CRATE-MAE learns structured representations from unlabeled data.
problem Learning structured representations from unlabeled data.
method Structured Diffusion with White-Box Transformers.
result CRATE-MAE achieves highly promising performance on large-scale imagery datasets.
Paper proposes using auto-encoders to efficiently purify adversarial perturbations.
problem Vulnerability of machine learning models to adversarial examples.
method Iterative adversarial training on an auto-encoder to purify perturbations.
result The auto-encoder trained model outperforms other methods in protecting models against white-box attacks.
Paper finds optimal membership inference strategies for machine learning models.
problem Determining if a sample was part of the training set of a machine learning model.
method Derives optimal strategies for membership inference with assumptions on parameter distribution, showing that black-box attacks are as good as white-box attacks.
result Optimal strategies are not tractable, leading to approximations that outperform existing methods.
This research discovers model architecture and training dataset characteristics through strategic input probing.
problem Discovering model architecture and training dataset characteristics in black box models.
method Structured input probes and model outputs are used to train a deep classifier for image and text classification.
result The approach successfully distinguishes between different image and text datasets and architectures.
PRETZEL optimizes machine learning prediction serving systems for better performance.
problem Low latency, high throughput, and graceful performance degradation under heavy load in prediction serving systems.
method Introducing a novel white box architecture enabling both end-to-end and multi-model optimizations.
result Average 5.5x reduction in 99th percentile latency, 25x reduction in memory footprint, and 4.7x increase in throughput compared to state-of-the-art approaches.
RIGA watermarks DNNs covertly and robustly with minimal accuracy loss.
problem Watermarking deep neural networks to enable tracing after release.
method Robust white-box GAN watermarking using adversarial training.
result Significantly improves covertness and robustness over state-of-the-art.
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
Efficiently distills white-box adversarial attacks into black-box models.
problem Generating efficient adversarial examples for robustness.
method Train a model to emulate white-box attack behavior and distill it into a more efficient black-box model.
result Reduces adversarial example generation time by 19x-39x and transfers to black-box settings.
White-box attacks reveal deep learning model training data records.
problem Privacy leakage in deep learning models.
method Design of white-box inference attacks for both centralized and federated learning.
result Deep models, even well-generalized ones, are susceptible to white-box membership inference attacks.
A new Frank-Wolfe framework improves efficiency and effectiveness of adversarial attacks.
problem Develop efficient and effective optimization-based adversarial attack algorithms.
method Proposes a Frank-Wolfe algorithm variant for both white-box and black-box adversarial attacks.
result Demonstrates improved efficiency and effectiveness compared to existing methods.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
Paper presents a method to disrupt deep uncertainty estimation without affecting accuracy.
problem Uncertainty estimation in deep neural networks for risk-sensitive applications.
method A novel attack that cripples uncertainty estimation without reducing accuracy.
result The attack causes the network to be more confident in incorrect predictions than correct ones.
Paper improves ATN for generating adversarial examples.
problem Generating adversarial examples to fool models.
method Improves Adversarial Transformation Networks (ATN).
result Won 2nd place in CAAD 2018 non-target task.
The application of deep recurrent networks to audio transcription has led to impressive gains in automatic speech recognition (ASR) systems. Many have demonstrated that small adversarial perturbations can fool deep neural networks into incorrectly predicting a specified target with high confidence. Current work on fool…
New method calibrates white-box MI attacks, outperforming previous black-box methods.
problem Calibrating membership inference attacks on white-box models.
method Leveraging model memorization and overfitting features.
result Calibrated attack provides high precision in membership inference.
Extends batch active learning to non-differentiable models.
problem Efficiently training machine learning models on large, initially unlabelled datasets.
method Black-box batch active learning for regression tasks that relies solely on model predictions.
result Achieves strong performance on regression datasets compared to white-box approaches for deep learning models.
Many deployed learned models are black boxes: given input, returns output. Internal information about the model, such as the architecture, optimisation procedure, or training data, is not disclosed explicitly as it might contain proprietary information or make the system more vulnerable. This work shows that such attri…
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
FEDMD-NFDP improves federated learning privacy without sacrificing performance.
problem Privacy leakage in federated learning when sharing predictions.
method Noise-Free Differential Privacy (NFDP) applied to federated model distillation.
result FEDMD-NFDP achieves comparable utility and privacy guarantees.
New action poisoning attacks improve LinUCB's performance by changing action signals.
problem Improving understanding of adversarial attacks on contextual bandit algorithms.
method Proposed action poisoning attacks in white-box and black-box settings.
result Action poisoning attacks can force LinUCB to pull a target arm frequently with low cost.
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
Evaluates SHIELD's effectiveness against adaptive adversaries in various threat models.
problem Evaluating SHIELD's efficacy against adaptive adversaries in different threat models.
method Empirical analysis of SHIELD's robustness against adaptive attacks using Projected Gradient Descent (PGD) attacks in various threat models (white-box, gray-box).
result The targeted PGD attack success rate drops from 64.3% to 48.9% when models are trained from scratch instead of retrained.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks. ReduNet optimizes data compression by maximizing rate reduction in deep networks.
problem Optimizing deep networks for high-dimensional multi-class data.
method Maximizing rate reduction through iterative gradient ascent, leading to a multi-layer deep network.
result ReduNet achieves optimal linear discriminative representation and is more efficient in the spectral domain.
