Improves model classification accuracy in black-box settings.
problem Difficulty in inferring model properties due to limited query access.
method Introduces discriminative factorization to distinguish high-quality queries.
result Probability of chance-level classification decreases exponentially with query budget.
Adapts example weights to optimize black-box metrics.
problem Optimizing metrics defined by black-box functions.
method Adaptive example weighting and iterative post-shifting.
result Improves classification performance compared to baselines.
GAMIN attacks black-box models to reveal training data, achieving high success rates.
problem Exposing sensitive information in machine learning models trained on private data.
method Generative adversarial model training to generate inputs similar to training data.
result GAMIN can extract recognizable digits and features from complex models like CNNs.
tDB removes unfairness from black-box models using probability theory.
problem Mitigating unfairness in predictions from black-box models.
method towerDebias (tDB) method based on the Tower Property.
result tDB improves prediction fairness without retraining the original model.
Paper explores how black box models can deviate from average performance.
problem Understanding and interpreting predictions from sophisticated black box models.
method Two general approaches to provide interpretable descriptions of black box classification model performance.
result Identifies regions where black box models deviate significantly from their average performance.
Interpretable deep learning is a fundamental building block towards safer AI, especially when the deployment possibilities of deep learning-based computer-aided medical diagnostic systems are so eminent. However, without a computational formulation of black-box interpretation, general interpretability research rely hea…
Proposes a method for explaining black-box models with nested feature attributions.
problem Making black-box models transparent and trustworthy.
method Model-agnostic local explanation method exploiting nested feature structure and consistency property.
result Accurate and consistent HiFAs and LoFAs estimated using fewer model queries.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
Driven by an increasing need for model interpretability, interpretable models have become strong competitors for black-box models in many real applications. In this paper, we propose a novel type of model where interpretable models compete and collaborate with black-box models. We present the Model-Agnostic Linear Comp…
Paper introduces Native Guide for generating time series counterfactual explanations.
problem Lack of explainability for time series data in AI systems.
method Model-agnostic, instance-based counterfactual generation for time series classification.
result Native Guide produces better counterfactual explanations than benchmarks.
Develops a method to find costly high-confidence errors in black box models.
problem Finding rare high-confidence errors missed by random sampling.
method Adversarial perturbation-guided search technique to find errors at rates greater than expected given model confidence.
result Our Adversarial Distance search discovers high-confidence errors at a rate greater than expected given model confidence.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
CLE explains any classifier predictions in plain terms.
problem Understanding complex classifier predictions.
method Model-agnostic explanation technique approximating locally using interpretable models.
result CLE provides faithful and interpretable explanations for various classifiers.
Machine learning models have been found to be susceptible to adversarial examples that are often indistinguishable from the original inputs. These adversarial examples are created by applying adversarial perturbations to input samples, which would cause them to be misclassified by the target models. Attacks that search…
Paper proposes ZO-NGD for more efficient black-box attacks.
problem Vulnerability of state-of-the-art DNNs to adversarial attacks.
method Zeroth-order natural gradient descent (ZO-NGD) for black-box attacks.
result ZO-NGD achieves significantly lower model query complexities.
As the use of black-box models becomes ubiquitous in high stake decision-making systems, demands for fair and interpretable models are increasing. While it has been shown that interpretable models can be as accurate as black-box models in several critical domains, existing fair classification techniques that are interp…
TabPFN learns to approximate functions on tabular data.
problem TabPFN tackles function approximation on tabular data.
method Treated as a black-box function approximator generator, observed behavior on varied datasets.
result Observed behavior that is both brilliant and baffling.
BAR reprograms black-box ML models for transfer learning with scarce data.
problem Transfer learning with limited data and resources.
method Zeroth-order optimization and multi-label mapping techniques to reprogram black-box models.
result BAR outperforms state-of-the-art methods and baseline transfer learning approaches.
Develops logic programs for explaining classification model decisions.
problem Creating explanations for decisions made by classification models.
method Answer-set programs for computing counterfactual interventions.
result Maximum responsibility causal explanations can be computed.
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
Hybrid neural network infers states from black-box systems.
problem Inference of state models in black-box systems without source code instrumentation.
method Convolutional and recurrent layers learn correlations between time series signals.
result Improves state change point detection by up to 102%.
We interpret black box predictive models using causal attribution.
problem Interpreting models trained using machine learning in high-stakes applications.
method Estimate causal effects of model inputs on output using observational data.
result Effective interpretation of black box predictive models via causal attribution.
New method turns optimization algorithms into uniformly stable learning algorithms for non-Euclidean norms.
problem Non-Euclidean norms in binary classification problems.
method Black-box reduction method using uniformly convex regularizers.
result Achieves optimal statistical risk bounds on excess risk for non-Euclidean norms.
