Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

Abstract

Although deep neural networks (DNNs) have achieved great success in many tasks, they can often be fooled by \emph{adversarial examples} that are generated by adding small but purposeful distortions to natural examples. Previous studies to defend against adversarial examples mostly focused on refining the DNN models, but have either shown limited success or required expensive computation. We propose a new strategy, \emph{feature squeezing}, that can be used to harden DNN models by detecting adversarial examples. Feature squeezing reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. By comparing a DNN model's prediction on the original input with that on squeezed inputs, feature squeezing detects adversarial examples with high accuracy and few false positives. This paper explores two feature squeezing methods: reducing the color bit depth of each pixel and spatial smoothing. These simple strategies are inexpensive and complementary to other defenses, and can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks.

To appear in Network and Distributed Systems Security Symposium (NDSS) 2018

References in corpus (10)

• Explaining and Harnessing Adversarial Examples
• Improving neural networks by preventing co-adaptation of feature detectors
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Adversarial Feature Selection against Evasion Attacks
• Defensive Distillation is Not Robust to Adversarial Examples
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Universal adversarial perturbations
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples

Cited by in corpus (393)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Adversarially Robust Generalization Requires More Data
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Attacks and Defences: A Survey
• Countering Adversarial Images using Input Transformations
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Microsoft Malware Classification Challenge
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Securing Connected & Autonomous Vehicles: Challenges Posed by Adversarial Machine Learning and The Way Forward
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Cars
• Adversarial Weight Perturbation Helps Robust Generalization
• Detecting Adversarial Image Examples in Deep Networks with Adaptive Noise Reduction
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• Motivating the Rules of the Game for Adversarial Example Research
• Input-Aware Dynamic Backdoor Attack
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• A Survey on AI Assurance
• Adversarial Attacks Against Medical Deep Learning Systems
• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Smooth Adversarial Training
• AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning
• Low Frequency Adversarial Perturbation
• The Pitfalls of Simplicity Bias in Neural Networks
• Deep Learning for Steganalysis of Diverse Data Types: A review of methods, taxonomy, challenges and future directions
• Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses
• Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Backdoor Attacks against Transfer Learning with Pre-trained Deep Learning Models
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Robust Pre-Training by Adversarial Contrastive Learning
• Scattering Model Guided Adversarial Examples for SAR Target Recognition: Attack and Defense
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Unrestricted Adversarial Examples via Semantic Manipulation
• Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems
• FDA3 : Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Decentralized Deep Learning for Multi-Access Edge Computing: A Survey on Communication Efficiency and Trustworthiness
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Security and Privacy Issues in Deep Learning
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• Testing and verification of neural-network-based safety-critical control software: A systematic literature review
• Discretization based Solutions for Secure Machine Learning against Adversarial Attacks
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Adversarial Examples in Modern Machine Learning: A Review
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• RAB: Provable Robustness Against Backdoor Attacks
• Certified Adversarial Robustness for Deep Reinforcement Learning
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuning
• Towards Robust Neural Networks via Random Self-ensemble
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• Defensive Quantization: When Efficiency Meets Robustness
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Bypassing Feature Squeezing by Increasing Adversary Strength
• QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attacks
• Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review
• Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer
• Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
• Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
• Towards a Robust Deep Neural Network in Texts: A Survey
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• Adversarial Phenomenon in the Eyes of Bayesian Deep Learning
• Boosting Adversarial Transferability through Enhanced Momentum
• Robust Image Classification: Defensive Strategies against FGSM and PGD Adversarial Attacks
• Enhancing the Transferability of Adversarial Attacks through Variance Tuning
• Combating Adversarial Misspellings with Robust Word Recognition
• Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Exploiting vulnerabilities of deep neural networks for privacy protection
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• A Survey on Security Attacks and Defense Techniques for Connected and Autonomous Vehicles
• Intriguing Properties of Adversarial Examples
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• The Attacker's Perspective on Automatic Speaker Verification: An Overview
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• Generating 3D Adversarial Point Clouds
• Towards resilient machine learning for ransomware detection
• TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
• Adversarial Neural Pruning with Latent Vulnerability Suppression
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Evolving Robust Neural Architectures to Defend from Adversarial Attacks
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks
• Secure Deep Learning Engineering: A Software Quality Assurance Perspective
• A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples
• Interpretable Deep Learning under Fire
• PAC-learning in the presence of evasion adversaries
• Attacking Optical Character Recognition (OCR) Systems with Adversarial Watermarks
• Improving adversarial robustness of deep neural networks by using semantic information
• How Robust are Discriminatively Trained Zero-Shot Learning Models?
