Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples

Abstract

Many machine learning models are vulnerable to adversarial examples: inputs that are specially crafted to cause a machine learning model to produce an incorrect output. Adversarial examples that affect one model often affect another model, even if the two models have different architectures or were trained on different training sets, so long as both models were trained to perform the same task. An attacker may therefore train their own substitute model, craft adversarial examples against the substitute, and transfer them to a victim model, with very little information about the victim. Recent work has further developed a technique that uses the victim model as an oracle to label a synthetic training set for the substitute, so the attacker need not even collect a training set to mount the attack. We extend these recent techniques using reservoir sampling to greatly enhance the efficiency of the training procedure for the substitute model. We introduce new transferability attacks between previously unexplored (substitute, victim) pairs of machine learning model classes, most notably SVMs and decision trees. We demonstrate our attacks on two commercial machine learning classification systems from Amazon (96.19% misclassification rate) and Google (88.94%) using only 800 queries of the victim model, thereby showing that existing machine learning approaches are in general vulnerable to systematic black-box attacks regardless of their structure.

References in corpus (3)

• Distilling the Knowledge in a Neural Network
• Poisoning Attacks against Support Vector Machines
• Practical Black-Box Attacks against Machine Learning

Cited by in corpus (430)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• On Evaluating Adversarial Robustness
• Robust Physical-World Attacks on Deep Learning Models
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Attacks and Defences: A Survey
• Generating Natural Adversarial Examples
• The Space of Transferable Adversarial Examples
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Adversarial Examples Are Not Bugs, They Are Features
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• On the (Statistical) Detection of Adversarial Examples
• Black-box Adversarial Attacks with Limited Queries and Information
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• What Clinicians Want: Contextualizing Explainable Machine Learning for Clinical End Use
• Neural Trojans
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
• Solving Inverse Problems With Deep Neural Networks -- Robustness Included?
• Smart Home Personal Assistants: A Security and Privacy Review
• Federated Learning in Mobile Edge Networks: A Comprehensive Survey
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• On Adaptive Attacks to Adversarial Example Defenses
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• Early Methods for Detecting Adversarial Images
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• Adversarial Attacks Against Medical Deep Learning Systems
• Adversarial Examples that Fool Detectors
• Improving Adversarial Robustness of Ensembles with Diversity Training
• When Machine Learning Meets Privacy: A Survey and Outlook
• Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Understanding and Enhancing the Transferability of Adversarial Examples
• Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Functional Adversarial Attacks
• The Pitfalls of Simplicity Bias in Neural Networks
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustness
• Towards Demystifying Membership Inference Attacks
• Certified Defenses for Data Poisoning Attacks
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• APE-GAN: Adversarial Perturbation Elimination with GAN
• Adversarial Samples on Android Malware Detection Systems for IoT Systems
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Revisiting Adversarially Learned Injection Attacks Against Recommender Systems
• CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition
• Handling Adversarial Concept Drift in Streaming Data
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Invisible Mask: Practical Attacks on Face Recognition with Infrared
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Unrestricted Adversarial Examples via Semantic Manipulation
• Boosting Adversarial Training with Hypersphere Embedding
• Privacy Intelligence: A Survey on Image Privacy in Online Social Networks
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• Security and Privacy Issues in Deep Learning
• On the Effectiveness of Defensive Distillation
• Are Accuracy and Robustness Correlated?
