TrojDRL shows reinforcement learning agents vulnerable to Trojan attacks.
problem Vulnerability of reinforcement learning agents to Trojan attacks.
method Data-poisoning and in-band reward modification to augment reinforcement learning policies.
result Policies can be imperceptibly modified to perform differently when a Trojan is triggered.
Graph neural networks are vulnerable to adversarial attacks that manipulate graph structure.
problem Vulnerability of graph neural networks to adversarial attacks.
method Meta-learning approach to solve bilevel optimization problem of training-time attacks.
result Small graph perturbations can significantly degrade graph neural network performance.
Attackers can poison environments to force RL agents to follow target policies.
problem Security threat to reinforcement learning where attackers manipulate environments to force agents into following target policies.
method Optimization framework for finding optimal stealthy attacks under different measures of attack cost.
result Attackers can easily succeed in teaching any target policy to RL agents under mild conditions.
2DSig-Detect detects adversarial perturbations in images.
problem Adversarial attacks degrade image model performance.
method 2D-signature embedded semi-supervised framework using rough path theory.
result 2DSig-Detect outperforms other methods in detecting adversarial perturbations.
Recent developments have established the vulnerability of deep reinforcement learning to policy manipulation attacks via intentionally perturbed inputs, known as adversarial examples. In this work, we propose a technique for mitigation of such attacks based on addition of noise to the parameter space of deep reinforcem…
This work generates training-time adversarial data using auto-encoders to manipulate classifiers.
problem Manipulating the behavior of trained classifiers during test time with bounded perturbation.
method An auto-encoder-like network generates perturbations, learning to update weights to produce harmful noise.
result The method can manipulate classifiers effectively, showing good transferability.
Paper proposes FHMM for better attacker behaviour profiling.
problem Modeling attacker behaviour for better predictive power.
method Semi-supervised Fusion Hidden Markov Model (FHMM).
result FHMM provides comparable accuracy to Deep RNN at lower training time.
New normalization method makes neural networks more robust to adversarial attacks.
problem Adversarial vulnerability of BatchNorm in deep neural networks.
method Identified distribution shift caused by adversarial images, proposed RobustNorm to use inference-time statistics.
result RobustNorm makes models more robust to adversarial attacks without sacrificing BatchNorm benefits.
This paper investigates why adversarial attacks can be effective against different models.
problem Understanding why adversarial attacks transfer between models.
method Developed a unifying optimization framework and formal definition for attack transferability.
result Identified two main factors: target model's vulnerability and surrogate model complexity.
A new method improves adversarial robustness and interpretability with reduced training time.
problem Adversarial attacks on deep neural networks.
method A novel regularizer incorporating first and second order information via a quadratic approximation to the adversarial loss.
result Single iteration of the proposed regularizer achieves stronger robustness than prior methods.
Defense against DL-based lithographic hotspot detectors backdooring attacks reduces success rate from 84% to ~0%
problem DL-based lithographic hotspot detectors are vulnerable to backdoor attacks that can misclassify hotspots.
method Training data augmentation to eliminate intentional biases introduced during training.
result Significant reduction in attack success rate (from 84% to ~0%) using the proposed defense.
secml is a Python library for secure and explainable machine learning.
problem Evaluate and understand security and explainability of machine learning models.
method Implement attacks and explainability methods for various algorithms.
result Demonstrates how quickly models fail under adversarial perturbations and visualizes influential features.
PASE method protects machine learning models from membership inference attacks without significant accuracy loss.
problem Membership inference attacks on machine learning models.
method Switching ensembles approach to mitigate privacy leakage.
result PASE method provides effective privacy protection with minimal accuracy penalty.
This paper improves machine learning models' robustness against evasion attacks using randomness.
problem Evasion attacks that adapt to machine learning models to avoid detection.
method Incorporates randomness into both training and application phases of machine learning models.
result The proposed randomization-based approach further improves the robustness of machine learning models, especially random forest.
This work enhances deep neural networks with robust features to improve their robustness against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial images.
method Augmenting classification pipelines with robust features like binarization and group extraction.
result Improved robustness and training speed on adversarial inputs, with significant improvements over state-of-the-art methods.