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• A Formalization of Robustness for Deep Neural Networks
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation Techniques
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• Biologically Inspired Mechanisms for Adversarial Robustness
• Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing
• An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Models
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• Learning to Anonymize Faces for Privacy Preserving Action Detection
• VerIDeep: Verifying Integrity of Deep Neural Networks through Sensitive-Sample Fingerprinting
• An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Networks
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• Adversarial Image Color Transformations in Explicit Color Filter Space
• Gradient Band-based Adversarial Training for Generalized Attack Immunity of A3C Path Finding
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Learnable Boundary Guided Adversarial Training
• Investigating Robustness of Adversarial Samples Detection for Automatic Speaker Verification
• Effective and Efficient Vote Attack on Capsule Networks
• Defending Against Physically Realizable Attacks on Image Classification
• How benign is benign overfitting?
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines
• Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
• AdvDrop: Adversarial Attack to DNNs by Dropping Information
• Are Adversarial Perturbations a Showstopper for ML-Based CAD? A Case Study on CNN-Based Lithographic Hotspot Detection
• SoK: Machine Learning Governance
• Towards Security Threats of Deep Learning Systems: A Survey
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning
• Towards Robust Neural Networks via Orthogonal Diversity
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
• Anomalous Example Detection in Deep Learning: A Survey
• Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Determining Sequence of Image Processing Technique (IPT) to Detect Adversarial Attacks
• FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• WaveGuard: Understanding and Mitigating Audio Adversarial Examples
• Effective Universal Unrestricted Adversarial Attacks using a MOE Approach
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Generative Dynamic Patch Attack
• Towards Adversarial-Resilient Deep Neural Networks for False Data Injection Attack Detection in Power Grids
• Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks
• Adversarial jamming attacks and defense strategies via adaptive deep reinforcement learning
• Evaluation of Neural Networks Defenses and Attacks using NDCG and Reciprocal Rank Metrics
• Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
• Defense against adversarial attacks on spoofing countermeasures of ASV
• Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability
• Image Transformation can make Neural Networks more robust against Adversarial Examples
• Decision-based Universal Adversarial Attack
• Trustworthy AI in the Age of Pervasive Computing and Big Data
• Defending against Machine Learning based Inference Attacks via Adversarial Examples: Opportunities and Challenges
• Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Frequency Centric Defense Mechanisms against Adversarial Examples
• SoK: Systematic analysis of adversarial threats against deep learning approaches for autonomous anomaly detection systems in SDN-IoT networks
• LiBRe: A Practical Bayesian Approach to Adversarial Detection
• RobFR: Benchmarking Adversarial Robustness on Face Recognition
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Detecting Adversarial Attacks On Audiovisual Speech Recognition
• Runtime Monitoring Neuron Activation Patterns
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Attacking and Defending Machine Learning Applications of Public Cloud
• Detection Defense Against Adversarial Attacks with Saliency Map
• Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?
• A Multiversion Programming Inspired Approach to Detecting Audio Adversarial Examples
• SEC4SR: A Security Analysis Platform for Speaker Recognition
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• Improved Detection of Adversarial Images Using Deep Neural Networks
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• HoneyModels: Machine Learning Honeypots
• Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers
• A Data-driven Adversarial Examples Recognition Framework via Adversarial Feature Genome
• Regularizers for Single-step Adversarial Training
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• Towards Characterizing Adversarial Defects of Deep Learning Software from the Lens of Uncertainty
• GraN: An Efficient Gradient-Norm Based Detector for Adversarial and Misclassified Examples
• Noisy Computations during Inference: Harmful or Helpful?
