Watermarking of deep neural networks (DNN) can enable their tracing once released by a data owner. In this paper, we generalize white-box watermarking algorithms for DNNs, where the data owner needs white-box access to the model to extract the watermark. White-box watermarking algorithms have the advantage that they do…
On-device research index
arXiv research
A locally-built, LLM-digested index of recent arXiv papers in quant finance, geometry/topology, and statistical ML — keyword search served straight from SQLite on this machine.
168,742 papers · 148 categories
Trend · papers per month
48 results for “white-box networks”
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
Deep neural networks are susceptible to various inference attacks as they remember information about their training data. We design white-box inference attacks to perform a comprehensive privacy analysis of deep learning models. We measure the privacy leakage through parameters of fully trained models as well as the pa…
CRATE-MAE learns structured representations from unlabeled data.
problem Learning structured representations from unlabeled data.
method Structured Diffusion with White-Box Transformers.
result CRATE-MAE achieves highly promising performance on large-scale imagery datasets.
Transfer learning improves model robustness against adversarial attacks.
problem Understanding how transfer learning affects model robustness against adversarial attacks.
method Extensive empirical evaluations of white-box and black-box attacks on fine-tuned transfer learning models.
result Adversarial examples are more transferable when fine-tuning is used than when networks are trained independently.
InvGAN solves GAN inference problem without training data.
problem Inferring latent variables in GANs without access to training data.
method Training an encoder network to invert a pre-trained generator.
result Approximate inversion of latent codes from GAN generations.
ReduNet optimizes data compression by maximizing rate reduction in deep networks.
problem Optimizing deep networks for high-dimensional multi-class data.
method Maximizing rate reduction through iterative gradient ascent, leading to a multi-layer deep network.
result ReduNet achieves optimal linear discriminative representation and is more efficient in the spectral domain.
Ensemble of diverse CNNs detects and mitigates adversarial attacks.
problem Detecting and defending against adversarial attacks.
method An ensemble of specialized CNNs with a voting mechanism.
result Significant reduction in adversarial attack risk rate.
RTFE provides adversarial robustness to multiple models.
problem Adversarial examples can transfer to other models, compromising robustness.
method Proposes RTFE, a deep learning-based pre-processing mechanism.
result RTFE provides adversarial robustness to multiple independently trained classifiers.
In this paper, we propose an improvement of Adversarial Transformation Networks(ATN) to generate adversarial examples, which can fool white-box models and black-box models with a state of the art performance and won the 2rd place in the non-target task in CAAD 2018.
New method improves black-box attacks using pre-trained models.
problem Efficiently attacking black-box models with limited information.
method EigenBA algorithm leveraging pre-trained white-box model's Jacobian matrix.
result Optimal perturbations are related to right singular vectors of Jacobian matrix.
In this work, we evaluate adversarial robustness in the context of transfer learning from a source trained on CIFAR 100 to a target network trained on CIFAR 10. Specifically, we study the effects of using robust optimisation in the source and target networks. This allows us to identify transfer learning strategies unde…
Graphical normalizing flows use Bayesian networks to improve normalizing flows' interpretability and performance.
problem Improving the interpretability and performance of normalizing flows.
method Revisiting normalizing flows as probabilistic graphical models, proposing graphical normalizing flows with either prescribed or learnable graph structures.
result Graphical conditioners lead to competitive white box density estimators.
Machine Learning systems are vulnerable to adversarial attacks and will highly likely produce incorrect outputs under these attacks. There are white-box and black-box attacks regarding to adversary's access level to the victim learning algorithm. To defend the learning systems from these attacks, existing methods in th…
ODS improves adversarial attacks by maximizing output diversity.
problem Efficiency and effectiveness of adversarial attacks, especially black-box attacks.
method Output Diversified Sampling (ODS) that maximizes diversity in model outputs.
result ODS reduces the number of queries needed for black-box attacks on ImageNet by a factor of two.
