Paper proposes B3D method for black-box backdoor detection.
problem Detecting backdoor attacks in black-box models without access to training data.
method Gradient-free optimization to reverse-engineer triggers, simple strategy for reliable predictions.
result Effectiveness of B3D method corroborated on hundreds of DNN models.
AdvMind detects adversary intent in black-box attacks with high accuracy.
problem Detecting adversary intent in black-box adversarial attacks is challenging.
method AdvMind accounts for adversary adaptiveness and synthesizes queries to expose intent.
result AdvMind detects adversary intent with over 75% accuracy after observing less than 3 query batches.
Bringing transparency to black-box decision making systems (DMS) has been a topic of increasing research interest in recent years. Traditional active and passive approaches to make these systems transparent are often limited by scalability and/or feasibility issues. In this paper, we propose a new notion of black-box D…
Faced with distribution shift between training and test set, we wish to detect and quantify the shift, and to correct our classifiers without test set labels. Motivated by medical diagnosis, where diseases (targets) cause symptoms (observations), we focus on label shift, where the label marginal p(y) changes but the …
DAL enhances black-box bandit algorithms for non-stationary environments.
problem Non-stationary environments in bandit problems.
method DAL combines any stationary bandit algorithm with a change detector.
result DAL consistently outperforms state-of-the-art methods in various non-stationary scenarios.
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
Proposes a Bayesian approach to explain, justify, and quantify uncertainty in DNNs.
problem Lack of transparency and confidence in DNNs for critical applications.
method Bayesian approach to extract explanations, justifications, and uncertainty estimates from black box DNNs.
result Improves interpretability and reliability of DNNs, validated on CIFAR-10.
Improves relevancy of black-box anomaly detectors with user feedback.
problem Users often ignore many detected anomalies, requiring a method to identify and prioritize relevant ones.
method Uses user feedback to adjust anomaly selection process based on identified anomaly types.
result Significant improvements in precision and recall over various anomaly detectors.
Efficiently explains model outputs using HSIC, a dependence measure.
problem Efficiently explain model outputs for various architectures.
method HSIC, RKHS, Reproducing Kernel Hilbert Spaces, black-box attribution.
result Up to 8 times faster than previous methods while maintaining fidelity.
BAR reprograms black-box ML models for transfer learning with scarce data.
problem Transfer learning with limited data and resources.
method Zeroth-order optimization and multi-label mapping techniques to reprogram black-box models.
result BAR outperforms state-of-the-art methods and baseline transfer learning approaches.
This work proposes xGEMs or manifold guided exemplars, a framework to understand black-box classifier behavior by exploring the landscape of the underlying data manifold as data points cross decision boundaries. To do so, we train an unsupervised implicit generative model -- treated as a proxy to the data manifold. We …
Hybrid neural network infers states from black-box systems.
problem Inference of state models in black-box systems without source code instrumentation.
method Convolutional and recurrent layers learn correlations between time series signals.
result Improves state change point detection by up to 102%.
Master algorithm fails to detect non-stationarity in practical settings.
problem Non-Stationary Reinforcement Learning without prior knowledge.
method Master algorithm tested under various conditions, including piecewise stationary multi-armed bandits.
result Master's non-stationarity detection is ineffective for practical horizons, leading to performance similar to random restarting.
Study on robustness of learning-based novelty detection methods under adversarial attacks.
problem Understanding how learning-based novelty detection methods perform under adversarial perturbations.
method Formulated an oracle attack setup and evaluated vulnerability using black-box adversarial algorithms.
result Adversarial perturbations can significantly increase FDR while maintaining high detection power.
Improves reliability of BBVI optimization methods.
problem Reliability issues and expertise required for BBVI optimization.
method RABVI framework with automated learning rate adjustment and KL divergence estimation.
result RABVI detects inaccurate variational approximations and optimizes reliability.
