A two-layer network corrects logits to defend adversarial attacks.
problem Detecting and defending adversarial attacks on deep learning models.
method A two-layer network trained on mixed logits to recover original predictions.
result Shows promising results in defense with high accuracy and interpretability.
Paper models game theory for defending against data poisoning attacks.
problem Defending against data poisoning attacks using game theory.
method Modeling attacker-defender game, proving non-existence of pure Nash Equilibrium, proposing mixed strategy approach, and developing an algorithm to approximate Nash Equilibrium.
result Demonstrated effectiveness of mixed strategy defense in experiments.
Defends classifiers from adversarial attacks using self-supervised data estimation.
problem Protecting classifiers from adversarial attacks with full attacker access.
method RIDE, a self-supervised learning algorithm for individual data estimation.
result Significant improvement in adversarial defense performance (98%, 76%, 43% test accuracy on MNIST, CIFAR-10, and ImageNet datasets respectively).
BPN defends against adversarial attacks by generating beneficial perturbations.
problem Adversarial attacks cause deep neural networks to misclassify clean inputs.
method BPN generates beneficial perturbations during training to neutralize future adversarial attacks.
result BPN is robust to adversarial examples and more efficient than classical adversarial training.
Defends against ML inference attacks using adversarial examples.
problem Automated inference attacks using ML classifiers pose privacy and security threats.
method Turns ML classifier vulnerabilities into defenses by adding adversarial noise to public data.
result Adversarial examples can mislead ML classifiers and protect private data.
Entangled watermarks improve model defense against extraction attacks.
problem Model extraction attacks risk leaking valuable intellectual property.
method Entangled Watermarking Embeddings (EWE) leverages model capacity to overfit to outlier input-output pairs.
result The approach successfully claims model ownership with high confidence and minimal performance loss.
UAG defends GNNs against adversarial attacks by quantifying and explaining uncertainties.
problem Lack of uncertainty quantification in GNNs makes them vulnerable to adversarial attacks.
method UAG uses Bayesian Uncertainty Technique (BUT) and Uncertainty-aware Attention Technique (UAT).
result UAG outperforms state-of-the-art solutions in defending adversarial attacks on GNNs.
This paper defends SVMs against poisoning attacks using DBSCAN and hardness proofs.
problem Adversarial injection of specially crafted samples into training data to misclassify SVMs.
method Two strategies: robust SVM algorithms and data sanitization (DBSCAN).
result Proves hardness of simple SVM problem and effectiveness of DBSCAN for poisoning attacks.
This paper optimizes cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
problem Optimizing cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
method Combining strategic behavior of players with contagion dynamics, a method is extended to determine optimal resource allocation based on simple network metrics weighted by risk profiles.
result The asymmetry between attacker and defender valuations drives optimal attack and defense strategies, shaping system resilience.
The vulnerability of machine learning systems to adversarial attacks questions their usage in many applications. In this paper, we propose a randomized diversification as a defense strategy. We introduce a multi-channel architecture in a gray-box scenario, which assumes that the architecture of the classifier and the t…
DefenseVGAE defends graph neural networks against adversarial attacks.
problem Vulnerability of GNNs to adversarial structural perturbations.
method Variational Graph Autoencoder (VGAE) to reconstruct graph structure.
result DefenseVGAE reduces adversarial perturbations and boosts GCN performance.
COMPAS recidivism predictions show racial bias against African Americans, study finds.
problem Racial bias in recidivism prediction algorithms.
method Causal analysis using FACT, a fairness measure grounded in causal inference.
result COMPAS shows racial bias against African American defendants, robust to unmeasured confounding.
This research secures deployed sentiment analysis models by identifying and defending against attack vectors.
problem Securing deployed machine learning models, particularly sentiment analysis systems, from adversarial attacks.
method BAD (Build, Attack, Defend) Architecture, evaluating two implementations.
result Demonstrated a viable methodology for securing machine learning models in production.
The results of a learning process depend on the input data. There are cases in which an adversary can strategically tamper with the input data to affect the outcome of the learning process. While some datasets are difficult to attack, many others are susceptible to manipulation. A resourceful attacker can tamper with l…
New method defends against both single-step and iterative adversarial examples.
problem Defending against adversarial examples, especially iterative ones, is computationally expensive.
method Single-Step Adversarial Training (SST) with modifications.
result Our method outperforms state-of-the-art methods in both accuracy and training time.
