Sparse-RS framework efficiently attacks models with sparse perturbations.
problem Efficiently attacking models with sparse perturbations in the black-box setting.
method Random search-based Sparse-RS framework for score-based attacks.
result Sparse-RS achieves state-of-the-art success rate and query efficiency.
New defense method reduces adversarial attacks on neural networks.
problem Vulnerability of deep neural networks to adversarial attacks.
method Sparse coding frontend trained on clean images.
result Significantly attenuates adversarial attacks before reaching classifier.
Neural networks have been proven to be vulnerable to a variety of adversarial attacks. From a safety perspective, highly sparse adversarial attacks are particularly dangerous. On the other hand the pixelwise perturbations of sparse attacks are typically large and thus can be potentially detected. We propose a new black…
LSDAT reduces query efficiency for decision-based adversarial attacks.
problem Improving query efficiency for decision-based adversarial attacks.
method Low-rank and sparse decomposition (LSD) to craft perturbations.
result LSDAT achieves superior fooling rates with fewer queries.
It is by now well-known that small adversarial perturbations can induce classification errors in deep neural networks (DNNs). In this paper, we make the case that sparse representations of the input data are a crucial tool for combating such attacks. For linear classifiers, we show that a sparsifying front end is prova…
New method certifies robustness to sparse adversarial attacks.
problem Ensuring robustness of classifiers to sparse adversarial attacks.
method Randomized ablation of input features to provide robustness guarantees.
result Certifies robustness to sparse adversarial attacks with up to 31 pixels of distortion.
Derives moments of PL networks for robust DNNs.
problem Analyzing robustness of DNNs to adversarial attacks.
method Derives exact analytic expressions for moments of PL networks, generalizes variance expression, and constructs sparse and smooth adversarial attacks.
result New variance expressions are tighter and can be efficiently approximated.
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
Efficiently poisons offline RLHF models by flipping preference labels.
problem Vulnerability of offline RLHF models to preference label flipping attacks.
method Developed two attack methods: BAL-A and BMP-A, solving a structured binary sparse approximation problem.
result Demonstrated that flipping one preference label induces a parameter-independent shift in the DPO gradient, enabling structured binary sparse approximation.
Campfire simplifies sparse training for CNNs, achieving high accuracy with minimal pruning.
problem Training CNNs with sparse weights to maintain high accuracy and robustness.
method Gradual pruning technique with simplified sparsity structure, exploring various tradeoffs.
result Sparse ResNet-50 and ResNet-50 v1.5 achieve 75% top-1 accuracy with 70% sparsity, <1% accuracy loss.
Sparse perturbations improve convergence in SZO methods for faster training.
problem Dependency of SZO methods on function dimensionality limits their convergence speed.
method Sparse perturbations reduce the effective dimensionality of the optimization problem.
result Sparse SZO optimization leads to faster convergence in training loss and test accuracy.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
CLEANN detects and mitigates neural network Trojans without labeled data.
problem Trojans in embedded neural networks that bypass detection during inference.
method Dictionary learning and sparse approximation for identifying Trojan triggers, lightweight algorithm/hardware co-design.
result Efficient real-time execution on resource-constrained platforms, competitive attack resiliency.
We develop a method to factorize symmetric sparse Boolean matrices efficiently.
problem Finding a symmetric factorization of a given matrix into a sparse, Boolean matrix.
method Polynomial-time algorithm based on bootstrapping higher-order information and tensor decomposition.
result A matrix with full column rank can be recovered with high probability when the matrix size is sufficiently large.
Deep neural networks (DNNs) are computationally/memory-intensive and vulnerable to adversarial attacks, making them prohibitive in some real-world applications. By converting dense models into sparse ones, pruning appears to be a promising solution to reducing the computation/memory cost. This paper studies classificat…
Adaptive Bayesian method improves deep learning performance and robustness.
problem Ensuring sparsity in deep learning models to improve performance and robustness.
method Adaptive empirical Bayesian method with self-adaptive spike-and-slab priors and stochastic gradient MCMC optimization.
result The method achieves state-of-the-art performance on MNIST and Fashion MNIST and compression performance on CIFAR10.
