This paper evaluates and compares gradient leakage attacks in federated learning.
problem Gradient leakage attacks compromise client privacy in federated learning.
method Formal and experimental analysis of gradient leakage attacks, evaluation of attack effectiveness and cost.
result Gradient leakage attacks can reconstruct private local training data from shared parameter updates.
Localized uncertainty attacks target uncertain regions to create imperceptible adversarial examples.
problem Adversarial examples that are imperceptible to humans and strong under deterministic classifiers.
method Localized uncertainty attacks by perturbing uncertain regions, using predictive uncertainty or surrogate models.
result Localized uncertainty attacks produce strong adversarial examples that retain input similarity.
Gen-LRA attacks synthetic data leakage without model knowledge.
problem Auditing synthetic data privacy leakage.
method Generative Likelihood Ratio Attack (Gen-LRA).
result Gen-LRA outperforms other attacks across metrics.
Simple regional perturbations maintain model transferability while reducing adversarial example distortion.
problem Comparing efficacy of regional adversarial attacks without complex methods.
method Developed a simple regional adversarial perturbation attack using cross-entropy sign.
result Localized adversarial examples require significantly less Lp norm distortion compared to non-local counterparts. New defense mechanism detects and mitigates poisoned regression data.
problem Vulnerability of regression models to targeted data poisoning attacks.
method Introduces N-LID, a measure of local intrinsic dimensionality to distinguish poisoned samples.
result N-LID based defense outperforms state-of-the-art methods in prediction accuracy and runtime.
We propose the Square Attack, a score-based black-box l2- and l∞-adversarial attack that does not rely on local gradient information and thus is not affected by gradient masking. Square Attack is based on a randomized search scheme which selects localized square-shaped updates at random positions so that at …
Federated learning is a recently proposed paradigm that enables multiple clients to collaboratively train a joint model. It allows clients to train models locally, and leverages the parameter server to generate a global model by aggregating the locally submitted gradient updates at each round. Although the incentive mo…
Study reveals how neural network smoothness affects their vulnerability to adversarial attacks.
problem Understanding adversarial vulnerability in deep learning networks.
method Analysis of manifold smoothness and generalization capability of deep neural networks trained with local errors.
result High generalization accuracy requires a fast power-law decay of eigen-spectrum of hidden representations.
Semantic paraphrases can fool financial sentiment classifiers due to geometric shifts in model representations.
problem Semantic paraphrase attacks on financial sentiment classifiers
method Developing a continuous local model of semantic paraphrase perturbations
result The worst-case local displacement of the target representation is governed by the largest generalised eigenvalue of a matrix pencil constructed from the Jacobians of the two embedding maps.
Adversarial example generation becomes a viable method for evaluating the robustness of a machine learning model. In this paper, we consider hard-label black-box attacks (a.k.a. decision-based attacks), which is a challenging setting that generates adversarial examples based on only a series of black-box hard-label que…
Study membership inference under skewed priors and adaptive thresholds, improving attack accuracy.
problem Membership inference in imbalanced settings with selective thresholding.
method Developed PPV metric for skewed priors, threshold selection procedure, and a new inference attack.
result Improved inference attack accuracy in imbalanced settings.
Paper proposes efficient privacy-preserving matrix encryption for secure collaborative learning against malicious adversaries.
problem Secure collaborative learning of sensitive data across different agencies is challenging with malicious adversaries.
method The paper applies matrix encryption to secure data against chosen plaintext attack, known plaintext attack, and collusion attack, achieving local differential privacy and high computation efficiency.
result The proposed schemes are computationally efficient and secure against malicious adversaries compared to existing techniques.
It has been shown that deep neural networks (DNNs) may be vulnerable to adversarial attacks, raising the concern on their robustness particularly for safety-critical applications. Recognizing the local nature and limitations of existing adversarial attacks, we present a new type of global adversarial attacks for assess…
It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks. In this paper, we take a bottom-up signal processing perspective to this problem and show that a systematic exploitation of sparsity in natural data is a promising tool for defense. For linear classifi…
Paper tackles cybersecurity attack detection with an ensemble approach.
problem Challenges in multi-class classification for cyber security breaches.
method Designing a multi-node multi-class classification ensemble approach.
result Proposed approach outperforms full-data approach in multi-node data-censoring cases.
