Paper evaluates and mitigates privacy risks in deep learning models.
problem Quantifying and defending against privacy attacks in deep learning.
method Quantitative evaluation of trade-offs, reformulating attacks, and proposing a novel SPN.
result Model accuracy improved by 5-20% while maintaining data privacy.
This work improves understanding of neural network reconstruction attacks and distillation.
problem Understanding and mitigating reconstruction attacks on neural networks.
method Developed a stronger dataset reconstruction attack and studied its characteristics.
result Reconstruction attacks can recover entire training sets in the infinite width regime.
Paper addresses data reconstruction from privacy-protected templates using STCA.
problem Reconstructing privacy-sensitive data from protected templates.
method Sparse ternary coding with ambiguization (STCA) for privacy preservation.
result STCA maintains theoretical performance against deep reconstruction attacks for synthetic data but requires special measures for real images.
ME-Net defends neural nets against adversarial attacks by reconstructing images.
problem Adversarial attacks on deep neural networks.
method ME-Net uses matrix estimation to preprocess images, destroying adversarial noise while preserving global structure.
result ME-Net consistently outperforms state-of-the-art defenses on various benchmarks.
New method can infer training data from deep neural networks with high success rates.
problem Model inversion attacks on deep neural networks pose privacy risks.
method Generative model-inversion attack using GANs and partial public information.
result Significant improvement in identifying private training data from deep models.
SAPAG attacks distributed learning by reconstructing true training data from gradients.
problem Privacy attacks on distributed learning systems through gradients.
method SAPAG uses a Gaussian kernel-based gradient difference distance measure.
result SAPAG can reconstruct training data on various DNNs and at different training phases.
Face recognition systems are vulnerable to composite face reconstruction attacks.
problem Vulnerability of face recognition systems to composite face reconstruction attacks.
method Assumed attacker uses composite face parts to reconstruct faces faster and more efficiently.
result Current face recognition systems are extremely vulnerable to random search attacks.
New study analyzes security of neural network data reconstruction attacks.
problem Data reconstruction attacks pose a threat to private training data.
method Analyzes security boundary of data reconstruction attacks via neuron exclusivity state.
result Characterizes insecure/secure boundary of data reconstruction attacks.
Paper improves privacy for language models against reconstruction attacks.
problem Reconstruction attacks can regenerate training data from language models.
method Uses Rényi differential privacy with optimized privacy budgets.
result Better privacy guarantees for extraction of rare secrets.
New analysis shows reconstruction attacks are unreliable without prior data knowledge.
problem Privacy and security risks from neural network memorization of training data.
method Complementary analysis of reconstruction methods, proving their unreliability without prior data knowledge.
result Reconstruction attacks are fundamentally unreliable without prior data knowledge, and networks trained more extensively are less susceptible.
In this paper we propose a new membership attack method called co-membership attacks against deep generative models including Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs). Specifically, membership attack aims to check whether a given instance x was used in the training data or not. A co-me…
Machine learning (ML) has progressed rapidly during the past decade and the major factor that drives such development is the unprecedented large-scale data. As data generation is a continuous process, this leads to ML model owners updating their models frequently with newly-collected data in an online learning scenario…
Optimal defenses protect FL models from gradient reconstruction attacks.
problem Gradient reconstruction attacks compromise FL models by recovering original data from shared gradients.
method Derive a theoretical lower bound of reconstruction error, customize noise and pruning defenses, and achieve optimal trade-off between leakage and utility.
result Our methods outperform Gradient Noise and Pruning in protecting training data and maintaining model utility.
Deep learning attacks chaos-based image encryption.
problem Chaos-based image encryption vulnerability.
method Project encrypted images to low-dimensional space, use deconvolutional generator to regenerate images.
result Proposes a key-independent, end-to-end trained method to attack chaos-based encryption.
Capsule networks detect and diagnose adversarial images better than CNNs.
problem Detecting and diagnosing adversarial images in neural networks.
method Class-conditional capsule reconstruction and reconstructive attack.
result Capsule networks outperform CNNs in detecting and diagnosing adversarial images.
