Study detects and mitigates stealthy DDoS attacks in IoT networks.
problem Stealthy DDoS attacks in IoT networks.
method Anomaly-based IDS for timely detection and mitigation.
result Demonstrated capability of detecting and mitigating small attack size per source.
A stealthy framework injects faults into DNNs to misclassify images without affecting overall accuracy.
problem Vulnerability of deep neural networks to misclassification attacks.
method Fault sneaking attack using ADMM optimization with constraints on maintaining model accuracy and minimizing parameter modifications.
result The framework can inject multiple sneaking faults into DNNs without reducing overall accuracy.
Attackers can poison environments to force RL agents to follow target policies.
problem Security threat to reinforcement learning where attackers manipulate environments to force agents into following target policies.
method Optimization framework for finding optimal stealthy attacks under different measures of attack cost.
result Attackers can easily succeed in teaching any target policy to RL agents under mild conditions.
Stealthy hardware Trojan exploits DLA architecture vulnerabilities.
problem Security of DLA deployed on hardware accelerators.
method Input Interception Attack (IIA) exploiting statistical properties of DLA outputs.
result Stealthy Trojan can trigger with some definiteness.
Paper examines adversarial attacks on event cause analysis in power grids.
problem Adversarial attacks manipulate data to mislead event classifiers.
method Investigated adversarial attacks on CNN-based event cause analysis.
result Demonstrated adversaries can misclassify events through stealthy data manipulations.
This paper addresses detection of a reverse engineering (RE) attack targeting a deep neural network (DNN) image classifier; by querying, RE's aim is to discover the classifier's decision rule. RE can enable test-time evasion attacks, which require knowledge of the classifier. Recently, we proposed a quite effective app…
StealthRank subtly boosts LLM rankings without detectable anomalies.
problem Adversarial manipulation of LLM-driven ranking systems.
method Energy-based optimization with Langevin dynamics for stealthy prompt generation.
result StealthRank outperforms existing methods in covertly boosting rankings.
Subpopulation attacks poison data to misclassify naturally distributed points.
problem Improving accuracy of machine learning predictions through adversarial data modification.
method Introducing a novel subpopulation attack framework, using influence functions and gradient optimization.
result Subpopulation attacks are effective and stealthy, making them difficult to defend against.
Low-rate application layer distributed denial of service (LDDoS) attacks are both powerful and stealthy. They force vulnerable webservers to open all available connections to the adversary, denying resources to real users. Mitigation advice focuses on solutions that potentially degrade quality of service for legitimate…
Paper proposes ZO-NGD for more efficient black-box attacks.
problem Vulnerability of state-of-the-art DNNs to adversarial attacks.
method Zeroth-order natural gradient descent (ZO-NGD) for black-box attacks.
result ZO-NGD achieves significantly lower model query complexities.
Study cyber-attacks on RL algorithms, focusing on cost signal manipulation.
problem Adversarial manipulation of cost signals in reinforcement learning.
method Quantitative analysis of TD(λ) and Q-learning algorithms under manipulation. result Bound on approximation error for TD(λ) and convergence properties for Q-learning under stealthy attacks. Deep learning models have consistently outperformed traditional machine learning models in various classification tasks, including image classification. As such, they have become increasingly prevalent in many real world applications including those where security is of great concern. Such popularity, however, may attr…
3D models vulnerable to adversarial attacks, new method improves success rate and naturalness.
problem Vulnerability of 3D deep learning models to adversarial examples in the physical world.
method ε-isometric (ε-ISO) attack considering geometric properties and invariance to physical transformations. result Significantly improved attack success rate and naturalness of 3D adversarial examples.
VERA-V uses variational inference to discover vulnerabilities in multimodal vision-language models.
problem Existing methods for jailbreaking vision-language models are brittle, limited, and focus on single attacks.
method VERA-V recasts jailbreak discovery as learning a joint posterior distribution over text-image prompts, using variational inference and three complementary strategies.
result VERA-V consistently outperforms state-of-the-art baselines, achieving up to 53.75% higher attack success rate.
RW-based learning is vulnerable to the Pac-Man attack, which eliminates active RWs.
problem Vulnerability of RW-based learning to malicious behavior.
method Proposed the Average Crossing (AC) algorithm to prevent RW extinction.
result RW-based stochastic gradient descent remains convergent under AC, even in the presence of Pac-Man.
Backdoor attacks are found to be effective against robust machine learning models trained with PGD.
problem Injecting and defending against backdoor attacks in robust machine learning models.
method Study and detection of backdoor attacks on PGD-trained robust models using feature clustering.
result AEGIS effectively detects PGD-trained robust DNNs infected with backdoors with 91.6% accuracy.