We study the effectiveness of various approaches that defend against adversarial attacks on deep networks via manipulations based on basis function representations of images. Specifically, we experiment with low-pass filtering, PCA, JPEG compression, low resolution wavelet approximation, and soft-thresholding. We evalu…
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
Membership inference (MI) attacks exploit the fact that machine learning algorithms sometimes leak information about their training data through the learned model. In this work, we study membership inference in the white-box setting in order to exploit the internals of a model, which have not been effectively utilized …
Adversarial examples are important for understanding the behavior of neural models, and can improve their robustness through adversarial training. Recent work in natural language processing generated adversarial examples by assuming white-box access to the attacked model, and optimizing the input directly against it (E…
New research shows many recent defenses against adversarial examples are ineffective against black-box attacks.
problem The robustness of recent defenses against adversarial examples is insufficient, especially against black-box attacks.
method Evaluation of nine defenses on two black-box adversarial models and six attacks on CIFAR-10 and Fashion-MNIST datasets.
result Most recent defenses provide only marginal improvements in security () compared to undefended networks.
Depending on how much information an adversary can access to, adversarial attacks can be classified as white-box attack and black-box attack. For white-box attack, optimization-based attack algorithms such as projected gradient descent (PGD) can achieve relatively high attack success rates within moderate iterates. How…
Extends batch active learning to non-differentiable models.
problem Efficiently training machine learning models on large, initially unlabelled datasets.
method Black-box batch active learning for regression tasks that relies solely on model predictions.
result Achieves strong performance on regression datasets compared to white-box approaches for deep learning models.
New action poisoning attacks improve LinUCB's performance by changing action signals.
problem Improving understanding of adversarial attacks on contextual bandit algorithms.
method Proposed action poisoning attacks in white-box and black-box settings.
result Action poisoning attacks can force LinUCB to pull a target arm frequently with low cost.
Study on how many queries an adversary needs to make to match the best attack in white-box model.
problem Query complexity of adversarial attacks in machine learning models.
method Investigates the number of queries required for an adversary to match the best possible attack in the white-box model, using entropy of decision boundaries as a measure.
result Lower bound on the number of queries required for an adversary to match the best possible attack in the white-box model.
Despite their accuracy, neural network-based classifiers are still prone to manipulation through adversarial perturbations. Those perturbations are designed to be misclassified by the neural network, while being perceptually identical to some valid input. The vast majority of attack methods rely on white-box conditions…
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers …
Paper presents a method to disrupt deep uncertainty estimation without affecting accuracy.
problem Uncertainty estimation in deep neural networks for risk-sensitive applications.
method A novel attack that cripples uncertainty estimation without reducing accuracy.
result The attack causes the network to be more confident in incorrect predictions than correct ones.
Stein-Encoder isolates genetic signals in multi-modal biomedical data.
problem Integration of high-dimensional genomic data with clinical data obscures genetic predictive impact.
method White-box supervised framework using Stein's method and residualization.
result Stein-Encoder improves predictive accuracy and reveals specific biological mechanisms.
NP-Attack reduces query counts for black-box adversarial attacks.
problem Efficiency of black-box adversarial attacks is low.
method Uses Neural Process to characterize image structure and find adversarial examples.
result NP-Attack significantly decreases query counts.
Machine learning models are vulnerable to adversarial examples. Iterative adversarial training has shown promising results against strong white-box attacks. However, adversarial training is very expensive, and every time a model needs to be protected, such expensive training scheme needs to be performed. In this paper,…
Evaluates local explanations using white-box models and log odds ratios.
problem Costly and subjective evaluation of local explanations.
method Benchmarking explanation techniques using log odds ratios.
result Explanation techniques' performance depends on model, dataset, data point, and normalization.
SCENE-Net improves 3D point cloud segmentation with low resource usage and transparency.
problem Lack of resources and transparency in 3D semantic segmentation models.
method SCENE-Net uses signature shapes identified via GENEOs to achieve semantic segmentation with minimal resources.
result SCENE-Net achieves comparable IoU to state-of-the-art methods with less data and computational resources.