Paper proposes a black-box technique to generate adversarial samples.
problem Robustness of Deep Neural Networks (DNNs) to adversarial samples.
method Black-box Momentum Iterative Fast Gradient Sign Method (BMI-FGSM) using Differential Evolution to approximate gradients.
result Achieves high success rates in generating adversarial samples and misclassification.
New attacks reduce bad queries in black-box classifiers, improving effectiveness.
problem Evasion attacks often issue many bad queries, which are costly.
method Design new attacks that minimize bad queries while increasing non-bad queries.
result Reduces the number of bad queries by 1.5-7.3 times, improving attack effectiveness.
Machine-learning models have been recently used for detecting malicious Android applications, reporting impressive performances on benchmark datasets, even when trained only on features statically extracted from the application, such as system calls and permissions. However, recent findings have highlighted the fragili…
Machine Learning systems are vulnerable to adversarial attacks and will highly likely produce incorrect outputs under these attacks. There are white-box and black-box attacks regarding to adversary's access level to the victim learning algorithm. To defend the learning systems from these attacks, existing methods in th…
Deep-PrAE improves rare-event simulation for black-box systems.
problem Evaluating rare safety-critical events in learning-based systems.
method Combines deep neural networks with IS to create statistically guaranteed estimations.
result Deep-PrAE provides accurate bounds on safety-critical event probabilities.
Adversarial attacks can fool ML energy theft detection models.
problem Vulnerability of ML-based energy theft detection models to adversarial attacks.
method Design of an adversarial measurement generation algorithm.
result ML models can be significantly fooled by adversarial attacks, reducing their detection accuracy.
Paper shows how to hide individuals in graphs to fool community detection models.
problem Adversarial attack on community detection models by hiding individuals.
method Iterative learning framework that updates a graph generator and a community detection model.
result Adversarial graphs generated by the method can fool multiple community detection models.
AdvFlow generates imperceptible adversarial images using normalizing flows.
problem Adversarial attacks on deep learning classifiers.
method Normalizing flows to model adversarial examples.
result Generated adversaries closely follow clean data distribution, making them harder to detect.
Proposes a method to ensure accurate estimation of rare events in AI systems.
problem Lack of efficiency guarantees in black-box systems for rare-event simulation.
method Integrates deep learning with importance sampling to create a statistically guaranteed estimator.
result Demonstrates effective estimation of rare-event probabilities in AI systems.
New approach optimizes expensive black-box systems with uncertain outputs.
problem Optimizing expensive black-box systems with limited data and uncertainty.
method Flexible non-interpolating surrogate model (TK-MARS) and Smart-Replication approach.
result TK-MARS outperforms original MARS and detects important variables.
We study black-box attacks on machine learning classifiers where each query to the model incurs some cost or risk of detection to the adversary. We focus explicitly on minimizing the number of queries as a major objective. Specifically, we consider the problem of attacking machine learning classifiers subject to a budg…
Machine-learning driven safety-critical autonomous systems, such as self-driving cars, must be able to detect situations where its trained model is not able to make a trustworthy prediction. Often viewed as a black-box, it is non-obvious to determine when a model will make a safe decision and when it will make an erron…
Interprets feature interactions in ad-click prediction models.
problem Improving interpretability of black-box recommender systems.
method Interprets feature interactions from a source model and encodes them in a target model.
result Interpretations significantly outperform existing recommender models.
ProtoX-AD: A self-explainable time series anomaly detection framework
problem Lack of explainability in self-supervised time series anomaly detection
method Learning transformation-aware latent representations and interpretable prototypes
result Achieves detection performance comparable to black-box methods while offering more consistent and semantically meaningful explanations
Proposes a tabular transformer model to maintain feature effect intelligibility.
problem Losing marginal feature effects in deep tabular transformer networks.
method Adapts tabular transformer networks to identify marginal feature effects.
result The model accurately identifies marginal feature effects, matching black-box performance while maintaining intelligibility.
