This paper explores how the generalization of substitute classifiers affects the success of black-box adversarial attacks.
problem Understanding the factors driving the transferability of black-box adversarial examples.
method Max-min adversarial example game framework and theoretical generalization bounds.
result Substitute NN with better generalization behavior results in more transferable adversarial examples.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
Enhances adversarial example transferability by fine-tuning existing examples.
problem Adversarial examples are often overfit to a source model, limiting black-box transferability.
method Intermediate Level Attack (ILA) fine-tunes adversarial examples on a pre-specified layer of the source model.
result ILAs achieve high transferability to target models without knowledge of their architecture.
BAR reprograms black-box ML models for transfer learning with scarce data.
problem Transfer learning with limited data and resources.
method Zeroth-order optimization and multi-label mapping techniques to reprogram black-box models.
result BAR outperforms state-of-the-art methods and baseline transfer learning approaches.
Paper tackles hypothesis transfer learning for black-box models.
problem Difficult to build universal machine learning models across different institutions.
method Dynamic Knowledge Distillation (dkdHTL) with instance-wise weighting.
result Empirical results show the effectiveness of dkdHTL.
New method optimizes BO by learning search spaces from past evaluations.
problem Optimizing expensive black-box functions efficiently.
method Automatically designs BO search space from historical data.
result Significant boost in BO performance by reducing search space size.
Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples may be overfit to exploit the particular architecture and …
We consider the black-box adversarial setting, where the adversary has to generate adversarial perturbations without access to the target models to compute gradients. Previous methods tried to approximate the gradient either by using a transfer gradient of a surrogate white-box model, or based on the query feedback. Ho…
MPHD transfers knowledge across different domains for Bayesian optimization.
problem Optimizing functions with unknown or diverse domains.
method MPHD uses neural nets to map domain-specific contexts to GP specifications, enabling transfer learning across heterogeneous search spaces.
result MPHD improves black-box function optimization performance on diverse domains.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
New methods improve black-box adversarial attacks with fewer queries.
problem Efficiently craft adversarial examples without access to gradients.
method Prior-guided random gradient-free algorithms based on biased sampling and gradient averaging.
result Both methods require fewer queries and achieve higher success rates.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
Unified view on GP transfer learning for Bayesian optimization.
problem Improving data efficiency in Bayesian optimization with scarce data.
method Unified hierarchical GP models for transfer learning, including a novel boosted GP transfer model.
result Unified analysis and comparison of transfer learning methods for GP models.
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
Paper presents a robust transfer learning method for active level set estimation.
problem Efficiently identifying regions of a black-box function with limited function evaluations.
method Incorporates prior knowledge from a related function while locally adapting it.
result The method achieves better convergence of level sets compared to standard transfer learning.
New method improves adversarial transferability from Bayesian neural networks.
problem Improving the effectiveness of black-box evasion attacks.
method Sampling from the posterior distribution of neural network weights to build a surrogate.
result Significantly improved success rates of state-of-the-art attacks (up to 83.2 percentage points).
Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model'…
Cronus securely transfers model parameters to protect federated learning from poisoning attacks.
problem Federated learning's privacy and security issues, especially with large models.
method Cronus uses black-box knowledge transfer to reduce parameter dimensions and control information leakage.
result Cronus is the only secure federated learning method against poisoning attacks.
Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in many machine learning tasks, including but not limited to image classification, text mining, and speech processing. However, recent research on DNNs has indicated ever-increasing concern o…
Machine Learning (ML) and Deep Learning (DL) models have achieved state-of-the-art performance on multiple learning tasks, from vision to natural language modelling. With the growing adoption of ML and DL to many areas of computer science, recent research has also started focusing on the security properties of these mo…
We propose a new randomized ensemble technique with a provable security guarantee against black-box transfer attacks. Our proof constructs a new security problem for random binary classifiers which is easier to empirically verify and a reduction from the security of this new model to the security of the ensemble classi…
Face recognition models can be inferred from student models, posing privacy risks.
problem Privacy threats in transfer learning models for face recognition.
method Membership inference attacks and attribute inference from aggregate-level information.
result Sensitive attributes can be inferred from student models, even with limited auxiliary information.
New method lures adversaries to choose false directions in black-box attacks.
problem Improving robustness against black-box transfer attacks.
method Incorporates a removable neural network to induce a luring effect.
result Demonstrates effectiveness in thwarting state-of-the-art attacks.
Despite the considerable success of convolutional neural networks in a broad array of domains, recent research has shown these to be vulnerable to small adversarial perturbations, commonly known as adversarial examples. Moreover, such examples have shown to be remarkably portable, or transferable, from one model to ano…
LGV boosts adversarial attacks by improving surrogate models.
problem Improving the transferability of black-box adversarial attacks.
method LGV uses a pretrained surrogate model and multiple weight sets from additional training epochs to generate an effective surrogate ensemble.
result LGV outperforms other test-time transformations by significant margins.
TL-ANDI distills context from source data to improve transfer learning for TFMs.
problem Limited transfer learning due to context-size constraints and distribution shifts.
method TL-ANDI uses posterior-aware distillation to construct a compact source context and locally distills labels.
result Improves transfer performance by addressing context-size and distribution shifts.
