Paper introduces class-oriented poisoning attacks to improve adversarial availability attacks.
problem Improving adversarial availability attacks on neural networks.
method Gradient-based framework for crafting poisoned images at the class level.
result Demonstrated effectiveness of class-oriented poisoning attacks on various models and datasets.
Study shows flipping a small subset of labels can severely damage machine learning models.
problem Adversarial attacks on distributed machine learning models.
method Formalized label flipping attacks, proposed a greedy algorithm, demonstrated with logistic regression models.
result A budget of only 0.1% of labels at each training step can reduce model accuracy by 6%, and some models can perform worse than random guessing when up to 25% of labels are flipped.
New attacks prevent both supervised and contrastive learning from private data.
problem Preventing unauthorized use of private data and commercial datasets.
method Contrastive-like data augmentations in supervised error minimization or maximization frameworks.
result Achieve state-of-the-art worst-case unlearnability across SL and CL algorithms.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
Paper proposes a new method to attack Bayesian forecasting models.
problem Lack of research on adversarial attacks against time series forecasting systems.
method Decision analysis based attacking strategy for Bayesian forecasting models.
result Demonstrates the vulnerability of Bayesian forecasting models to adversarial attacks.
Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate…
Many machine learning algorithms are vulnerable to almost imperceptible perturbations of their inputs. So far it was unclear how much risk adversarial perturbations carry for the safety of real-world machine learning applications because most methods used to generate such perturbations rely either on detailed model inf…
MAZE attacks a model without data, using synthetic inputs.
problem Model Stealing attacks that require data to replicate a target model.
method MAZE uses zeroth-order gradient estimation to create synthetic inputs.
result MAZE achieves high clone accuracy without data.
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
As online systems based on machine learning are offered to public or paid subscribers via application programming interfaces (APIs), they become vulnerable to frequent exploits and attacks. This paper studies adversarial machine learning in the practical case when there are rate limitations on API calls. The adversary …
New attacks inflate earnings while reducing fraud scores, potentially millions at stake.
problem Manipulating financial reports to hide distress and gain.
method Maximum Violated Multi-Objective (MVMO) attacks that adapt search direction.
result Inflation of earnings by 100-200% while reducing fraud scores by 15% in 50% of cases.
Deep learning on graph structures has shown exciting results in various applications. However, few attentions have been paid to the robustness of such models, in contrast to numerous research work for image or text adversarial attack and defense. In this paper, we focus on the adversarial attacks that fool the model by…
A new attack for probabilistic classifiers adapts to noise levels.
problem Adversarial examples can mislead probabilistic classifiers.
method Adapts HopSkipJump attack for probabilistic classifiers, adjusting queries based on noise levels.
result Decision-based attacks are effective against probabilistic classifiers, even with noise.
AdvFlow generates imperceptible adversarial images using normalizing flows.
problem Adversarial attacks on deep learning classifiers.
method Normalizing flows to model adversarial examples.
result Generated adversaries closely follow clean data distribution, making them harder to detect.
Marich extracts high-fidelity models from public data with minimal queries.
problem Creating an accurate replica of a target ML model using few queries.
method Sequentially selects informative queries to maximize entropy and reduce model mismatch.
result Extracted models achieve 60-95% of target model's accuracy with 1,000-8,500 queries.
Square Attack efficiently attacks deep models with random updates.
problem Efficiently attacking deep learning models without gradient information.
method Randomized search of localized square updates.
result Significantly more query-efficient and higher success rate compared to state-of-the-art methods.
Charmer improves character-level adversarial attacks for language models.
problem Efficiency and effectiveness of character-level adversarial attacks for language models.
method Query-based adversarial attack method that maintains semantic similarity.
result Charmer achieves high attack success rate and similar adversarial examples.
Efficiently attacks large-scale graphs without using the whole graph.
problem Vulnerability of graph neural networks to adversarial attacks.
method Simplified Gradient-based Attack (SGA) method for large-scale graphs.
result SGA achieves significant time and memory efficiency improvements.
