Paper discusses imperceptible attacks on tabular data models.
problem Security of machine learning models on tabular data.
method Formalizes imperceptibility of adversarial attacks, proposes an approach to generate imperceptible adversarial examples.
result Demonstrates ability to generate imperceptible adversarial examples with high fooling rate.
TrISec generates imperceptible attacks without needing training data.
problem Imperceptible attacks on deep neural networks during inference.
method Back-propagation algorithm on pre-trained DNNs, training data-unaware.
result Generated attack images successfully misclassify without being noticeable.
CapsAttacks study imperceptible adversarial attacks on Capsule Networks, showing they can fool these networks.
problem Vulnerability of Capsule Networks to imperceptible adversarial attacks.
method Proposed a greedy algorithm for generating targeted imperceptible adversarial examples.
result Capsule Networks can be fooled by imperceptible adversarial attacks, similar to CNNs.
Localized uncertainty attacks target uncertain regions to create imperceptible adversarial examples.
problem Adversarial examples that are imperceptible to humans and strong under deterministic classifiers.
method Localized uncertainty attacks by perturbing uncertain regions, using predictive uncertainty or surrogate models.
result Localized uncertainty attacks produce strong adversarial examples that retain input similarity.
AdvFlow generates imperceptible adversarial images using normalizing flows.
problem Adversarial attacks on deep learning classifiers.
method Normalizing flows to model adversarial examples.
result Generated adversaries closely follow clean data distribution, making them harder to detect.
New technique hides adversarial attacks in complex images, making them imperceptible.
problem Lack of interpretability in Convolutional Neural Networks (CNNs) and vulnerability to adversarial attacks.
method Developed a technique that hides adversarial attacks in regions of high complexity, making them imperceptible to human observers.
result Significant evidence of concealment of adversarial attacks in images, making them imperceptible to human observers.
FineFool attacks deep models by focusing on object contours, improving attack performance.
problem Adversarial attacks on deep learning models, especially those that focus on perturbation size and success rate.
method FineFool uses attention to focus on object contours, producing more efficient and imperceptible perturbations.
result FineFool achieves better attack performance compared to state-of-the-art attacks, including higher success rate and smaller perturbations.
Simple attack bypasses state-of-the-art DNN watermarking.
problem Protecting DNN models from watermark removal attacks.
method Combining imperceptible pattern embedding and spatial-level transformations for a simple yet effective watermark removal.
result Our attack bypasses state-of-the-art watermarking solutions with high success rates.
Designing models that are robust to small adversarial perturbations of their inputs has proven remarkably difficult. In this work we show that the reverse problem---making models more vulnerable---is surprisingly easy. After presenting some proofs of concept on MNIST, we introduce a generic tilting attack that injects …
Paper proposes privacy-preserving learning for images, making them imperceptible to humans but recognizable by machines.
problem Conflict between developing AI systems and protecting sensitive training data.
method Encryption strategies (random shuffling and sub-patch mixing) followed by minimal adaptation to vision transformer.
result Achieves comparable accuracy to competitive methods while ensuring human-imperceptibility of encrypted images.
Study shows various pixel p-norm measures do not match human perception of adversarial attacks.
problem Understanding human perception of adversarial attacks on image classification systems.
method Performed a behavioral study comparing different p-norm measures and alternative metrics.
result Human perception of adversarial attacks does not align with pixel p-norm measures and other metrics.
3D point cloud attacks examine how neural networks can be fooled.
problem Understanding how 3D neural networks can be exploited by attackers.
method Examined two categories of attacks: distributional and shape attacks.
result Some shape attacks can fool 3D point cloud classification models even after preprocessing.
Proposes a deep diffusion watermarking framework for secure image processing.
problem Secure watermarking of deep neural networks in image processing.
method End-to-end training of two FCNNs with residual structure for embedding and extraction.
result Framework improves security and robustness with customizable trade-offs.
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to aug…
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
AdversarialPSO uses fewer queries to create high-success-rate adversarial examples.
problem Creating imperceptible adversarial examples with high success rates in black-box settings.
method AdversarialPSO, a black-box attack using Particle Swarm Optimization.
result Achieved high success rates (99.6% on CIFAR-10, 96.3% on MNIST, 82.0% on Imagenet) with fewer queries.