Paper analyzes adversarial attacks and defenses using game theory.
problem Unclear conditions for optimal attacks and defenses in adversarial learning.
method Game-theoretic framework with locally linear decision boundary model.
result Fast Gradient Method attack and Randomized Smoothing defense form a Nash Equilibrium.
Novel defense algorithm improves SVMs against data poisoning attacks.
problem Vulnerability of SVMs to targeted training data manipulations like poisoning attacks.
method Developed a weighted SVM using K-LID to de-emphasize suspicious data samples.
result Significant reduction in classification error rates (10% on average) with the proposed defense.
Stochastic LWTA networks resist adversarial attacks while maintaining accuracy.
problem Adversarial robustness of neural networks.
method Replaced ReLU with stochastic LWTA activations, trained with Variational Bayesian and PGD.
result Stochastic LWTA networks achieve state-of-the-art robustness against adversarial attacks.
This paper improves attacks on recommender systems by solving optimization problems more precisely.
problem Adversarial injection attacks on recommender systems.
method Solving optimization problems for generating fake user interactions more accurately.
result The exact solution for generating fake users leads to a much larger impact on recommender systems.
Efficient method defends privacy in federated learning without accuracy loss.
problem Privacy attacks on federated learning by reconstructing and identifying local data.
method Random noise perturbation method that allows recovery of true gradients.
result Strong privacy protection without sacrificing learning accuracy.
Understanding and characterizing the subspaces of adversarial examples aid in studying the robustness of deep neural networks (DNNs) to adversarial perturbations. Very recently, Ma et al. (ICLR 2018) proposed to use local intrinsic dimensionality (LID) in layer-wise hidden representations of DNNs to study adversarial s…
Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversaria…
It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks (DNNs). In this paper, we make the case that sparse representations of the input data are a crucial tool for combating such attacks. For linear classifiers, we show that a sparsifying front end is prova…
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
Federated learning (FL) has recently emerged as a new form of collaborative machine learning, where a common model can be learned while keeping all the training data on local devices. Although it is designed for enhancing the data privacy, we demonstrated in this paper a new direction in inference attacks in the contex…
Collaborative (federated) learning enables multiple parties to train a model without sharing their private data, but through repeated sharing of the parameters of their local models. Despite its advantages, this approach has many known privacy and security weaknesses and performance overhead, in addition to being limit…
The paper provides Gaussian approximations for decentralized Federated Learning.
problem Lack of asymptotic statistical guarantees for local SGD in Federated Learning.
method Two generalized Gaussian approximation results for local SGD trajectories.
result Valid multiplier bootstrap procedures and Gaussian bootstrap-based tests for detecting adversarial attacks.
Today's state-of-the-art image classifiers fail to correctly classify carefully manipulated adversarial images. In this work, we develop a new, localized adversarial attack that generates adversarial examples by imperceptibly altering the backgrounds of normal images. We first use this attack to highlight the unnecessa…
New model improves deep learning robustness against adversarial attacks.
problem Improving adversarial robustness of deep learning models.
method Local competition principle, LWTA nonlinearities, Bayesian non-parametrics.
result The new model achieves high robustness to adversarial perturbations on MNIST and CIFAR10 datasets.
New study tackles free-rider attacks in federated learning models.
problem Free-rider attacks compromise federated learning models by non-contributing to data updates.
method Theoretical and experimental analysis of iterative federated learning schemes, including FedAvg and FedProx.
result Formal guarantees for free-rider attacks to converge to aggregated models of fair participants.
Paper addresses Byzantine attacks in decentralized optimization over networks.
problem Byzantine attacks in decentralized stochastic optimization over static and time-varying networks.
method Formulate a TV norm-penalized approximation of the problem, solve using stochastic subgradient method.
result Proposed method reaches a neighborhood of the Byzantine-free optimal solution.