Paper proposes a new black-box attack approach to minimize visual distortion.
problem Constructing adversarial examples that minimize visual distortion in a black-box threat model.
method Learning the noise distribution of adversarial examples to approximate the gradient of a non-differentiable loss function.
result The proposed attack results in much lower visual distortion compared to state-of-the-art black-box attacks.
Recent studies show that Deep Reinforcement Learning (DRL) models are vulnerable to adversarial attacks, which attack DRL models by adding small perturbations to the observations. However, some attacks assume full availability of the victim model, and some require a huge amount of computation, making them less feasible…
We introduce two tactics to attack agents trained by deep reinforcement learning algorithms using adversarial examples, namely the strategically-timed attack and the enchanting attack. In the strategically-timed attack, the adversary aims at minimizing the agent's reward by only attacking the agent at a small subset of…
Adversarial policies beat superhuman Go AI systems.
problem Vulnerability of superhuman AI systems to adversarial attacks.
method Training adversarial policies to trick KataGo into making blunders.
result Adversarial policies achieve >97% win rate against KataGo at superhuman settings.
New normalization method makes neural networks more robust to adversarial attacks.
problem Adversarial vulnerability of BatchNorm in deep neural networks.
method Identified distribution shift caused by adversarial images, proposed RobustNorm to use inference-time statistics.
result RobustNorm makes models more robust to adversarial attacks without sacrificing BatchNorm benefits.
Study proposes framework for cyber bonds to compensate cyber attack losses.
problem Cyber risk treatment in finance industry.
method Developed a framework, used publicly available data to determine loss distribution parameters, numerically simulated bond price and characteristics, considered two coupon calculation approaches.
result Numerical simulations of cyber bond price, yield, and characteristics.
Machine Learning systems are vulnerable to adversarial attacks and will highly likely produce incorrect outputs under these attacks. There are white-box and black-box attacks regarding to adversary's access level to the victim learning algorithm. To defend the learning systems from these attacks, existing methods in th…
AFD learns features resistant to adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method AFD learns features invariant to adversarial perturbations through a game of predictive and robust features.
result AFD effectively resists a wide range of attack types and strengths.
DefenseVGAE defends graph neural networks against adversarial attacks.
problem Vulnerability of GNNs to adversarial structural perturbations.
method Variational Graph Autoencoder (VGAE) to reconstruct graph structure.
result DefenseVGAE reduces adversarial perturbations and boosts GCN performance.
Study reveals how high-dimensional models are vulnerable to consistent adversarial attacks.
problem Understanding the vulnerability of high-dimensional linear classifiers to adversarial attacks.
method Introducing a new error metric to quantify model vulnerability, and rigorously characterizing these metrics in asymptotic settings.
result As models become more overparameterized, their vulnerability to label-preserving perturbations increases.
Machine learning models have been found to be susceptible to adversarial examples that are often indistinguishable from the original inputs. These adversarial examples are created by applying adversarial perturbations to input samples, which would cause them to be misclassified by the target models. Attacks that search…
Sparse-RS framework efficiently attacks models with sparse perturbations.
problem Efficiently attacking models with sparse perturbations in the black-box setting.
method Random search-based Sparse-RS framework for score-based attacks.
result Sparse-RS achieves state-of-the-art success rate and query efficiency.
This work proposes a robust ensemble method for decision trees that resists adversarial attacks.
problem Adversarial attacks on machine learning models, especially decision trees.
method Feature partitioning to train robust ensembles and approximate certification methods.
result The proposed ensemble method can resist evasion attacks by a majority of its models.
