This paper addresses detection of a reverse engineering (RE) attack targeting a deep neural network (DNN) image classifier; by querying, RE's aim is to discover the classifier's decision rule. RE can enable test-time evasion attacks, which require knowledge of the classifier. Recently, we proposed a quite effective app…
On-device research index
arXiv research
A locally-built, LLM-digested index of recent arXiv papers in quant finance, geometry/topology, and statistical ML — keyword search served straight from SQLite on this machine.
168,932 papers · 148 categories
Trend · papers per month
48 results for “test-time attacks”
Neural networks can predict BMI from faces, and can be fooled into wrong predictions.
problem Vulnerability of BMI prediction models to adversarial attacks.
method Test-time adversarial attacks on neural networks trained to infer BMI from facial images.
result Neural networks can be tricked into predicting incorrect BMI values, posing a risk of insurance fraud.
New attacks show ML models can be compromised even when targeting one concept.
problem Vulnerability of ML models to multi-concept attacks.
method Developed novel multi-concept attack techniques for deep learning.
result Successfully attacked one set of classifiers without impacting others.
Paper explores how poisoning data can increase privacy risks in machine learning models.
problem Increasing privacy risks of benign training samples through data poisoning attacks.
method Proposes generic and optimization-based attacks to amplify membership exposure.
result Demonstrates substantial increase in membership inference precision with minimal model performance degradation.
Study robustness of split conformal prediction under adversarial attacks.
problem Ensuring distribution-free coverage guarantees in CP under adversarial conditions.
method Theoretical analysis and extensive experiments on split conformal prediction robustness.
result Prediction coverage varies with calibration-time attack strength, enabling control over coverage under adversarial tests.
Deep neural networks are susceptible to \emph{adversarial} attacks. In computer vision, well-crafted perturbations to images can cause neural networks to make mistakes such as confusing a cat with a computer. Previous adversarial attacks have been designed to degrade performance of models or cause machine learning mode…
2DSig-Detect: a semi-supervised framework for anomaly detection on image data using 2D-signaturescs.CV
2DSig-Detect detects adversarial perturbations in images.
problem Adversarial attacks degrade image model performance.
method 2D-signature embedded semi-supervised framework using rough path theory.
result 2DSig-Detect outperforms other methods in detecting adversarial perturbations.
Data poisoning is an attack on machine learning models wherein the attacker adds examples to the training set to manipulate the behavior of the model at test time. This paper explores poisoning attacks on neural nets. The proposed attacks use "clean-labels"; they don't require the attacker to have any control over the …
PAC-Bayesian bounds estimate adversarial robustness.
problem Estimating robustness to imperceptible input perturbations.
method PAC-Bayesian framework for averaging over hypotheses.
result General bounds valid for any type of adversarial attacks.
There is great potential for damage from adversarial learning (AL) attacks on machine-learning based systems. In this paper, we provide a contemporary survey of AL, focused particularly on defenses against attacks on statistical classifiers. After introducing relevant terminology and the goals and range of possible kno…
Adversarial attacks can manipulate deep trading policies, compromising their performance.
problem Adversarial attacks can compromise deep reinforcement learning trading policies.
method Developed a threat model and proposed two attack techniques.
result Demonstrated the effectiveness of adversarial attacks against DQN trading agents.
Machine learning has become one of the main components for task automation in many application domains. Despite the advancements and impressive achievements of machine learning, it has been shown that learning algorithms can be compromised by attackers both at training and test time. Machine learning systems are especi…
DAD++ improves test-time adversarial defense without access to training data.
problem Improving adversarial robustness of pre-trained models without access to training data.
method Test-time Data-free Adversarial Defense (DAD++) with detection and correction schemes.
result DAD++ significantly improves adversarial robustness with minimal clean accuracy drop.
