New defense method against physical attacks on image classification models.
problem Defending against physically realizable attacks on image classification models.
method Proposed a new abstract adversarial model, rectangular occlusion attacks, and developed two approaches for efficiently computing adversarial examples.
result Adversarial training using the new attack yields robust image classification models against physical attacks.
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
Paper proposes ATN to attack time series classification models.
problem Adversarial attacks on time series classification models.
method Adversarial transformation network (ATN) on a distilled model.
result Time series classification models are susceptible to adversarial attacks.
Bayesian optimisation method targets graph classification models against adversarial attacks.
problem Adversarial attacks on graph classification models, especially for graph-level tasks.
method Bayesian optimisation-based attack method for graph classification models.
result Effectiveness and flexibility of the proposed method validated on various graph classification tasks.
Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing …
Deep learning (DL), despite its enormous success in many computer vision and language processing applications, is exceedingly vulnerable to adversarial attacks. We consider the use of DL for radio signal (modulation) classification tasks, and present practical methods for the crafting of white-box and universal black-b…
Paper proposes transforming ATN to attack multivariate time series models.
problem Generating adversarial samples for multivariate time series classification models.
method Proposes using a distilled model as a surrogate to mimic attacked models and applies 1-NN DTW and FCN attacks.
result Both models were susceptible to attacks on all 18 datasets.
Paper defends LSTM-based text classification models from backdoor attacks.
problem Backdoor attacks in LSTM models cause misclassification of spam or malicious speech.
method Backdoor Keyword Identification (BKI) to identify and exclude poisoned samples.
result BKI method effectively mitigates backdoor attacks in various text classification datasets.
Proposes a method to add adversarial framing to images without changing them.
problem Neural networks are vulnerable to adversarial attacks.
method Adds adversarial framing to the border of images without altering their content.
result Successfully attacks state-of-the-art methods on image and video classification.
Paper presents an optimization-based attack and defense for graph neural networks.
problem Adversarial robustness of graph neural networks (GNNs).
method Gradient-based attack and optimization-based adversarial training.
result Optimization-based attack can significantly decrease GNN classification performance with minimal edge perturbations.
This paper explores vulnerabilities in hierarchical graph pooling neural networks for graph classification.
problem Vulnerability of hierarchical graph pooling neural networks in graph classification tasks.
method Proposes an adversarial attack framework using a surrogate model to generate adversarial samples.
result Adversarial samples can fool hierarchical GNN-based graph classification models, demonstrating their vulnerability.
This study evaluates adversarial attacks and defenses for chest X-ray disease classification.
problem Vulnerability of deep neural networks to adversarial examples in chest X-ray disease detection.
method Detailed introduction and evaluation of various attack and defense methods.
result Attack and defense methods perform poorly with excessive iterations and large perturbations.
Defense against small image patches using occlusions.
problem Vulnerability of deep learning to small adversarial patches.
method Partially occlude image around each patch location.
result Certified security against patch attacks of a certain size.
A new model protects deep learning models from GAN attacks.
problem Vulnerability of collaborative learning to GAN attacks.
method Introduces a key-based classification model and a training scheme using private keys.
result Resilient against GAN attacks without increasing model complexity.
Framework for generating adversarial examples from learning algorithms.
problem Adversarial perturbations leading to erroneous classification.
method Perturbation analysis framework based on convex programming.
result Closed-form solutions for new adversarial attacks.
Trapdoors in neural networks attract adversarial attacks, making them easier to detect.
problem Adversarial attacks on neural networks are difficult to detect and defend against.
method Intentionally inject trapdoors to attract adversarial attacks, then detect them based on feature similarity.
result Trapdoor-protected models can accurately detect adversarial examples with minimal impact on normal classification.
Study shows adversarial attacks can fool speech-to-text models, and PCA is ineffective as a defense.
problem Adversarial attacks can mislead speech-to-text neural networks.
method Crafted adversarial waveforms, used PCA for defense, tested under black-box setting.
result PCA is ineffective as a defense mechanism against adversarial attacks in audio domain.
