DCNs are fooled by Gabor noise patterns similar to adversarial perturbations.
problem Sensitivity of DCNs to Gabor noise patterns.
method Examined different DCN architectures and their sensitivity to Gabor noise.
result DCNs are fooled by Gabor noise patterns similar to adversarial perturbations.
DEceit constructs effective universal pixel-restricted perturbations for deep image classifiers.
problem Creating effective universal pixel-restricted perturbations for deep neural networks.
method DEceit algorithm for black-box feedback, targeting 10% of pixels in images.
result Perturbing only 10% of pixels achieves high Fooling Rate and visual similarity.
New method evaluates visual explanations of deep models using adversarial perturbations.
problem Lack of objective evaluation of visual explanations of deep models.
method Proposes an adversarial perturbation approach to evaluate visual explanations of deep models.
result Demonstrates the effectiveness of the proposed approach through comparisons with existing methods.
PerceptNet mimics human vision to estimate image quality.
problem Estimating perceptual distance between images and their perturbations.
method Inspired by human visual system, PerceptNet uses convolutional neural network architecture.
result PerceptNet outperforms traditional image quality metrics and deep learning methods.
New mechanisms from primate vision improve neural network robustness.
problem Demonstrating robust neural networks to small adversarial perturbations.
method Investigated two biologically plausible mechanisms: non-uniform retina sampling and receptive field diversity.
result Non-uniform retina sampling and receptive field diversity improve adversarial robustness.
Neural networks are known to be vulnerable to adversarial examples, inputs that have been intentionally perturbed to remain visually similar to the source input, but cause a misclassification. It was recently shown that given a dataset and classifier, there exists so called universal adversarial perturbations, a single…
Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the Lp distance for penalizing perturbations. Researchers have explored different defense met…
This work learns visual representations for deformable objects using contrastive estimation.
problem Challenges in learning plannable visual representations for deformable objects.
method Jointly optimizes visual representation and dynamics models using contrastive estimation.
result Substantial improvements in performance over standard model-based learning techniques.
Paper proposes a method to make neural networks more robust to visual distortions.
problem Neural networks lack robustness to real-world visual distortions.
method A general training method that makes neural networks more robust to input visual perturbations.
result Proposed training method improves neural network performance in noisy datasets.
This paper proposes a new algorithm for controlling classification results by generating a small additive perturbation without changing the classifier network. Our work is inspired by existing works generating adversarial perturbation that worsens classification performance. In contrast to the existing methods, our wor…
The paper introduces extremal perturbations for better attribution analysis in deep networks.
problem Identifying input parts responsible for model outputs.
method Extremal perturbations, smooth masks, and technical innovations for computation.
result Demonstrates excellent sensitivity to spatial properties of deep neural networks.
TULiP estimates uncertainty for deep learning models safely.
problem Reliable uncertainty estimation for deep learning models in the open world.
method TULiP considers a hypothetical perturbation, bounds its effect, and computes uncertainty from sampled predictions.
result TULiP achieves state-of-the-art performance in OOD detection benchmarks.
New tool for interpreting neural nets, explaining model behavior.
problem Interpreting neural network responses and explaining model behavior.
method Full-Gradient representation and FullGrad saliency map approximation.
result FullGrad method explains model behavior more comprehensively and accurately than other methods.
Deep nets mislead on subtle perturbed inputs.
problem Vulnerability of DNNs to adversarial examples.
method Visual analytics approach to explain datapaths of adversarial examples.
result Visualization helps experts investigate datapaths from high-level layers to neuron activations.
Image classifiers are sensitive to small changes, affecting most images in a class.
problem Sensitivity of image classifiers to small perturbations.
method Demonstrated sensitivity for any classifier over images, showing that for most classes, a tiny perturbation can change the classification of a majority of images.
result Image classifiers are sensitive to small perturbations, affecting most images in a class.
New strategy uses interpretability to improve adversarial learning.
problem Improving adversarial learning speed and effectiveness.
method Spatially constrained one-pixel adversarial perturbations guided by gradient-based interpretability.
result Spatially constrained one-pixel adversarial perturbations noticeably improve convergence and attack success.
FineFool attacks deep models by focusing on object contours, improving attack performance.
problem Adversarial attacks on deep learning models, especially those that focus on perturbation size and success rate.
method FineFool uses attention to focus on object contours, producing more efficient and imperceptible perturbations.
result FineFool achieves better attack performance compared to state-of-the-art attacks, including higher success rate and smaller perturbations.
