Free adversarial training reduces the generalization gap compared to vanilla method.
problem Improving generalization in adversarial training.
method Analysis of algorithmic stability in free adversarial training.
result Free adversarial training shows a lower generalization gap.
Detects adversarial examples using SHAP values from neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Uses SHAP values from internal layers to distinguish normal from adversarial inputs.
result Demonstrates high detection accuracy and strong generalization to various attack methods.
We propose a novel technique to make neural network robust to adversarial examples using a generative adversarial network. We alternately train both classifier and generator networks. The generator network generates an adversarial perturbation that can easily fool the classifier network by using a gradient of each imag…
TEAM uses Taylor expansion to generate adversarial examples.
problem Vulnerability of deep neural networks to adversarial examples.
method Approximates DNN output using Taylor expansion and optimizes with Lagrange multiplier method.
result Improves robustness of DNNs through adversarial training.
Paper generates diverse, readable adversarial texts from scratch.
problem Text classification models are easily fooled by adversarial examples.
method Trained a conditional variational autoencoder (VAE) with adversarial loss and utilized GANs to generate consistent adversarial texts.
result Successfully generates adversarial texts with higher success rate and acceptable quality.
Proposes a probabilistic method for generating semantically-aware adversarial examples.
problem Generating adversarial examples that are difficult for humans to detect while preserving semantics.
method Embeds subjective understanding of semantics as a distribution into adversarial example generation.
result Achieves higher success rates in circumventing adversarial defense mechanisms.
New method improves DNN robustness against adversarial attacks.
problem Adversarial vulnerability of neural networks.
method Enforcing linearity in DNN in transformed input and feature space, and augmenting with Local Lipschitz regularizer.
result Significantly improved robustness of DNN models on various datasets.
A new efficient PGD method generates smaller perturbation adversarial examples.
problem Adversarial examples in deep neural networks.
method Modified Project Gradient Descent (PGD) method for ensemble models.
result Generates smaller perturbation adversarial examples than PGD method.
A new method reduces adversarial training time without overfitting.
problem Catastrophic overfitting in single-step adversarial training.
method FGSMPR: FGSM with PGD Regularization.
result Reduces the gap to multi-step adversarial training.
By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversa…
As adversarial attacks pose a serious threat to the security of AI system in practice, such attacks have been extensively studied in the context of computer vision applications. However, few attentions have been paid to the adversarial research on automatic path finding. In this paper, we show dominant adversarial exam…
Generative models create indistinguishable adversarial objects for object detection.
problem Creating unrestricted adversarial examples for object detection.
method Search over latent space of GAN for adversarial objects.
result Generated adversarial objects are indistinguishable from non-adversarial objects and transferable.
New method generates realistic adversarial images with smaller perturbations.
problem Generating realistic adversarial images with small perturbations.
method Imposes spatial distortions (scaling, rotation, shear, translation) in addition to perturbations.
result Produces visually more realistic attacks that deceive classifiers without affecting human predictions.
Simple regularization methods mimic adversarial training's robustness.
problem Expensive adversarial training for robustness.
method Label smoothing and logit squeezing.
result Achieves strong adversarial robustness without adversarial examples.
We propose a method to generate audio adversarial examples that can attack a state-of-the-art speech recognition model in the physical world. Previous work assumes that generated adversarial examples are directly fed to the recognition model, and is not able to perform such a physical attack because of reverberation an…
TEAM generates more powerful adversarial examples for DNNs.
problem Vulnerability of DNNs to imperceptible adversarial examples.
method TEAM uses Taylor expansion and Lagrangian multiplier method to craft adversarial examples.
result TEAM generates adversarial examples with 100% attack success rate using smaller perturbations.
mFI-PSO generates effective adversarial images for DNNs.
problem Vulnerability of DNNs to small perturbations in images.
method Uses mFI for pixel selection and PSO for objective functions.
result mFI-PSO effectively designs flexible adversarial images.
One popular hypothesis of neural network generalization is that the flat local minima of loss surface in parameter space leads to good generalization. However, we demonstrate that loss surface in parameter space has no obvious relationship with generalization, especially under adversarial settings. Through visualizing …
Paper proposes a method to detect adversarial examples that can resist norm-constrained attacks.
problem Vulnerabilities of deep neural networks to adversarial examples in sensitive domains.
method Train K binary classifiers to distinguish between clean data and adversarially perturbed samples, use at test time to classify inputs.
result Proposed method can resist norm-constrained white-box attacks.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
Machine learning models, especially based on deep architectures are used in everyday applications ranging from self driving cars to medical diagnostics. It has been shown that such models are dangerously susceptible to adversarial samples, indistinguishable from real samples to human eye, adversarial samples lead to in…
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less Lp norm distortion compared to non-local counterparts. Paper generates natural adversarial examples for hyperspectral data.
problem Creating adversarial examples for black-box models.
method Modified Wasserstein GAN reweights true data distribution.
result Successfully generates adversarial hyperspectral signatures.
In recent years, neural networks have demonstrated outstanding effectiveness in a large amount of applications.However, recent works have shown that neural networks are susceptible to adversarial examples, indicating possible flaws intrinsic to the network structures. To address this problem and improve the robustness …
Adversarial examples are typically constructed by perturbing an existing data point within a small matrix norm, and current defense methods are focused on guarding against this type of attack. In this paper, we propose unrestricted adversarial examples, a new threat model where the attackers are not restricted to small…
Adversarial training makes models more vulnerable to privacy attacks.
problem Privacy attacks on robust models become feasible.
method Demonstrated through model inversion attacks on robustly trained models.
result Privacy attacks on robust models are now feasible.