Paper defends diffusion models from membership inference attacks using Langevin dynamics.
problem Defending diffusion models against membership inference attacks.
method Uses critically-damped higher-order Langevin dynamics with auxiliary variables.
result Demonstrates improved resistance to membership inference attacks through theoretical investigation and validation.
GNNGuard defends Graph Neural Networks against structural perturbations.
problem Adversarial attacks on graph neural networks can degrade performance catastrophically.
method Detects and quantifies the relationship between graph structure and node features, then uses this to mitigate attacks.
result GNNGuard outperforms existing defenses by 15.3% on average across various attacks and datasets.
Denoised smoothing defends pretrained classifiers against adversarial attacks.
problem Adversarial attacks on pretrained classifiers.
method Prepending a denoiser to any off-the-shelf classifier using randomized smoothing.
result Guaranteed ℓp-robustness to adversarial examples without modifying the pretrained classifier. Efficient method defends deep learning models from adversarial attacks.
problem Vulnerability of deep learning models to adversarial attacks.
method Training a Denoising Autoencoder (DAE) to reduce data dimensions and serve as a defense.
result The method provides a 2.43x speedup while maintaining robustness against adversarial attacks.
A new algorithm RESYNC for defenders against malicious attackers in multi-player bandits.
problem Malicious players colliding with cooperative players to prevent rewards.
method Decentralized and robust algorithm RESYNC for defenders.
result RESYNC algorithm is order-optimal, performing gracefully as the number of collisions increases.
Efficient method defends privacy in federated learning without accuracy loss.
problem Privacy attacks on federated learning by reconstructing and identifying local data.
method Random noise perturbation method that allows recovery of true gradients.
result Strong privacy protection without sacrificing learning accuracy.
A new method for estimating adversarial strategies in nonlinear systems.
problem Inferring an intelligent adversarial agent's strategy in highly nonlinear systems.
method Formulated inverse cognition as a nonlinear Gaussian state-space model and developed an inverse UKF (IUKF) system.
result The estimation error of IUKF converges and closely follows the recursive Cramér-Rao lower bound.
Pro-GNN defends graph neural networks from adversarial attacks by learning graph structure.
problem Vulnerability of GNNs to adversarial attacks on real-world graphs.
method Pro-GNN learns a structural graph and a robust GNN model jointly from perturbed graphs guided by intrinsic graph properties.
result Pro-GNN achieves significantly better performance than state-of-the-art defense methods, even on heavily perturbed graphs.
Adaptive Misinformation defends against model stealing attacks by sending incorrect predictions for OOD queries.
problem Model stealing attacks clone target models using black-box query access and a surrogate dataset.
method Selective sending of incorrect predictions for Out-Of-Distribution (OOD) queries to degrade attacker's clone model accuracy.
result Our defense reduces attacker's clone model accuracy by up to 40% while maintaining benign user accuracy under 0.5%.
The increasing scale and sophistication of cyberattacks has led to the adoption of machine learning based classification techniques, at the core of cybersecurity systems. These techniques promise scale and accuracy, which traditional rule or signature based methods cannot. However, classifiers operating in adversarial …
A CAE improves DNN's outlier and adversary defense.
problem Improving DNN's robustness against outliers and adversaries.
method Proposes a classification-autoencoder (CAE) that compresses samples into disjoint spaces and uses a decoder to classify and defend against adversaries.
result The CAE achieves state-of-the-art outlier recognition and near-lossless classification of adversaries.
Enhances single-step adversarial training to defend against iterative adversarial examples.
problem Defending against iterative adversarial examples in neural networks.
method Identified and leveraged empirical properties of Iter-Adv to improve Single-Adv.
result Enhanced Single-Adv to defend against iterative adversarial examples with improved accuracy and reduced training cost.
Defense against user shilling attacks in collaborative filtering using edge reweighting.
problem Vulnerability of collaborative filtering to profile injection attacks.
method Adversarial robustness based edge reweighting to attenuate non-robust edges.
result Effective defense against various types of attacks demonstrated through experiments.
Recent work has shown that state-of-the-art models are highly vulnerable to adversarial perturbations of the input. We propose cowboy, an approach to detecting and defending against adversarial attacks by using both the discriminator and generator of a GAN trained on the same dataset. We show that the discriminator con…
FGSV defends against shell company attacks in group data valuation.
problem Shell company attacks on group-level data valuation.
method Developed a provably fast and accurate approximation algorithm for FGSV.
result Empirical results show significant improvement in computational efficiency and accuracy.