New method generates realistic adversarial images with smaller perturbations.
problem Generating realistic adversarial images with small perturbations.
method Imposes spatial distortions (scaling, rotation, shear, translation) in addition to perturbations.
result Produces visually more realistic attacks that deceive classifiers without affecting human predictions.
Enhanced image recognition models learn from human-like memory and shape biases.
problem Improving robustness of image recognition models against various perturbations.
method Integrating human-like episodic memory and shape bias features into image recognition models.
result Combining human-like features improves robustness against both adversarial and natural perturbations.
Capsule networks detect and diagnose adversarial images better than CNNs.
problem Detecting and diagnosing adversarial images in neural networks.
method Class-conditional capsule reconstruction and reconstructive attack.
result Capsule networks outperform CNNs in detecting and diagnosing adversarial images.
Generative model improves scene graph prediction for rare compositions.
problem Challenges in inferring unseen or rare scene graph compositions.
method Synthesizing rare scene graphs by perturbing real ones, using conditional GANs.
result Marginal but consistent improvements in zero- and few-shot metrics.
Adversarial attacks on spectrograms can fool audio classifiers trained on waveforms.
problem Susceptibility of audio classifiers to adversarial attacks on spectrograms.
method Applying adversarial attacks to spectrograms and reconstructing audio waveforms.
result Perturbed spectrograms can fool 2D CNNs and 1D CNNs trained on audio waveforms.
FRA-Attack improves adversarial transferability for closed-source MLLMs by aligning visual focus across models.
problem Improving adversarial transferability for closed-source MLLMs, especially with high accuracy.
method Unified frequency-domain regularization approach: high-pass DCT objective for feature alignment and Frequency-domain Gradient Regularization (FGR) for gradient optimization.
result FRA-Attack achieves superior cross-model transferability, especially on GPT-5.4, Claude-Opus-4.6, and Gemini-3-flash.
The Madry Lab recently hosted a competition designed to test the robustness of their adversarially trained MNIST model. Attacks were constrained to perturb each pixel of the input image by a scaled maximal L∞ distortion ε = 0.3. This discourages the use of attacks which are not optimized on the L∞ dis…
Perceptual ad-blocking is vulnerable to attacks, creating new security risks.
problem Vulnerability of perceptual ad-blocking to attacks and new security risks.
method Analysis and creation of adversarial examples to bypass perceptual ad-blocking.
result Perceptual ad-blocking can be bypassed using adversarial examples, introducing new security risks.
Deep Convolutional Networks (DCNs) have been shown to be vulnerable to adversarial examples---perturbed inputs specifically designed to produce intentional errors in the learning algorithms at test time. Existing input-agnostic adversarial perturbations exhibit interesting visual patterns that are currently unexplained…
Captum library simplifies model interpretability for PyTorch.
problem Improving model interpretability for various PyTorch models.
method Unified, open-source library with generic attribution algorithms and metrics.
result Unified and scalable model interpretability for multimodal inputs.
Adversarial training provides a means of regularizing supervised learning algorithms while virtual adversarial training is able to extend supervised learning algorithms to the semi-supervised setting. However, both methods require making small perturbations to numerous entries of the input vector, which is inappropriat…
Paper proposes meshAdv to generate adversarial 3D meshes for visual recognition.
problem Vulnerability of deep neural networks to adversarial examples.
method Differentiable renderer to manipulate shape and texture of 3D meshes.
result 3D meshes effectively attack classifiers and object detectors.
This paper introduces a database to assess the perceptual similarity of adversarial images.
problem The lack of reliable metrics to assess the perceptual similarity of adversarial images generated by Lp norms. method Creation of a database and evaluation of fifteen FR image fidelity assessment metrics.
result The database and metrics can help in designing new metrics for adversarial examples.
Proposes a method to generate semantically meaningful adversarial examples.
problem Challenges in creating semantically meaningful adversarial examples.
method Captures semantics via manifold learning, perturbs using Gram-Schmidt process, and imposes adversarial constraints.
result Effectively generates adversarial examples that evade existing defenses.
