Paper develops image disguising to protect privacy in outsourced deep learning.
problem Privacy concerns in outsourced deep learning, especially re-identification and model-based attacks.
method Develops image disguising approach to protect against attacks.
result Image-disguising mechanisms provide high protection against attacks while maintaining model quality.
Paper proposes a new black-box adversarial attack using normalizing flows.
problem Adversarial vulnerability of deep neural networks.
method Proposes a novel black-box adversarial attack using normalizing flows.
result Demonstrates competitive performance against well-known black-box adversarial attack methods.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
Paper shows how to trick machine learning-based authentication systems.
problem Ineffectiveness of machine learning in authentication systems against sophisticated attacks.
method Constructing a blind attack using query synthesis and Explainable-AI techniques.
result Demonstrated that machine learning models can be fooled with under 100 queries.
Defense against spam filter attacks using mixture models.
problem Data poisoning attacks on naive Bayes spam filters.
method Mixture of naive Bayes models to isolate attacks.
result Mixture model isolates attacks in a second component, preserving original spam.
Paper identifies classes vulnerable to adversarial attacks.
problem Adversarial attacks on deep learning models.
method Distance-based measures applied on trained models to identify susceptible classes.
result Identifies k most susceptible target classes for adversarial attacks.
This paper reduces the number of queries needed for black-box attacks on DNNs.
problem Efficiently conducting black-box attacks on deep neural networks.
method Active learning strategy combined with state-of-the-art white-box attack methods.
result Significantly reduces the number of queries needed for black-box attacks.
Study compares federated learning and coreset approaches for privacy in distributed machine learning.
problem Measuring privacy in distributed machine learning approaches.
method Comparison of federated learning and coreset approaches using membership inference attack.
result Federated learning offers better privacy than coreset, but with higher communication cost.
Quantile regression attacks outperform shadow models in unseen class membership inference attacks.
problem Failure of shadow model attacks on unseen classes due to limited data access.
method Quantile regression attacks that learn features of member examples.
result Quantile regression attacks achieve up to 11x higher TPR than shadow model-based approaches.
Detects audio adversarial examples using anomalous pattern detection.
problem Identifies adversarial audio attacks in deep neural networks.
method Applies anomalous pattern detection in activation space of audio models.
result Can detect adversarial examples with up to 0.98 AUC, no degradation on benign samples.
Orthogonal deep models defend against black-box attacks by ensuring internal representations are nearly orthogonal.
problem Vulnerability of deep learning models to black-box adversarial attacks.
method Introduce a gradient regularization scheme to encourage deep models' internal representations to be orthogonal to another model's.
result Orthogonal deep models significantly boost robustness against transferable black-box adversarial attacks.
Black-box attacks on RL agents using temporal information.
problem Vulnerability of RL agents to adversarial samples.
method Sequence-to-sequence models for predicting future actions.
result Adversarial samples can trigger RL agents to misbehave after a delay.
Novel technique detects adversarial samples in face recognition models.
problem Widespread adversarial sample attacks on DNN models.
method Bi-directional correspondence inference between attributes and internal neurons to identify critical neurons.
result 94% detection accuracy for 7 different kinds of attacks with 9.91% false positives.
This paper introduces a novel approach to measuring privacy risks in deep computer vision models based on intermediate outputs.
problem The exposure of intermediate results in hidden layers of deep computer vision models poses significant privacy concerns.
method The approach leverages Degrees of Freedom (DoF) to evaluate the amount of information retained in each layer and combines this with the rank of the Jacobian matrix to assess sensitivity to input variations.
result The proposed framework provides deeper insights into privacy risks associated with intermediate representations without requiring adversarial attack simulations.
MulDef defends neural networks against adversarial examples by combining multiple models.
problem Vulnerability of neural networks to adversarial examples.
method A general defense framework based on multiple models with robustness diversity.
result Substantially improved accuracy on adversarial examples (22-74%) while maintaining similar accuracy on legitimate examples.
Paper introduces DNTs to clone black-box models efficiently.
problem Cloning functionality of black-box models.
method Deep Neural Trees (DNTs) trained with active learning.
result Trained DNT can clone task-specific behavior of black-box models.
A new neural network model enhances adversarial robustness without sacrificing task performance.
problem Adversarial attacks on neural networks deployed in real-world scenarios.
method Proposes a novel neural network paradigm where each parameter is modeled as a statistical distribution with learnable parameters.
result Demonstrates highly robust performance to various adversarial attacks while maintaining task-specific performance.
Low frequency perturbations improve model robustness, contrary to high frequency attacks.
problem Improving model robustness against adversarial attacks.
method Systematic control of frequency components in perturbations.
result Low frequency perturbations improve model robustness, especially in white-box and black-box settings.
We inject undetectable backdoors into obfuscated neural networks and language models.
problem Safeguarding models from sophisticated adversarial attacks.
method Developed a strategy to plant undetectable backdoors in obfuscated neural networks and language models.
result Undetectable backdoors can be planted in obfuscated models, even if weights and architecture are accessible.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
Proposes a multi-task learning model using variational information bottleneck.
problem Balancing performance and robustness across different tasks in multi-task learning.
method Variational Information Bottleneck (VIB) architecture for multi-task learning.
result The proposed model achieves competitive prediction accuracy under adversarial attacks.
Improved IDS using LSTM and embedding for network traffic data.
problem Network security threats and need for IDS to detect attacks.
method Proposes IDS models using LSTM for time-series and embedding for categorical network traffic data.
result Improves binary classification accuracy to 99.72%.
