This paper introduces defensive dropout to protect deep neural networks from adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Proposes using dropout at test time to enhance robustness, modeling the problem as a game between attacker and defender.
result Defensive dropout reduces adversarial attack success rate significantly, from 100% to 13.89% on MNIST.
New method generates fast adversarial faces with high success rate.
problem Vulnerability of face recognition systems to adversarial attacks.
method Fast landmark manipulation method and semantic structure constrained attack.
result 99.86% success rate on state-of-the-art face recognition models.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.
This paper characterizes adversarial examples in deep learning.
problem Security threats posed by adversarial attacks in deep learning systems.
method Statistical characterization of adversarial examples, easy and hard categorization of attacks, extensive experimental study.
result Adversarial attacks behave differently under different hyperparameters and frameworks.
AI-GAN generates realistic adversarial examples efficiently.
problem Efficient generation of perceptually realistic adversarial examples.
method A joint training of a generator, discriminator, and attacker.
result Achieves high attack success rates and reduces generation time.
AdversarialPSO uses fewer queries to create high-success-rate adversarial examples.
problem Creating imperceptible adversarial examples with high success rates in black-box settings.
method AdversarialPSO, a black-box attack using Particle Swarm Optimization.
result Achieved high success rates (99.6% on CIFAR-10, 96.3% on MNIST, 82.0% on Imagenet) with fewer queries.
This work generates diverse adversarial attacks for different domains using latent variable perturbation.
problem Adversarial attacks on deep neural networks are limited to a single perturbation.
method Frame adversarial attacks as learning a distribution of perturbations, enabling generation of diverse attacks.
result Framework generates competitive or superior adversarial attacks across diverse domains (images, text, graphs).
Paper proposes a new Hessian-aware zeroth-order optimization for improving black-box adversarial attacks.
problem Improving black-box adversarial attacks on neural networks.
method Introduces a Hessian-aware zeroth-order optimization algorithm called ZO-HessAware.
result ZO-HessAware achieves improved success rates with lower query complexity.
Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversaria…
Square Attack efficiently attacks deep models with random updates.
problem Efficiently attacking deep learning models without gradient information.
method Randomized search of localized square updates.
result Significantly more query-efficient and higher success rate compared to state-of-the-art methods.
Defense against DL-based lithographic hotspot detectors backdooring attacks reduces success rate from 84% to ~0%
problem DL-based lithographic hotspot detectors are vulnerable to backdoor attacks that can misclassify hotspots.
method Training data augmentation to eliminate intentional biases introduced during training.
result Significant reduction in attack success rate (from 84% to ~0%) using the proposed defense.
Sparse-RS framework efficiently attacks models with sparse perturbations.
problem Efficiently attacking models with sparse perturbations in the black-box setting.
method Random search-based Sparse-RS framework for score-based attacks.
result Sparse-RS achieves state-of-the-art success rate and query efficiency.
Paper presents a defense framework against adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Cross-layer strategic ensemble defense with input and output transformations.
result Strategic ensemble defense achieves high defense success rates and robustness.
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
FineFool attacks deep models by focusing on object contours, improving attack performance.
problem Adversarial attacks on deep learning models, especially those that focus on perturbation size and success rate.
method FineFool uses attention to focus on object contours, producing more efficient and imperceptible perturbations.
result FineFool achieves better attack performance compared to state-of-the-art attacks, including higher success rate and smaller perturbations.
New method can infer training data from deep neural networks with high success rates.
problem Model inversion attacks on deep neural networks pose privacy risks.
method Generative model-inversion attack using GANs and partial public information.
result Significant improvement in identifying private training data from deep models.
Improves black-box adversarial attacks with a transfer-based prior.
problem Low attack success rates and poor query efficiency in black-box adversarial attacks.
method P-RGF method that integrates a transfer-based prior and query information.
result Significantly reduces the number of queries needed for successful attacks.
Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. In a successful adversarial attack, the targeted mis-classification should be ach…
New attacks show data augmentation may not improve privacy.
problem Measuring privacy risk in models trained with data augmentation.
method Formulated membership inference as a set classification problem, designed input permutation invariant features.
result Proposed approach universally outperforms original methods on models trained with data augmentation.
Study tackles discretization problem in crafting adversarial examples for discrete integer domains.
problem Discretization problem in crafting adversarial examples for discrete integer domains.
method Proposes a black-box method to reduce adversarial example searching to a derivative-free optimization problem.
result Significantly higher success rate in crafting adversarial images in discrete integer domain compared to black-box methods.
Enhanced attacks quantify machine learning data leakage.
problem Quantifying how much machine learning models reveal about their training data.
method Hypothesis testing framework for membership inference attacks.
result New attacks achieve higher true positive rates with lower false positive rates.
Universal audio perturbations fool multiple classification models.
problem Creating audio adversarial perturbations that work across different models.
method Two methods: greedy iterative approach and novel penalty formulation.
result The penalty method produces more successful attacks with limited training data.
Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black…
Graph attacks can be successful with just a few bad nodes.
problem Adversarial attacks on graph neural networks.
method Identifying and exploiting anchor nodes to compromise graph models.
result A few bad nodes can significantly degrade graph model performance.
3D models vulnerable to adversarial attacks, new method improves success rate and naturalness.
problem Vulnerability of 3D deep learning models to adversarial examples in the physical world.
method ε-isometric (ε-ISO) attack considering geometric properties and invariance to physical transformations. result Significantly improved attack success rate and naturalness of 3D adversarial examples.