• Adversarial Defense by Stratified Convolutional Sparse Coding
• PASA: Attack Agnostic Unsupervised Adversarial Detection using Prediction & Attribution Sensitivity Analysis
• Defense-VAE: A Fast and Accurate Defense against Adversarial Attacks
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency
• Stateful Detection of Black-Box Adversarial Attacks
• Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis
• Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Feature-level Malware Obfuscation in Deep Learning
• A Data Augmentation-based Defense Method Against Adversarial Attacks in Neural Networks
• Adversarially Robust Estimate and Risk Analysis in Linear Regression
• Learning under $p$-Tampering Attacks
• Detecting Adversarial Examples - A Lesson from Multimedia Forensics
• Exploiting the Inherent Limitation of L0 Adversarial Examples
• Adversarial Attacks in Multimodal Systems: A Practitioner's Survey
• Advancing Adversarial Training by Injecting Booster Signal
• Customizing an Adversarial Example Generator with Class-Conditional GANs
• MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes
• Tailoring Adversarial Attacks on Deep Neural Networks for Targeted Class Manipulation Using DeepFool Algorithm
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Mitigating Gradient-based Adversarial Attacks via Denoising and Compression
• Certifying Joint Adversarial Robustness for Model Ensembles
• Improve Adversarial Robustness via Weight Penalization on Classification Layer
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start
• Self-supervised Adversarial Training
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Adversarial Example Detection by Classification for Deep Speech Recognition
• Stroke-based Character Reconstruction
• Medical Aegis: Robust adversarial protectors for medical images
• CAP: Co-Adversarial Perturbation on Weights and Features for Improving Generalization of Graph Neural Networks
• ATRO: Adversarial Training with a Rejection Option
• DAFAR: Defending against Adversaries by Feedback-Autoencoder Reconstruction
• Attack as Defense: Characterizing Adversarial Examples using Robustness
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• A Frequency Perspective of Adversarial Robustness
• Long-term Cross Adversarial Training: A Robust Meta-learning Method for Few-shot Classification Tasks
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Perceptually Constrained Adversarial Attacks
• Noise Optimization for Artificial Neural Networks
• Self-supervised Fine-tuning for Correcting Super-Resolution Convolutional Neural Networks
• MAD-VAE: Manifold Awareness Defense Variational Autoencoder
• Convolutional Neural Networks with Transformed Input based on Robust Tensor Network Decomposition
• Understanding the Error in Evaluating Adversarial Robustness
• Cross-Layer Strategic Ensemble Defense Against Adversarial Examples
• AuxBlocks: Defense Adversarial Example via Auxiliary Blocks
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve
• Structure-Invariant Testing for Machine Translation
• Query-Free Attacks on Industry-Grade Face Recognition Systems under Resource Constraints
• A Deep Learning-based Fine-grained Hierarchical Learning Approach for Robust Malware Classification
• Progressive Defense Against Adversarial Attacks for Deep Learning as a Service in Internet of Things
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• Semantically Adversarial Learnable Filters
• Going Grayscale: The Road to Understanding and Improving Unlearnable Examples
• Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models
• Detecting and Correcting Adversarial Images Using Image Processing Operations
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• ExAD: An Ensemble Approach for Explanation-based Adversarial Detection
• Less is More: Culling the Training Set to Improve Robustness of Deep Neural Networks
• Malware Evasion Attack and Defense
• ZK-GanDef: A GAN based Zero Knowledge Adversarial Training Defense for Neural Networks
• Black-box Attacks on Image Activity Prediction and its Natural Language Explanations
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• An Empirical Investigation of Randomized Defenses against Adversarial Attacks
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization
• Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices
• Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs
• Enhanced countering adversarial attacks via input denoising and feature restoring
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Dynamic Efficient Adversarial Training Guided by Gradient Magnitude
• Multiplicative Reweighting for Robust Neural Network Optimization
• Improving Neural ODEs via Knowledge Distillation
• SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attacks
• Downscaling Attack and Defense: Turning What You See Back Into What You Get
• Query complexity of adversarial attacks
• FBI: Fingerprinting models with Benign Inputs
• HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks
• Perceptual Deep Neural Networks: Adversarial Robustness through Input Recreation
• A Survey on Assessing the Generalization Envelope of Deep Neural Networks: Predictive Uncertainty, Out-of-distribution and Adversarial Samples
• Immuno-mimetic Deep Neural Networks (Immuno-Net)
• Who is Responsible for Adversarial Defense?
• Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity
• Exploiting Multi-Object Relationships for Detecting Adversarial Attacks in Complex Scenes
• Heat and Blur: An Effective and Fast Defense Against Adversarial Examples
• Challenging the adversarial robustness of DNNs based on error-correcting output codes
• Analysis of Random Perturbations for Robust Convolutional Neural Networks
• Adversarial Purification through Representation Disentanglement
• Can the state of relevant neurons in a deep neural networks serve as indicators for detecting adversarial attacks?
• Deep Latent Defence
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Reveal of Vision Transformers Robustness against Adversarial Attacks
• Beating Attackers At Their Own Games: Adversarial Example Detection Using Adversarial Gradient Directions
• Robusta: Robust AutoML for Feature Selection via Reinforcement Learning
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences
• Adversarial Examples Detection beyond Image Space
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• Ensemble Generative Cleaning with Feedback Loops for Defending Adversarial Attacks
• On The Utility of Conditional Generation Based Mutual Information for Characterizing Adversarial Subspaces
• Robust Deep Learning Ensemble against Deception
• Understanding and Quantifying Adversarial Examples Existence in Linear Classification
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Clipping free attacks against artificial neural networks
• Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks
• Robustness from Simple Classifiers
• Search Space of Adversarial Perturbations against Image Filters
• On Lyapunov exponents and adversarial perturbation
• Augmenting Model Robustness with Transformation-Invariant Attacks
• The magnitude vector of images
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Learning to Disentangle Robust and Vulnerable Features for Adversarial Detection
• Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation
• Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
• Training Machine Learning Models by Regularizing their Explanations
• Human Imperceptible Attacks and Applications to Improve Fairness
• Defending Against Adversarial Attacks Using Random Forests
• HAWKEYE: Adversarial Example Detector for Deep Neural Networks
• Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• Keyed Non-Parametric Hypothesis Tests
• Orthogonal Deep Models As Defense Against Black-Box Attacks
• Robustifying Binary Classification to Adversarial Perturbation
• State-Reification Networks: Improving Generalization by Modeling the Distribution of Hidden Representations
• Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples
• Moiré Attack (MA): A New Potential Risk of Screen Photos
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• On Brightness Agnostic Adversarial Examples Against Face Recognition Systems
• Improving Adversarial Robustness for Free with Snapshot Ensemble
• An Explainable Adversarial Robustness Metric for Deep Learning Neural Networks
• Comparative Study on Noise-Augmented Training and its Effect on Adversarial Robustness in ASR Systems
• When Should You Defend Your Classifier -- A Game-theoretical Analysis of Countermeasures against Adversarial Examples
• Adversarial Examples and the Deeper Riddle of Induction: The Need for a Theory of Artifacts in Deep Learning
• Generating Minimal Adversarial Perturbations with Integrated Adaptive Gradients
• Adaptive Gradient for Adversarial Perturbations Generation
• Testing Machine Translation via Referential Transparency
• Adversarial Machine Learning for Cybersecurity and Computer Vision: Current Developments and Challenges
• Feature Losses for Adversarial Robustness
• Image Decomposition and Classification through a Generative Model
• How to beat a Bayesian adversary
• A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification
• Improving Compositionality of Neural Networks by Decoding Representations to Inputs
• Shape Defense Against Adversarial Attacks
• Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Images
• David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge
• Detection of Adversarial Supports in Few-shot Classifiers Using Self-Similarity and Filtering
• Learning Task-aware Robust Deep Learning Systems
• Adversarial Defenses via Vector Quantization
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability
• Imitation Game for Adversarial Disillusion with Chain-of-Thought Reasoning in Generative AI
• Generating Adversarial Perturbation with Root Mean Square Gradient
• On Configurable Defense against Adversarial Example Attacks
• PredCoin: Defense against Query-based Hard-label Attack
• The Controllability of Planning, Responsibility, and Security in Automatic Driving Technology
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Context-Aware Image Denoising with Auto-Threshold Canny Edge Detection to Suppress Adversarial Perturbation
• Adversarial Attack Attribution: Discovering Attributable Signals in Adversarial ML Attacks
• Denoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks
• Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection
• Boosting the Robustness Verification of DNN by Identifying the Achilles's Heel
• FAdeML: Understanding the Impact of Pre-Processing Noise Filtering on Adversarial Machine Learning
• Dual Head Adversarial Training
• Towards Robust Classification with Image Quality Assessment
• Towards Natural Robustness Against Adversarial Examples