Paper presents membership encoding for deep learning models to protect training data.
problem Protecting training data from inference attacks and ensuring copyright.
method Membership encoding algorithm for deep neural networks.
result Membership information can be encoded for a subset of training data, robust to model compression and fine-tuning.
Cronus securely transfers model parameters to protect federated learning from poisoning attacks.
problem Federated learning's privacy and security issues, especially with large models.
method Cronus uses black-box knowledge transfer to reduce parameter dimensions and control information leakage.
result Cronus is the only secure federated learning method against poisoning attacks.
Paper proposes HRS to improve neural network robustness without significant accuracy loss.
problem Vulnerability of neural networks to adversarial attacks and performance degradation.
method Hierarchical Random Switching (HRS) for robustness without sacrificing accuracy.
result HRS significantly improves adversarial robustness with minimal accuracy loss.
This paper detects multi-stage Feint Attacks using Bi-RNN and few-shot learning.
problem Detecting multi-stage Feint Attacks due to lack of professional datasets and semantic relationships.
method Fuzzy clustering for attack chain mining, few-shot deep learning, Bi-RNN for feature extraction.
result Accurately detected Feint Attacks using Bi-RNN and few-shot learning.
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.
Efficient attacks on DRL models without model access and low computation.
problem Vulnerabilities of DRL models to adversarial attacks.
method Adapting black-box attacks, introducing efficient online sequential attacks, exploring perturbations in environment dynamics, and generating robust physical perturbations.
result Demonstrated the effectiveness of proposed attacks on real-world robots.
Reward-poisoning attacks can force RL agents to learn bad policies, and we categorize and quantify their feasibility.
problem Reward-poisoning attacks can manipulate RL agents to learn undesirable policies.
method Categorize attacks by infinity-norm constraint, provide thresholds for feasibility, and develop adaptive attack strategies.
result Adaptive reward-poisoning attacks can achieve the nefarious policy in polynomial steps, while non-adaptive attacks require exponential steps.
Spanning attack improves black-box attacks with unlabeled data.
problem Query inefficiency in black-box attacks due to high input space dimensionality.
method Proposes spanning attack by constraining adversarial perturbations in a low-dimensional subspace via an auxiliary unlabeled dataset.
result Significantly improves query efficiency of black-box attacks.
Headless attacks bypass classification heads to fool transfer learning models.
problem Adversarial attacks against transfer learning models without access to the classification head.
method Label-blind adversarial attacks that do not require class-label information.
result Transfer attack lowers ResNet18 accuracy on CIFAR10 by over 40%.
New attack manipulates UCB algorithm, new defense algorithm reduces pseudo-regret.
problem Adversarial attacks on stochastic bandit algorithms.
method Introducing action-manipulation attacks and proposing a robust defense algorithm.
result Proposed defense algorithm reduces pseudo-regret to O(max{log T, A}).
This paper explores evasion attacks against Bayesian models.
problem Bayesian predictive models are vulnerable to evasion attacks.
method Developed gradient-based attacks for specific point predictions and entire posterior distributions.
result Optimal evasion attacks can be designed against Bayesian models.
Adversarial attacks pose a threat to deep neural networks, especially in safety-critical applications.
problem Adversarial attacks can misclassify deep neural networks, leading to safety issues.
method Adversarial attacks are categorized into white-box and black-box attacks based on the attacker's knowledge. They can be targeted or non-targeted.
result Adversarial attacks are effective and can transfer between different models and real-world scenarios.
Adversarial attacks hide cyber-physical attacks in ICS.
problem Hiding cyber-physical attacks in industrial control systems.
method Modeling an attacker compromising sensors, manipulating data, and evaluating attacks on both continuous and mixed data.
result Successfully hides cyber-physical attacks with 2.87 out of 12 sensors compromised on average.
New approach deflects adversarial attacks by causing them to resemble target classes.
problem Ongoing cycle of stronger defenses being broken by more advanced attacks.
method Combines three detection mechanisms in Capsule Networks to achieve state-of-the-art performance on both standard and defense-aware attacks. Uses human study to show attacks can no longer be called adversarial.
result Attack images can no longer be called adversarial because they are classified the same way as humans do.
This paper optimizes attacks on reinforcement learning policies, reducing their effectiveness.
problem Optimizing adversarial attacks on reinforcement learning policies to minimize rewards.
method Designing optimal attacks for both white-box and black-box scenarios using Markov Decision Processes and Reinforcement Learning.
result Optimal attacks can reduce the effectiveness of reinforcement learning policies, especially for smooth policies.