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Defending Model Inversion and Membership Inference Attacks via Prediction Purification
• Black-Box Adversarial Attack with Transferable Model-based Embedding
• Adversarial Examples in Modern Machine Learning: A Review
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Adversarial Machine Learning -- Industry Perspectives
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Data Driven Exploratory Attacks on Black Box Classifiers in Adversarial Domains
• Defending against Adversarial Images using Basis Functions Transformations
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Entangled Watermarks as a Defense against Model Extraction
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Label-Consistent Backdoor Attacks
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Weighted-Sampling Audio Adversarial Example Attack
• A black-box adversarial attack for poisoning clustering
• BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks
• DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Machine Learning Security in Industry: A Quantitative Survey
• Robustness Verification of Tree-based Models
• Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating
• Adversarially Robust Neural Architectures
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Fooling OCR Systems with Adversarial Text Images
• Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
• Universal Adversarial Examples and Perturbations for Quantum Classifiers
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Adversarial Attacks for Optical Flow-Based Action Recognition Classifiers
• Bypassing Feature Squeezing by Increasing Adversary Strength
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• Security Matters: A Survey on Adversarial Machine Learning
• Enabling AutoML for Zero-Touch Network Security: Use-Case Driven Analysis
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• Adversarial Robustness via Fisher-Rao Regularization
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Deep Transfer Learning for Static Malware Classification
• Query-Efficient Black-box Adversarial Examples (superceded)
• MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses
• Unadversarial Examples: Designing Objects for Robust Vision
• Task dependent Deep LDA pruning of neural networks
• Adversarial Examples in Deep Learning: Characterization and Divergence
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• The Limitations of Model Uncertainty in Adversarial Settings
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• A Targeted Attack on Black-Box Neural Machine Translation with Parallel Data Poisoning
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations
• Adversarial Image Perturbation for Privacy Protection -- A Game Theory Perspective
• Morphence: Moving Target Defense Against Adversarial Examples
• Adversarial Reprogramming of Neural Networks
• Towards Visual Distortion in Black-Box Attacks
• Data-driven Identification of 2D Partial Differential Equations using extracted physical features
• AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flows
• Transferable Perturbations of Deep Feature Distributions
• Fooling a Real Car with Adversarial Traffic Signs
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• Imitation Attacks and Defenses for Black-box Machine Translation Systems
• Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Brain Programming is Immune to Adversarial Attacks: Towards Accurate and Robust Image Classification using Symbolic Learning
• Improving adversarial robustness of deep neural networks by using semantic information
• Defending Against Adversarial Examples with K-Nearest Neighbor
• Copycat CNN: Are Random Non-Labeled Data Enough to Steal Knowledge from Black-box Models?
• PAC-learning in the presence of evasion adversaries
• Interpretable Deep Learning under Fire
• To compress or not to compress: Understanding the Interactions between Adversarial Attacks and Neural Network Compression
• Attacking Optical Character Recognition (OCR) Systems with Adversarial Watermarks
• CopyCAT: Taking Control of Neural Policies with Constant Attacks
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• RANDOM MASK: Towards Robust Convolutional Neural Networks
• A Formalization of Robustness for Deep Neural Networks
• Improving Robustness of Task Oriented Dialog Systems
• Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems
• Percival: Making In-Browser Perceptual Ad Blocking Practical With Deep Learning
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Membership Leakage in Label-Only Exposures
• Adversarially Robust Training through Structured Gradient Regularization
• Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
• Breaking Transferability of Adversarial Samples with Randomness
• Adversarial Attacks for Tabular Data: Application to Fraud Detection and Imbalanced Data
• A Spectral View of Adversarially Robust Features
• A Survey on Resilient Machine Learning
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• VerIDeep: Verifying Integrity of Deep Neural Networks through Sensitive-Sample Fingerprinting
• Query-limited Black-box Attacks to Classifiers
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Learning to Anonymize Faces for Privacy Preserving Action Detection
• Curls & Whey: Boosting Black-Box Adversarial Attacks
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Transferable Universal Adversarial Perturbations Using Generative Models
• Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual Perspective
• Learning Transferable Adversarial Examples via Ghost Networks
• An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Models
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
• Towards Robust and Stable Deep Learning Algorithms for Forward Backward Stochastic Differential Equations
• AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models
• Experimental demonstration of adversarial examples in learning topological phases
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• When Attackers Meet AI: Learning-empowered Attacks in Cooperative Spectrum Sensing
• Adversarial Example Games
• Perturbation Analysis of Gradient-based Adversarial Attacks
• Projecting Trouble: Light Based Adversarial Attacks on Deep Learning Classifiers
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Raze to the Ground: Query-Efficient Adversarial HTML Attacks on Machine-Learning Phishing Webpage Detectors
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• How benign is benign overfitting?