Recently, deep neural networks have significant progress and successful application in various fields, but they are found vulnerable to attack instances, e.g., adversarial examples. State-of-art attack methods can generate attack images by adding small perturbation to the source image. These attack images can fool the …
This paper explores how the generalization of substitute classifiers affects the success of black-box adversarial attacks.
problem Understanding the factors driving the transferability of black-box adversarial examples.
method Max-min adversarial example game framework and theoretical generalization bounds.
result Substitute NN with better generalization behavior results in more transferable adversarial examples.
New method for bidirectional generative modeling using adversarial gradient estimation.
problem Bidirectional generative modeling with various f-divergences. method Adversarial gradient estimation for f-divergence optimization. result Similar algorithms for different f-divergences with varying scaling. Researchers create adversarial examples to deceive iris recognition systems.
problem Tackling the vulnerability of iris recognition systems to adversarial attacks.
method Developed a deep auto-encoder surrogate network to generate adversarial examples for iris recognition systems.
result Demonstrated that adversarial examples can fool iris recognition systems in both white-box and black-box settings.
It has been observed that deep learning architectures tend to make erroneous decisions with high reliability for particularly designed adversarial instances. In this work, we show that the perturbation analysis of these architectures provides a framework for generating adversarial instances by convex programming which,…
Study non-asymptotic bounds for robust estimators under misspecified models.
problem Evaluate performance of robust estimators under adversarial conditions.
method Propose a general approach to adversarial risk analysis, including investigations on generalization and approximation errors.
result Establish non-asymptotic upper bounds for adversarial excess risk under Lipschitz loss functions.
Adversarial training improves graph autoencoder generalization.
problem Improving graph autoencoder generalization.
method Formulated L2 and L1 adversarial training for graph autoencoders and variational graph autoencoders.
result Adversarial training boosts graph autoencoder and variational graph autoencoder generalization.
Survey of adversarial examples in visual machine learning models.
problem Vulnerability of machine learning models to adversarial examples.
method Exploration of various adversarial attack and defense methods.
result Understanding of adversarial attack and defense mechanisms.
Adaptive framework generates challenging adversarial scenarios for autonomous vehicles.
problem Lack of efficient and adaptable evaluation methods for autonomous vehicles.
method Adaptive evaluation framework using ensemble models and nonparametric Bayesian clustering.
result Adversarial scenarios significantly degrade tested autonomous vehicles' performance.
Generative models for complex stochastic dynamics using adversarial learning.
problem Data-driven modeling of multistep stochastic dynamics.
method Adversarial learning with GANs and MMD for stable model classes.
result Stable generative models for long-time prediction and stochastic systems.
New method creates powerful, transferable adversarial attacks for deep learning networks.
problem Vulnerability of deep learning networks to adversarial attacks.
method Developed a method to generate strong, transferable adversarial attacks.
result Demonstrated that the proposed method can easily transfer strong adversarial attacks between different models.
This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
Interpolated adversarial training improves robustness without sacrificing accuracy.
problem Improving adversarial robustness without degrading generalization performance.
method Interpolated adversarial training using interpolation-based methods.
result Retains adversarial robustness while achieving a standard test error of 6.45%.
The paper analyzes how generated data improves adversarial training in high-dimensional regression.
problem Improving adversarial training in high-dimensional regression.
method Theoretical analysis of a two-stage training approach with generated data and pseudo-labels.
result Two-stage adversarial training achieves better performance than ridgeless training in high-dimensional linear regression.
Method generates adversarial examples to improve classifier robustness.
problem Addressing adversarial examples in machine learning.
method MDL principle for generating adversarial examples.
result Evasion rate of 78.24% for adversarial examples compared to 8.16% for original malware.
We present heuristics for solving the maximin problem induced by the generative adversarial privacy setting for linear and convolutional neural network (CNN) adversaries. In the linear adversary setting, we present a greedy algorithm for approximating the optimal solution for the privatizer, which performs better as th…
AdvFlow generates imperceptible adversarial images using normalizing flows.
problem Adversarial attacks on deep learning classifiers.
method Normalizing flows to model adversarial examples.
result Generated adversaries closely follow clean data distribution, making them harder to detect.
Adversarial samples are perturbed inputs crafted to mislead the machine learning systems. A training mechanism, called adversarial training, which presents adversarial samples along with clean samples has been introduced to learn robust models. In order to scale adversarial training for large datasets, these perturbati…
Adversarial training provides a principled approach for training robust neural networks. From an optimization perspective, adversarial training is essentially solving a bilevel optimization problem. The leader problem is trying to learn a robust classifier, while the follower problem is trying to generate adversarial s…
Adversarial examples are maliciously tweaked images that can easily fool machine learning techniques, such as neural networks, but they are normally not visually distinguishable for human beings. One of the main approaches to solve this problem is to retrain the networks using those adversarial examples, namely adversa…
Paper proposes a method to generate adversarial perturbations for black-box attacks without accessing inner states.
problem Generating adversarial perturbations for black-box attacks without accessing inner states of a DNN.
method Matrix-free generation method that requires fewer query trials.
result The proposed method successfully deceives a DNN for semantic segmentation more effectively than random noise.
In this paper we present a method for learning a discriminative classifier from unlabeled or partially labeled data. Our approach is based on an objective function that trades-off mutual information between observed examples and their predicted categorical class distribution, against robustness of the classifier to an …