AI-GAN generates realistic adversarial examples efficiently.
problem Efficient generation of perceptually realistic adversarial examples.
method A joint training of a generator, discriminator, and attacker.
result Achieves high attack success rates and reduces generation time.
Efficient method defends deep learning models from adversarial attacks.
problem Vulnerability of deep learning models to adversarial attacks.
method Training a Denoising Autoencoder (DAE) to reduce data dimensions and serve as a defense.
result The method provides a 2.43x speedup while maintaining robustness against adversarial attacks.
MetaPoison poisons neural networks by learning to craft imperceptible changes to training data.
problem Data poisoning attacks on neural networks.
method MetaPoison uses meta-learning to approximate bilevel optimization for crafting poisons.
result MetaPoison outperforms previous methods and works in various scenarios.
New method defends against unseen threat models using perceptual adversarial training.
problem Lack of precise mathematical characterization of human perception in adversarial attacks.
method Adversarial training against the set of all imperceptible adversarial examples approximated by deep neural networks.
result Perceptual Adversarial Training (PAT) achieves state-of-the-art robustness against multiple diverse adversarial attacks.
PPD defends deep learning models against adversarial attacks using image permutations and Fourier phases.
problem Adversarial examples can mislead deep learning models.
method Combines random image permutation with Fourier phase components.
result Demonstrated state-of-the-art robustness against adversarial attacks.
FDA3 defends IIoT applications against adversarial attacks by federating defense knowledge.
problem Adversarial attacks on DNNs in IIoT applications can cause devastating consequences.
method Federated learning approach to aggregate defense knowledge from different sources.
result FDA3 can resist more attacks than existing methods and prevent new attacks.
TrojDRL shows reinforcement learning agents vulnerable to Trojan attacks.
problem Vulnerability of reinforcement learning agents to Trojan attacks.
method Data-poisoning and in-band reward modification to augment reinforcement learning policies.
result Policies can be imperceptibly modified to perform differently when a Trojan is triggered.
Machine learning systems based on deep neural networks, being able to produce state-of-the-art results on various perception tasks, have gained mainstream adoption in many applications. However, they are shown to be vulnerable to adversarial example attack, which generates malicious output by adding slight perturbation…
New attacks prevent both supervised and contrastive learning from private data.
problem Preventing unauthorized use of private data and commercial datasets.
method Contrastive-like data augmentations in supervised error minimization or maximization frameworks.
result Achieve state-of-the-art worst-case unlearnability across SL and CL algorithms.
New research shows that the dimension gap between intrinsic and ambient dimensions affects adversarial vulnerability of machine learning models.
problem The mystery of adversarial attacks on machine learning models.
method Introducing two types of adversarial attacks and proving their relationship to the dimension gap.
result The dimension gap between intrinsic and ambient dimensions makes clean-trained models more vulnerable to off-manifold adversarial perturbations.
Paper defends against adversarial videos by detecting and reducing imperceptible perturbations.
problem Adversarial videos can fool well-trained video classification models.
method Temporal consistency between frames and spatial denoising to detect and reduce perturbations.
result The proposed method significantly improves robustness against adversarial attacks.
Enhances DNNs by selectively learning key image edges.
problem Improving DNN robustness against adversarial attacks.
method Introduces Secure Selective Convolution (SSC) to learn important image edges.
result Significant reduction in attack success rate and imperceptibility of adversarial images.
Graph deep learning models are vulnerable to adversarial attacks, which this paper addresses.
problem Adversarial attacks on graph data models, especially their discreteness and imperceptible perturbations.
method Proposed both attack and defense techniques, including integrated gradients for attacks and graph inspection for defenses.
result Demonstrated the effectiveness of proposed methods through experiments on various datasets.
This paper analyzes the limits of neural networks under adversarial attacks.
problem Understanding how neural networks perform under adversarial noise.
method Defined the adversarial VC-dimension and combined it with the VC-dimension of halfspace classifiers.
result Concluded the adversarial VC-dimension of neural networks with sign activation functions.
Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
HRFA generates high-resolution, realistic adversarial examples for DNNs.
problem Revealing vulnerabilities of DNNs with imperceptible, semantic attacks.
method Modifies latent feature representation, backpropagating through generative model.
result Generates adversarial examples with up to 1024x1024 resolution, evading denoising defenses.
New approach makes adversarial examples less suspicious without changing perceptual salience.
problem Robustness of deep neural networks to unsuspicious adversarial examples.
method Splitting images into foreground and background, allowing larger perturbations in background while maintaining low cognitive salience.
result Dual-perturbation attacks are effective against classifiers robust to conventional attacks and adversarial training yields more robust classifiers.
Game theory improves smart road sign security against small perturbations.
problem Ensuring smart road signs are secure from small-scale adversarial attacks.
method Integrates game theory into smart road sign classification to detect imperceptible perturbations.
result Proposes a randomized detection strategy to ensure robustness against worst-case attackers.
A new efficient PGD method generates smaller perturbation adversarial examples.
problem Adversarial examples in deep neural networks.
method Modified Project Gradient Descent (PGD) method for ensemble models.
result Generates smaller perturbation adversarial examples than PGD method.
Study evaluates adversarial attacks on speech emotion recognition systems.
problem Adversarial examples challenge the robustness of speech emotion recognition systems.
method Proposes adversarial training and GAN as defenses.
result Demonstrates effective use of adversarial examples for robustness.
New method makes neural networks more secure by protecting latent layers from adversarial attacks.
problem Vulnerability of latent layers in adversarially trained models to small perturbations.
method Latent Adversarial Training (LAT) and Latent Attack (LA) algorithms.
result Improves adversarial accuracy by 1-2% on MNIST, CIFAR-10, CIFAR-100 datasets.
The paper uses Fisher information to explain and defend against adversarial attacks.
problem Vulnerability of deep learning models to adversarial attacks.
method Proposes OSSA for adversarial attack and eigenvalues for detection.
result Fisher information reveals model vulnerability through eigenvalues.
CycleGAN (Zhu et al. 2017) is one recent successful approach to learn a transformation between two image distributions. In a series of experiments, we demonstrate an intriguing property of the model: CycleGAN learns to "hide" information about a source image into the images it generates in a nearly imperceptible, high-…
Our attacks are stronger and faster under Wasserstein metric.
problem Vulnerability of deep models to adversarial attacks.
method Developed an exact yet efficient projection operator and used the Frank-Wolfe method.
result Generated much stronger attacks and improved model robustness.
TensorShield defends images from adversarial attacks using tensor decomposition.
problem Adversarial attacks on images can fool deep neural networks.
method Tensor decomposition to find low-rank approximations of images, reducing high-frequency perturbations.
result TensorShield outperforms existing methods like SLQ by 14% against FGSM attacks.
New algorithm improves robustness by more regularization on less robust samples.
problem Improving robustness against adversarial attacks.
method Proposes a new adversarial training algorithm that applies more regularization to data vulnerable to adversarial attacks.
result Empirically superior to other existing algorithms, achieving state-of-the-art performance in generalization and robustness.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
PAC-Bayesian bounds estimate adversarial robustness.
problem Estimating robustness to imperceptible input perturbations.
method PAC-Bayesian framework for averaging over hypotheses.
result General bounds valid for any type of adversarial attacks.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.
Paper develops a method to generate discrete adversarial attacks on text classification models using submodular optimization.
problem Generating adversarial examples for discrete structures like text is challenging.
method Formulated adversarial attacks as an optimization task on submodular set functions, guided by gradient information.
result Achieved a 1-1/e approximation factor for attacks using the greedy algorithm.
Differentiable adversarial attacks improve model robustness in MTPP models.
problem Improving model robustness against adversarial attacks in MTPP models.
method Proposed a differentiable adversarial attack scheme PERMTPP that addresses the sequential nature and varying time-scales of MTPPs.
result Demonstrated offensive and defensive capabilities, and reduced inference times on real-world datasets.
Paper detects adversarial speech inputs with high accuracy.
problem Adversarial attacks on ASR systems.
method Uncertainty quantification using neural networks.
result Detection accuracy of adversarial inputs over 0.99.