Neural networks are prone to adversarial attacks. In general, such attacks deteriorate the quality of the input by either slightly modifying most of its pixels, or by occluding it with a patch. In this paper, we propose a method that keeps the image unchanged and only adds an adversarial framing on the border of the im…
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attackscs.LG
Transferability captures the ability of an attack against a machine-learning model to be effective against a different, potentially unknown, model. Empirical evidence for transferability has been shown in previous work, but the underlying reasons why an attack transfers or not are not yet well understood. In this paper…
Paper examines test-time smoothing defenses against adversarial examples.
problem Adversarial examples can mislead neural networks, compromising robustness.
method Evaluates various test-time smoothing defenses on ImageNet.
result Non-monotonic relation between attacks and defenses, large variance among samples.
Study online learner attacks by manipulating labels, revealing critical thresholds.
problem Adversarial attacks on online learners, especially label manipulation.
method Control-theoretical perspective, theoretical analysis, empirical study.
result Discontinuous transition in learner's accuracy occurs at a critical threshold.
Randomized smoothing reduces accuracy in ML models, especially at higher noise levels.
problem Adversarial attacks on ML models, especially randomized smoothing's accuracy drop.
method Theoretical and empirical analysis of randomized smoothing's effect on feasible hypotheses space.
result For some noise levels, randomized smoothing shrinks the set of feasible hypotheses, leading to accuracy drops.
We investigate conditions under which test statistics exist that can reliably detect examples, which have been adversarially manipulated in a white-box attack. These statistics can be easily computed and calibrated by randomly corrupting inputs. They exploit certain anomalies that adversarial attacks introduce, in part…
The convolutional neural network (CNN) architecture is increasingly being applied to new domains, such as malware detection, where it is able to learn malicious behavior from raw bytes extracted from executables. These architectures reach impressive performance with no feature engineering effort involved, but their rob…
Study robust algorithms for deep networks under adversarial perturbations.
problem Designing robust deep networks to adversarial attacks.
method Connecting robustness to polynomial optimization, designing efficient algorithms.
result Provable robustness for linear classifiers and PTFs, characterizing robustness price, efficient certification.
The paper explores robustness in linear regression models under adversarial attacks.
problem The impact of test-time adversarial attacks on linear regression models.
method Quantitative estimates and phase transitions analysis.
result Precise characterization of tradeoffs between adversarial robustness and accuracy.
Deep Neural Networks (DNNs) have tremendous potential in advancing the vision for self-driving cars. However, the security of DNN models in this context leads to major safety implications and needs to be better understood. We consider the case study of steering angle prediction from camera images, using the dataset fro…
Feature Partitioning for Robust Tree Ensembles and their Certification in Adversarial Scenarioscs.LG
This work proposes a robust ensemble method for decision trees that resists adversarial attacks.
problem Adversarial attacks on machine learning models, especially decision trees.
method Feature partitioning to train robust ensembles and approximate certification methods.
result The proposed ensemble method can resist evasion attacks by a majority of its models.
secml is a Python library for secure and explainable machine learning.
problem Evaluate and understand security and explainability of machine learning models.
method Implement attacks and explainability methods for various algorithms.
result Demonstrates how quickly models fail under adversarial perturbations and visualizes influential features.
In machine learning (ML) security, attacks like evasion, model stealing or membership inference are generally studied in individually. Previous work has also shown a relationship between some attacks and decision function curvature of the targeted model. Consequently, we study an ML model allowing direct control over t…
Machine Learning models have been shown to be vulnerable to adversarial examples, ie. the manipulation of data by a attacker to defeat a defender's classifier at test time. We present a novel probabilistic definition of adversarial examples in perfect or limited knowledge setting using prior probability distributions o…
Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. This work provides a solution to hardening DNNs under adversarial attacks through…
Backdoor attacks make models predict a specific class near triggers, smoothing their decision function.
problem Understanding and mitigating backdoor attacks on deep neural networks.
method Defined a measure to quantify backdoor smoothing and detected other smoothing patterns.
result Backdoor attacks induce a smoother decision function around triggered samples.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
New model improves classifier security against evasion attacks by selecting features.
problem Security of machine learning classifiers against evasion attacks.
method Adversary-aware feature selection model incorporating specific adversary assumptions.
result Classifier security worsens with feature selection, but new model improves it.