This study evaluates how adversarial examples transfer between different models.
problem Transferability of adversarial examples across models poses a threat to machine learning reliability.
method Evaluation of three adversarial attacks (FGSM, Basic Iterative Method, Carlini & Wagner) on two model classes (VGG and Inception). Use of specific parameters and metrics (L-Infinity clipping, SSIM) for assessment.
result Adversarial examples can be transferred between models, indicating a vulnerability in machine learning systems.
Study improves Bayesian optimisation with ensemble transfer learning.
problem Improving sample efficiency in Bayesian optimisation of expensive functions.
method Empirical analysis of ensemble-based transfer learning methods and pipeline components.
result Two components (warm start initialisation and positive weight constraint) improve transfer learning Bayesian optimisation performance.
Framework reuses pre-trained models for data-free transfer learning.
problem Challenges in retrieving source data for model training.
method Model Recycling Framework for parameter-efficient training.
result Makes multi-source data-free supervised transfer learning possible.
The paper analyzes and minimizes transferability of adversarial attacks between models in an ensemble.
problem Adversarial attacks can transfer between models, posing security risks.
method Introduces a gradient-based measure to assess and reduce transferability, and uses it during training to increase robustness.
result Demonstrates that the gradient-based measure can be used to increase an ensemble's robustness to adversarial attacks.
Paper proposes a black-box technique to generate adversarial samples.
problem Robustness of Deep Neural Networks (DNNs) to adversarial samples.
method Black-box Momentum Iterative Fast Gradient Sign Method (BMI-FGSM) using Differential Evolution to approximate gradients.
result Achieves high success rates in generating adversarial samples and misclassification.
LOTOS improves ensemble robustness by promoting orthogonal transformations.
problem Transferability of adversarial examples threatens robustness of classification models.
method LOTOS promotes orthogonality among sub-spaces of transformations in ensemble models.
result LOTOS increases robust accuracy of ensembles by 6 percentage points against black-box attacks.
P-BO reduces black-box adversarial attacks by 10x with Bayesian optimization and function prior.
problem Efficiently generating adversarial examples against black-box models.
method Prior-guided Bayesian Optimization (P-BO) with a function prior initialized from a surrogate model.
result Significantly reduces the number of queries needed for adversarial attacks.
Adversarial examples are maliciously tweaked images that can easily fool machine learning techniques, such as neural networks, but they are normally not visually distinguishable for human beings. One of the main approaches to solve this problem is to retrain the networks using those adversarial examples, namely adversa…
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
New methods improve autotuning of exascale applications by 1.5x.
problem Finding optimal performance parameters for exascale applications.
method Multitask and transfer learning for autotuning.
result Average 1.5x improvement in application runtime.
Skip connections make adversarial examples more transferable in ResNets.
problem Transferability of adversarial examples in ResNets with skip connections.
method Skip Gradient Method (SGM) to craft more transferable adversarial examples.
result SGM improves transferability of adversarial examples in various DNNs.
Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model's parameters. Adversarial training is the process of explicitly training a model on adversarial examples,…
Enhances PCE surrogates using transfer learning for expensive simulations.
problem Over-sampling in PCE for expensive forward models.
method Transfer learning from similar tasks to a new task with limited training data.
result Improves scalability and accuracy of PCE surrogates.
Study examines adversarial robustness of ANN variants, revealing differences in black-box settings.
problem Adversarial robustness of alternative neural network architectures.
method Analysis of conventional, stochastic ANNs, and SNNs across three datasets; experiments in white-box and black-box settings.
result Stochastic ANNs are more robust than conventional ANNs in black-box settings, especially with surrogate attacks.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
Transferring knowledge across tasks to improve data-efficiency is one of the open key challenges in the field of global black-box optimization. Readily available algorithms are typically designed to be universal optimizers and, therefore, often suboptimal for specific tasks. We propose a novel transfer learning method …
Orthogonal deep models defend against black-box attacks by ensuring internal representations are nearly orthogonal.
problem Vulnerability of deep learning models to black-box adversarial attacks.
method Introduce a gradient regularization scheme to encourage deep models' internal representations to be orthogonal to another model's.
result Orthogonal deep models significantly boost robustness against transferable black-box adversarial attacks.
The paper explores transferability of adversarial examples between convex and 01 loss models, finding non-transferability due to different decision boundaries caused by outliers.
problem Transferability of adversarial examples between convex and 01 loss models.
method Empirical study of transferability between linear 01 loss and convex (hinge) loss models, and between neural networks with different activation functions.
result Adversarial examples are non-transferable between convex and 01 loss models due to different decision boundaries caused by outliers.
Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image model…
Black-box attacks on RL agents using temporal information.
problem Vulnerability of RL agents to adversarial samples.
method Sequence-to-sequence models for predicting future actions.
result Adversarial samples can trigger RL agents to misbehave after a delay.
Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversaria…
Powerful adversarial attack methods are vital for understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. In this paper, we propose a black-box adversarial attack algorithm that can defeat both vanilla DNNs and those generated by various defense techniques develo…