Boosts adversarial attacks with momentum to improve model robustness.
problem Vulnerability of deep neural networks to adversarial examples.
method Momentum-based iterative algorithms to boost adversarial attacks.
result More transferable adversarial examples and higher success rates for black-box attacks.
Cascade adversarial training improves robustness against iterative attacks.
problem Improving robustness against unknown iterative attacks.
method Cascade adversarial training, incorporating adversarial images and embedding space for low-level similarity learning.
result Enhanced robustness against iterative attacks, but decreased robustness against one-step attacks.
A new method uses adversarial attacks to detect other adversarial attacks.
problem Detecting iterative adversarial attacks on deep neural networks.
method Using the Carlini-Wagner (CW) attack as a detector itself, under certain assumptions.
result The method provides asymptotically optimal separation of original and attacked images.
WITCHcraft improves PGD attacks with random step size, enhancing efficiency.
problem Efficiently crafting adversarial attacks on neural networks.
method Variant of PGD using random step size.
result Superior performance to classical PGD without additional computational cost.
This paper analyzes adversarial attacks methods and their effectiveness.
problem Understanding the effectiveness and theoretical properties of adversarial attacks.
method Comparative and formal analysis of loss functions of three adversarial attack methods.
result The Iterative Fast Gradient Sign attack is the slowest in creating adversarial examples.
ADef iteratively deforms images to create robust adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Iterative application of small deformations through gradient descent.
result ADef produces more robust adversarial attacks compared to additive perturbations.
New study tackles free-rider attacks in federated learning models.
problem Free-rider attacks compromise federated learning models by non-contributing to data updates.
method Theoretical and experimental analysis of iterative federated learning schemes, including FedAvg and FedProx.
result Formal guarantees for free-rider attacks to converge to aggregated models of fair participants.
Federated learning is protected against adversarial attacks with residual-based reweighting.
problem Adversarial attacks on federated learning's aggregation process.
method Residual-based reweighting combined with iteratively reweighted least squares.
result Our aggregation algorithm outperforms other methods in label-flipping and backdoor attacks.
New methods improve adversarial attacks' transferability to other models.
problem Vulnerability of deep learning models to adversarial examples.
method Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM).
result NI-FGSM and SIM generate more transferable adversarial examples.
Quantized neural networks can improve robustness against adversarial attacks.
problem Adversarial attacks on neural networks with low-precision weights and activations.
method Proposed a third benefit of very low-precision neural networks: improved robustness against some adversarial attacks. Focused on weights and activations quantized to ±1, and conducted black-box and white-box experiments.
result Non-scaled binary neural networks can reduce the impact of iterative attacks, but do not artificially mask gradients.
This work develops secure distributed algorithms for machine learning to protect against data poisoning and network attacks.
problem Vulnerability of distributed machine learning algorithms to cyber threats.
method Game-theoretic framework to capture conflicting goals of a learner and an attacker, iterative distributed algorithm.
result Distributed SVM is prone to fail in different types of attacks, with impact depending on network structure and attack capabilities.
New methods improve Byzantine robustness in distributed learning.
problem Existing robust aggregation rules fail in realistic scenarios.
method Introducing new robust iterative clipping procedure and worker momentum.
result First provably robust method for standard stochastic optimization.
Paper proposes using auto-encoders to efficiently purify adversarial perturbations.
problem Vulnerability of machine learning models to adversarial examples.
method Iterative adversarial training on an auto-encoder to purify perturbations.
result The auto-encoder trained model outperforms other methods in protecting models against white-box attacks.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
The paper shows how imitation learning can be exploited to extract DRL policies.
problem The confidentiality and integrity of DRL policies are vulnerable to model extraction attacks.
method Developed proof-of-concept attacks using imitation learning techniques.
result Demonstrated the feasibility of launching black-box attacks against DRL policies.
Paper tackles Byzantine attacks in Federated Learning by clustering and robustifying.
problem Adversarial attacks from Byzantine machines in Federated Learning.
method Iterative Federated Clustering Algorithm (IFCA) with trimmed mean and median aggregation.
result Improved convergence rate for strongly convex loss functions in Byzantine-Robust IFCA.
A new Frank-Wolfe framework improves efficiency and effectiveness of adversarial attacks.
problem Develop efficient and effective optimization-based adversarial attack algorithms.
method Proposes a Frank-Wolfe algorithm variant for both white-box and black-box adversarial attacks.
result Demonstrates improved efficiency and effectiveness compared to existing methods.