We investigate a family of poisoning attacks against Support Vector Machines (SVM). Such attacks inject specially crafted training data that increases the SVM's test error. Central to the motivation for these attacks is the fact that most learning algorithms assume that their training data comes from a natural or well-…
OTAD uses optimal transport to create robust models against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial perturbations.
method OTAD combines optimal transport and Lipschitz networks to create a robust model.
result OTAD outperforms other robust models on diverse datasets.
Local convolutions bias neural networks towards high-frequency adversarial examples.
problem High-frequency adversarial examples in neural networks.
method Analysis of different linear and nonlinear architectures, focusing on the impact of local convolution operations.
result Local convolutions induce an implicit bias towards high frequency features, leading to high-frequency adversarial examples.
EI-MTD defends edge intelligence against adversarial attacks with dynamic scheduling.
problem Adversarial attacks on edge intelligence models.
method EI-MTD uses differential knowledge distillation to create robust member models and a dynamic scheduling policy based on a Bayesian Stackelberg game.
result EI-MTD effectively protects edge intelligence from black-box adversarial attacks.
Validates neural networks inputs to protect against adversarial examples.
problem Ensuring neural networks robustness against adversarial attacks.
method Runtime local robustness verification based on normal distribution of robustness radii.
result Improves neural network accuracy and protects against adversarial examples.
SAPAG attacks distributed learning by reconstructing true training data from gradients.
problem Privacy attacks on distributed learning systems through gradients.
method SAPAG uses a Gaussian kernel-based gradient difference distance measure.
result SAPAG can reconstruct training data on various DNNs and at different training phases.
P-BO reduces black-box adversarial attacks by 10x with Bayesian optimization and function prior.
problem Efficiently generating adversarial examples against black-box models.
method Prior-guided Bayesian Optimization (P-BO) with a function prior initialized from a surrogate model.
result Significantly reduces the number of queries needed for adversarial attacks.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.
TensorShield defends images from adversarial attacks using tensor decomposition.
problem Adversarial attacks on images can fool deep neural networks.
method Tensor decomposition to find low-rank approximations of images, reducing high-frequency perturbations.
result TensorShield outperforms existing methods like SLQ by 14% against FGSM attacks.
Dynamic defense against Byzantine poisoning in federated learning.
problem Byzantine poisoning attacks on federated learning models.
method Dynamic federated aggregation operator to filter out adversarial clients.
result Dynamic selection of clients improves global learning model performance.
Proposes a method to improve Byzantine-robustness in compressed federated learning.
problem Byzantine-robustness in compressed federated learning.
method Gradient difference compression and stochastic average gradient algorithm (SAGA).
result The proposed method reaches a neighborhood of the optimal solution at a linear convergence rate.
An Intrusion Detection System (IDS) is a key cybersecurity tool for network administrators as it identifies malicious traffic and cyberattacks. With the recent successes of machine learning techniques such as deep learning, more and more IDS are now using machine learning algorithms to detect attacks faster. However, t…
Study compares federated learning and coreset approaches for privacy in distributed machine learning.
problem Measuring privacy in distributed machine learning approaches.
method Comparison of federated learning and coreset approaches using membership inference attack.
result Federated learning offers better privacy than coreset, but with higher communication cost.
Paper tackles Byzantine attacks in distributed learning with a new ADMM method.
problem Byzantine workers sending arbitrary messages bias distributed learning.
method Byzantine-robust stochastic ADMM exploiting separable problem structure.
result Proposed method converges to optimal solution at O(1/k) rate.
Tensor network decomposition, originated from quantum physics to model entangled many-particle quantum systems, turns out to be a promising mathematical technique to efficiently represent and process big data in parsimonious manner. In this study, we show that tensor networks can systematically partition structured dat…
FLANDERS detects and blocks extreme model poisoning in federated learning.
problem Resilience against large-scale model poisoning attacks in federated learning.
method FLANDERS treats client updates as matrix-valued time series and identifies outliers using autoregressive forecasting.
result FLANDERS significantly improves robustness in federated learning across various attacks.
Stein shrinkage improves BN robustness against adversarial attacks.
problem Improving BN robustness against adversarial attacks.
method Applying Stein shrinkage to BN mean and variance estimates.
result Stein shrinkage outperforms vanilla BN in adversarial settings.