Classifiers trained using conventional empirical risk minimization or maximum likelihood methods are known to suffer dramatic performance degradations when tested over examples adversarially selected based on knowledge of the classifier's decision rule. Due to the prominence of Artificial Neural Networks (ANNs) as clas…
Despite being popularly used in many applications, neural network models have been found to be vulnerable to adversarial examples, i.e., carefully crafted examples aiming to mislead machine learning models. Adversarial examples can pose potential risks on safety and security critical applications. However, existing def…
The application of deep recurrent networks to audio transcription has led to impressive gains in automatic speech recognition (ASR) systems. Many have demonstrated that small adversarial perturbations can fool deep neural networks into incorrectly predicting a specified target with high confidence. Current work on fool…
Deep Learning models are vulnerable to adversarial examples, i.e.\ images obtained via deliberate imperceptible perturbations, such that the model misclassifies them with high confidence. However, class confidence by itself is an incomplete picture of uncertainty. We therefore use principled Bayesian methods to capture…
Colored noise improves neural network robustness against adversarial attacks.
problem Vulnerability of neural networks to adversarial perturbations.
method Injection of colored noise into network weights and activations during adversarial training.
result Our approach outperforms previous methods in terms of adversarial accuracy on CIFAR-10 and CIFAR-100 datasets.
The easiness at which adversarial instances can be generated in deep neural networks raises some fundamental questions on their functioning and concerns on their use in critical systems. In this paper, we draw a connection between over-generalization and adversaries: a possible cause of adversaries lies in models desig…
SONet stabilizes ODE networks for robustness without adversarial training.
problem Improving adversarial robustness of neural networks without sacrificing natural accuracy.
method SONet uses skew-symmetric ODE blocks and DOPRI5 solver for robustness.
result SONet achieves comparable robustness to adversarial defense methods without trade-off.
Backdoors in deep neural networks are undetectable and enable invariance-based adversarial examples.
problem Statistically undetectable backdoors in deep neural networks.
method Adversarial model trainer method to plant backdoors, showing invariance-based adversarial examples.
result Backdoors are statistically undetectable and enable generation of adversarial examples for every input.
Despite the successful application of machine learning (ML) in a wide range of domains, adaptability---the very property that makes machine learning desirable---can be exploited by adversaries to contaminate training and evade classification. In this paper, we investigate the feasibility of applying a specific class of…
Minimalistic unsupervised learning with sparse manifold transform achieves SOTA performance.
problem Achieving state-of-the-art unsupervised learning performance without complex engineering.
method Sparse manifold transform, leveraging sparse coding, manifold learning, and slow feature analysis.
result 99.3% KNN top-1 accuracy on MNIST, 81.1% on CIFAR-10, and 53.2% on CIFAR-100.
The paper identifies potential adversarial samples near decision boundaries of neural networks.
problem Vulnerability of deep neural networks to small perturbations of inputs.
method Developed a method to explore near decision boundaries of trained classifiers to identify potential adversarial samples.
result Potential adversarial samples represent only 61% of the test data but cover more than 82% of adversarial samples produced by iFGSM and 92% of those by DeepFool on CIFAR10.
Deep learning algorithms and networks are vulnerable to perturbed inputs which is known as the adversarial attack. Many defense methodologies have been investigated to defend against such adversarial attack. In this work, we propose a novel methodology to defend the existing powerful attack model. We for the first time…
We propose a simple change to existing neural network structures for better defending against gradient-based adversarial attacks. Instead of using popular activation functions (such as ReLU), we advocate the use of k-Winners-Take-All (k-WTA) activation, a C0 discontinuous function that purposely invalidates the neural …
Membership inference determines, given a sample and trained parameters of a machine learning model, whether the sample was part of the training set. In this paper, we derive the optimal strategy for membership inference with a few assumptions on the distribution of the parameters. We show that optimal attacks only depe…
Stochastic LWTA networks resist adversarial attacks while maintaining accuracy.
problem Adversarial robustness of neural networks.
method Replaced ReLU with stochastic LWTA activations, trained with Variational Bayesian and PGD.
result Stochastic LWTA networks achieve state-of-the-art robustness against adversarial attacks.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.