New defense method against physical attacks on image classification models.
problem Defending against physically realizable attacks on image classification models.
method Proposed a new abstract adversarial model, rectangular occlusion attacks, and developed two approaches for efficiently computing adversarial examples.
result Adversarial training using the new attack yields robust image classification models against physical attacks.
A structured approach to generating adversarial attacks for ML systems.
problem Vulnerability of ML systems to adversarial perturbations.
method Developed an 'attack generator' to systematically create adversarial attacks.
result Summarized and extended existing adversarial perturbation taxonomies.
RayS attack improves hard-label adversarial attacks by reducing query complexity and identifying false robust models.
problem Challenges in hard-label adversarial attacks, especially in terms of effectiveness and efficiency.
method Reformulates continuous problem into discrete problem without gradient estimation and uses a fast check step to eliminate unnecessary searches.
result Significantly reduces the number of queries needed for hard-label attacks and identifies false robust models.
New attacks on RL agents' action space improve understanding of cyber-physical systems vulnerabilities.
problem Understanding and improving the robustness of RL agents in CPS against action space attacks.
method Proposed white-box MAS and LAS attack algorithms to optimize and temporally couple attack budgets.
result LAS attacks cause significantly more performance degradation than MAS attacks.
Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. How…
New method handles uncertainty in adversarial attacks using ensemble noise simulation.
problem Uncertainty in adversarial attacks on neural networks.
method Simulates attacker's noisy perturbation using various gradient-based attack algorithms and a pre-processing Denoising Autoencoder (DAE) defense.
result Significant improvements in post-attack accuracy with the proposed ensemble-trained defense.
New attacks reveal membership in label-only ML models.
problem Vulnerability of ML models to membership inference attacks.
method Developed decision-based membership inference attacks.
result Label-only exposures are vulnerable to membership leakage.
Paper creates universal adversarial attacks.
problem Creating universal, transferable, and targeted adversarial attacks.
method Learn a universal mapping to map sources to adversarial examples.
result Examples can fool networks into classifying all into one targeted class and have strong transferability.
Defends against ML inference attacks using adversarial examples.
problem Automated inference attacks using ML classifiers pose privacy and security threats.
method Turns ML classifier vulnerabilities into defenses by adding adversarial noise to public data.
result Adversarial examples can mislead ML classifiers and protect private data.
This paper proposes multi-view attack strategies for deep models.
problem Vulnerability of multi-view deep models to adversarial attacks.
method Two multi-view attack strategies: two-stage attack (TSA) and end-to-end attack (ETEA).
result Proposed multi-view attack strategies are effective on multi-view deep models.
Adversarial attacks for image classification are small perturbations to images that are designed to cause misclassification by a model. Adversarial attacks formally correspond to an optimization problem: find a minimum norm image perturbation, constrained to cause misclassification. A number of effective attacks have b…
New attacks can infer model training membership using only label predictions, not confidence.
problem Inferring whether a data point was used to train a machine learning model.
method Evaluate model's predicted labels under perturbations to infer membership.
result Label-only attacks perform as well as confidence-based attacks and break defenses that rely on confidence masking.
Paper studies attacks on bandit algorithms and shows how attackers can manipulate data to hijack behavior.
problem Potential attacks on bandit algorithms can cause catastrophic loss in real-world applications.
method Proposes a framework of offline and online attacks on bandit algorithms using convex optimization and adaptive strategies.
result Attackers can force bandit algorithms to pull target arms with high probability by manipulating data.
Efficiently attacks large-scale graphs without using the whole graph.
problem Vulnerability of graph neural networks to adversarial attacks.
method Simplified Gradient-based Attack (SGA) method for large-scale graphs.
result SGA achieves significant time and memory efficiency improvements.
Pixle attacks images by rearranging pixels, bypassing neural networks.
problem Vulnerability of neural networks to black-box adversarial attacks.
method A novel attack that rearranges a small number of pixels in images.
result Successfully attacks a high percentage of samples on various datasets and models.
Adversarial training makes models more vulnerable to privacy attacks.
problem Privacy attacks on robust models become feasible.
method Demonstrated through model inversion attacks on robustly trained models.
result Privacy attacks on robust models are now feasible.
We introduce two tactics to attack agents trained by deep reinforcement learning algorithms using adversarial examples, namely the strategically-timed attack and the enchanting attack. In the strategically-timed attack, the adversary aims at minimizing the agent's reward by only attacking the agent at a small subset of…