New flaw found in SAP defense, reducing its effectiveness to 0.1%.
problem Weakness in Stochastic Activation Pruning defense against adversarial attacks.
method Re-examined the implementation of SAP and introduced a new BPDA attack.
result SAP's effectiveness reduced to 0.1% when properly applied.
It has been shown that adversaries can craft example inputs to neural networks which are similar to legitimate inputs but have been created to purposely cause the neural network to misclassify the input. These adversarial examples are crafted, for example, by calculating gradients of a carefully defined loss function w…
New method makes deep nets more robust to attacks without increasing training time.
problem Gradient obfuscation makes models vulnerable to stronger attacks.
method Local linearization regularizer to penalize non-linearity in loss surface.
result Models trained with regularizer achieve 47% adversarial accuracy on ImageNet.
This paper detects function-level obfuscation in binary code using graph-based methods.
problem Detecting and characterizing function-level obfuscation in binary code.
method Graph-based approaches, including GNNs, are compared on various datasets.
result GNNs outperform baselines in function-level obfuscation detection, especially in a 11-class classification task.
Paper proposes a framework to identify and obfuscate sensitive features via information density estimation.
problem Identifying and protecting sensitive attributes from leakage in obfuscation mechanisms.
method Information density estimation to identify leaking features, followed by a targeted obfuscation mechanism.
result Proven leakage guarantee in terms of Eγ-divergence for the obfuscation mechanism. New method detects malware through obfuscation using adversarial risk analysis.
problem Insufficient malware detection in obfuscated binaries.
method Hybrid framework and adversarial risk analysis.
result Improved detection of malware through obfuscation.
We inject undetectable backdoors into obfuscated neural networks and language models.
problem Safeguarding models from sophisticated adversarial attacks.
method Developed a strategy to plant undetectable backdoors in obfuscated neural networks and language models.
result Undetectable backdoors can be planted in obfuscated models, even if weights and architecture are accessible.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
New input gradient regularization improves adversarial robustness efficiently.
problem Improving adversarial robustness in machine learning models.
method Derive robustness bounds, implement scaleable input gradient regularization, avoid double backpropagation.
result Input gradient regularization is competitive with adversarial training and avoids gradient obfuscation.
The goal of homomorphic encryption is to encrypt data such that another party can operate on it without being explicitly exposed to the content of the original data. We introduce an idea for a privacy-preserving transformation on natural language data, inspired by homomorphic encryption. Our primary tool is {\em obfusc…
Develops a framework to obfuscate sensitive attributes in machine learning models.
problem Minimizing information leakage of sensitive attributes in crowdsourced data.
method Proposes a minimax optimization formulation and proves an information-theoretic lower bound.
result Adversarial learning achieves the best trade-off between attribute obfuscation and accuracy.
SONet stabilizes ODE networks for robustness without adversarial training.
problem Improving adversarial robustness of neural networks without sacrificing natural accuracy.
method SONet uses skew-symmetric ODE blocks and DOPRI5 solver for robustness.
result SONet achieves comparable robustness to adversarial defense methods without trade-off.
We consider the problem of obfuscating sensitive information while preserving utility, and we propose a machine learning approach inspired by the generative adversarial networks paradigm. The idea is to set up two nets: the generator, that tries to produce an optimal obfuscation mechanism to protect the data, and the c…
Paper presents a lightweight, unobtrusive method to protect edge device data privacy.
problem Protecting inference data privacy in IoT edge devices with limited compute power.
method A lightweight neural network at edge devices to obfuscate inference data without indicating obfuscation.
result Effectively protects inference data confidentiality while preserving backend accuracy.
The paper explores maximal perturbations to hide certain attributes in data while keeping the model's performance intact.
problem Protecting sensitive attributes from both model and human detection.
method Adversarial perturbations applied to raw data to conditionally damage model's classification of one attribute while preserving the rest.
result Maximal perturbations can hide certain attributes from both model and human detection, impacting model performance but not human perception.
Improves code2vec for Java classes by obfuscating variable names.
problem Code2vec's reliance on variable names makes it vulnerable to typos and attacks.
method Obfuscate variable names during code2vec training and aggregate method embeddings for class-level predictions.
result Obfuscated variable names improve model's robustness and accuracy.