New method attacks GNNs with limited node access, increasing misclassification rate.
problem Attacking GNNs with limited node access and limited attack nodes.
method Generalized gradient-based attacks using importance scores derived from random walks.
result Proposed greedy procedure significantly increases misclassification rate.
Paper develops a method to generate discrete adversarial attacks on text classification models using submodular optimization.
problem Generating adversarial examples for discrete structures like text is challenging.
method Formulated adversarial attacks as an optimization task on submodular set functions, guided by gradient information.
result Achieved a 1-1/e approximation factor for attacks using the greedy algorithm.
A new adversarial attack improves model perturbation efficiency.
problem Improving adversarial attacks to better perturb images.
method LogBarrier method for solving constrained minimization problem.
result LogBarrier attack performs better on challenging images.
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
Researchers create a flickering attack to fool video recognition networks.
problem Adversarial manipulation of video classification networks.
method Introducing a flickering temporal perturbation to fool video classifiers.
result Achieved high fooling ratio and temporal-invariant perturbation.
This paper explores how to fool ECG diagnosis systems with adversarial ECGs.
problem Vulnerability of DNN-powered ECG diagnosis systems to adversarial attacks.
method Analyzed ECG properties to design effective adversarial attacks under two models.
result Demonstrates weaknesses in DNN-powered ECG diagnosis systems under adversarial attacks.
Study shows various pixel p-norm measures do not match human perception of adversarial attacks.
problem Understanding human perception of adversarial attacks on image classification systems.
method Performed a behavioral study comparing different p-norm measures and alternative metrics.
result Human perception of adversarial attacks does not align with pixel p-norm measures and other metrics.
This paper explores adversarial examples in malware detection.
problem Malware detectors are vulnerable to adversarial interference.
method Training an existing model on a production-scale dataset to test adversarial attacks.
result Some previous attacks are less effective than initially reported.
Study reveals how high-dimensional models are vulnerable to consistent adversarial attacks.
problem Understanding the vulnerability of high-dimensional linear classifiers to adversarial attacks.
method Introducing a new error metric to quantify model vulnerability, and rigorously characterizing these metrics in asymptotic settings.
result As models become more overparameterized, their vulnerability to label-preserving perturbations increases.
Light-based attacks can misclassify images without altering physical objects.
problem Physical attacks on deep learning classifiers are limited by the ability to modify inputs directly.
method Constructs an experimental setup with a light projection source, object, and camera. Uses differential evolution to select light patterns.
result Projected light can degrade classification accuracy from 98% to 22% for 2D objects and from 89% to 43% for 3D objects.
This paper reviews defenses against adversarial learning attacks on statistical classifiers.
problem Adversarial attacks on machine learning systems, particularly statistical classifiers.
method Survey of recent work on test-time evasion, data poisoning, and reverse engineering attacks and defenses.
result Novel insights that challenge conventional AL wisdom and target unresolved issues.
Paper detects adversarial attacks in sound classification models.
problem Adversarial attacks threaten data-driven models, especially in sound classification.
method Detects adversarial subspaces in unitary vector domain using chordal distance and generalized Schur decomposition.
result Regularized logistic regression detector outperforms other approaches on benchmark datasets.
GAMIN attacks black-box models to reveal training data, achieving high success rates.
problem Exposing sensitive information in machine learning models trained on private data.
method Generative adversarial model training to generate inputs similar to training data.
result GAMIN can extract recognizable digits and features from complex models like CNNs.
Deep neural networks are susceptible to \emph{adversarial} attacks. In computer vision, well-crafted perturbations to images can cause neural networks to make mistakes such as confusing a cat with a computer. Previous adversarial attacks have been designed to degrade performance of models or cause machine learning mode…
New method improves neural network interpretability against adversarial attacks.
problem Adversarial attacks can hide from neural network interpretability methods.
method Develops an interpretability-aware defensive scheme promoting robust interpretation.
result Achieves both robust classification and robust interpretation.
