitivity can be exploited to mislead models, and addressing it improves model performance and robustness.
Unsupervised node embedding methods (e.g., DeepWalk, LINE, and node2vec) have attracted growing interests given their simplicity and effectiveness. However, although these methods have been proved effective in a variety of applications, none of the existing work has analyzed the robustness of them. This could be very r…
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Study adversarial attacks on automated trading systems.
problem Robustness of deep learning models in algorithmic trading.
method New attacks with size constraints to evaluate model robustness.
result Realistic adversarial attacks can fool automated trading systems.
Adversarial examples are important for understanding the behavior of neural models, and can improve their robustness through adversarial training. Recent work in natural language processing generated adversarial examples by assuming white-box access to the attacked model, and optimizing the input directly against it (E…
Causal models offer stronger privacy guarantees and better generalization than associational models in machine learning.
problem Privacy attacks on machine learning models, especially membership inference attacks.
method Demonstrated the benefit of causal learning in machine learning models, showing better generalization and stronger privacy guarantees.
result Causal models provide stronger differential privacy guarantees and are more robust to membership inference attacks compared to associational models.
Study adversarial attacks on cost-sensitive classifiers.
problem Safety-critical classification problems with cost-sensitive predictions.
method Used state-of-the-art adversarially-resistant neural networks and analyzed as a two-player zero-sum game.
result Introduced a new cost-sensitive attack that performs better than targeted attacks in some cases.
New method extracts high-accuracy, high-fidelity neural networks.
problem Extracting accurate and functionally-equivalent neural networks.
method Learning-based attack with practical functionally-equivalent extraction.
result First practical functionally-equivalent extraction attack.
New defense mechanism detects and mitigates poisoned regression data.
problem Vulnerability of regression models to targeted data poisoning attacks.
method Introduces N-LID, a measure of local intrinsic dimensionality to distinguish poisoned samples.
result N-LID based defense outperforms state-of-the-art methods in prediction accuracy and runtime.
Adaptive Misinformation defends against model stealing attacks by sending incorrect predictions for OOD queries.
problem Model stealing attacks clone target models using black-box query access and a surrogate dataset.
method Selective sending of incorrect predictions for Out-Of-Distribution (OOD) queries to degrade attacker's clone model accuracy.
result Our defense reduces attacker's clone model accuracy by up to 40% while maintaining benign user accuracy under 0.5%.
New method can infer training data from deep neural networks with high success rates.
problem Model inversion attacks on deep neural networks pose privacy risks.
method Generative model-inversion attack using GANs and partial public information.
result Significant improvement in identifying private training data from deep models.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
Machine learning models leak information about the datasets on which they are trained. An adversary can build an algorithm to trace the individual members of a model's training dataset. As a fundamental inference attack, he aims to distinguish between data points that were part of the model's training set and any other…
Excessive reuse of holdout data can lead to overfitting. However, there is little concrete evidence of significant overfitting due to holdout reuse in popular multiclass benchmarks today. Known results show that, in the worst-case, revealing the accuracy of k adaptively chosen classifiers on a data set of size n al…
Study online learner attacks by manipulating labels, revealing critical thresholds.
problem Adversarial attacks on online learners, especially label manipulation.
method Control-theoretical perspective, theoretical analysis, empirical study.
result Discontinuous transition in learner's accuracy occurs at a critical threshold.