DEceit constructs effective universal pixel-restricted perturbations for deep image classifiers.
problem Creating effective universal pixel-restricted perturbations for deep neural networks.
method DEceit algorithm for black-box feedback, targeting 10% of pixels in images.
result Perturbing only 10% of pixels achieves high Fooling Rate and visual similarity.
Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according t…
Evolutionary algorithm finds optimal pixel perturbations to improve neural network generalization.
problem Minimal data corruption by pixel modifications causes overfitting in neural networks.
method Evolutionary algorithm with a novel cost function to maximize generalization gap and domain divergence.
result Method outperforms previous pixel-based data distribution shift methods on CNNs.
Deep neural networks were shown to be vulnerable to single pixel modifications. However, the reason behind such phenomena has never been elucidated. Here, we propose Propagation Maps which show the influence of the perturbation in each layer of the network. Propagation Maps reveal that even in extremely deep networks s…
One pixel modification can make deep models unlearnable.
problem Protecting data from unauthorized training of deep neural networks.
method Perturbing only one pixel in each image to degrade model accuracy.
result Generated One-Pixel Shortcut (OPS) cannot be erased by adversarial training and strong augmentations.
New strategy uses interpretability to improve adversarial learning.
problem Improving adversarial learning speed and effectiveness.
method Spatially constrained one-pixel adversarial perturbations guided by gradient-based interpretability.
result Spatially constrained one-pixel adversarial perturbations noticeably improve convergence and attack success.
We improve image perturbation defenses using a better-defined Wasserstein threat model.
problem Real-world image perturbations are not pixel-independent, unlike ℓp threat models. method We rectify flaws in the Wasserstein threat model and explore stronger attacks and defenses.
result Current Wasserstein-robust models are ineffective against real-world perturbations.
New method certifies robustness to sparse adversarial attacks.
problem Ensuring robustness of classifiers to sparse adversarial attacks.
method Randomized ablation of input features to provide robustness guarantees.
result Certifies robustness to sparse adversarial attacks with up to 31 pixels of distortion.
A new method generates natural-looking adversarial examples by bounding internal activation values.
problem Creating natural-looking adversarial examples that closely mimic the original input.
method Bounding internal activation values through a distribution quantile bound and polynomial barrier loss function.
result Our attack achieves similar success and confidence levels as state-of-the-art methods but with more natural-looking perturbations.
Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-…
Minimalistic attacks reveal deep RL policies' vulnerabilities with little perturbation.
problem Tackling the vulnerability of deep reinforcement learning policies to minimal perturbations.
method Three key settings: black-box policy access, fractional-state adversary, and tactically-chanced attack. Formulated adversarial attacks on six Atari games.
result Deep RL policies can be significantly fooled by minimal perturbations, even in 0.01% of the input state.
This paper explores how facial recognition systems can be fooled by adversarial attacks.
problem Adversarial attacks on facial recognition systems.
method Applying Fast Gradient Sign Method and crafting various black-box attack algorithms.
result High levels of perturbation can significantly decrease classifier confidence and misclassification rates.
Randomly dropping pixels improves neural network robustness.
problem Adversarial examples vulnerability of deep neural networks.
method Training and testing with randomly subsampled images at high drop rates.
result Significantly improved robustness against various perturbations.
Simple image augmentation boosts deep RL from pixels.
problem Training deep RL models from raw pixel inputs is challenging.
method Applying standard computer vision data augmentation to reinforcement learning.
result Our method significantly improves SAC's performance on DeepMind control suite.
mFI-PSO generates effective adversarial images for DNNs.
problem Vulnerability of DNNs to small perturbations in images.
method Uses mFI for pixel selection and PSO for objective functions.
result mFI-PSO effectively designs flexible adversarial images.
Paper proposes EMO-based AE generation for black-box settings.
problem Designing robust adversarial examples for black-box models.
method Evolutionary Multi-objective Optimization (EMO) for generating various types of adversarial examples.
result EMO-based method generates AEs that are robust and applicable to high-resolution images.
