Paper tackles adversarial attacks on A3C path finding, proposing Gradient Band-based Adversarial Training.
problem Adversarial attacks on A3C path finding.
method Gradient Band-based Adversarial Training with CDG method.
result Gradient Band-based Adversarial Training achieves high attack immunity.
Lazy neural networks are vulnerable to adversarial attacks.
problem Adversarial robustness issues in lazy training models.
method Extending recent work on adversarial examples to lazy training models.
result Over-parametrized neural networks that generalize well remain vulnerable to single-step gradient ascent attacks.
This paper characterizes adversarial examples in deep learning.
problem Security threats posed by adversarial attacks in deep learning systems.
method Statistical characterization of adversarial examples, easy and hard categorization of attacks, extensive experimental study.
result Adversarial attacks behave differently under different hyperparameters and frameworks.
Method analyzes deep neural network activations to explain adversarial examples.
problem Difficulty in interpreting deep neural network representations.
method Persistent homology over graphical activation structure.
result Adversarial examples are not semantic structure additions but dominant activation structure alterations.
Adversarial training makes models more vulnerable to privacy attacks.
problem Privacy attacks on robust models become feasible.
method Demonstrated through model inversion attacks on robustly trained models.
result Privacy attacks on robust models are now feasible.
This work studies adversarial transferability and proposes ensemble methods to improve robustness.
problem Adversarial transferability in neural networks and its implications for robustness.
method Investigates the effect of various factors on adversarial transferability and proposes ensemble attack methods.
result Transferability is significantly hampered by input quantization and architectural mismatch, but not by initialization.
New algorithm reduces bandit regret by graph domination number.
problem Adversarial multi-armed bandit with partial observations and switching costs.
method New algorithm with improved policy regret bounds.
result Regret depends only on the domination number of the feedback graph.
Empirical study on SGD hyperparameters and adversarial robustness.
problem Effect of SGD hyperparameters on adversarial robustness and generalization.
method Empirical observation of learning rate, batch size, and momentum effects on adversarial robustness and generalization.
result Constant learning rate to batch size ratio leads to good generalization and almost constant adversarial robustness.
Defends against strategic data manipulation in machine learning.
problem Adversaries can tamper with datasets to influence learning outcomes.
method Uses multiple learners and strategic activation to counteract attacks.
result Demonstrates effectiveness of a game-theoretic approach to defense.
Light-based attacks can misclassify images without altering physical objects.
problem Physical attacks on deep learning classifiers are limited by the ability to modify inputs directly.
method Constructs an experimental setup with a light projection source, object, and camera. Uses differential evolution to select light patterns.
result Projected light can degrade classification accuracy from 98% to 22% for 2D objects and from 89% to 43% for 3D objects.
Paper introduces a new method to create adversarial examples against gradient-obfuscating defenses.
problem Crafting adversarial examples to fool gradient-obfuscating defenses.
method Stochastic Substitute Training (SST), a gray-box approach.
result Adversaries can create adversarial examples without knowledge or limited information about the defense.
Method identifies over-optimized adversarial examples using IQR-based logit thresholding.
problem Over-optimized adversarial examples are hard to detect due to model optimization.
method IQR-based logit thresholding method for identifying over-optimized adversarial examples.
result The logits of the model are more useful in detecting over-optimized adversarial examples.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
With rapid progress and significant successes in a wide spectrum of applications, deep learning is being applied in many safety-critical environments. However, deep neural networks have been recently found vulnerable to well-designed input samples, called adversarial examples. Adversarial examples are imperceptible to …
Enhances single-step adversarial training to defend against iterative adversarial examples.
problem Defending against iterative adversarial examples in neural networks.
method Identified and leveraged empirical properties of Iter-Adv to improve Single-Adv.
result Enhanced Single-Adv to defend against iterative adversarial examples with improved accuracy and reduced training cost.
This paper creates imperceptible, effective audio adversarial examples for speech recognition.
problem Current adversarial examples in speech recognition are easily detectable and ineffective in real-world settings.
method Developed imperceptible audio adversarial examples using psychoacoustic masking and simulated environmental distortions.
result Successfully created imperceptible, targeted adversarial examples for speech recognition that are effective in real-world settings.