Machine Learning models have been shown to be vulnerable to adversarial examples, ie. the manipulation of data by a attacker to defeat a defender's classifier at test time. We present a novel probabilistic definition of adversarial examples in perfect or limited knowledge setting using prior probability distributions o…
Study adversarial attacks on cost-sensitive classifiers.
problem Safety-critical classification problems with cost-sensitive predictions.
method Used state-of-the-art adversarially-resistant neural networks and analyzed as a two-player zero-sum game.
result Introduced a new cost-sensitive attack that performs better than targeted attacks in some cases.
Circle packings on compact surfaces simplified.
problem Simplifying circle packings on complex surfaces.
method Uniformisation of weighted maps.
result Unified approach to circle packings.
We study a variant of the source identification game with training data in which part of the training data is corrupted by an attacker. In the addressed scenario, the defender aims at deciding whether a test sequence has been drawn according to a discrete memoryless source X∼PX, whose statistics are known to hi…
New method defends against multiple perturbation models in adversarial attacks.
problem Defending against multiple types of adversarial attacks.
method Developed a natural generalization of PGD-based procedure to incorporate multiple perturbation models.
result Trained robust models against ℓ∞, ℓ2, and ℓ1 attacks, achieving 47.0% adversarial accuracy on CIFAR10. We study the effectiveness of various approaches that defend against adversarial attacks on deep networks via manipulations based on basis function representations of images. Specifically, we experiment with low-pass filtering, PCA, JPEG compression, low resolution wavelet approximation, and soft-thresholding. We evalu…
New defense method against physical attacks on image classification models.
problem Defending against physically realizable attacks on image classification models.
method Proposed a new abstract adversarial model, rectangular occlusion attacks, and developed two approaches for efficiently computing adversarial examples.
result Adversarial training using the new attack yields robust image classification models against physical attacks.
This paper improves model robustness against adversarial attacks using optimal transport.
problem Adversarial attacks can mislead deep learning models with imperceptible perturbations.
method Exploits optimal transport theory to align adversarial and original image distributions.
result SAT (Sinkhorn Adversarial Training) leads to more robust models compared to state-of-the-art.
Adversarial machine learning is a fast growing research area, which considers the scenarios when machine learning systems may face potential adversarial attackers, who intentionally synthesize input data to make a well-trained model to make mistake. It always involves a defending side, usually a classifier, and an atta…
Paper defends against malware detection attacks using clustering and deep learning.
problem Label flipping attacks on malware detection systems in IoT environments.
method Developed a Silhouette clustering-based attack mechanism and two CNN-type deep learning algorithms for defense.
result Proposed algorithms LSD and CSD improve malware detection accuracy by up to 19%.
Develops inverse unscented Kalman filter for non-linear systems.
problem Estimating defender's state in adversarial settings.
method Formulated inverse unscented Kalman filter (I-UKF) and reproducing kernel Hilbert space-based UKF (RKHS-UKF).
result Proposed filters are conservative estimators with upper-bounded error covariance.
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
SmoothLLM defends LLMs from jailbreaking attacks by randomly perturbing inputs.
problem Adversaries can fool large language models into generating objectionable content.
method SmoothLLM randomly perturbs multiple copies of a prompt and aggregates predictions to detect adversarial inputs.
result SmoothLLM sets the state-of-the-art for robustness against various jailbreak attacks.
Dataset inference defends against model stealing by identifying stolen training data.
problem Model stealing through machine learning models trained on proprietary data.
method Combines statistical testing with decision boundary estimation to identify stolen training data.
result Model owners can claim with high confidence that their model was stolen, even with limited stolen data.
Backdoor attacks are found to be effective against robust machine learning models trained with PGD.
problem Injecting and defending against backdoor attacks in robust machine learning models.
method Study and detection of backdoor attacks on PGD-trained robust models using feature clustering.
result AEGIS effectively detects PGD-trained robust DNNs infected with backdoors with 91.6% accuracy.
Guarantees recovery of compressible signals from adversarial noise.
problem Recovering compressible signals from noise and adversarial attacks.
method Extends adversarial defense framework to ℓ0, ℓ2, and ℓ∞ norms. result Recovery guarantees for various signal recovery methods under different noise types.
BUZz defends images from adversarial attacks using simple transformations.
problem Adversarial attacks on deep neural networks for image classification.
method Combination of deep neural networks and simple image transformations.
result Achieves significant improvement over state-of-the-art defenses with a modest drop in clean accuracy.
To accelerate research on adversarial examples and robustness of machine learning classifiers, Google Brain organized a NIPS 2017 competition that encouraged researchers to develop new methods to generate adversarial examples as well as to develop new ways to defend against them. In this chapter, we describe the struct…