Localized uncertainty attacks target uncertain regions to create imperceptible adversarial examples.
problem Adversarial examples that are imperceptible to humans and strong under deterministic classifiers.
method Localized uncertainty attacks by perturbing uncertain regions, using predictive uncertainty or surrogate models.
result Localized uncertainty attacks produce strong adversarial examples that retain input similarity.
Localized adversarial training improves image classifiers' robustness.
problem State-of-the-art image classifiers fail on carefully manipulated adversarial images.
method Developed a localized adversarial attack and used it to train a robust classifier.
result Localized adversarial training increases robustness against adversarial inputs.
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less Lp norm distortion compared to non-local counterparts. Study reveals how neural network smoothness affects their vulnerability to adversarial attacks.
problem Understanding adversarial vulnerability in deep learning networks.
method Analysis of manifold smoothness and generalization capability of deep neural networks trained with local errors.
result High generalization accuracy requires a fast power-law decay of eigen-spectrum of hidden representations.
It has been shown that deep neural networks (DNNs) may be vulnerable to adversarial attacks, raising the concern on their robustness particularly for safety-critical applications. Recognizing the local nature and limitations of existing adversarial attacks, we present a new type of global adversarial attacks for assess…
Paper proposes efficient privacy-preserving matrix encryption for secure collaborative learning against malicious adversaries.
problem Secure collaborative learning of sensitive data across different agencies is challenging with malicious adversaries.
method The paper applies matrix encryption to secure data against chosen plaintext attack, known plaintext attack, and collusion attack, achieving local differential privacy and high computation efficiency.
result The proposed schemes are computationally efficient and secure against malicious adversaries compared to existing techniques.
Stochastic LWTA networks resist adversarial attacks while maintaining accuracy.
problem Adversarial robustness of neural networks.
method Replaced ReLU with stochastic LWTA activations, trained with Variational Bayesian and PGD.
result Stochastic LWTA networks achieve state-of-the-art robustness against adversarial attacks.
Understanding and characterizing the subspaces of adversarial examples aid in studying the robustness of deep neural networks (DNNs) to adversarial perturbations. Very recently, Ma et al. (ICLR 2018) proposed to use local intrinsic dimensionality (LID) in layer-wise hidden representations of DNNs to study adversarial s…
Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversaria…
BOSH improves decision-based attacks by optimizing solution paths.
problem Generating optimal adversarial examples for decision-based attacks.
method BOSH-attack uses Bayesian Optimization and Successive Halving to explore solution paths.
result BOSH converges to better solutions with fewer queries.
New model improves deep learning robustness against adversarial attacks.
problem Improving adversarial robustness of deep learning models.
method Local competition principle, LWTA nonlinearities, Bayesian non-parametrics.
result The new model achieves high robustness to adversarial perturbations on MNIST and CIFAR10 datasets.
Square Attack efficiently attacks deep models with random updates.
problem Efficiently attacking deep learning models without gradient information.
method Randomized search of localized square updates.
result Significantly more query-efficient and higher success rate compared to state-of-the-art methods.
EI-MTD defends edge intelligence against adversarial attacks with dynamic scheduling.
problem Adversarial attacks on edge intelligence models.
method EI-MTD uses differential knowledge distillation to create robust member models and a dynamic scheduling policy based on a Bayesian Stackelberg game.
result EI-MTD effectively protects edge intelligence from black-box adversarial attacks.
Local convolutions bias neural networks towards high-frequency adversarial examples.
problem High-frequency adversarial examples in neural networks.
method Analysis of different linear and nonlinear architectures, focusing on the impact of local convolution operations.
result Local convolutions induce an implicit bias towards high frequency features, leading to high-frequency adversarial examples.
Mixup inference improves adversarial robustness by mixing inputs with clean samples.
problem Adversarial examples can fool deep networks due to local non-linearity.
method Develops mixup inference, which mixes inputs with clean samples to shrink adversarial perturbations.
result Mixup inference enhances adversarial robustness for mixup-trained models.
Paper analyzes adversarial attacks and defenses using game theory.
problem Unclear conditions for optimal attacks and defenses in adversarial learning.
method Game-theoretic framework with locally linear decision boundary model.
result Fast Gradient Method attack and Randomized Smoothing defense form a Nash Equilibrium.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
Dynamic defense against Byzantine poisoning in federated learning.
problem Byzantine poisoning attacks on federated learning models.
method Dynamic federated aggregation operator to filter out adversarial clients.
result Dynamic selection of clients improves global learning model performance.
Validates neural networks inputs to protect against adversarial examples.
problem Ensuring neural networks robustness against adversarial attacks.
method Runtime local robustness verification based on normal distribution of robustness radii.
result Improves neural network accuracy and protects against adversarial examples.
TensorShield defends images from adversarial attacks using tensor decomposition.
problem Adversarial attacks on images can fool deep neural networks.
method Tensor decomposition to find low-rank approximations of images, reducing high-frequency perturbations.
result TensorShield outperforms existing methods like SLQ by 14% against FGSM attacks.
This paper evaluates and compares gradient leakage attacks in federated learning.
problem Gradient leakage attacks compromise client privacy in federated learning.
method Formal and experimental analysis of gradient leakage attacks, evaluation of attack effectiveness and cost.
result Gradient leakage attacks can reconstruct private local training data from shared parameter updates.
OTAD uses optimal transport to create robust models against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial perturbations.
method OTAD combines optimal transport and Lipschitz networks to create a robust model.
result OTAD outperforms other robust models on diverse datasets.