Machine learning methods in general and Deep Neural Networks in particular have shown to be vulnerable to adversarial perturbations. So far this phenomenon has mainly been studied in the context of whole-image classification. In this contribution, we analyse how adversarial perturbations can affect the task of semantic…
New method generates adversarial images under various non-smooth metrics.
problem Adversarial perturbations misclassify deep neural networks.
method Proposes an attack methodology for non-ℓp adversarial dissimilarity metrics. result ProxLogBarrier outperforms existing methods and reveals new perturbation types.
New tool for interpreting neural nets, explaining model behavior.
problem Interpreting neural network responses and explaining model behavior.
method Full-Gradient representation and FullGrad saliency map approximation.
result FullGrad method explains model behavior more comprehensively and accurately than other methods.
New method evaluates visual explanations of deep models using adversarial perturbations.
problem Lack of objective evaluation of visual explanations of deep models.
method Proposes an adversarial perturbation approach to evaluate visual explanations of deep models.
result Demonstrates the effectiveness of the proposed approach through comparisons with existing methods.
This paper explores the trade-off between spatial and adversarial robustness in neural networks.
problem Understanding the trade-off between spatial and adversarial robustness in neural networks.
method Quantitative analysis and empirical testing with curriculum learning.
result Spatial robustness and adversarial robustness are quantitatively related and can be improved simultaneously.
Deep neural networks are powerful and popular learning models that achieve state-of-the-art pattern recognition performance on many computer vision, speech, and language processing tasks. However, these networks have also been shown susceptible to carefully crafted adversarial perturbations which force misclassificatio…
In this paper we propose a novel method for detecting adversarial examples by training a binary classifier with both origin data and saliency data. In the case of image classification model, saliency simply explain how the model make decisions by identifying significant pixels for prediction. A model shows wrong classi…
The study reveals how adversarial perturbations can include class features for generalization.
problem Understanding why adversarial examples deceive neural networks and transfer between networks.
method A one-hidden-layer network trained on mutually orthogonal samples.
result Adversarial perturbations, even of a few pixels, contain sufficient class features for generalization.
Improves image quality in generative models by estimating pixel-wise aleatoric uncertainty.
problem Lack of quantitative assessment of image quality in diffusion models.
method Estimate pixel-wise aleatoric uncertainty during sampling phase using a perturbation scheme designed for diffusion models.
result Uncertainty-guided sampling leads to better sample generation quality as shown by FID scores.
Despite the tremendous success of deep neural networks in various learning problems, it has been observed that adding an intentionally designed adversarial perturbation to inputs of these architectures leads to erroneous classification with high confidence in the prediction. In this work, we propose a general framework…
Spiking neural networks perform similarly to deep networks on occluded images.
problem Robust object recognition in partially occluded images.
method Developed a two-layer spiking neural network trained on natural scenes with a biologically plausible learning rule, compared to deep convolutional networks.
result Spiking neural networks achieve good accuracy and robustness on stepwise pixel erasement tasks.
PARADE generates provably robust adversarial examples for deep networks.
problem Creating robust adversarial examples for deep neural networks.
method Iterative refinement of adversarial regions using optimization to ensure robustness under various perturbations.
result PARADE finds large, provably robust adversarial regions with high volume under various perturbations.
Hierarchical randomized smoothing improves model robustness for complex data.
problem Certifying robustness on complex data (e.g. images, graphs) is challenging.
method Add random noise to a randomly selected subset of entities in a hierarchical manner.
result Hierarchical randomized smoothing yields stronger robustness guarantees with high accuracy.
A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by ℓp norm-bounded perturbations. In this paper, we propose a new threat model for adver…
PRoA assesses deep learning robustness against practical functional perturbations.
problem Inadequate practical robustness verification methods for deep learning systems.
method Probabilistic robustness assessment based on adaptive concentration.
result Statistical guarantees on probabilistic robustness against functional perturbations.
Paper proposes structured semantic perturbations to improve adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Manipulates semantic attributes via disentangled latent codes.
result Demonstrates the effectiveness of structured semantic perturbations.