• Towards Security Threats of Deep Learning Systems: A Survey
• Enhancing Cross-task Transferability of Adversarial Examples with Dispersion Reduction
• A Robust Adversarial Network-Based End-to-End Communications System With Strong Generalization Ability Against Adversarial Attacks
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines
• Efficient Training of Robust Decision Trees Against Adversarial Examples
• Not All Datasets Are Born Equal: On Heterogeneous Data and Adversarial Examples
• Boosting Gradient for White-Box Adversarial Attacks
• Sitatapatra: Blocking the Transfer of Adversarial Samples
• EREBA: Black-box Energy Testing of Adaptive Neural Networks
• Efficient Adversarial Training with Transferable Adversarial Examples
• Information Laundering for Model Privacy
• Convergence and Margin of Adversarial Training on Separable Data
• Snooping Attacks on Deep Reinforcement Learning
• Adaptive Adversarial Attack on Scene Text Recognition
• Cost-Aware Robust Tree Ensembles for Security Applications
• Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reduction
• Query Attack via Opposite-Direction Feature:Towards Robust Image Retrieval
• Adversarial Binaries for Authorship Identification
• Black-box Adversarial Attacks on Video Recognition Models
• Adversarial Robustness by Design through Analog Computing and Synthetic Gradients
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Input Validation for Neural Networks via Runtime Local Robustness Verification
• Towards Practical Lottery Ticket Hypothesis for Adversarial Training
• Hijack Vertical Federated Learning Models As One Party
• Improving Adversarial Robustness in Weight-quantized Neural Networks
• Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attacks
• Ulixes: Facial Recognition Privacy with Adversarial Machine Learning
• White-to-Black: Efficient Distillation of Black-Box Adversarial Attacks
• Decision-based Universal Adversarial Attack
• Adversarial Machine Learning Phases of Matter
• Towards Robust Training of Neural Networks by Regularizing Adversarial Gradients
• Universal, transferable and targeted adversarial attacks
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Jacobian Adversarially Regularized Networks for Robustness
• Mathematical Analysis of Adversarial Attacks
• AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients
• Detecting Overfitting via Adversarial Examples
• Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
• Laplacian Networks: Bounding Indicator Function Smoothness for Neural Network Robustness
• Headless Horseman: Adversarial Attacks on Transfer Learning Models
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
• RayS: A Ray Searching Method for Hard-label Adversarial Attack
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Detecting Adversarial Examples via Neural Fingerprinting
• Deep Neural Network Ensembles against Deception: Ensemble Diversity, Accuracy and Robustness
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• DAmageNet: A Universal Adversarial Dataset
• On the Certified Robustness for Ensemble Models and Beyond
• How Wrong Am I? - Studying Adversarial Examples and their Impact on Uncertainty in Gaussian Process Machine Learning Models
• Robustness and Transferability of Universal Attacks on Compressed Models
• A Transferable Anti-Forensic Attack on Forensic CNNs Using A Generative Adversarial Network
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• Transferable Sparse Adversarial Attack
• ATMPA: Attacking Machine Learning-based Malware Visualization Detection Methods via Adversarial Examples
• A Multiversion Programming Inspired Approach to Detecting Audio Adversarial Examples
• BASAR:Black-box Attack on Skeletal Action Recognition
• The Intriguing Relation Between Counterfactual Explanations and Adversarial Examples
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• A Backdoor Attack against 3D Point Cloud Classifiers
• HoneyModels: Machine Learning Honeypots
• CorrAttack: Black-box Adversarial Attack with Structured Search
• Theory-based residual neural networks: A synergy of discrete choice models and deep neural networks
• On the Robustness of Human Pose Estimation
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Robust Adversarial Attacks Against DNN-Based Wireless Communication Systems
• Discovering Robust Convolutional Architecture at Targeted Capacity: A Multi-Shot Approach
• Regional Adversarial Training for Better Robust Generalization
• DiffDefense: Defending against Adversarial Attacks via Diffusion Models
• Towards Robust Domain Generation Algorithm Classification
• Adversarial Detection: Attacking Object Detection in Real Time
• Black-box Adversarial Attacks on Network-wide Multi-step Traffic State Prediction Models
• Adversarial Attacks on Multivariate Time Series
• On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks
• Adversarial Transferability in Wearable Sensor Systems
• Blind Adversarial Network Perturbations
• DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation
• Who's Afraid of Adversarial Queries? The Impact of Image Modifications on Content-based Image Retrieval
• Strong Black-box Adversarial Attacks on Unsupervised Machine Learning Models
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Rearchitecting Classification Frameworks For Increased Robustness
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Deep Neural Networks for Choice Analysis: Extracting Complete Economic Information for Interpretation
• Defense-VAE: A Fast and Accurate Defense against Adversarial Attacks
• Noisy Computations during Inference: Harmful or Helpful?
