A new fast adversarial attack finds minimal perturbations to change class.
problem Evaluating robustness of neural networks against adversarial attacks.
method White-box adversarial attack minimizing perturbation size.
result Outperforms or matches state-of-the-art attacks.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Meta learning can adapt fast but is vulnerable to adversarial attacks.
problem Vulnerability of meta learning to adversarial attacks.
method Formal definition of adversarial attacks unique to meta learning, proposing an attacking algorithm.
result Meta learning is vulnerable to adversarial attacks.
Paper analyzes adversarial attacks and defenses using game theory.
problem Unclear conditions for optimal attacks and defenses in adversarial learning.
method Game-theoretic framework with locally linear decision boundary model.
result Fast Gradient Method attack and Randomized Smoothing defense form a Nash Equilibrium.
New robustness attacks improve evaluation of neural networks.
problem Difficulty in evaluating robustness of neural networks.
method Gradient-based adversarial attacks that are more reliable and efficient.
result Developed attacks are more reliable and efficient than existing methods.
Recently, deep neural networks have significant progress and successful application in various fields, but they are found vulnerable to attack instances, e.g., adversarial examples. State-of-art attack methods can generate attack images by adding small perturbation to the source image. These attack images can fool the …
A fast method computes class-specific adversarial perturbations for deep networks.
problem Computing robust adversarial perturbations for deep networks.
method Linear function of weights, no training data, no hyper-parameters.
result Obtains 34% to 51% fooling rate on ImageNet, transfers across models.
This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
RayS attack improves hard-label adversarial attacks by reducing query complexity and identifying false robust models.
problem Challenges in hard-label adversarial attacks, especially in terms of effectiveness and efficiency.
method Reformulates continuous problem into discrete problem without gradient estimation and uses a fast check step to eliminate unnecessary searches.
result Significantly reduces the number of queries needed for hard-label attacks and identifies false robust models.
New adaptive attacks bypass many defenses to adversarial examples.
problem Adversarial example defenses are not adequately evaluated using adaptive attacks.
method Detailed analysis of thirteen defenses, demonstrating their vulnerabilities to adaptive attacks.
result Adversarial example defenses are more vulnerable to adaptive attacks than previously thought.
Simple technique turns any adversarial attack into a universal one using few test examples.
problem Creating universal adversarial attacks with minimal data.
method Universalization technique using few adversarial test examples and spectral properties.
result Simple universalization technique achieves comparable fooling rates to state-of-the-art methods.
Paper explores fast adversarial training to improve robustness with less computation.
problem Efficiently defending against adversarial examples.
method Integrates simple self-attacks for faster training, focusing on overfitting recovery.
result Shows superior robust accuracy with reduced training time compared to strong adversarial training.
Patch augmentation boosts neural network accuracy and robustness.
problem Improving neural network accuracy and robustness to adversarial attacks.
method Data augmentation technique creating new images by superimposing patches from image pairs.
result Significant accuracy improvements on CIFAR-10 and CIFAR-100 datasets.
Fast and stable domain adaptation method using low-rank subspaces.
problem Improving generalization across domain boundaries in unsupervised learning.
method Calculates a single domain invariant subspace in closed form using low-rank techniques.
result Remarkable performance across various domain adaptation tasks.
Classifiers fail to classify correctly input images that have been purposefully and imperceptibly perturbed to cause misclassification. This susceptability has been shown to be consistent across classifiers, regardless of their type, architecture or parameters. Common defenses against adversarial attacks modify the cla…
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
New study analyzes security of neural network data reconstruction attacks.
problem Data reconstruction attacks pose a threat to private training data.
method Analyzes security boundary of data reconstruction attacks via neuron exclusivity state.
result Characterizes insecure/secure boundary of data reconstruction attacks.
Machine Learning models are vulnerable to adversarial attacks that rely on perturbing the input data. This work proposes a novel strategy using Autoencoder Deep Neural Networks to defend a machine learning model against two gradient-based attacks: The Fast Gradient Sign attack and Fast Gradient attack. First we use an …
Paper tackles catastrophic overfitting in single-step adversarial training.
problem Catastrophic overfitting leads to sudden drop in robust accuracy.
method Proposes a method to prevent overfitting by using all adversarial examples.
result Demonstrates prevention of catastrophic overfitting and improves robustness.
The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision…
Fast algorithm solves BVPs in linear time with probabilistic uncertainty.
problem Solving boundary value problems efficiently and accurately.
method Gauss--Markov prior tailored to BVPs, linear-time computation.
result Probabilistic solution with linear time complexity and comparable quality.
Proposes a query-efficient blackbox attack method.
problem Adversarial attacks on machine learning models, especially deep neural networks.
method QEBA: Query-Efficient Boundary-based blackbox Attack, using only final prediction labels.
result QEBA achieves 100% attack success rate with fewer queries and lower perturbation.
Stochastic multi-armed bandits form a class of online learning problems that have important applications in online recommendation systems, adaptive medical treatment, and many others. Even though potential attacks against these learning algorithms may hijack their behavior, causing catastrophic loss in real-world appli…
This paper explores how facial recognition systems can be fooled by adversarial attacks.
problem Adversarial attacks on facial recognition systems.
method Applying Fast Gradient Sign Method and crafting various black-box attack algorithms.
result High levels of perturbation can significantly decrease classifier confidence and misclassification rates.