Study vortex flows on Riemann surfaces, proving dominated splitting and Anosov properties.
problem Investigate flow properties on Riemann surfaces.
method Associate flow to vortex equations, investigate properties of flow.
result Show that flow always admits a dominated splitting and identify special cases of Anosov flow.
Gödel's sentence is an adversarial example but unsolvable.
problem The existence and unsolvability of adversarial examples.
method Analysis of non-isomorphic natural explanations and computability theory.
result Gödel's sentence is an adversarial example that cannot be solved.
Survey of adversarial examples in visual machine learning models.
problem Vulnerability of machine learning models to adversarial examples.
method Exploration of various adversarial attack and defense methods.
result Understanding of adversarial attack and defense mechanisms.
Steganalysis improves detection of adversarial examples.
problem Detecting adversarial examples from deep neural networks.
method Enhancing steganalysis features by estimating adversarial attack probabilities.
result The method accurately detects adversarial examples and resists secondary attacks.
This paper explains adversarial examples as feature redundancy abuse.
problem Understanding and mitigating adversarial examples in machine learning.
method Information-theoretic model to explain adversarial attacks.
result Feature redundancy is necessary for adversarial examples.
New method defends against both single-step and iterative adversarial examples.
problem Defending against adversarial examples, especially iterative ones, is computationally expensive.
method Single-Step Adversarial Training (SST) with modifications.
result Our method outperforms state-of-the-art methods in both accuracy and training time.
Proposes BATer for improved adversarial example detection.
problem Detecting adversarial examples in neural networks.
method Introduces a Bayesian adversarial example detector (BATer) using random components in a Bayesian neural network.
result BATer outperforms state-of-the-art detectors in adversarial example detection.
Enhances adversarial example transferability by fine-tuning existing examples.
problem Adversarial examples are often overfit to a source model, limiting black-box transferability.
method Intermediate Level Attack (ILA) fine-tunes adversarial examples on a pre-specified layer of the source model.
result ILAs achieve high transferability to target models without knowledge of their architecture.
GanDef uses GANs to defend against adversarial examples in neural networks.
problem Defending against adversarial examples in neural networks.
method GAN-based adversarial training defense using a competition game to regulate feature selection.
result GanDef trains a classifier to defend against adversarial examples with high accuracy.
This paper explores how temporal dependency in audio data can improve robustness against adversarial examples.
problem Mitigating adversarial examples in audio data.
method Exploiting temporal dependency to gain discriminative power against audio adversarial examples.
result Temporal dependency can be used to resist adaptive attacks on audio adversarial examples.
Proposes a probabilistic method for generating semantically-aware adversarial examples.
problem Generating adversarial examples that are difficult for humans to detect while preserving semantics.
method Embeds subjective understanding of semantics as a distribution into adversarial example generation.
result Achieves higher success rates in circumventing adversarial defense mechanisms.
Simple regularization methods mimic adversarial training's robustness.
problem Expensive adversarial training for robustness.
method Label smoothing and logit squeezing.
result Achieves strong adversarial robustness without adversarial examples.
Paper proposes a method to detect adversarial examples that can resist norm-constrained attacks.
problem Vulnerabilities of deep neural networks to adversarial examples in sensitive domains.
method Train K binary classifiers to distinguish between clean data and adversarially perturbed samples, use at test time to classify inputs.
result Proposed method can resist norm-constrained white-box attacks.
Detects adversarial examples using SHAP values from neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Uses SHAP values from internal layers to distinguish normal from adversarial inputs.
result Demonstrates high detection accuracy and strong generalization to various attack methods.
CCAT improves model robustness to various adversarial attacks.
problem Robustness to adversarial attacks does not generalize to unseen threat models.
method CCAT biases models towards low confidence predictions on adversarial examples.
result CCAT increases robustness against multiple adversarial attack norms and types.