New methods improve black-box adversarial attacks with fewer queries.
problem Efficiently craft adversarial examples without access to gradients.
method Prior-guided random gradient-free algorithms based on biased sampling and gradient averaging.
result Both methods require fewer queries and achieve higher success rates.
New attack method makes poisoned images transferable without access to victim model.
problem Injecting poisoned images into training data to mislead deep nets.
method Designing poison images to surround targeted images in feature space, using Dropout.
result Achieves over 50% transferable success with only 1% poisoning of training set.
A new Frank-Wolfe framework improves efficiency and effectiveness of adversarial attacks.
problem Develop efficient and effective optimization-based adversarial attack algorithms.
method Proposes a Frank-Wolfe algorithm variant for both white-box and black-box adversarial attacks.
result Demonstrates improved efficiency and effectiveness compared to existing methods.
Evaluates SHIELD's effectiveness against adaptive adversaries in various threat models.
problem Evaluating SHIELD's efficacy against adaptive adversaries in different threat models.
method Empirical analysis of SHIELD's robustness against adaptive attacks using Projected Gradient Descent (PGD) attacks in various threat models (white-box, gray-box).
result The targeted PGD attack success rate drops from 64.3% to 48.9% when models are trained from scratch instead of retrained.
This paper explores how the generalization of substitute classifiers affects the success of black-box adversarial attacks.
problem Understanding the factors driving the transferability of black-box adversarial examples.
method Max-min adversarial example game framework and theoretical generalization bounds.
result Substitute NN with better generalization behavior results in more transferable adversarial examples.
Federated learning is vulnerable to backdoor attacks; a new defense method is proposed.
problem Backdoor attacks in federated learning that can misclassify models.
method Adjusting the learning rate based on sign information of agents' updates.
result Our defense significantly reduces or eliminates backdoor attacks in federated learning.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
Paper proposes AoA, a new adversarial attack method that significantly increases transferability.
problem Developing universal adversarial attacks on deep neural networks.
method AoA attacks the semantic property of attention in DNNs, enhancing transferability by altering the loss function.
result AoA generates adversarial samples that defeat 13 well-trained DNNs, achieving over 85% error rate.
Study shows unequal success of membership inference attacks across different groups.
problem Unequal success of membership inference attacks across different groups.
method Established conditions for preventing MIAs and derived connections to fairness and differential privacy.
result Estimating disparate vulnerability to MIAs can lead to overestimation; suitable attacks and statistical framework provided.
DoPa detects various physical adversarial attacks on CNNs.
problem Vulnerability of CNNs to physical adversarial attacks.
method Interprets CNN's vulnerability, adds self-verification stage.
result Achieves 90% success rate for image attacks and 92% for audio attacks.
MI attacks often mislabel non-training samples, making them impractical.
problem MI attacks mislabel non-training samples, leading to high false positive rate.
method Analyzed new features like distance to decision boundary and gradient norms.
result MI attacks cannot achieve high accuracy and low false positive rate simultaneously.
Capsule networks detect and diagnose adversarial images better than CNNs.
problem Detecting and diagnosing adversarial images in neural networks.
method Class-conditional capsule reconstruction and reconstructive attack.
result Capsule networks outperform CNNs in detecting and diagnosing adversarial images.
Simple adaptive attacks can jailbreak state-of-the-art safety-aligned language models.
problem Vulnerability of safety-aligned language models to simple adaptive attacks.
method Designing adversarial prompt templates, random search on suffixes, and transfer/prefilling attacks.
result 100% attack success rate on various models including GPT-4, Vicuna, Mistral, and Claude.
DAmageNet generates universal adversarial samples with high transferability.
problem Vulnerability of deep neural networks to adversarial attacks.
method Generated 96,000 transferable adversarial samples from ImageNet.
result Adversarial samples misclassify various models with up to 90% error rate.
Recent studies have shown that adversarial examples in state-of-the-art image classifiers trained by deep neural networks (DNN) can be easily generated when the target model is transparent to an attacker, known as the white-box setting. However, when attacking a deployed machine learning service, one can only acquire t…
NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
Charmer improves character-level adversarial attacks for language models.
problem Efficiency and effectiveness of character-level adversarial attacks for language models.
method Query-based adversarial attack method that maintains semantic similarity.
result Charmer achieves high attack success rate and similar adversarial examples.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
Paper proposes a new black-box attack approach to minimize visual distortion.
problem Constructing adversarial examples that minimize visual distortion in a black-box threat model.
method Learning the noise distribution of adversarial examples to approximate the gradient of a non-differentiable loss function.
result The proposed attack results in much lower visual distortion compared to state-of-the-art black-box attacks.
Efficient method for generating adversarial examples with limited query budget.
problem Developing black-box adversarial attacks with limited information.
method Bayesian Optimization in a structured low-dimensional subspace.
result Significantly higher attack success rate with fewer queries.
Adversarial tweets can fool stock prediction models, causing financial loss.
problem Vulnerability of stock prediction models to adversarial attacks on social media.
method Solving combinatorial optimization problems with semantic and budget constraints to generate adversarial tweets.
result Adversarial tweets can fool stock prediction models and cause significant financial loss.
Researchers develop stealthy backdoor injection attacks in deep learning models.
problem Creating invisible perturbations to trigger model recognition of specific patterns.
method Proposes two approaches for generating imperceptible backdoors in deep learning models.
result Demonstrates high attack success rates (above 90%) with minimal model accuracy loss (below 1%) and injection rate (around 1%).
MODEF combines denoising and verification to defend against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial inputs.
method Cross-layer model diversity ensemble combining unsupervised denoising and supervised verification.
result MODEF achieves remarkable defense success rates against black-box attacks.