New method lures adversaries to choose false directions in black-box attacks.
problem Improving robustness against black-box transfer attacks.
method Incorporates a removable neural network to induce a luring effect.
result Demonstrates effectiveness in thwarting state-of-the-art attacks.
Improved NTL detection using human-in-the-loop approach with explainability.
problem Challenges in detecting NTL due to biased data and black-box models.
method Human-in-the-loop approach with explanatory methods to guide model training.
result Improved accuracy, interpretability, robustness, and flexibility of the prediction model.
How can we explain the predictions of a black-box model? In this paper, we use influence functions -- a classic technique from robust statistics -- to trace a model's prediction through the learning algorithm and back to its training data, thereby identifying training points most responsible for a given prediction. To …
Paper introduces detect-then-impute conformal prediction for cellwise outliers.
problem Uncertainty in prediction intervals for models with cellwise outliers.
method Detects outliers, imputes them, and constructs exchangeable features for conformal prediction.
result JDI-CP achieves a finite sample 1−2α coverage guarantee. Paper presents attacks on real-time object detection systems.
problem Adversarial attacks on real-time object detection systems.
method Three targeted adversarial Objectness Gradient attacks (TOG).
result Adversarial attacks can cause object-vanishing, object-fabrication, and object-mislabeling.
In this work we develop a fast saliency detection method that can be applied to any differentiable image classifier. We train a masking model to manipulate the scores of the classifier by masking salient parts of the input image. Our model generalises well to unseen images and requires a single forward pass to perform …
RbX generates local explanations for black-box models using greedy polytope construction.
problem Generating interpretable local explanations for complex models.
method Greedy algorithm for building a convex polytope to approximate feature regions.
result RbX can more accurately identify important features compared to existing methods.
Machine learning (ML) classifiers are vulnerable to adversarial examples. An adversarial example is an input sample which is slightly modified to induce misclassification in an ML classifier. In this work, we investigate white-box and grey-box evasion attacks to an ML-based malware detector and conduct performance eval…
Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administ…
ACE explains security anomaly detection models through feature contributions.
problem Understanding which features contribute to security anomalies.
method Regression framework to locally approximate anomaly scores.
result Identifies correct contributing features in synthetic data and real data.
CMDNet simplifies MAP detection for large systems with probabilistic relaxation.
problem High complexity of MAP detection in large systems.
method Probabilistic Continuous relaxation of discrete variables, iterative CMD algorithm, CMDNet with online optimization.
result CMDNet achieves a promising accuracy-complexity trade-off in MIMO systems.
DEceit constructs effective universal pixel-restricted perturbations for deep image classifiers.
problem Creating effective universal pixel-restricted perturbations for deep neural networks.
method DEceit algorithm for black-box feedback, targeting 10% of pixels in images.
result Perturbing only 10% of pixels achieves high Fooling Rate and visual similarity.
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
Tree-LIME explains deep learning models using decision trees.
problem Deep learning models are black boxes, making them hard to explain and prone to biases.
method Developed a Tree-LIME approach using decision trees to explain predictions of deep learning models.
result Tree-LIME can capture nonlinear interactions and creates more reliable explanations.
In recent years, a number of artificial intelligent services have been developed such as defect detection system or diagnosis system for customer services. Unfortunately, the core in these services is a black-box in which human cannot understand the underlying decision making logic, even though the inspection of the lo…
There has been a surge of interest in using machine learning (ML) to automatically detect malware through their dynamic behaviors. These approaches have achieved significant improvement in detection rates and lower false positive rates at large scale compared with traditional malware analysis methods. ML in threat dete…
We propose a general model explanation system (MES) for "explaining" the output of black box classifiers. This paper describes extensions to Turner (2015), which is referred to frequently in the text. We use the motivating example of a classifier trained to detect fraud in a credit card transaction history. The key asp…
Better methods to detect insider threats need new anticipatory analytics to capture risky behavior prior to losing data. In search of the best overall classifier, this work empirically scores 88 machine learning algorithms in 16 major families. We extract risk features from the large CERT dataset, which blends real net…