Study shows AmI attacks are not robust to adversarial examples.
problem Robustness of AmI attacks to adversarial examples.
method Evaluation of AmI attacks on adversarial examples.
result AmI attacks are not robust to adversarial examples.
A two-step defense method generates strong adversarial examples at low cost.
problem Vulnerability of deep neural networks to adversarial attacks.
method Develops a two-step defense approach that generates strong adversarial examples using FGSM at a lower computational cost compared to traditional multi-step adversarial training.
result Demonstrates effectiveness of the two-step defense approach against various attack methods with comparable robustness to traditional multi-step adversarial training.
This paper proposes SPT to generate diverse and transferable adversarial examples.
problem Limitations of recent adversarial examples in diversity and transferability.
method Structure-preserving transformation (SPT) to generate natural and diverse adversarial examples.
result Adversarial examples generated by SPT transfer well to other models with high success rate.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
Approach generates adversarial text examples for robustness testing.
problem Measuring and improving the robustness of text classifiers.
method Reinforcement learning in a black-box setting.
result Successfully fools trained models with high success rates.
TEAM uses Taylor expansion to generate adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Approximates DNN output using Taylor expansion and optimizes with Lagrange multiplier method.
result Improves robustness of DNNs through adversarial training.
Geometric analysis reveals how adversarial examples arise from model boundaries.
problem Adversarial examples cause misclassifications in machine learning models.
method Geometric framework using manifold reconstruction tools.
result Adversarial examples are a consequence of model boundaries on low-dimensional data manifolds.
Enhances adversarial examples for better transferability across models.
problem Adversarial examples often have limited black-box transferability.
method Fine-tunes existing adversarial examples by increasing perturbation on a pre-specified layer of the source model.
result Our method achieves greater black-box transferability of adversarial examples.
Study on adversarial examples and defenses for malware classification.
problem Vulnerability of neural networks to adversarial examples in malware classification.
method Analysis of different approaches for crafting adversarial examples and defense techniques in malware domain.
result Comparison of effectiveness of different approaches on multiple datasets.
Paper shows softmax output misleads in evaluating adversarial example strength.
problem Softmax output misleads in evaluating adversarial example strength.
method Demonstrates how adversarial examples can exploit softmax properties.
result Softmax output is a poor indicator of adversarial example strength.
This paper shows excessive invariance in adversarial robust models can make them more vulnerable to certain types of attacks.
problem Excessive invariance in adversarial robust models can make them more vulnerable to certain types of attacks.
method Analytical constructions and empirical studies of vision classifiers with state-of-the-art robustness to perturbation-based adversaries constrained by an ℓp norm. result Robustness to perturbation-based adversarial examples does not guarantee general robustness and can increase vulnerability to invariance-based adversarial examples.
Method generates audio attacks resistant to reverberation and noise.
problem Physical attacks on speech recognition models.
method Simulates playback and recording transformations to generate robust adversarial examples.
result Adversarial examples can attack speech recognition without being noticed by humans.
This paper explores how the generalization of substitute classifiers affects the success of black-box adversarial attacks.
problem Understanding the factors driving the transferability of black-box adversarial examples.
method Max-min adversarial example game framework and theoretical generalization bounds.
result Substitute NN with better generalization behavior results in more transferable adversarial examples.
The paper connects higher order risk measures and stochastic dominance, showing their equivalence and integrating them with optimization.
problem Comparing and characterizing random outcomes in risk assessment.
method Exploring the equivalence between higher order risk measures and stochastic dominance, using stochastic optimization and expectiles as examples.
result Higher order risk measures and stochastic dominance are equivalent and can be used to characterize random outcomes.
Transform images with adversarial examples for robust classification.
problem Adversarial examples mislead deep neural networks in image classification.
method Transform input images with adversarial examples from a pre-trained model.
result Significantly more robust against a wide range of attacks compared to state-of-the-art methods.
A novel method to train networks from each other's adversarial examples to resist black-box attacks.
problem Machine learning models can be fooled by adversarial examples, especially in black-box attacks.
method Simultaneous adversarial training combining two networks to learn from each other's adversarial examples.
result The method improves the networks' resilience to black-box attacks.