New framework evaluates model robustness against diverse, unforeseen attacks.
problem Real-world adversarial robustness is harder to assess than research suggests.
method ImageNet-UA framework for evaluating robustness against diverse, unseen attacks.
result Standard robustness measures fail to capture unforeseen robustness.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
GNNGuard defends Graph Neural Networks against structural perturbations.
problem Adversarial attacks on graph neural networks can degrade performance catastrophically.
method Detects and quantifies the relationship between graph structure and node features, then uses this to mitigate attacks.
result GNNGuard outperforms existing defenses by 15.3% on average across various attacks and datasets.
Paper explores fast adversarial training to improve robustness with less computation.
problem Efficiently defending against adversarial examples.
method Integrates simple self-attacks for faster training, focusing on overfitting recovery.
result Shows superior robust accuracy with reduced training time compared to strong adversarial training.
New attacks exploit transfer learning to misclassify text models.
problem Misclassification attacks against transfer learned text classifiers.
method Novel attack algorithms using unintended features from teacher models.
result Transfer learning increases vulnerability to misclassification attacks.
New findings show strong barriers against computational robustness in adversarial learning.
problem Computational robustness of classifiers against adversarial attacks.
method Information-theoretic and computational proofs for evasion and poisoning attacks.
result Polynomial-time attacks can find adversarial examples of O(√n) Hamming distance for product distributions.
MACER trains robust models without adversarial training, faster and more effective.
problem Learning robust models without relying on attack-dependent adversarial training.
method MACER trains provably robust smoothed classifiers by maximizing certified radius.
result MACER achieves larger average certified radius and faster training time compared to state-of-the-art methods.
New method makes deep nets more robust to attacks without increasing training time.
problem Gradient obfuscation makes models vulnerable to stronger attacks.
method Local linearization regularizer to penalize non-linearity in loss surface.
result Models trained with regularizer achieve 47% adversarial accuracy on ImageNet.
Proposes an autonomous IDS using multiple learning techniques.
problem Autonomous and zero-day attack detection in IDS.
method Parallel use of GRU, CNN, and random forest; majority vote and OR logic combination.
result Achieved high accuracy (87.28%) on NSL-KDD's 'KDDTest+' dataset.
New method defends against both single-step and iterative adversarial examples.
problem Defending against adversarial examples, especially iterative ones, is computationally expensive.
method Single-Step Adversarial Training (SST) with modifications.
result Our method outperforms state-of-the-art methods in both accuracy and training time.
MixTrain improves verifiable robustness of neural networks without sacrificing efficiency.
problem Efficiently making neural networks robust against adversarial attacks.
method Stochastic robust approximation and dynamic mixed training techniques.
result Achieves up to 95.2% verified robust accuracy with significantly reduced training time.
Randomized smoothing reduces accuracy in ML models, especially at higher noise levels.
problem Adversarial attacks on ML models, especially randomized smoothing's accuracy drop.
method Theoretical and empirical analysis of randomized smoothing's effect on feasible hypotheses space.
result For some noise levels, randomized smoothing shrinks the set of feasible hypotheses, leading to accuracy drops.
SWEEN improves certified robustness via weighted ensembling of smoothed classifiers.
problem Finding optimal base classifiers for randomized smoothing.
method Smoothed WEighted ENsembling (SWEEN) scheme.
result SWEEN achieves optimal certified robustness under mild assumptions.
New method reduces adversarial training time by up to 2.5x with comparable accuracy.
problem High computational complexity of adversarial training for deep neural networks.
method Replacing initial adversarial training with natural training.
result Significant reduction in training time (up to 2.5x) without loss in accuracy.
New approach to robustly reliable learners against instance-targeted attacks.
problem Addressing data poisoning attacks on robustly reliable learners.
method Defining regularized robustly reliable learners and efficient algorithms.
result Efficient algorithms for robustly reliable learners with sublinear runtime.
New method improves adversarial training efficiency and robustness.
problem High computational costs and lack of stability in adversarial training.
method Backward smoothing for randomized smoothing of random initialization.
result Our method achieves similar model robustness as state-of-the-art methods but with significantly less training time.
Remote explainability is impossible for single explanations, showing discriminatory features.
problem Remote explainability for machine learning models is challenging due to the lack of transparency.
method Analogy with club bouncer and proof of impossibility of remote explainability for single explanations.
result Remote explainability for single explanations is impossible, as shown by an attack that hides discriminatory features.
Sparse neural networks can be robust to adversarial attacks.
problem Finding robust neural networks that are also sparse.
method Empirical evaluation and analysis of the Lottery Ticket Hypothesis with adversarial training.
result Sparse, robust neural networks can be found using adversarial training.