Square Attack efficiently attacks deep models with random updates.
problem Efficiently attacking deep learning models without gradient information.
method Randomized search of localized square updates.
result Significantly more query-efficient and higher success rate compared to state-of-the-art methods.
A new algorithm reduces the cost of training robust deep neural networks.
problem High computational cost in training robust deep neural networks.
method Iterative descent-ascent algorithm based on saddle-point dynamical system.
result The algorithm converges to robust optimal solution under adversarial constraints.
CCAT improves model robustness to various adversarial attacks.
problem Robustness to adversarial attacks does not generalize to unseen threat models.
method CCAT biases models towards low confidence predictions on adversarial examples.
result CCAT increases robustness against multiple adversarial attack norms and types.
Random Gaussian noise and pixel discretization improve image classifier robustness.
problem Whitebox adversarial attacks decrease classifier accuracy.
method Inject random Gaussian noise, discretize pixels, and use any classifier.
result Reduces KL divergence and lower bound on classifier accuracy.
Improved algorithm speeds up generation of universal adversarial perturbations.
problem Slow generation of universal adversarial perturbations.
method Optimized algorithm based on orientation of perturbation vectors.
result Significantly faster generation of universal perturbations with higher fooling rates.
Paper shows how to hide individuals in graphs to fool community detection models.
problem Adversarial attack on community detection models by hiding individuals.
method Iterative learning framework that updates a graph generator and a community detection model.
result Adversarial graphs generated by the method can fool multiple community detection models.
Paper examines Go AI robustness against adversarial attacks.
problem Superhuman Go AIs are vulnerable to simple adversarial strategies.
method Three defenses tested: adversarial training, iterated adversarial training, and changing network architecture.
result No defense is robust against newly trained adversaries, and attacks are similar to cyclic attacks.
Study examines adversarial robustness of ANN variants, revealing differences in black-box settings.
problem Adversarial robustness of alternative neural network architectures.
method Analysis of conventional, stochastic ANNs, and SNNs across three datasets; experiments in white-box and black-box settings.
result Stochastic ANNs are more robust than conventional ANNs in black-box settings, especially with surrogate attacks.
BOSH improves decision-based attacks by optimizing solution paths.
problem Generating optimal adversarial examples for decision-based attacks.
method BOSH-attack uses Bayesian Optimization and Successive Halving to explore solution paths.
result BOSH converges to better solutions with fewer queries.
Efficient trust region based attacks reduce adversarial perturbation time significantly.
problem Vulnerability of neural networks to adversarial perturbations requiring time-consuming tuning.
method Trust region optimization for efficient adversarial attack computation.
result Significant speed up of up to 37 times for VGG-16 model on a Titan Xp GPU.
Improved DNN robustness to adversarial attacks using data-dependent activation and total variation minimization.
problem Improving Deep Neural Network robustness to adversarial attacks.
method Data-dependent activation function and total variation minimization.
result Robust accuracy of adversarially trained ResNet20 increased from ~46% to ~69% under IFGSM attack.
This study evaluates adversarial attacks and defenses for chest X-ray disease classification.
problem Vulnerability of deep neural networks to adversarial examples in chest X-ray disease detection.
method Detailed introduction and evaluation of various attack and defense methods.
result Attack and defense methods perform poorly with excessive iterations and large perturbations.
A new efficient PGD method generates smaller perturbation adversarial examples.
problem Adversarial examples in deep neural networks.
method Modified Project Gradient Descent (PGD) method for ensemble models.
result Generates smaller perturbation adversarial examples than PGD method.
Paper presents strong black-box attacks on unsupervised clustering models.
problem Adversarial attacks on unsupervised machine learning models.
method Iterative black-box attack on clustering algorithms.
result Adversarial samples can fool clustering algorithms irrespective of the algorithm used.
Generative models create image perturbations to fool AI models.
problem Creating adversarial examples that fool pre-trained models.
method Trainable deep neural networks for image perturbation generation.
result High fooling rates with small perturbation norms, faster than current methods.
Simple method for black-box adversarial attacks with low query efficiency.
problem Efficient construction of adversarial images in the black-box setting.
method Randomly sampling from an orthonormal basis and adjusting images.
result Demonstrated unprecedented query efficiency in both untargeted and targeted attacks.