This paper analyzes how training data can be leaked from gradients in neural networks and proposes a metric for measuring model security.
problem Training data leakage from gradients in neural networks for image classification.
method Formulated the problem as an optimisation problem for each layer, involving weights, gradients, and constraints from preceding layers.
result Attributed training data leakage to the architecture of the deep network and proposed a metric for measuring model security.
We explore methods of producing adversarial examples on deep generative models such as the variational autoencoder (VAE) and the VAE-GAN. Deep learning architectures are known to be vulnerable to adversarial examples, but previous work has focused on the application of adversarial examples to classification tasks. Deep…
Differentiable topology layer for machine learning models.
problem Regularizing and incorporating topological priors in machine learning models.
method Computes persistent homology based on level set and edge-based filtrations.
result Demonstrates three novel applications of the topology layer in machine learning.
Paper reconstructs training data from a single gradient query.
problem Privacy threats in federated learning due to model gradients.
method Provable attack using tensor decomposition.
result Training samples can be fully reconstructed from a single gradient query.
DefenseVGAE defends graph neural networks against adversarial attacks.
problem Vulnerability of GNNs to adversarial structural perturbations.
method Variational Graph Autoencoder (VGAE) to reconstruct graph structure.
result DefenseVGAE reduces adversarial perturbations and boosts GCN performance.
A method to control neural level sets for improved generalization and robustness.
problem Improving the properties of neural networks, particularly their decision boundaries and robustness.
method Sampling neural level sets and relating them to network parameters through a sample network.
result High fidelity surface reconstruction from raw 3D point clouds and comparable robust accuracy to state-of-the-art methods.
New attack recovers user-level information from large batch images.
problem Recovering private information from user-level gradients in distributed learning.
method Proposes a gradient inversion attack using a denoising diffusion model as a prior.
result Demonstrates recovery of realistic facial images and private attributes.
We present a simple technique that allows capsule models to detect adversarial images. In addition to being trained to classify images, the capsule model is trained to reconstruct the images from the pose parameters and identity of the correct top-level capsule. Adversarial images do not look like a typical member of t…
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
Reduces data leakage in distributed deep learning models.
problem Prevents reconstruction of sensitive raw data patterns during client communications.
method Reduces distance correlation between raw data and learned representations.
result Resilient to reconstruction attacks while maintaining model accuracy.
VAEs are vulnerable to adversarial attacks; new methods improve their robustness.
problem Vulnerability of VAEs to adversarial attacks.
method Introducing methods for producing adversarially robust VAEs, including disentangling latent representations and applying them to hierarchical VAEs.
result Hierarchical VAEs produce high-fidelity autoencoders that are also adversarially robust.
This work formalizes and solves GNN extraction, a new type of attack.
problem Extracting the underlying model from a black-box GNN with API access.
method Formalizes GNN extraction, presents a solution with preliminary results.
result Preliminary results show the feasibility of GNN extraction.
Adversarial machine learning in the context of image processing and related applications has received a large amount of attention. However, adversarial machine learning, especially adversarial deep learning, in the context of malware detection has received much less attention despite its apparent importance. In this pa…
Develops a new robustness criterion for VAEs and provides theoretical guarantees.
problem Lack of formalization for robustness in VAEs.
method Introduces r-robustness criterion and derives reconstruction margins. result Derives theoretical guarantees for VAE robustness.
Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
Graph embedding leaks sensitive graph properties and subgraphs.
problem Privacy risks in graph embedding sharing.
method Three inference attacks and a defense mechanism.
result High accuracy in inferring graph properties and subgraphs.
This work surveys attacks and defenses on edge neural networks.
problem Security challenges of edge neural networks due to their compute and memory intensity, data-independence, and privacy risks.
method Taxonomy of attacks and defenses on edge-deployed neural networks.
result New security considerations and approaches are needed for edge DNNs.