Study robust regression learning under adversarial attacks.
problem Understanding which function classes are learnable in the presence of adversarial attacks.
method Introduced a novel agnostic sample compression scheme and used fat-shattering dimension to construct adversarially robust sample compression schemes.
result Finite fat-shattering dimension classes are learnable in both realizable and agnostic settings.
Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for …
Detects poisoned training samples in deep neural networks.
problem Data poisoning attacks on deep neural networks.
method Two approaches: parametric probability distributions and Bayesian deep neural networks.
result Uncertainty estimates from trained models can discriminate clean from poisoned samples.
The vulnerability of machine learning systems to adversarial attacks questions their usage in many applications. In this paper, we propose a randomized diversification as a defense strategy. We introduce a multi-channel architecture in a gray-box scenario, which assumes that the architecture of the classifier and the t…
New framework evaluates model robustness against diverse, unforeseen attacks.
problem Real-world adversarial robustness is harder to assess than research suggests.
method ImageNet-UA framework for evaluating robustness against diverse, unseen attacks.
result Standard robustness measures fail to capture unforeseen robustness.
Machine learning classifiers are known to be vulnerable to inputs maliciously constructed by adversaries to force misclassification. Such adversarial examples have been extensively studied in the context of computer vision applications. In this work, we show adversarial attacks are also effective when targeting neural …
We propose a novel approach towards adversarial attacks on neural networks (NN), focusing on tampering the data used for training instead of generating attacks on trained models. Our network-agnostic method creates a backdoor during training which can be exploited at test time to force a neural network to exhibit abnor…
LGV boosts adversarial attacks by improving surrogate models.
problem Improving the transferability of black-box adversarial attacks.
method LGV uses a pretrained surrogate model and multiple weight sets from additional training epochs to generate an effective surrogate ensemble.
result LGV outperforms other test-time transformations by significant margins.
The study sets limits on how robust classifiers can be against adversarial attacks.
problem Understanding the limits of robustness in classification models against adversarial attacks.
method Utilized optimal transport theory to derive variational formulae and explicit lower-bounds on Bayes-optimal error.
result Explicit lower-bounds on the Bayes-optimal error for distance-based attacks, universal in geometry of class-conditional distributions.
Deep generative models are rapidly becoming a common tool for researchers and developers. However, as exhaustively shown for the family of discriminative models, the test-time inference of deep neural networks cannot be fully controlled and erroneous behaviors can be induced by an attacker. In the present work, we show…
Deep neural networks (DNNs) have transformed several artificial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Specifically, suppose we have a testing …
Despite the considerable success enjoyed by machine learning techniques in practice, numerous studies demonstrated that many approaches are vulnerable to attacks. An important class of such attacks involves adversaries changing features at test time to cause incorrect predictions. Previous investigations of this proble…
New method makes machine learning models robust to label flipping attacks.
problem Machine learning models are vulnerable to label flipping attacks.
method Randomized smoothing over arbitrary functions to build certifiably robust classifiers.
result Linear classifiers are robust to label flipping attacks with deterministic bounds.
Graph transformation framework improves graph neural network performance.
problem Data quality issues in graph neural networks.
method Test-time graph transformation framework (GTrans).
result Significant performance improvements (up to 3.8%) across various datasets.
Survey on privacy issues in deep learning and proposed solutions.
problem Privacy concerns in deep learning models due to sensitive data.
method Review of existing privacy techniques and gaps in research.
result Identification of test-time inference privacy as a research gap.
Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image model…
Making learners robust to adversarial perturbation at test time (i.e., evasion attacks) or training time (i.e., poisoning attacks) has emerged as a challenging task. It is known that for some natural settings, sublinear perturbations in the training phase or the testing phase can drastically decrease the quality of the…