Prediction systems are successfully deployed in applications ranging from disease diagnosis, to predicting credit worthiness, to image recognition. Even when the overall accuracy is high, these systems may exhibit systematic biases that harm specific subpopulations; such biases may arise inadvertently due to underrepre…
In recent years, a number of artificial intelligent services have been developed such as defect detection system or diagnosis system for customer services. Unfortunately, the core in these services is a black-box in which human cannot understand the underlying decision making logic, even though the inspection of the lo…
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
DAEGEN generates adversarial inputs for neural networks using a black-box differential technique.
problem Generating adversarial inputs that highlight differences between neural network models.
method DAEGEN uses a local search-based optimization algorithm to find difference-inducing adversarial examples (DIAEs).
result DAEGEN is the first black-box differential technique for adversarial input generation and performs well compared to existing methods.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
The paper tests semantic importance in opaque models using betting.
problem Precise statistical guarantees for semantic concepts in black-box models.
method Formalizes global and local statistical importance via conditional independence and SKIT.
result Shows effectiveness and flexibility of the framework on various models.
Optimizes hard-to-optimize metrics using adaptive surrogates.
problem Training models with black-box and hard-to-optimize metrics.
method Expresses metric as a function of surrogates, solves optimization problem over relaxed surrogate space.
result Approach performs on par with known methods and adds value when metric form is unknown.
Interprets feature interactions in ad-click prediction models.
problem Improving interpretability of black-box recommender systems.
method Interprets feature interactions from a source model and encodes them in a target model.
result Interpretations significantly outperform existing recommender models.
Risk Advisor predicts and mitigates ML deployment failures.
problem Predicting and mitigating test-time failure risks of ML systems.
method Post-hoc meta-learner for estimating failure risks and uncertainties.
result Reliably predicts deployment-time failure risks across various ML models.
Recently, generating adversarial examples has become an important means of measuring robustness of a deep learning model. Adversarial examples help us identify the susceptibilities of the model and further counter those vulnerabilities by applying adversarial training techniques. In natural language domain, small pertu…
Interpretable semi-supervised classifier for black-box models with two self-labeling strategies.
problem Lack of labeled data and difficulty in explaining black-box models.
method Combines black-box and white-box approaches for self-labeling and prediction.
result Superior prediction rates and interpretability compared to state-of-the-art classifiers.
Paper introduces active Bayesian method for assessing black-box classifiers efficiently.
problem Need to assess performance of black-box classifiers reliably with limited labels.
method Develops inference strategies and proposes active Bayesian framework for efficient instance selection.
result Significant gains in performance assessment with fewer labels compared to traditional methods.
The increasing scale and sophistication of cyberattacks has led to the adoption of machine learning based classification techniques, at the core of cybersecurity systems. These techniques promise scale and accuracy, which traditional rule or signature based methods cannot. However, classifiers operating in adversarial …
Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in many machine learning tasks, including but not limited to image classification, text mining, and speech processing. However, recent research on DNNs has indicated ever-increasing concern o…
Vision models are interpretable when they classify objects on the basis of features that a person can directly understand. Recently, methods relying on visual feature prototypes have been developed for this purpose. However, in contrast to how humans categorize objects, these approaches have not yet made use of any tax…
FrequentNet uses frequency domain basis vectors for image classification, making models more interpretable and efficient.
problem Image classification models are often complex and hard to interpret.
method FrequentNet selects filter vectors from frequency domain basis vectors instead of training them with back propagation.
result The method improves interpretability and efficiency of image classification models.
We study the AutoML problem of automatically configuring machine learning pipelines by jointly selecting algorithms and their appropriate hyper-parameters for all steps in supervised learning pipelines. This black-box (gradient-free) optimization with mixed integer & continuous variables is a challenging problem. We pr…
PredDiff measures prediction changes while marginalizing features, offering new insights into interaction effects.
problem Understanding interaction effects in black-box models.
method Model-agnostic, local attribution method based on probability theory.
result Introduced a new measure for interaction effects between arbitrary feature subsets.
This paper introduces a new metric for deep learning networks based on their classification performance.
problem The mystery and black-box nature of deep learning networks.
method Proposes a new distance measure based on the probabilistic performance of deep learning networks.
result The proposed metric space is compact and coincides with the quotient topological space.
Interpretable companion model for black-box classifiers.
problem Dilemma between interpretable and black-box models.
method Trains a companion model from data and black-box model predictions, optimizing a combination of accuracy and complexity.
result Companion model provides interpretable predictions with a slight accuracy loss for user choice.
Black box machine learning models are currently being used for high stakes decision-making throughout society, causing problems throughout healthcare, criminal justice, and in other domains. People have hoped that creating methods for explaining these black box models will alleviate some of these problems, but trying t…
New method attacks GNNs with limited node access, increasing misclassification rate.
problem Attacking GNNs with limited node access and limited attack nodes.
method Generalized gradient-based attacks using importance scores derived from random walks.
result Proposed greedy procedure significantly increases misclassification rate.
Adversarial Reprogramming has demonstrated success in utilizing pre-trained neural network classifiers for alternative classification tasks without modification to the original network. An adversary in such an attack scenario trains an additive contribution to the inputs to repurpose the neural network for the new clas…
Black-box risk scoring models permeate our lives, yet are typically proprietary or opaque. We propose Distill-and-Compare, a model distillation and comparison approach to audit such models. To gain insight into black-box models, we treat them as teachers, training transparent student models to mimic the risk scores ass…
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.