GraphAT improves graph neural networks by dynamically considering connected examples in adversarial training.
problem Graph neural networks are vulnerable to adversarial perturbations due to connections between examples.
method GraphAT dynamically regularizes based on graph structure to resist adversarial perturbations.
result GraphAT outperforms normal training on GCN by 4.51% in node classification accuracy.
Efficient method defends deep learning models from adversarial attacks.
problem Vulnerability of deep learning models to adversarial attacks.
method Training a Denoising Autoencoder (DAE) to reduce data dimensions and serve as a defense.
result The method provides a 2.43x speedup while maintaining robustness against adversarial attacks.
Adversarial examples are augmented data points generated by imperceptible perturbation of input samples. They have recently drawn much attention with the machine learning and data mining community. Being difficult to distinguish from real examples, such adversarial examples could change the prediction of many of the be…
New framework assesses neural sensitivity to small perturbations.
problem Comparing neural representations' sensitivity to small changes.
method Local decodable information, Fisher information, and projected pullback/Fisher metric.
result Reveals differences in neural sensitivity not captured by activation alignment.
Study Fisher information for detecting neural network adversarial attacks.
problem Detecting and understanding adversarial examples in neural networks.
method Compute Fisher information quantities efficiently and analyze their behavior on adversarial examples.
result Fisher information can highlight important input neurons and reveal unreasonable network behavior.
Recently proposed adversarial training methods show the robustness to both adversarial and original examples and achieve state-of-the-art results in supervised and semi-supervised learning. All the existing adversarial training methods consider only how the worst perturbed examples (i.e., adversarial examples) could af…
Manipulated explanations can be made imperceptible to the naked eye.
problem The trustworthiness and interpretability of neural networks can be compromised by manipulable explanations.
method The paper demonstrates that explanations can be altered by applying small, imperceptible input changes that do not affect the network's output.
result An upper bound on the susceptibility of explanations to manipulation has been derived, and effective mechanisms to enhance explanation robustness have been proposed.
Layer-wise relevance propagation (LRP) is a recently proposed technique for explaining predictions of complex non-linear classifiers in terms of input variables. In this paper, we apply LRP for the first time to natural language processing (NLP). More precisely, we use it to explain the predictions of a convolutional n…
regvis.net offers a visual survey of regulatory visualization.
problem Lack of a comprehensive resource for regulatory visualization.
method Collection and manual tagging of 80+ publications, creation of a searchable webpage.
result First publication set tailored for regulatory visualization.
Proposes a new feature-based evaluation method for explaining Deep Learning models in text classification.
problem Lack of consideration for linguistic dependencies in existing attribution-based explanations.
method Investigates perturbations based on embedded features removal from intermediate layers of Convolutional Neural Networks.
result Visualization tool assists analysts in understanding model predictions better.
Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reas…
Algorithm transfers visual concepts to answer out-of-vocabulary questions.
problem Leveraging off-the-shelf visual and linguistic data for out-of-vocabulary answers in visual question answering.
method Unsupervised task discovery for learning task conditional visual classifier, then transferring to visual question answering models.
result Algorithm generalizes to out-of-vocabulary answers successfully.
Spiking neural networks perform similarly to deep networks on occluded images.
problem Robust object recognition in partially occluded images.
method Developed a two-layer spiking neural network trained on natural scenes with a biologically plausible learning rule, compared to deep convolutional networks.
result Spiking neural networks achieve good accuracy and robustness on stepwise pixel erasement tasks.
Improves CNN robustness by reducing texture bias.
problem CNNs' reliance on local texture over global shape.
method Inspired by human vision, InfoDrop decorrelates model output from local texture.
result Enhanced robustness across various scenarios.
Net2Vis automates CNN visualization for publications.
problem Lack of consistent visual representations in deep learning papers.
method Proposes a visual grammar and automated system for generating publication-ready CNN visualizations.
result Reduces time and ambiguity in generating network visualizations.
Aims to make neural networks robust to small, imperceptible perturbations.
problem Neural networks can be fooled by small, imperceptible changes.
method Proposes a Generative Adversarial Networks (GAN) framework to learn robust classifiers.
result Our method outperforms adversarial training in robustness.
Proposes a spectral method to assess and combine multiple data visualizations.
problem Evaluating and combining the strengths of different data visualization algorithms.
method Spectral method for assessing and combining multiple visualizations.
result Proposes a visualization eigenscore to quantify relative performance and a consensus visualization.