Deep neural networks require large amounts of resources which makes them hard to use on resource constrained devices such as Internet-of-things devices. Offloading the computations to the cloud can circumvent these constraints but introduces a privacy risk since the operator of the cloud is not necessarily trustworthy.…
Deep learning models misclassify malware with added benign features.
problem Detecting malware with deep learning when it's mixed with benign code.
method Trained a deep neural network classifier using benign and malware features. Demonstrated the impact of adding benign features to malware. Used data augmentation to improve classifier robustness.
result Adding benign features to malware significantly increases false negatives.
LLMs detect market patterns through causal reasoning, not just temporal association.
problem Detecting structural market patterns in financial data.
method Obfuscation testing using the WHO-WHOM-WHAT framework.
result LLMs achieve 71.5% detection rate of market patterns without temporal context.
Paper discusses privacy issues in IoT and proposes a lightweight neural network approach.
problem Privacy concerns in IoT due to extensive data collection and processing.
method Developed a privacy-preserving inference approach for IoT objects and a deep neural network in the cloud.
result Satisfactory performance of the proposed approach on the MNIST dataset.
New approaches improve adversarial robustness of DEQs.
problem Adversarial vulnerability of DEQs.
method Developed approaches to estimate intermediate gradients and integrate them into attacking pipelines.
result Demonstrated adversarial robustness of DEQs competitive with deep networks.
NKI integrates obfuscated datasets using nonlinear kernels for improved data collaboration.
problem Privacy-preserving data collaboration with reduced reconstruction risk.
method Formulates linear kernel integration, kernelizes it, and introduces graph regularization and centering constraints.
result NKI improves classification accuracy over existing linear integration methods under nonlinear dimensionality reduction.
New mechanisms from primate vision improve neural network robustness.
problem Demonstrating robust neural networks to small adversarial perturbations.
method Investigated two biologically plausible mechanisms: non-uniform retina sampling and receptive field diversity.
result Non-uniform retina sampling and receptive field diversity improve adversarial robustness.
This work enhances collaborative inference privacy by minimizing conditional entropy and boosting robustness against model inversion attacks.
problem Privacy leakage in collaborative inference systems via model inversion attacks.
method Theoretical proof and derivation of a differentiable measure for bounding conditional entropy, followed by a CEM algorithm to maximize it.
result Theoretical proof and experimental validation show that CEM consistently boosts inversion robustness without compromising feature utility or efficiency.
Paper presents faster, robust adversarial training methods.
problem Increasing neural network robustness against adversarial attacks.
method Integrates FGSM with Pixelwise Noise Injection Layer (PNIL) and uniform noise.
result Achieves comparable results to PGD-based adversarial training but faster.
Paper proposes DP-SGD and DP-NSGD for differentially private non-convex optimization.
problem Mitigating privacy risks in large model learning.
method Clip or normalize per-sample gradients and add noise for differential privacy.
result Achieved convergence rate of gradient norm for non-convex optimization.
RENNs protect input privacy by rotating d-ary features.
problem Protecting input privacy from intermediate-layer features.
method Rotation-equivariant neural networks using d-ary vectors/tensors.
result RENNs effectively hide input information without degrading output accuracy.
Additive noise protects privacy in releasing datasets for SVM classification.
problem Maintaining privacy in releasing datasets for SVM classification.
method Additive noise applied to obfuscate the dataset, optimizing privacy and utility measures.
result Optimal noise distribution ensures close classifier performance between original and obfuscated datasets, achieving local differential privacy.
Paper defends sensitive attributes in GNNs from inference attacks.
problem Protecting sensitive attributes in GNNs from inference attacks.
method Proposes adversarial training with TV and Wasserstein distance to locally filter sensitive attributes.
result Framework creates strong defense against inference attacks with minimal performance loss.
A new method improves adversarial robustness and interpretability with reduced training time.
problem Adversarial attacks on deep neural networks.
method A novel regularizer incorporating first and second order information via a quadratic approximation to the adversarial loss.
result Single iteration of the proposed regularizer achieves stronger robustness than prior methods.
Paper finds exact Hessian sharpness in deep matrix factorization.
problem Understanding the geometry of loss landscapes in deep matrix factorization.
method Presented the first exact expression for Hessian maximum eigenvalue.
result Spectral-norm balance is a sufficient condition for flatness in deep matrix factorization.