Label-Smoothing improves adversarial robustness of deep learning models.
problem Improving the robustness of deep learning models against adversarial attacks.
method Label-Smoothing, including adversarial, Boltzmann, and second-best variants, applied to various models and datasets.
result Label-Smoothing enhances adversarial robustness across multiple attacks and datasets.
Improved clustering speed for 20 clusters on CIFAR-100 dataset.
problem Training time complexity for VAEs with discrete latent variables is linear in the number of clusters.
method Applied a continuous relaxation to discrete variables in Gaussian Mixture VAE, reducing training time complexity to constant.
result Reduced training time from 47 hours to 6 hours for 20 clusters on CIFAR-100.
Gradient amplification boosts deep learning model performance without increasing training time.
problem Vanishing gradients in deep neural networks.
method Gradient amplification approach to prevent vanishing gradients and training strategy to enable/disable across epochs.
result Improves performance of deep learning models with reduced training time.
This paper improves model fusion by training-time neuron alignment, reducing barriers in multi-model fusion.
problem Diverse neuron permutations across different settings hinder model fusion performances.
method Training-time neuron alignment using fixed neuron anchors to reduce training-time permutations.
result Training-time neuron alignment improves fusion of pretrained models and federated learning performances.
Paper introduces a new method to compute pseudoinverse for ELM with large datasets.
problem Efficient computation of pseudoinverse for ELM with large datasets.
method Rank-based matrix decomposition of the hidden layer matrix.
result Optimal training time and reduced computational complexity for large hidden nodes.
Predict training time without training using a linearized model.
problem Predicting the training time of a deep network without actual training.
method Approximate training dynamics with a linearized model and solve a low-dimensional SDE in function space.
result Predict training time within 20% error margin and 30-45x reduction in cost.
ZK-GanDef uses GANs to defend against adversarial examples without using them during training.
problem Adversarial examples challenge the effectiveness of neural network classifiers.
method Generative adversarial net (GAN) based zero knowledge adversarial training defense.
result Enhances test accuracy on adversarial examples by up to 49.17% compared to zero knowledge approaches.
New approach predicts deep learning training times more accurately.
problem Inaccurate prediction of deep learning training times.
method Trains a deep learning network to predict execution time for parts of a network.
result Can predict execution times for unseen scenarios and hardware choices.
TRASHFIRE improves model robustness by analyzing training rates and costs.
problem Understanding and predicting model robustness under adversarial conditions.
method Survival models, worst-case examples, cost-aware analysis.
result Deeper models offer marginal robustness gains due to inference time, not inherent robustness.
This paper proposes a curriculum learning framework for NMT to reduce training time and improve performance.
problem Slow training and need for heuristics in NMT systems.
method A curriculum learning framework that decides training samples based on estimated difficulty and model competence.
result Up to 70% decrease in training time and up to 2.2 BLEU accuracy improvements.
Optimizes deep learning training by treating it as an optimal control problem.
problem Fragility of deep neural networks to adversarial inputs.
method Formulates adversarial training as a min-max optimization problem and interprets it as an optimal control problem.
result Provides the first convergence analysis of adversarial training algorithm.
This paper detects multi-stage Feint Attacks using Bi-RNN and few-shot learning.
problem Detecting multi-stage Feint Attacks due to lack of professional datasets and semantic relationships.
method Fuzzy clustering for attack chain mining, few-shot deep learning, Bi-RNN for feature extraction.
result Accurately detected Feint Attacks using Bi-RNN and few-shot learning.
We developed safe and ranged approximations for ReLU, tanh, and sigmoid functions to reduce neural network training time.
problem Expensive computation of hyperbolic tangent and sigmoid functions in neural networks.
method Function approximation techniques to create safe and ranged approximations.
result 10% to 37% improvement in training times on CPU and 20% to 53% improvement in ranged cases.
Improved CAEs reduce training time and enhance generalization.
problem Stability issues in Concrete Autoencoders (CAEs) for feature selection.
method Indirectly Parameterized Concrete Autoencoders (IP-CAEs) learn parameters of Gumbel-Softmax distributions.
result IP-CAEs achieve significant improvements in generalization and training time.
This paper studies adversarial attacks on Gaussian process bandits.
problem Adversarial attacks on Gaussian process bandits to manipulate optimal function regions.
method Proposes various adversarial attack methods on GP bandits, including white-box and black-box attacks.
result Adversarial attacks can force GP bandits to optima in target regions even with low attack budgets.