New attacks improve privacy audits by analyzing model updates.
problem Improving privacy audits of AI models through sequence analysis.
method Developed SeMI attacks to identify target insertions in model sequences.
result SeMI attacks achieve higher power and tighter privacy audits.
Applications in machine learning, optimization, and control require the sequential selection of a few system elements, such as sensors, data, or actuators, to optimize the system performance across multiple time steps. However, in failure-prone and adversarial environments, sensors get attacked, data get deleted, and a…
We study data poisoning attacks in the online setting where training items arrive sequentially, and the attacker may perturb the current item to manipulate online learning. Importantly, the attacker has no knowledge of future training items nor the data generating distribution. We formulate online data poisoning attack…
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
Recent studies show that Deep Reinforcement Learning (DRL) models are vulnerable to adversarial attacks, which attack DRL models by adding small perturbations to the observations. However, some attacks assume full availability of the victim model, and some require a huge amount of computation, making them less feasible…
RNNs are vulnerable to adversarial attacks, especially in network traffic.
problem Adversarial attacks on RNNs for IDSs in network traffic.
method Developed new explainability techniques and ARS for comparing IDSs.
result RNNs are vulnerable to adversarial attacks, even in sequential data.
Attack graphs provide compact representations of the attack paths that an attacker can follow to compromise network resources by analysing network vulnerabilities and topology. These representations are a powerful tool for security risk assessment. Bayesian inference on attack graphs enables the estimation of the risk …
Differentiable adversarial attacks improve model robustness in MTPP models.
problem Improving model robustness against adversarial attacks in MTPP models.
method Proposed a differentiable adversarial attack scheme PERMTPP that addresses the sequential nature and varying time-scales of MTPPs.
result Demonstrated offensive and defensive capabilities, and reduced inference times on real-world datasets.
Study improves resilience against adversarial clean-label attacks in real and noisy settings.
problem Ensuring accurate predictions in the presence of adversarial clean-label samples.
method Sequential learning from a stream of i.i.d. data, allowing abstention for uncertain predictions.
result Theoretical analysis and adaptations for the agnostic setting with a clean-label adversary and noise.
Reinforcement learning (RL) has advanced greatly in the past few years with the employment of effective deep neural networks (DNNs) on the policy networks. With the great effectiveness came serious vulnerability issues with DNNs that small adversarial perturbations on the input can change the output of the network. Sev…
Real-world graph applications, such as advertisements and product recommendations make profits based on accurately classify the label of the nodes. However, in such scenarios, there are high incentives for the adversaries to attack such graph to reduce the node classification performance. Previous work on graph adversa…
Deep neural networks (DNNs) are vulnerable to malicious inputs crafted by an adversary to produce erroneous outputs. Works on securing neural networks against adversarial examples achieve high empirical robustness on simple datasets such as MNIST. However, these techniques are inadequate when empirically tested on comp…
Marich extracts high-fidelity models from public data with minimal queries.
problem Creating an accurate replica of a target ML model using few queries.
method Sequentially selects informative queries to maximize entropy and reduce model mismatch.
result Extracted models achieve 60-95% of target model's accuracy with 1,000-8,500 queries.
Deep learning models are vulnerable to external attacks. In this paper, we propose a Reinforcement Learning (RL) based approach to generate adversarial examples for the pre-trained (target) models. We assume a semi black-box setting where the only access an adversary has to the target model is the class probabilities o…
Algorithm helps explain neural networks' decisions.
problem Lack of transparency in neural networks' decision-making.
method Proposes an algorithm to trace and detect adversarial attacks.
result Algorithm effectively traces DNNs' decision processes and detects adversarial attacks.
New method for model inversion attacks on deep networks.
problem Extracting private information from trained deep learning models.
method Leveraging generative adversarial networks to find realistic class representations.
result Efficiency of model inversion attack within a connected lower-dimensional manifold.
Paper presents first model extraction attack against DRL models.
problem Stealing DRL models from interaction with environment.
method Imitation learning approach to recover DRL models from predicted actions.
result Successfully recovers DRL models with high fidelity and accuracy.
We introduce a unified probabilistic framework for solving sequential decision making problems ranging from Bayesian optimisation to contextual bandits and reinforcement learning. This is accomplished by a probabilistic model-based approach that explains observed data while capturing predictive uncertainty during the d…
SOO uses bandit theory to optimize functions with limited evaluations.
problem Optimizing functions with a limited number of evaluations.
method SOO is a machine learning approach that uses domain partitioning and a tradeoff between exploration and exploitation.
result SOO provides guarantees on the returned solution and is numerically efficient.
Generative ML learns optimal pursuit trajectories in pursuit-evasion games.
problem Optimizing Blue's pursuit trajectory to intercept Red in a game of pursuit-evasion.
method Applying generative machine learning to learn optimal action policies for Blue.
result Generative ML models can learn relevant representations for pursuit-evasion dynamics.