Paper proposes a method to improve building extraction from aerial images by adapting CNN models.
problem Limited generalization of CNN-based segmentation models for unseen images.
method Combines domain transfer and adversarial attack concepts to adapt input images to target images.
result Improves overall IoU and outperforms other methods in cross-dataset experiments.
This research aims to develop robust audio spoofing detection methods that work across various spoofing techniques.
problem Detecting audio spoofing attacks in speaker verification systems.
method Examined traditional and machine learned audio features for robust spoofing detection.
result Fused models based on both known and machine learned features achieve comparable performance with an EER of 12.
GraphSAC detects anomalies in large graphs by sampling and filtering node subsets.
problem Vulnerability of holistic anomaly detection methods to compromised nodal attributes and network links.
method Randomly draws subsets of nodes, filters out contaminated sets, and uses SSL to estimate nominal label distributions.
result GraphSAC provides performance guarantees and is scalable to large graphs.
This paper detects multi-stage Feint Attacks using Bi-RNN and few-shot learning.
problem Detecting multi-stage Feint Attacks due to lack of professional datasets and semantic relationships.
method Fuzzy clustering for attack chain mining, few-shot deep learning, Bi-RNN for feature extraction.
result Accurately detected Feint Attacks using Bi-RNN and few-shot learning.
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Efficient attacks on DRL models without model access and low computation.
problem Vulnerabilities of DRL models to adversarial attacks.
method Adapting black-box attacks, introducing efficient online sequential attacks, exploring perturbations in environment dynamics, and generating robust physical perturbations.
result Demonstrated the effectiveness of proposed attacks on real-world robots.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
Unified framework for sequential decision making using meta-learning surrogate models.
problem Sequential decision making problems in various domains.
method Probabilistic model-based approach with meta-learning for data-efficient adaptation.
result Efficient and general black-box learning approach across different problem domains.
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
New attack manipulates UCB algorithm, new defense algorithm reduces pseudo-regret.
problem Adversarial attacks on stochastic bandit algorithms.
method Introducing action-manipulation attacks and proposing a robust defense algorithm.
result Proposed defense algorithm reduces pseudo-regret to O(max{log T, A}).
This paper explores evasion attacks against Bayesian models.
problem Bayesian predictive models are vulnerable to evasion attacks.
method Developed gradient-based attacks for specific point predictions and entire posterior distributions.
result Optimal evasion attacks can be designed against Bayesian models.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
A new Frank-Wolfe framework improves efficiency and effectiveness of adversarial attacks.
problem Develop efficient and effective optimization-based adversarial attack algorithms.
method Proposes a Frank-Wolfe algorithm variant for both white-box and black-box adversarial attacks.
result Demonstrates improved efficiency and effectiveness compared to existing methods.
A new adversarial attack improves model perturbation efficiency.
problem Improving adversarial attacks to better perturb images.
method LogBarrier method for solving constrained minimization problem.
result LogBarrier attack performs better on challenging images.
Adversarial attacks hide cyber-physical attacks in ICS.
problem Hiding cyber-physical attacks in industrial control systems.
method Modeling an attacker compromising sensors, manipulating data, and evaluating attacks on both continuous and mixed data.
result Successfully hides cyber-physical attacks with 2.87 out of 12 sensors compromised on average.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.
This paper optimizes attacks on reinforcement learning policies, reducing their effectiveness.
problem Optimizing adversarial attacks on reinforcement learning policies to minimize rewards.
method Designing optimal attacks for both white-box and black-box scenarios using Markov Decision Processes and Reinforcement Learning.
result Optimal attacks can reduce the effectiveness of reinforcement learning policies, especially for smooth policies.
New defense method against physical attacks on image classification models.
problem Defending against physically realizable attacks on image classification models.
method Proposed a new abstract adversarial model, rectangular occlusion attacks, and developed two approaches for efficiently computing adversarial examples.
result Adversarial training using the new attack yields robust image classification models against physical attacks.
A structured approach to generating adversarial attacks for ML systems.
problem Vulnerability of ML systems to adversarial perturbations.
method Developed an 'attack generator' to systematically create adversarial attacks.
result Summarized and extended existing adversarial perturbation taxonomies.
RayS attack improves hard-label adversarial attacks by reducing query complexity and identifying false robust models.
problem Challenges in hard-label adversarial attacks, especially in terms of effectiveness and efficiency.
method Reformulates continuous problem into discrete problem without gradient estimation and uses a fast check step to eliminate unnecessary searches.
result Significantly reduces the number of queries needed for hard-label attacks and identifies false robust models.
New attacks on RL agents' action space improve understanding of cyber-physical systems vulnerabilities.
problem Understanding and improving the robustness of RL agents in CPS against action space attacks.
method Proposed white-box MAS and LAS attack algorithms to optimize and temporally couple attack budgets.
result LAS attacks cause significantly more performance degradation than MAS attacks.
New method handles uncertainty in adversarial attacks using ensemble noise simulation.
problem Uncertainty in adversarial attacks on neural networks.
method Simulates attacker's noisy perturbation using various gradient-based attack algorithms and a pre-processing Denoising Autoencoder (DAE) defense.
result Significant improvements in post-attack accuracy with the proposed ensemble-trained defense.
This paper investigates why adversarial attacks can be effective against different models.
problem Understanding why adversarial attacks transfer between models.
method Developed a unifying optimization framework and formal definition for attack transferability.
result Identified two main factors: target model's vulnerability and surrogate model complexity.