• The Adversarial Attack and Detection under the Fisher Information Metric
• Harmonic Adversarial Attack Method
• Fraternal Twins: Unifying Attacks on Machine Learning and Digital Watermarking
• Effects of Differential Privacy and Data Skewness on Membership Inference Vulnerability
• Spanning Attack: Reinforce Black-box Attacks with Unlabeled Data
• Attacking CNN-based anti-spoofing face authentication in the physical domain
• Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks
• Calibrated neighborhood aware confidence measure for deep metric learning
• Detecting Adversarial Examples - A Lesson from Multimedia Forensics
• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• AutoGAN: Robust Classifier Against Adversarial Attacks
• NTD: Non-Transferability Enabled Backdoor Detection
• Exploiting Vulnerabilities of Load Forecasting Through Adversarial Attacks
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• BUZz: BUffer Zones for defending adversarial examples in image classification
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• A4 : Evading Learning-based Adblockers
• Analysis Methods in Neural Language Processing: A Survey
• Reducing Adversarial Example Transferability Using Gradient Regularization
• Robust and Private Learning of Halfspaces
• Data Poisoning Attacks on Neighborhood-based Recommender Systems
• Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack
• Bandlimiting Neural Networks Against Adversarial Attacks
• Brain-inspired reverse adversarial examples
• Minimax Defense against Gradient-based Adversarial Attacks
• Adversarial Attack across Datasets
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks
• Adversarial Attacks on Classifiers for Eye-based User Modelling
• Representation of White- and Black-Box Adversarial Examples in Deep Neural Networks and Humans: A Functional Magnetic Resonance Imaging Study
• Visually Imperceptible Adversarial Patch Attacks on Digital Images
• Dompteur: Taming Audio Adversarial Examples
• White-Box Target Attack for EEG-Based BCI Regression Problems
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• Concurrent Adversarial Learning for Large-Batch Training
• DeepSmartFuzzer: Reward Guided Test Generation For Deep Learning
• Soft Adversarial Training Can Retain Natural Accuracy
• Patch augmentation: Towards efficient decision boundaries for neural networks
• On The Relationship Between Universal Adversarial Attacks And Sparse Representations
• A New Ensemble Method for Concessively Targeted Multi-model Attack
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Avengers Ensemble! Improving Transferability of Authorship Obfuscation
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• A Layer-wise Adversarial-aware Quantization Optimization for Improving Robustness
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• IWA: Integrated Gradient based White-box Attacks for Fooling Deep Neural Networks
• Attack as Defense: Characterizing Adversarial Examples using Robustness
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• Understanding Object Detection Through An Adversarial Lens
• Regional Image Perturbation Reduces $L_p$ Norms of Adversarial Examples While Maintaining Model-to-model Transferability
• Query-Free Attacks on Industry-Grade Face Recognition Systems under Resource Constraints
• Yet Another Intermediate-Level Attack
• Ensemble Noise Simulation to Handle Uncertainty about Gradient-based Adversarial Attacks
• Defending against substitute model black box adversarial attacks with the 01 loss
• Propagated Perturbation of Adversarial Attack for well-known CNNs: Empirical Study and its Explanation
• A Computationally Efficient Method for Defending Adversarial Deep Learning Attacks
• Cross-Layer Strategic Ensemble Defense Against Adversarial Examples
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• Provably Robust Metric Learning
• Defective Convolutional Networks
• Uncovering the Connections Between Adversarial Transferability and Knowledge Transferability
• On Adaptive Distance Estimation
• A cryptographic approach to black box adversarial machine learning
• Improving Robustness of Malware Classifiers using Adversarial Strings Generated from Perturbed Latent Representations
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Mixed Strategy Game Model Against Data Poisoning Attacks
• Robust Deep Learning Ensemble against Deception
• Black-box Attacks on Automatic Speaker Verification using Feedback-controlled Voice Conversion
• Controlled Caption Generation for Images Through Adversarial Attacks
• Who's Afraid of Adversarial Transferability?