For regular particle filter algorithm or Sequential Monte Carlo (SMC) methods, the initial weights are traditionally dependent on the proposed distribution, the posterior distribution at the current timestamp in the sampled sequence, and the target is the posterior distribution of the previous timestamp. This is techni…
Improved IDS using LSTM and embedding for network traffic data.
problem Network security threats and need for IDS to detect attacks.
method Proposes IDS models using LSTM for time-series and embedding for categorical network traffic data.
result Improves binary classification accuracy to 99.72%.
Deep learning improves time series classification accuracy.
problem Classifying time series data efficiently.
method Developed deep neural networks for time series classification.
result Demonstrated superior performance of deep learning methods.
"Feint Attack", as a new type of APT attack, has become the focus of attention. It adopts a multi-stage attacks mode which can be concluded as a combination of virtual attacks and real attacks. Under the cover of virtual attacks, real attacks can achieve the real purpose of the attacker, as a result, it often caused hu…
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
New attack manipulates UCB algorithm, new defense algorithm reduces pseudo-regret.
problem Adversarial attacks on stochastic bandit algorithms.
method Introducing action-manipulation attacks and proposing a robust defense algorithm.
result Proposed defense algorithm reduces pseudo-regret to O(max{log T, A}).
This paper explores evasion attacks against Bayesian models.
problem Bayesian predictive models are vulnerable to evasion attacks.
method Developed gradient-based attacks for specific point predictions and entire posterior distributions.
result Optimal evasion attacks can be designed against Bayesian models.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
Adversarial attacks hide cyber-physical attacks in ICS.
problem Hiding cyber-physical attacks in industrial control systems.
method Modeling an attacker compromising sensors, manipulating data, and evaluating attacks on both continuous and mixed data.
result Successfully hides cyber-physical attacks with 2.87 out of 12 sensors compromised on average.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.
RayS attack improves hard-label adversarial attacks by reducing query complexity and identifying false robust models.
problem Challenges in hard-label adversarial attacks, especially in terms of effectiveness and efficiency.
method Reformulates continuous problem into discrete problem without gradient estimation and uses a fast check step to eliminate unnecessary searches.
result Significantly reduces the number of queries needed for hard-label attacks and identifies false robust models.
Robust algorithm optimizes corrupted Gaussian process bandits.
problem Sequential optimization of corrupted, expensive reward functions.
method Robust GP Phased Elimination (RGP-PE) algorithm.
result Algorithm balances robustness to corruptions with exploration and exploitation.
Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. How…
New method handles uncertainty in adversarial attacks using ensemble noise simulation.
problem Uncertainty in adversarial attacks on neural networks.
method Simulates attacker's noisy perturbation using various gradient-based attack algorithms and a pre-processing Denoising Autoencoder (DAE) defense.
result Significant improvements in post-attack accuracy with the proposed ensemble-trained defense.
Control policies, trained using the Deep Reinforcement Learning, have been recently shown to be vulnerable to adversarial attacks introducing even very small perturbations to the policy input. The attacks proposed so far have been designed using heuristics, and build on existing adversarial example crafting techniques …
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Adversarial attacks for image classification are small perturbations to images that are designed to cause misclassification by a model. Adversarial attacks formally correspond to an optimization problem: find a minimum norm image perturbation, constrained to cause misclassification. A number of effective attacks have b…
This paper proposes multi-view attack strategies for deep models.
problem Vulnerability of multi-view deep models to adversarial attacks.
method Two multi-view attack strategies: two-stage attack (TSA) and end-to-end attack (ETEA).
result Proposed multi-view attack strategies are effective on multi-view deep models.
New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
Efficiently attacks large-scale graphs without using the whole graph.
problem Vulnerability of graph neural networks to adversarial attacks.
method Simplified Gradient-based Attack (SGA) method for large-scale graphs.
result SGA achieves significant time and memory efficiency improvements.
Most state-of-the-art machine learning (ML) classification systems are vulnerable to adversarial perturbations. As a consequence, adversarial robustness poses a significant challenge for the deployment of ML-based systems in safety- and security-critical environments like autonomous driving, disease detection or unmann…
We introduce two tactics to attack agents trained by deep reinforcement learning algorithms using adversarial examples, namely the strategically-timed attack and the enchanting attack. In the strategically-timed attack, the adversary aims at minimizing the agent's reward by only attacking the agent at a small subset of…
A new method uses adversarial attacks to detect other adversarial attacks.
problem Detecting iterative adversarial attacks on deep neural networks.
method Using the Carlini-Wagner (CW) attack as a detector itself, under certain assumptions.
result The method provides asymptotically optimal separation of original and attacked images.
Study on reward poisoning attacks on CMAB, revealing attackability depends on adversary's knowledge.
problem Reward poisoning attacks on Combinatorial Multi-Armed Bandits (CMAB).
method Provided a sufficient and necessary condition for attackability, devised an attack algorithm.
result Attackability of CMAB depends on adversary's knowledge of the bandit instance.