Paper proposes a method to encrypt faces while maintaining visual similarity.
problem Protecting personal data from unauthorized face recognition.
method Targeted identity-protection iterative method (TIP-IM) to generate adversarial identity masks.
result TIP-IM provides 95%+ protection success rate against face recognition models.
Deep Neural Networks (DNNs) have recently led to significant improvements in many fields. However, DNNs are vulnerable to adversarial examples which are samples with imperceptible perturbations while dramatically misleading the DNNs. Moreover, adversarial examples can be used to perform an attack on various kinds of DN…
ADAPT improves robustness of Vision Transformers without full model fine-tuning.
problem Vulnerability of Vision Transformers to adversarial attacks.
method Parameter-efficient prompt tuning with ADAPT framework for adaptive adversarial training.
result ADAPT achieves robust accuracy of ~40% w.r.t. SOTA methods using only ~1% of the parameters.
Paper proposes an ensemble of attacks to evaluate adversarial robustness more reliably.
problem Insufficient evaluation of adversarial defenses leads to incorrect robustness assessments.
method Developed two extensions of PGD-attack and combined them with two complementary attacks.
result Identified several broken defenses with lower robust test accuracy than reported.
Transform images with adversarial examples for robust classification.
problem Adversarial examples mislead deep neural networks in image classification.
method Transform input images with adversarial examples from a pre-trained model.
result Significantly more robust against a wide range of attacks compared to state-of-the-art methods.
The paper addresses learner privacy in convex optimization with feedback.
problem Privacy risks from eavesdropping adversaries observing learner's queries.
method Optimally obfuscating learner's queries to make their learned optimal value hard to estimate.
result Query complexity overhead is additive in L in the minimax formulation, multiplicative in L in the Bayesian formulation. Simplifies fair PCA with fast, efficient solution.
problem Learning fair low-rank approximations of data.
method Conceptually simple approach with analytic solution.
result Faster and similar results to existing fair PCA methods.
Generative Adversarial Network purifies images from steganography without degrading quality.
problem Destruction of image steganography while maintaining visual quality.
method Generative Adversarial Network (GAN) optimized for steganography destruction.
result High rate of steganographic content destruction with minimal visual quality degradation.
The authors seek financial datasets to benchmark feature engineering methods on US market data.
problem Improving predictive models for financial data science competitions.
method Feature engineering methods applied to multivariate time-series data from the US market.
result Predictive power of models tested against Numerai-Signals targets.
With the celebrated success of deep learning, some attempts to develop effective methods for detecting malicious PowerShell programs employ neural nets in a traditional natural language processing setup while others employ convolutional neural nets to detect obfuscated malicious commands at a character level. While the…
Recurrent neural networks (RNNs) are powerful constructs capable of modeling complex systems, up to and including Turing Machines. However, learning such complex models from finite training sets can be difficult. In this paper we empirically show that RNNs can learn models of computer peripheral devices through input a…
Origami uses SGX enclaves and blinding to protect deep neural network inference privacy.
problem Protecting deep neural network inference privacy in machine learning services.
method Combines enclave execution, cryptographic blinding, and accelerator-based computation.
result Demonstrates improved privacy-preserving inference performance compared to prior work.
Masked LARk prevents cross-site tracking while training models.
problem Cross-site tracking of user data through third-party cookies.
method Secure multi-party compute (MPC) protocol with masking.
result Prevents cross-site tracking and maintains model training flexibility.
Identifying meaningful signal buried in noise is a problem of interest arising in diverse scenarios of data-driven modeling. We present here a theoretical framework for exploiting intrinsic geometry in data that resists noise corruption, and might be identifiable under severe obfuscation. Our approach is based on uncov…
MatchGNet detects malware by learning program behavior graphs.
problem Malware evasion through obfuscation and high false positives in traditional detection methods.
method Heterogeneous Graph Matching Network model that learns graph representation and similarity metrics.
result MatchGNet reduces false positives by 50% while maintaining zero false negatives.
Clustering algorithms have been increasingly adopted in security applications to spot dangerous or illicit activities. However, they have not been originally devised to deal with deliberate attack attempts that may aim to subvert the clustering process itself. Whether clustering can be safely adopted in such settings r…
Secure neural network inference on untrusted platforms using holographic reduced representations.
problem Secure neural network inference on untrusted platforms.
method Connectionist Symbolic Pseudo Secrets using Holographic Reduced Representations (HRR).
result Empirical robustness to attack under various threat models.