Efficient method defends privacy in federated learning without accuracy loss.
problem Privacy attacks on federated learning by reconstructing and identifying local data.
method Random noise perturbation method that allows recovery of true gradients.
result Strong privacy protection without sacrificing learning accuracy.
New framework UIFV reconstructs private features in VFL without model details.
problem Privacy risks in VFL where adversaries can reconstruct sensitive features.
method Unified InverNet Framework (UIFV) that uses intermediate feature data.
result Significantly outperforms state-of-the-art techniques in attack precision.
Deep neural networks have been demonstrated to be vulnerable to adversarial attacks, where small perturbations intentionally added to the original inputs can fool the classifier. In this paper, we propose a defense method, Featurized Bidirectional Generative Adversarial Networks (FBGAN), to extract the semantic feature…
New defense method protects client data privacy in federated learning.
problem Gradient leakage attacks in federated learning.
method Learning to obscure data to generate synthetic samples.
result Synthetic samples preserve predictive features and protect privacy.
Improved reliability of machine learning predictions using variational auto-encoders.
problem Individual unreliability of machine learning models.
method Modified variational auto-encoders to identify a low-dimensional space for reliable classification.
result Improved reliability of predictions and robust identification of adversarial samples.
Paper tackles model vulnerabilities by reconstructing training data.
problem Reconstructing training data from model parameters poses a security risk.
method Developed a mathematical framework and score matching method for both Bayesian and non-Bayesian models.
result First score matching framework for reconstructing data in Bayesian models.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
The paper analyzes privacy leakage in federated learning using linear algebra and optimization theory.
problem Privacy leakage in federated learning despite its promise for data privacy.
method Theoretical analysis from linear algebra and optimization theory perspectives.
result Derives sufficient conditions to prevent data reconstruction attacks and establishes an upper bound on privacy leakage.
New attack method improves neural network security.
problem Vulnerability of deep neural networks to adversarial attacks.
method Ensemble adversarial attack with long-term gradient memory.
result Enhanced robustness against adversarial attacks.
Background elimination for noisy character images or character images from real scene is still a challenging problem, due to the bewildering backgrounds, uneven illumination, low resolution and different distortions. We propose a stroke-based character reconstruction(SCR) method that use a weighted quadratic Bezier cur…
This paper proposes multi-view attack strategies for deep models.
problem Vulnerability of multi-view deep models to adversarial attacks.
method Two multi-view attack strategies: two-stage attack (TSA) and end-to-end attack (ETEA).
result Proposed multi-view attack strategies are effective on multi-view deep models.
Adversarial attacks can manipulate deep trading policies, compromising their performance.
problem Adversarial attacks can compromise deep reinforcement learning trading policies.
method Developed a threat model and proposed two attack techniques.
result Demonstrated the effectiveness of adversarial attacks against DQN trading agents.
Unified bounds for DP risks reduce noise and improve accuracy.
problem Difficult interpretation and calibration of DP mechanisms.
method Hypothesis-testing interpretation of DP (f-DP) and unified bounds. result Unified bounds are tighter and tunable for specific risks.
This work enhances collaborative inference privacy by minimizing conditional entropy and boosting robustness against model inversion attacks.
problem Privacy leakage in collaborative inference systems via model inversion attacks.
method Theoretical proof and derivation of a differentiable measure for bounding conditional entropy, followed by a CEM algorithm to maximize it.
result Theoretical proof and experimental validation show that CEM consistently boosts inversion robustness without compromising feature utility or efficiency.
The burgeoning success of deep learning has raised the security and privacy concerns as more and more tasks are accompanied with sensitive data. Adversarial attacks in deep learning have emerged as one of the dominating security threat to a range of mission-critical deep learning systems and applications. This paper ta…
This study examines how model architecture affects deep learning model privacy.
problem Privacy concerns in deep learning models due to potential leakage of sensitive information.
method Investigation of CNNs and Transformers, focusing on activation layers, stem layers, LN layers, and attention modules.
result Transformers generally exhibit higher vulnerability to privacy attacks than CNNs.