Adversarial examples are maliciously tweaked images that can easily fool machine learning techniques, such as neural networks, but they are normally not visually distinguishable for human beings. One of the main approaches to solve this problem is to retrain the networks using those adversarial examples, namely adversa…
The problem of spoofing attacks is increasingly relevant as digital systems are becoming more ubiquitous. Thus the detection of such attacks and the localisation of attackers have been objects of recent study. After an attack has been detected, various algorithms have been proposed in order to localise the attacker. In…
By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversa…
Robust ASR model removes fast-changing features to resist attacks.
problem Vulnerability of ASR systems to adversarial attacks.
method Removing fast-changing features using slow feature analysis or low-pass filtering.
result Hybrid ASR models are more than four times more robust against targeted attacks.
Study reveals how neural network smoothness affects their vulnerability to adversarial attacks.
problem Understanding adversarial vulnerability in deep learning networks.
method Analysis of manifold smoothness and generalization capability of deep neural networks trained with local errors.
result High generalization accuracy requires a fast power-law decay of eigen-spectrum of hidden representations.
Simple adaptive attacks can jailbreak state-of-the-art safety-aligned language models.
problem Vulnerability of safety-aligned language models to simple adaptive attacks.
method Designing adversarial prompt templates, random search on suffixes, and transfer/prefilling attacks.
result 100% attack success rate on various models including GPT-4, Vicuna, Mistral, and Claude.
Improved neural network robustness with instance-specific perturbation margins.
problem Adversarial training fails to generalize well to unperturbed test set.
method Instance adaptive adversarial training with sample-specific perturbation margins.
result Test accuracy improves with a marginal drop in robustness.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
Mixup improves model robustness and generalization by convexly combining examples.
problem Improving model robustness and generalization.
method Using Mixup augmentation in training, which involves convex combinations of pairs of examples and their labels.
result Mixup training helps models exhibit robustness to adversarial attacks and reduces overfitting.
Neural networks are vulnerable to adversarially-constructed perturbations of their inputs. Most research so far has considered perturbations of a fixed magnitude under some lp norm. Although studying these attacks is valuable, there has been increasing interest in the construction of (and robustness to) unrestricted…
ADAPT improves robustness of Vision Transformers without full model fine-tuning.
problem Vulnerability of Vision Transformers to adversarial attacks.
method Parameter-efficient prompt tuning with ADAPT framework for adaptive adversarial training.
result ADAPT achieves robust accuracy of ~40% w.r.t. SOTA methods using only ~1% of the parameters.
A new attack for probabilistic classifiers adapts to noise levels.
problem Adversarial examples can mislead probabilistic classifiers.
method Adapts HopSkipJump attack for probabilistic classifiers, adjusting queries based on noise levels.
result Decision-based attacks are effective against probabilistic classifiers, even with noise.
The state-of-the-art performance of deep learning algorithms has led to a considerable increase in the utilization of machine learning in security-sensitive and critical applications. However, it has recently been shown that a small and carefully crafted perturbation in the input space can completely fool a deep model.…
Adaptive Misinformation defends against model stealing attacks by sending incorrect predictions for OOD queries.
problem Model stealing attacks clone target models using black-box query access and a surrogate dataset.
method Selective sending of incorrect predictions for Out-Of-Distribution (OOD) queries to degrade attacker's clone model accuracy.
result Our defense reduces attacker's clone model accuracy by up to 40% while maintaining benign user accuracy under 0.5%.
A fast, accurate method for pricing American options with free boundaries.
problem Pricing American options with free boundaries efficiently and accurately.
method A sixth-order compact finite difference scheme with a dynamic staggered boundary scheme and 3(2) R-K Bogacki-Shampine time stepping.
result An efficient sixth-order compact scheme for pricing American options with free boundaries.
Researchers compute exact decision boundaries of neural networks.
problem Finding exact decision boundaries of trained neural networks is intractable.
method Developed mathematical tools to investigate decision boundaries of trained deep models.
result Some simplifying assumptions about decision boundaries are unreliable.
Neural networks are prone to adversarial attacks. In general, such attacks deteriorate the quality of the input by either slightly modifying most of its pixels, or by occluding it with a patch. In this paper, we propose a method that keeps the image unchanged and only adds an adversarial framing on the border of the im…
Efficient method defends deep learning models from adversarial attacks.
problem Vulnerability of deep learning models to adversarial attacks.
method Training a Denoising Autoencoder (DAE) to reduce data dimensions and serve as a defense.
result The method provides a 2.43x speedup while maintaining robustness against adversarial attacks.
A new algorithm reduces the cost of training robust deep neural networks.
problem High computational cost in training robust deep neural networks.
method Iterative descent-ascent algorithm based on saddle-point dynamical system.
result The algorithm converges to robust optimal solution under adversarial constraints.
Many machine learning algorithms are vulnerable to almost imperceptible perturbations of their inputs. So far it was unclear how much risk adversarial perturbations carry for the safety of real-world machine learning applications because most methods used to generate such perturbations rely either on detailed model inf…
AFD learns features resistant to adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method AFD learns features invariant to adversarial perturbations through a game of predictive and robust features.
result AFD effectively resists a wide range of attack types and strengths.
Study robustness of early-stopping GD for linear regression attacks.
problem Robustness of gradient-descent methods to adversarial attacks.
method Early-stopping strategies, gradient-descent, Mahalanobis attacks, feature-dependent learning rates, data transformations.
result Early-stopped GD is optimally robust to Euclidean-norm attacks but sub-optimal for Mahalanobis attacks.