The paper analyzes how adversarial attacks affect sparse regression models.
problem Effects of adversarial attacks on sparse regression models.
method Primal-dual witness paradigm to analyze support of estimated regression parameter vector.
result Adversaries can influence sample complexity by corrupting irrelevant features.
Score attack method provides a lower bound on privacy-constrained minimax risk.
problem Characterizing the optimality of privacy-constrained statistical models.
method Score attack based on tracing attack concept.
result Optimally lower bounds the minimax risk of estimating unknown model parameters.
Pro-GNN defends graph neural networks from adversarial attacks by learning graph structure.
problem Vulnerability of GNNs to adversarial attacks on real-world graphs.
method Pro-GNN learns a structural graph and a robust GNN model jointly from perturbed graphs guided by intrinsic graph properties.
result Pro-GNN achieves significantly better performance than state-of-the-art defense methods, even on heavily perturbed graphs.
Sparse neural networks can be robust to adversarial attacks.
problem Finding robust neural networks that are also sparse.
method Empirical evaluation and analysis of the Lottery Ticket Hypothesis with adversarial training.
result Sparse, robust neural networks can be found using adversarial training.
Paper develops a robust classifier for Gaussian mixture models under sparse adversarial perturbations.
problem Classifying data under sparse adversarial perturbations for Gaussian mixture models.
method Develops FilTrun algorithm with filtration and truncation modules.
result Characterizes optimal robust classifier and robust classification error.
In this paper, we address a problem of machine learning system vulnerability to adversarial attacks. We propose and investigate a Key based Diversified Aggregation (KDA) mechanism as a defense strategy. The KDA assumes that the attacker (i) knows the architecture of classifier and the used defense strategy, (ii) has an…
Guarantees robustness of Gaussian process classifiers against adversarial attacks.
problem Protecting machine learning classifiers from adversarial perturbations.
method Developed an adversarial bound (AB) for Gaussian process classifiers, providing a formal guarantee of robustness.
result Proves that the proposed method produces a practical, useful, and provably robust classifier.
Stochastic LWTA networks resist adversarial attacks while maintaining accuracy.
problem Adversarial robustness of neural networks.
method Replaced ReLU with stochastic LWTA activations, trained with Variational Bayesian and PGD.
result Stochastic LWTA networks achieve state-of-the-art robustness against adversarial attacks.
In this paper, we study the adversarial robustness of subspace learning problems. Different from the assumptions made in existing work on robust subspace learning where data samples are contaminated by gross sparse outliers or small dense noises, we consider a more powerful adversary who can first observe the data matr…
Proposes DSM priors for Bayesian neural networks to improve interpretability and robustness.
problem Bayesian neural networks struggle with interpretability, overconfidence, and adversarial attacks.
method Introduces Dirichlet scale mixture (DSM) priors to address these issues.
result DSM priors lead to sparse networks, robustness against adversarial attacks, and competitive predictive performance.
Gaussian process (GP) models form a core part of probabilistic machine learning. Considerable research effort has been made into attacking three issues with GP models: how to compute efficiently when the number of data is large; how to approximate the posterior when the likelihood is not Gaussian and how to estimate co…
Optimizes subset selection in sparse learning problems.
problem Sparse learning problems, particularly best subset selection.
method Developed an efficient primal-dual algorithm leveraging dual range estimation and incremental strategy.
result Improves solutions of best subset selection with reduced redundant computation.
Anomaly detection model for large networks identifies attacks with reduced false positives.
problem Detecting anomalies in large, sparse, directed networks.
method Dynamic logistic model with latent factors, variational Bayesian estimation, case-control approximation.
result Model reduces false positives by identifying red team attack with half the detection rate.