This work uses Lyapunov theory to improve the robustness of deep neural networks against adversarial attacks.
problem Vulnerability of deep neural networks to subtle adversarial perturbations.
method Treated each layer as a nonlinear dynamical system and used Lyapunov theory for stability and robustness.
result Developed empirically tight bounds on adversarial perturbations and proved stability and robustness globally.
P-BO reduces black-box adversarial attacks by 10x with Bayesian optimization and function prior.
problem Efficiently generating adversarial examples against black-box models.
method Prior-guided Bayesian Optimization (P-BO) with a function prior initialized from a surrogate model.
result Significantly reduces the number of queries needed for adversarial attacks.
Improves deep learning robustness by enforcing local and global compactness.
problem Deep neural networks' vulnerability to adversarial attacks.
method Proposes Adversary Divergence Reduction Network (ADRN) that enforces local/global compactness and clustering assumption.
result Augmenting adversarial training with ADRN components improves robustness.
New deep learning model robust to adversarial attacks using stochastic LWTA units.
problem Adversarial robustness in deep learning networks.
method Introduces deep networks with stochastic LWTA activations, combining them with Bayesian non-parametric tools.
result Achieves high robustness to adversarial perturbations, outperforming state-of-the-art methods.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.
Tensor network decomposition, originated from quantum physics to model entangled many-particle quantum systems, turns out to be a promising mathematical technique to efficiently represent and process big data in parsimonious manner. In this study, we show that tensor networks can systematically partition structured dat…
DAEGEN generates adversarial inputs for neural networks using a black-box differential technique.
problem Generating adversarial inputs that highlight differences between neural network models.
method DAEGEN uses a local search-based optimization algorithm to find difference-inducing adversarial examples (DIAEs).
result DAEGEN is the first black-box differential technique for adversarial input generation and performs well compared to existing methods.
Detects adversarial directions to make reinforcement learning policies more robust.
problem Adversarial attacks exploit non-robust directions in reinforcement learning policies, leading to instability.
method Local quadratic approximation of deep neural policy loss to identify non-robust directions.
result Provides a theoretical basis for distinguishing safe from adversarial observations.
Stein shrinkage improves BN robustness against adversarial attacks.
problem Improving BN robustness against adversarial attacks.
method Applying Stein shrinkage to BN mean and variance estimates.
result Stein shrinkage outperforms vanilla BN in adversarial settings.
Adversarial training is an effective methodology for training deep neural networks that are robust against adversarial, norm-bounded perturbations. However, the computational cost of adversarial training grows prohibitively as the size of the model and number of input dimensions increase. Further, training against less…
SIGMA improves IDS robustness against new attacks using GAN and metaheuristics.
problem Lack of robustness in IDS against new, unseen attacks.
method SIGMA uses GAN and metaheuristics to generate adversarial examples and retrain IDS.
result SIGMA can improve IDS performance up to 100% after two rounds of improvement.
It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks. In this paper, we take a bottom-up signal processing perspective to this problem and show that a systematic exploitation of sparsity in natural data is a promising tool for defense. For linear classifi…
This paper improves attacks on recommender systems by solving optimization problems more precisely.
problem Adversarial injection attacks on recommender systems.
method Solving optimization problems for generating fake user interactions more accurately.
result The exact solution for generating fake users leads to a much larger impact on recommender systems.
One popular hypothesis of neural network generalization is that the flat local minima of loss surface in parameter space leads to good generalization. However, we demonstrate that loss surface in parameter space has no obvious relationship with generalization, especially under adversarial settings. Through visualizing …
Study membership inference under skewed priors and adaptive thresholds, improving attack accuracy.
problem Membership inference in imbalanced settings with selective thresholding.
method Developed PPV metric for skewed priors, threshold selection procedure, and a new inference attack.
result Improved inference attack accuracy in imbalanced settings.
It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks (DNNs). In this paper, we make the case that sparse representations of the input data are a crucial tool for combating such attacks. For linear classifiers, we show that a sparsifying front end is prova…
Adversarial machine learning in the context of image processing and related applications has received a large amount of attention. However, adversarial machine learning, especially adversarial deep learning, in the context of malware detection has received much less attention despite its apparent importance. In this pa…
LIME outperforms other explainers in identifying adversarial attack regions.
problem Evaluating explainers for detecting adversarial attacks in neural networks.
method Quantitative and qualitative investigation of three explainers on adversarial examples.
result LIME outperforms classic salience and guided backpropagation in identifying adversarial attack regions.
Paper introduces techniques to enhance time series data robustness against adversarial attacks.
problem Vulnerability of deep learning time series classifiers to adversarial attacks.
method Two local gradient based and one spectral density based data augmentation techniques.
result Trained models with augmented data achieve state-of-the-art classification accuracy and robustness.
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmann…
Paper tackles adversarial attacks on nonparametric regression models.
problem Vulnerability of machine learning models to adversarial attacks in nonparametric regression.
method Establishes minimax rate and proposes adaptive estimators for robust nonparametric regression under adversarial Lq-risks. result Achieves minimax optimality and provides adaptive estimators for robust nonparametric regression.
The paper provides Gaussian approximations for decentralized Federated Learning.
problem Lack of asymptotic statistical guarantees for local SGD in Federated Learning.
method Two generalized Gaussian approximation results for local SGD trajectories.
result Valid multiplier bootstrap procedures and Gaussian bootstrap-based tests for detecting adversarial attacks.
New defense method against physical attacks on image classification models.
problem Defending against physically realizable attacks on image classification models.
method Proposed a new abstract adversarial model, rectangular occlusion attacks, and developed two approaches for efficiently computing adversarial examples.
result Adversarial training using the new attack yields robust image classification models against physical attacks.
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.