New method for black-box adversarial attacks using pretrained model embeddings.
problem Efficiently attacking unknown target networks with high-level semantic patterns.
method Learn a low-dimensional embedding using a pretrained model, then search within the embedding space.
result Significant reduction in the number of queries for black-box adversarial attacks.
Study on how many queries an adversary needs to make to match the best attack in white-box model.
problem Query complexity of adversarial attacks in machine learning models.
method Investigates the number of queries required for an adversary to match the best possible attack in the white-box model, using entropy of decision boundaries as a measure.
result Lower bound on the number of queries required for an adversary to match the best possible attack in the white-box model.
NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
RobNets improve robustness of deep neural networks against adversarial attacks.
problem Vulnerability of deep neural networks to adversarial attacks.
method One-shot neural architecture search, finetuning sub-networks, and analyzing robustness indicators.
result RobNets achieve superior robustness performance across various datasets.
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
SCENE-Net improves 3D point cloud segmentation with low resource usage and transparency.
problem Lack of resources and transparency in 3D semantic segmentation models.
method SCENE-Net uses signature shapes identified via GENEOs to achieve semantic segmentation with minimal resources.
result SCENE-Net achieves comparable IoU to state-of-the-art methods with less data and computational resources.
New benchmarks for algorithm control using RL.
problem Optimizing algorithm performance through online hyperparameter tuning.
method Formulated as a contextual MDP, solved with reinforcement learning.
result Reinforcement learning outperforms black-box approaches for longer sequences.
Graphical normalizing flows use Bayesian networks to improve normalizing flows' interpretability and performance.
problem Improving the interpretability and performance of normalizing flows.
method Revisiting normalizing flows as probabilistic graphical models, proposing graphical normalizing flows with either prescribed or learnable graph structures.
result Graphical conditioners lead to competitive white box density estimators.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
Evaluates local explanations using white-box models and log odds ratios.
problem Costly and subjective evaluation of local explanations.
method Benchmarking explanation techniques using log odds ratios.
result Explanation techniques' performance depends on model, dataset, data point, and normalization.
Study examines adversarial robustness of ANN variants, revealing differences in black-box settings.
problem Adversarial robustness of alternative neural network architectures.
method Analysis of conventional, stochastic ANNs, and SNNs across three datasets; experiments in white-box and black-box settings.
result Stochastic ANNs are more robust than conventional ANNs in black-box settings, especially with surrogate attacks.
Two attacks reveal vulnerabilities in deep neural network watermarking schemes.
problem Protecting deep learning models from unauthorized redistribution.
method Proposed black-box and white-box attacks to remove backdoor-based watermarks.
result Watermarks can be removed with minimal effort and without sensitive model information.
Efficiently explains model outputs using HSIC, a dependence measure.
problem Efficiently explain model outputs for various architectures.
method HSIC, RKHS, Reproducing Kernel Hilbert Spaces, black-box attribution.
result Up to 8 times faster than previous methods while maintaining fidelity.
Defends classifiers from adversarial attacks using self-supervised data estimation.
problem Protecting classifiers from adversarial attacks with full attacker access.
method RIDE, a self-supervised learning algorithm for individual data estimation.
result Significant improvement in adversarial defense performance (98%, 76%, 43% test accuracy on MNIST, CIFAR-10, and ImageNet datasets respectively).
RTFE provides adversarial robustness to multiple models.
problem Adversarial examples can transfer to other models, compromising robustness.
method Proposes RTFE, a deep learning-based pre-processing mechanism.
result RTFE provides adversarial robustness to multiple independently trained classifiers.
In the last decade, deep learning algorithms have become very popular thanks to the achieved performance in many machine learning and computer vision tasks. However, most of the deep learning architectures are vulnerable to so called adversarial examples. This questions the security of deep neural networks (DNN) for ma…
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Semi-parametric framework for nonlinear system identification
problem Nonlinear system identification
method Orthogonal Gaussian process regression
result Interpretable models from incomplete physics
DCENWCNet improves WBC classification with LIME-based explainability.
problem Classifying white blood cells from blood images with high accuracy and interpretability.
method Integrates three CNN architectures with different settings to balance feature learning and performance.
result Achieves highest mean accuracy on the Rabbin-WBC dataset, outperforming state-of-the-art networks.
Interpretable semi-supervised classifier for black-box models with two self-labeling strategies.
problem Lack of labeled data and difficulty in explaining black-box models.
method Combines black-box and white-box approaches for self-labeling and prediction.
result Superior prediction rates and interpretability compared to state-of-the-art classifiers.
Minimalistic unsupervised learning with sparse manifold transform achieves SOTA performance.
problem Achieving state-of-the-art unsupervised learning performance without complex engineering.
method Sparse manifold transform, leveraging sparse coding, manifold learning, and slow feature analysis.
result 99.3% KNN top-1 accuracy on MNIST, 81.1% on CIFAR-10, and 53.2% on CIFAR-100.
SmoothFool efficiently computes smooth adversarial perturbations for deep networks.
problem Vulnerability of deep neural networks to adversarial attacks with specific statistical properties.
method SmoothFool: a general and computationally efficient framework for computing smooth adversarial perturbations.
result Smoothness significantly enhances robustness against adversarial attacks and improves transferability.
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.