A new algorithm fools deep neural networks with few queries.
problem Adversarial examples can mislead deep neural networks into incorrect classifications.
method qFool: a decision-based attack algorithm that reduces query count.
result qFool generates adversarial examples with fewer queries than previous methods.
Bayesian framework robustifies classifiers against malicious attacks.
problem Adversarial attacks on classification algorithms in security and business.
method Adversarial risk analysis and approximate Bayesian computation.
result Robustifies statistical classification algorithms against attacks.
Indirect attacks can fool graph classifiers even with poisoned neighbors.
problem How to evaluate and defend graph convolutional neural networks against indirect adversarial attacks.
method Proposed a method to generate adversarial perturbations on a single node far from the target.
result 99% attack success rate within two-hops from the target in two datasets.
Universal audio perturbations fool multiple classification models.
problem Creating audio adversarial perturbations that work across different models.
method Two methods: greedy iterative approach and novel penalty formulation.
result The penalty method produces more successful attacks with limited training data.
T-BFA targets and misleads specific DNN inputs to a chosen output.
problem Targeted attack on DNN weight parameters to hijack function.
method Identifies critical weight bits, ranks them by class dependence, and flips them to mislead inputs.
result Successfully misclassifies images from 'Hen' to 'Goose' class with 100% success rate, maintaining 59.35% validation accuracy.
Domain knowledge helps detect adversarial examples in multi-label classification.
problem Detecting adversarial examples in multi-label classification.
method Convert domain knowledge into constraints and inject them into a semi-supervised learning problem.
result Domain-knowledge constraints help detect adversarial examples effectively.
Adversaries can fool deep learning modulator classifiers over wireless channels.
problem Vulnerability of deep learning modulator classifiers to adversarial attacks over wireless channels.
method Presented various adversarial attacks considering channel effects, including targeted and non-targeted attacks, and a universal adversarial perturbation attack.
result Modulation classification is vulnerable to adversarial attacks over wireless channels with realistic channel effects.
Proposes learning ordered Top-k attacks for image classification.
problem Vulnerability of DNNs to adversarial attacks, especially white-box targeted attacks.
method Adversarial distillation framework to compute adversarial probability distributions and minimize KL divergence.
result Outperforms C&W method in Top-1 and Top-5 settings for image classification.
Paper proposes a robust audio classification method against adversarial attacks.
problem Adversarial attacks can fool machine learning models into making incorrect predictions.
method Proposes a novel SVM-based approach using DWT and SURF features.
result The proposed method provides a good balance between accuracy and resilience against adversarial attacks.
Bayesian explanations are more resilient to adversarial attacks than deterministic ones.
problem Stability of saliency-based explanations under adversarial attacks in Neural Networks.
method Empirical and theoretical analysis of Bayesian vs deterministic Neural Networks.
result Bayesian explanations are more stable under adversarial perturbations and direct attacks.
Poisoning attacks can undermine fairness in machine learning models.
problem Poisoning attacks can introduce classification disparities among different groups in data.
method Developed a gradient-based poisoning attack framework to target algorithmic fairness.
result Demonstrated the effectiveness of poisoning attacks in both white-box and black-box scenarios.
Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for …
New technique hides adversarial attacks in complex images, making them imperceptible.
problem Lack of interpretability in Convolutional Neural Networks (CNNs) and vulnerability to adversarial attacks.
method Developed a technique that hides adversarial attacks in regions of high complexity, making them imperceptible to human observers.
result Significant evidence of concealment of adversarial attacks in images, making them imperceptible to human observers.
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
Paper proposes a new method to attack Bayesian forecasting models.
problem Lack of research on adversarial attacks against time series forecasting systems.
method Decision analysis based attacking strategy for Bayesian forecasting models.
result Demonstrates the vulnerability of Bayesian forecasting models to adversarial attacks.
Paper presents a method to disrupt deep uncertainty estimation without affecting accuracy.
problem Uncertainty estimation in deep neural networks for risk-sensitive applications.
method A novel attack that cripples uncertainty estimation without reducing accuracy.
result The attack causes the network to be more confident in incorrect predictions than correct ones.