Universal audio perturbations fool multiple classification models.
problem Creating audio adversarial perturbations that work across different models.
method Two methods: greedy iterative approach and novel penalty formulation.
result The penalty method produces more successful attacks with limited training data.
Logit pairing methods don't provide robustness against adversarial examples.
problem Improving adversarial robustness of classifiers.
method Logit regularization methods (CLP, LSQ, ALP) to craft adversarial examples.
result Adversarial Logit Pairing (ALP) may provide robustness, but the increase is small.
Paper proposes iterative trimmed loss minimization for learning from corrupted data.
problem Learning from corrupted training data.
method Iterative trimmed loss minimization, alternating between selecting and retraining samples.
result Recovery of ground truth with linear convergence rate in generalized linear models.
Compensation methods correct overestimation of adversarial robustness in neural networks.
problem Overestimation of adversarial robustness using first-order attack methods.
method Proposed compensation methods address inaccurate gradient computation and reduce backpropagations.
result Empirical evaluation of adversarial robustness is improved with these methods.
This study evaluates how adversarial examples transfer between different models.
problem Transferability of adversarial examples across models poses a threat to machine learning reliability.
method Evaluation of three adversarial attacks (FGSM, Basic Iterative Method, Carlini & Wagner) on two model classes (VGG and Inception). Use of specific parameters and metrics (L-Infinity clipping, SSIM) for assessment.
result Adversarial examples can be transferred between models, indicating a vulnerability in machine learning systems.
New attack strategy circumvents CC framework's defences in federated learning.
problem Vulnerabilities in Byzantine attacks in federated learning.
method Introducing a novel attack strategy and proposing a new robust defence mechanism.
result Reduces test accuracy of robust aggregators up to 33% in image classification tasks.
New method attacks black-box models with fewer queries.
problem Attacking machine learning models without model information.
method Formulated as a real-valued optimization problem, solved with zeroth order optimization.
result Demonstrated to outperform random walk approach on various datasets.
New sparsity attacks degrade DNN efficiency, raising concerns for resource-constrained systems.
problem Vulnerabilities in DNNs through energy and latency attacks.
method Proposed sparsity attacks that modify DNN inputs to reduce activation sparsity, increasing execution time and energy consumption.
result Adversarial sparsity attacks can degrade DNN efficiency by up to 1.82x in image recognition DNNs.
OGAN attacks autoencoders to prevent deepfake creation.
problem Preventing deepfake creation using adversarial attacks.
method Training-resistant adversarial attack on face-swapping autoencoders.
result OGAN attacks are training-resistant and transfer across different models and faces.
This paper extends Newton's method to distributed learning, avoiding saddle points and handling Byzantine workers.
problem Avoiding saddle points in distributed non-convex optimization, especially in the presence of Byzantine workers.
method Extends cubic-regularized Newton method to distributed framework, addressing communication bottlenecks and Byzantine attacks.
result The method achieves improved iteration complexity compared to first-order methods, with a 25% improvement in experiments.
DBCL defends collaborative learning by sketching parameters to prevent gradient-based privacy inference attacks.
problem Privacy leaks in collaborative machine learning due to gradient-based attacks.
method Random matrix sketching applied to parameters, followed by re-generation of sketching after each iteration.
result DBCL prevents effective gradient-based privacy inference attacks without significant computational or accuracy costs.
Paper tackles Byzantine attacks in distributed learning with a new ADMM method.
problem Byzantine workers sending arbitrary messages bias distributed learning.
method Byzantine-robust stochastic ADMM exploiting separable problem structure.
result Proposed method converges to optimal solution at O(1/k) rate.
SIGMA improves IDS robustness against new attacks using GAN and metaheuristics.
problem Lack of robustness in IDS against new, unseen attacks.
method SIGMA uses GAN and metaheuristics to generate adversarial examples and retrain IDS.
result SIGMA can improve IDS performance up to 100% after two rounds of improvement.
Federated learning is vulnerable to model poisoning attacks by a single malicious agent.
problem Vulnerability of federated learning to model poisoning attacks by a single non-colluding agent.
method Exploration of model poisoning attacks, including boosting, alternating minimization, and parameter estimation.
result Even a constrained adversary can successfully carry out model poisoning attacks while maintaining stealth.
Enhances adversarial examples' transferability through diverse input patterns.
problem Low success rates of adversarial attacks in the black-box setting.
method Applying random transformations to input images at each iteration.
result Generates adversarial examples that transfer better to different networks.