New benchmarks for algorithm control using RL.
problem Optimizing algorithm performance through online hyperparameter tuning.
method Formulated as a contextual MDP, solved with reinforcement learning.
result Reinforcement learning outperforms black-box approaches for longer sequences.
Evaluates local explanations using white-box models and log odds ratios.
problem Costly and subjective evaluation of local explanations.
method Benchmarking explanation techniques using log odds ratios.
result Explanation techniques' performance depends on model, dataset, data point, and normalization.
RIGA watermarks DNNs covertly and robustly with minimal accuracy loss.
problem Watermarking deep neural networks to enable tracing after release.
method Robust white-box GAN watermarking using adversarial training.
result Significantly improves covertness and robustness over state-of-the-art.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
Deep neural networks are susceptible to various inference attacks as they remember information about their training data. We design white-box inference attacks to perform a comprehensive privacy analysis of deep learning models. We measure the privacy leakage through parameters of fully trained models as well as the pa…
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
SMEs provide a transparent testbed for RL evaluation.
problem Lack of precise, white-box diagnostics in RL environments.
method Synthetic Monitoring Environments (SMEs) with fully configurable task characteristics and known optimal policies.
result SMEs allow for precise evaluation of RL algorithms, revealing the impact of specific environmental properties.
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
This paper benchmarks time-series adversarial defenses and attacks.
problem Adversarial attacks on time-series data.
method Detailed benchmarking of adversarial defense methods in the L∞ threat model. result Adversarial defenses offer robustness against both strong white-box and black-box attacks.
Paper proposes using auto-encoders to efficiently purify adversarial perturbations.
problem Vulnerability of machine learning models to adversarial examples.
method Iterative adversarial training on an auto-encoder to purify perturbations.
result The auto-encoder trained model outperforms other methods in protecting models against white-box attacks.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
New method calibrates white-box MI attacks, outperforming previous black-box methods.
problem Calibrating membership inference attacks on white-box models.
method Leveraging model memorization and overfitting features.
result Calibrated attack provides high precision in membership inference.
CRATE-MAE learns structured representations from unlabeled data.
problem Learning structured representations from unlabeled data.
method Structured Diffusion with White-Box Transformers.
result CRATE-MAE achieves highly promising performance on large-scale imagery datasets.
Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. How…
Extends batch active learning to non-differentiable models.
problem Efficiently training machine learning models on large, initially unlabelled datasets.
method Black-box batch active learning for regression tasks that relies solely on model predictions.
result Achieves strong performance on regression datasets compared to white-box approaches for deep learning models.
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
New action poisoning attacks improve LinUCB's performance by changing action signals.
problem Improving understanding of adversarial attacks on contextual bandit algorithms.
method Proposed action poisoning attacks in white-box and black-box settings.
result Action poisoning attacks can force LinUCB to pull a target arm frequently with low cost.
Paper finds optimal membership inference strategies for machine learning models.
problem Determining if a sample was part of the training set of a machine learning model.
method Derives optimal strategies for membership inference with assumptions on parameter distribution, showing that black-box attacks are as good as white-box attacks.
result Optimal strategies are not tractable, leading to approximations that outperform existing methods.
Stein-Encoder isolates genetic signals in multi-modal biomedical data.
problem Integration of high-dimensional genomic data with clinical data obscures genetic predictive impact.
method White-box supervised framework using Stein's method and residualization.
result Stein-Encoder improves predictive accuracy and reveals specific biological mechanisms.
Study on how many queries an adversary needs to make to match the best attack in white-box model.
problem Query complexity of adversarial attacks in machine learning models.
method Investigates the number of queries required for an adversary to match the best possible attack in the white-box model, using entropy of decision boundaries as a measure.
result Lower bound on the number of queries required for an adversary to match the best possible attack in the white-box model.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
SCENE-Net improves 3D point cloud segmentation with low resource usage and transparency.
problem Lack of resources and transparency in 3D semantic segmentation models.
method SCENE-Net uses signature shapes identified via GENEOs to achieve semantic segmentation with minimal resources.
result SCENE-Net achieves comparable IoU to state-of-the-art methods with less data and computational resources.
Defends classifiers from adversarial attacks using self-supervised data estimation.
problem Protecting classifiers from adversarial attacks with full attacker access.
method RIDE, a self-supervised learning algorithm for individual data estimation.
result Significant improvement in adversarial defense performance (98%, 76%, 43% test accuracy on MNIST, CIFAR-10, and ImageNet datasets respectively).
RTFE provides adversarial robustness to multiple models.
problem Adversarial examples can transfer to other models, compromising robustness.
method Proposes RTFE, a deep learning-based pre-processing mechanism.
result RTFE provides adversarial robustness to multiple independently trained classifiers.
Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image model…
Paper proposes a black-box adversarial attack method for graph embedding models.
problem Robustness of graph embedding models against adversarial attacks.
method GF-Attack constructs a generalized adversarial attacker by the graph filter and feature matrix, performing the attack on the graph filter in a black-box fashion.
result GF-Attack can consistently make strong attacks on different graph embedding models even with small perturbations.
Minimalistic unsupervised learning with sparse manifold transform achieves SOTA performance.
problem Achieving state-of-the-art unsupervised learning performance without complex engineering.
method Sparse manifold transform, leveraging sparse coding, manifold learning, and slow feature analysis.
result 99.3% KNN top-1 accuracy on MNIST, 81.1% on CIFAR-10, and 53.2% on CIFAR-100.
Detects adversarial examples in deep speech recognition.
problem Vulnerability of deep speech recognition systems to adversarial attacks.
method Formulated as a classification problem, generated adversarial and normal datasets, trained CNN.
result Accurately distinguishes between adversarial and normal examples for known attacks.
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security (<25%) compared to undefended networks. Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
We study the effectiveness of various approaches that defend against adversarial attacks on deep networks via manipulations based on basis function representations of images. Specifically, we experiment with low-pass filtering, PCA, JPEG compression, low resolution wavelet approximation, and soft-thresholding. We evalu…
Facebook's ResNeXt WSL models show exceptional robustness against image corruptions and adversarial attacks.
problem Image recognition model robustness against corruptions and adversarial attacks.
method Training with 1B images from Instagram and fine-tuning on ImageNet.
result ResNeXt WSL models achieve state-of-the-art results on ImageNet-C, ImageNet-P, and ImageNet-A.
Adversarial examples are important for understanding the behavior of neural models, and can improve their robustness through adversarial training. Recent work in natural language processing generated adversarial examples by assuming white-box access to the attacked model, and optimizing the input directly against it (E…
ReduNet optimizes data compression by maximizing rate reduction in deep networks.
problem Optimizing deep networks for high-dimensional multi-class data.
method Maximizing rate reduction through iterative gradient ascent, leading to a multi-layer deep network.
result ReduNet achieves optimal linear discriminative representation and is more efficient in the spectral domain.
In this appraisal paper, we evaluate the efficacy of SHIELD, a compression-based defense framework for countering adversarial attacks on image classification models, which was published at KDD 2018. Here, we consider alternative threat models not studied in the original work, where we assume that an adaptive adversary …
In this work, we evaluate adversarial robustness in the context of transfer learning from a source trained on CIFAR 100 to a target network trained on CIFAR 10. Specifically, we study the effects of using robust optimisation in the source and target networks. This allows us to identify transfer learning strategies unde…
ME-Net defends neural nets against adversarial attacks by reconstructing images.
problem Adversarial attacks on deep neural networks.
method ME-Net uses matrix estimation to preprocess images, destroying adversarial noise while preserving global structure.
result ME-Net consistently outperforms state-of-the-art defenses on various benchmarks.
In this paper, we propose an improvement of Adversarial Transformation Networks(ATN) to generate adversarial examples, which can fool white-box models and black-box models with a state of the art performance and won the 2rd place in the non-target task in CAAD 2018.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
New method detects adversarial images by exploiting their density.
problem Detecting adversarial images that are hard to find with gradient methods.
method Develop a test based on the density of adversarial directions.
result Unprecedented accuracy in detecting adversarial attacks under white-box setting.
Two attacks reveal vulnerabilities in deep neural network watermarking schemes.
problem Protecting deep learning models from unauthorized redistribution.
method Proposed black-box and white-box attacks to remove backdoor-based watermarks.
result Watermarks can be removed with minimal effort and without sensitive model information.
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Semi-parametric framework for nonlinear system identification
problem Nonlinear system identification
method Orthogonal Gaussian process regression
result Interpretable models from incomplete physics
This research discovers model architecture and training dataset characteristics through strategic input probing.
problem Discovering model architecture and training dataset characteristics in black box models.
method Structured input probes and model outputs are used to train a deep classifier for image and text classification.
result The approach successfully distinguishes between different image and text datasets and architectures.
NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
FEDMD-NFDP improves federated learning privacy without sacrificing performance.
problem Privacy leakage in federated learning when sharing predictions.
method Noise-Free Differential Privacy (NFDP) applied to federated model distillation.
result FEDMD-NFDP achieves comparable utility and privacy guarantees.
Graphical normalizing flows use Bayesian networks to improve normalizing flows' interpretability and performance.
problem Improving the interpretability and performance of normalizing flows.
method Revisiting normalizing flows as probabilistic graphical models, proposing graphical normalizing flows with either prescribed or learnable graph structures.
result Graphical conditioners lead to competitive white box density estimators.
Deep 3D models are vulnerable to isometry transformations under adversarial attacks.
problem Vulnerability of deep 3D models to isometry transformations under adversarial attacks.
method Developed a black-box attack with success rate over 95% and a novel white-box attack framework.
result Deep 3D models are extremely vulnerable to isometry transformations under adversarial attacks.