Dual quality assessment method tackles adversarial robustness issues across various metrics.
problem Varying robustness levels and bias in adversarial attacks and defenses.
method Model agnostic dual quality assessment method, including robustness levels.
result Current networks and defenses are vulnerable at all robustness levels, highlighting the need for a dual approach.
Given the ability to directly manipulate image pixels in the digital input space, an adversary can easily generate imperceptible perturbations to fool a Deep Neural Network (DNN) image classifier, as demonstrated in prior work. In this work, we propose ShapeShifter, an attack that tackles the more challenging problem o…
DANCE improves saliency maps by adding subtle input variations.
problem Poor performance of saliency methods in saturated gradients, adversarial perturbations, and inter-feature dependence.
method Two-step procedure: 1) Perturbation mechanism, 2) Aggregation of saliency maps.
result DANCE saliency method outperforms existing methods qualitatively and quantitatively.
Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the Lp distance for penalizing perturbations. Researchers have explored different defense met…
Adversarial examples are perturbed inputs designed to fool machine learning models. Most recent works on adversarial examples for image classification focus on directly modifying pixels with minor perturbations. A common requirement in all these works is that the malicious perturbations should be small enough (measured…
Automated tests detect interactions in unstructured data.
problem Detecting interactions between latent variables in low-dimensional systems.
method Derive two interaction tests based on pairwise interventions and integrate them into an active learning pipeline.
result Tests can identify more known biological interactions than random search and standard active learning baselines.
Adversarial examples are perturbed inputs that are designed (from a deep learning network's (DLN) parameter gradients) to mislead the DLN during test time. Intuitively, constraining the dimensionality of inputs or parameters of a network reduces the 'space' in which adversarial examples exist. Guided by this intuition,…
In this paper, we study the nonnegative matrix factorization problem under the separability assumption (that is, there exists a cone spanned by a small subset of the columns of the input nonnegative data matrix containing all columns), which is equivalent to the hyperspectral unmixing problem under the linear mixing mo…
Adversarial examples have been shown to exist for a variety of deep learning architectures. Deep reinforcement learning has shown promising results on training agent policies directly on raw inputs such as image pixels. In this paper we present a novel study into adversarial attacks on deep reinforcement learning polic…
Injecting adversarial examples during training, known as adversarial training, can improve robustness against one-step attacks, but not for unknown iterative attacks. To address this challenge, we first show iteratively generated adversarial images easily transfer between networks trained with the same strategy. Inspir…
In blind hyperspectral unmixing (HU), the pure-pixel assumption is well-known to be powerful in enabling simple and effective blind HU solutions. However, the pure-pixel assumption is not always satisfied in an exact sense, especially for scenarios where pixels are heavily mixed. In the no pure-pixel case, a good blind…
A new method improves robustness in image translation by modeling uncertainty.
problem Performance degradation in image translation models due to lack of robustness to outliers and uncertainty.
method UGAC method based on Uncertainty-aware Generalized Adaptive Cycle Consistency, modeling per-pixel residual with generalized Gaussian distribution.
result Our method exhibits stronger robustness towards unseen perturbations in test data.
Study identifies key parameters and input dimensions making LLMs and VLMs brittle.
problem Vulnerability of large language and vision-language models to perturbations.
method Proposed FI measure based on information geometry to quantify sensitivity.
result Small subset of high FI parameters significantly contribute to brittleness.
New technique crafts imperceivable sparse adversarial attacks.
problem Vulnerability of neural networks to adversarial attacks.
method Proposes a black-box technique to minimize l0-distance, integrating componentwise constraints. result Adversarial examples are almost imperceivable and non-detectable.
Any subset of the plane can be approximated by a set of square pixels. This transition from a shape to its pixelation is rather brutal since it destroys geometric and topological information about the shape. Using a technique inspired by Morse Theory, we algorithmically produce a PL approximation of the original shape …
LSDAT reduces query efficiency for decision-based adversarial attacks.
problem Improving query efficiency for decision-based adversarial attacks.
method Low-rank and sparse decomposition (LSD) to craft perturbations.
result LSDAT achieves superior fooling rates with fewer queries.