• Robust binary classification with the 01 loss
• Augmenting Model Robustness with Transformation-Invariant Attacks
• Physical Adversarial Attacks Against End-to-End Autoencoder Communication Systems
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Trivial or impossible -- dichotomous data difficulty masks model differences (on ImageNet and beyond)
• Feedback Learning for Improving the Robustness of Neural Networks
• Adversarial Learning with Cost-Sensitive Classes
• MAT: A Multi-strength Adversarial Training Method to Mitigate Adversarial Attacks
• Natural Adversarial Objects
• Enhanced countering adversarial attacks via input denoising and feature restoring
• Challenge AI Mind: A Crowd System for Proactive AI Testing
• AI-Powered GUI Attack and Its Defensive Methods
• On the transferability of adversarial examples between convex and 01 loss models
• Clipping free attacks against artificial neural networks
• Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptation
• Fast Approximate Spectral Normalization for Robust Deep Neural Networks
• Adversarial Robustness on Image Classification with $k$-means
• Simulating Unknown Target Models for Query-Efficient Black-box Attacks
• A Study on the Uncertainty of Convolutional Layers in Deep Neural Networks
• Query complexity of adversarial attacks
• A Tandem Framework Balancing Privacy and Security for Voice User Interfaces
• Real-time Detection of Practical Universal Adversarial Perturbations
• The Human Visual System and Adversarial AI
• Deep Repulsive Prototypes for Adversarial Robustness
• Evaluating Ensemble Robustness Against Adversarial Attacks
• Renofeation: A Simple Transfer Learning Method for Improved Adversarial Robustness
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability
• Broadly Applicable Targeted Data Sample Omission Attacks
• PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks
• Are L2 adversarial examples intrinsically different?
• Online Adversarial Attacks
• Absum: Simple Regularization Method for Reducing Structural Sensitivity of Convolutional Neural Networks
• Generating Adversarial Examples With Conditional Generative Adversarial Net
• Graph Interpolating Activation Improves Both Natural and Robust Accuracies in Data-Efficient Deep Learning
• Exploring Adversarial Fake Images on Face Manifold
• Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classes
• Thwarting finite difference adversarial attacks with output randomization
• OLR-WA: Online Weighted Average Linear Regression in Multivariate Data Streams
• Multi-way Encoding for Robustness
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• A note on hyperparameters in black-box adversarial examples
• Target Model Agnostic Adversarial Attacks with Query Budgets on Language Understanding Models
• Tricking Adversarial Attacks To Fail
• Localized Uncertainty Attacks
• Evaluating adversarial robustness in simulated cerebellum
• Analyzing Adversarial Robustness of Deep Neural Networks in Pixel Space: a Semantic Perspective
• Understanding Adversarial Examples Through Deep Neural Network's Response Surface and Uncertainty Regions
• EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attacks
• Towards adversarial robustness with 01 loss neural networks
• Adversarial Attacks on Cognitive Self-Organizing Networks: The Challenge and the Way Forward
• Identifying and Exploiting Structures for Reliable Deep Learning
• Architectural Resilience to Foreground-and-Background Adversarial Noise
• Towards Sharper First-Order Adversary with Quantized Gradients
• On the Vulnerability of CNN Classifiers in EEG-Based BCIs
• Exploring Adversarial Examples for Efficient Active Learning in Machine Learning Classifiers
• When Should You Defend Your Classifier -- A Game-theoretical Analysis of Countermeasures against Adversarial Examples
• Adversarial Ranking Attack and Defense
• Adversarial Perturbation Intensity Achieving Chosen Intra-Technique Transferability Level for Logistic Regression
• Fairness Degrading Adversarial Attacks Against Clustering Algorithms
• Denoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks
• Comprehensible Counterfactual Explanation on Kolmogorov-Smirnov Test
• Investigating Image Applications Based on Spatial-Frequency Transform and Deep Learning Techniques
• Spatially Correlated Patterns in Adversarial Images
• An Empirical Review of Adversarial Defenses
• Adaptive Verifiable Training Using Pairwise Class Similarity
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• The Effect of Class Definitions on the Transferability of Adversarial Attacks Against Forensic CNNs
• Adversarial Stylometry in the Wild: Transferable Lexical Substitution Attacks on Author Profiling
• Adversarial Imitation Attack
• Target Training Does Adversarial Training Without Adversarial Samples
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns
• blessing in disguise: Designing Robust Turing Test by Employing Algorithm Unrobustness
• Robustness Tests of NLP Machine Learning Models: Search and Semantically Replace
• Effectiveness of random deep feature selection for securing image manipulation detectors against adversarial examples
• Adversarial Attacks for Multi-view Deep Models