We present a black-box adversarial attack algorithm which sets new state-of-the-art model evasion rates for query efficiency in the ℓ∞ and ℓ2 metrics, where only loss-oracle access to the model is available. On two public black-box attack challenges, the algorithm achieves the highest evasion rate, sur…
Data poisoning attacks can severely degrade FL models, especially targeting specific classes.
problem Data poisoning attacks against federated learning systems.
method Demonstrated targeted attacks on FL systems, analyzed attack longevity, and proposed a defense strategy.
result Data poisoning attacks can cause substantial drops in classification accuracy and recall with a small percentage of malicious participants.
Deep networks are well-known to be fragile to adversarial attacks. We conduct an empirical analysis of deep representations under the state-of-the-art attack method called PGD, and find that the attack causes the internal representation to shift closer to the "false" class. Motivated by this observation, we propose to …
The paper certifies decision trees against evasion attacks using program analysis.
problem Vulnerability of decision tree models to evasion attacks by maliciously crafted perturbations.
method Transform decision trees into imperative programs for program analysis, leveraging abstract interpretation.
result Soundly verifies security guarantees of decision tree models, yielding minimal false positives.
Cyber attacks are growing in frequency and severity. Over the past year alone we have witnessed massive data breaches that stole personal information of millions of people and wide-scale ransomware attacks that paralyzed critical infrastructure of several countries. Combating the rising cyber threat calls for a multi-p…
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
SmoothLLM defends LLMs from jailbreaking attacks by randomly perturbing inputs.
problem Adversaries can fool large language models into generating objectionable content.
method SmoothLLM randomly perturbs multiple copies of a prompt and aggregates predictions to detect adversarial inputs.
result SmoothLLM sets the state-of-the-art for robustness against various jailbreak attacks.
Bayesian Optimization improves machine learning for detecting network attacks.
problem Detecting network attacks to secure critical information.
method Bayesian Optimization for tuning machine learning algorithms (SVM-RBF, RF, k-NN).
result The proposed framework achieves high accuracy and low false alarms.
The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the lp-norms for $p \in…
Terrorism has become one of the most tedious problems to deal with and a prominent threat to mankind. To enhance counter-terrorism, several research works are developing efficient and precise systems, data mining is not an exception. Immense data is floating in our lives, though the scarce availability of authentic ter…
Simple technique turns any adversarial attack into a universal one using few test examples.
problem Creating universal adversarial attacks with minimal data.
method Universalization technique using few adversarial test examples and spectral properties.
result Simple universalization technique achieves comparable fooling rates to state-of-the-art methods.
Researchers develop method to protect against 'weight poisoning' attacks on pre-trained models.
problem The security threat of downloading untrusted pre-trained weights that can be manipulated after fine-tuning.
method RIPPLe regularization method and Embedding Surgery initialization procedure.
result Demonstrated that weight poisoning attacks are possible even with limited knowledge of the dataset and fine-tuning procedure.
Adversarial training can hurt robust accuracy in small sample size scenarios.
problem Adversarial training improves test accuracy but may degrade robustness in limited data settings.
method Analyzes high-dimensional linear classification with noiseless observations, and observes perceptible attacks on image datasets.
result Adversarial training can negatively impact robust generalization in small sample size regimes.
Recent advances in machine learning, especially techniques such as deep neural networks, are enabling a range of emerging applications. One such example is autonomous driving, which often relies on deep learning for perception. However, deep learning-based perception has been shown to be vulnerable to a host of subtle …
Convolutional Neural Networks and Deep Learning classification systems in general have been shown to be vulnerable to attack by specially crafted data samples that appear to belong to one class but are instead classified as another, commonly known as adversarial examples. A variety of attack strategies have been propos…
We demonstrate the existence of universal adversarial perturbations, which can fool a family of audio classification architectures, for both targeted and untargeted attack scenarios. We propose two methods for finding such perturbations. The first method is based on an iterative, greedy approach that is well-known in c…
Due to insufficient training data and the high computational cost to train a deep neural network from scratch, transfer learning has been extensively used in many deep-neural-network-based applications. A commonly used transfer learning approach involves taking a part of a pre-trained model, adding a few layers at the …