Despite their impressive performance, deep convolutional neural networks (CNNs) have been shown to be sensitive to small adversarial perturbations. These nuisances, which one can barely notice, are powerful enough to fool sophisticated and well performing classifiers, leading to ridiculous misclassification results. In…
In this paper we propose a Bayesian nonparametric approach to modelling sparse time-varying networks. A positive parameter is associated to each node of a network, which models the sociability of that node. Sociabilities are assumed to evolve over time, and are modelled via a dynamic point process model. The model is a…
We give a new algorithm for approximating the Discrete Fourier transform of an approximately sparse signal that has been corrupted by worst-case L0 noise, namely a bounded number of coordinates of the signal have been corrupted arbitrarily. Our techniques generalize to a wide range of linear transformations that are…
Paper proposes a framework to detect adversarial concept drifts under poisoning attacks.
problem Adversarial concept drift in data streams.
method Augmented Restricted Boltzmann Machine with improved gradient computation and energy function.
result High robustness and efficacy of the proposed drift detection framework in adversarial scenarios.
Although deep learning has shown great success in recent years, researchers have discovered a critical flaw where small, imperceptible changes in the input to the system can drastically change the output classification. These attacks are exploitable in nearly all of the existing deep learning classification frameworks.…
Class selectivity affects robustness to corruptions but not to adversarial attacks.
problem Understanding the relationship between class selectivity and robustness in neural networks.
method Investigated the impact of class selectivity on robustness to natural corruptions and adversarial attacks using Tiny ImageNetC and CIFAR10C datasets.
result Decreasing class selectivity increases robustness to both natural corruptions and adversarial attacks.
New deep learning model robust to adversarial attacks using stochastic LWTA units.
problem Adversarial robustness in deep learning networks.
method Introduces deep networks with stochastic LWTA activations, combining them with Bayesian non-parametric tools.
result Achieves high robustness to adversarial perturbations, outperforming state-of-the-art methods.
Deep neural networks perform well on real world data but are prone to adversarial perturbations: small changes in the input easily lead to misclassification. In this work, we propose an attack methodology not only for cases where the perturbations are measured by ℓp norms, but in fact any adversarial dissimilarit…
Neural networks have been shown to be vulnerable against minor adversarial perturbations of their inputs, especially for high dimensional data under ℓ∞ attacks. To combat this problem, techniques like adversarial training have been employed to obtain models which are robust on the training set. However, the …
Efficient algorithm solves best subset selection problem.
problem Sparse learning problems, especially best subset selection.
method Primal-dual method based on dual forms of ℓ0-regularized problems. result Improves solutions of best subset selection with reduced redundant computation.
Gradient-based explanations correlate with Android malware classifier robustness.
problem Evasion attacks on Android malware classifiers using sparse perturbations.
method Investigated gradient-based attribution methods for explaining classifier decisions and their evenness, proposing metrics to assess adversarial robustness.
result Gradient-based explanations, especially Integrated Gradients, correlate with adversarial robustness of malware classifiers.
Orthogonal Matching Pursuit (OMP) has long been considered a powerful heuristic for attacking compressive sensing problems; however, its theoretical development is, unfortunately, somewhat lacking. This paper presents an improved Restricted Isometry Property (RIP) based performance guarantee for T-sparse signal reconst…
"Feint Attack", as a new type of APT attack, has become the focus of attention. It adopts a multi-stage attacks mode which can be concluded as a combination of virtual attacks and real attacks. Under the cover of virtual attacks, real attacks can achieve the real purpose of the attacker, as a result, it often caused hu…
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
New attack manipulates UCB algorithm, new defense algorithm reduces pseudo-regret.
problem Adversarial attacks on stochastic bandit algorithms.
method Introducing action-manipulation attacks and proposing a robust defense algorithm.
result Proposed defense algorithm reduces pseudo-regret to O(max{log T, A}).