Ensemble Adversarial Training: Attacks and Defenses

Abstract

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against strong ones. As a result, we find that adversarial training remains vulnerable to black-box attacks, where we transfer perturbations computed on undefended models, as well as to a powerful novel single-step attack that escapes the non-smooth vicinity of the input data via a small random step. We further introduce Ensemble Adversarial Training, a technique that augments training data with perturbations transferred from other models. On ImageNet, Ensemble Adversarial Training yields models with strong robustness to black-box attacks. In particular, our most robust model won the first round of the NIPS 2017 competition on Defenses against Adversarial Attacks. However, subsequent work found that more elaborate black-box attacks could significantly enhance transferability and reduce the accuracy of our models.

22 pages, 5 figures, International Conference on Learning Representations (ICLR) 2018 (amended in April 2020 to include subsequent attacks that significantly reduced the robustness of our models)

References in corpus (13)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Certified Defenses against Adversarial Examples
• Domain Adaptation: Learning Bounds and Algorithms
• The Space of Transferable Adversarial Examples
• Systematic evaluation of CNN advances on the ImageNet
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Foveation-based Mechanisms Alleviate Adversarial Examples
• Biologically inspired protection of deep networks from adversarial attacks
• Comment on "Biologically inspired protection of deep networks from adversarial attacks"
• Using Non-invertible Data Transformations to Build Adversarial-Robust Neural Networks

Cited by in corpus (335)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• A Unifying Review of Deep and Shallow Anomaly Detection
• Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles
• Certified Defenses against Adversarial Examples
• Adversarial Attacks and Defences: A Survey
• Countering Adversarial Images using Input Transformations
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Optimization Problems for Machine Learning: A Survey
• Spectral Signatures in Backdoor Attacks
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data
• Adversarial Examples: Opportunities and Challenges
• Generating Adversarial Examples with Adversarial Networks
• Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Security and Privacy Approaches in Mixed Reality: A Literature Survey
• Adversarial Weight Perturbation Helps Robust Generalization
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Image Super-Resolution as a Defense Against Adversarial Attacks
• When Machine Unlearning Jeopardizes Privacy
• Are Labels Required for Improving Adversarial Robustness?
• On Adversarial Examples for Character-Level Neural Machine Translation
• Ten Years of Generative Adversarial Nets (GANs): A survey of the state-of-the-art
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• WaveCNet: Wavelet Integrated CNNs to Suppress Aliasing Effect for Noise-Robust Image Classification
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• Adversarial Training and Robustness for Multiple Perturbations
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead
• Rethinking Bayesian Learning for Data Analysis: The Art of Prior and Inference in Sparsity-Aware Modeling
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• The Butterfly Effect in Artificial Intelligence Systems: Implications for AI Bias and Fairness
• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• Fixing Data Augmentation to Improve Adversarial Robustness
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Provably Minimally-Distorted Adversarial Examples
• LESSON: Multi-Label Adversarial False Data Injection Attack for Deep Learning Locational Detection
• Adversarial Examples for Semantic Segmentation and Object Detection
• Understanding and Enhancing the Transferability of Adversarial Examples
• Practical Blind Membership Inference Attack via Differential Comparisons
• Low Frequency Adversarial Perturbation
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Improving Transferability of Adversarial Examples with Input Diversity
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Adversarial Attack and Defense on Point Sets
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Boosting Adversarial Training with Hypersphere Embedding
• FDA3 : Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications
• Hardware Trojan Attacks on Neural Networks
• Neuron Shapley: Discovering the Responsible Neurons
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Maximal Jacobian-based Saliency Map Attack
• Security and Privacy Issues in Deep Learning
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Watch out! Motion is Blurring the Vision of Your Deep Neural Networks
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Discretization based Solutions for Secure Machine Learning against Adversarial Attacks
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Dynamic Time Warping based Adversarial Framework for Time-Series Domain
• Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks
• Boosting Adversarial Attacks with Momentum
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Walking on the Edge: Fast, Low-Distortion Adversarial Examples
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Adversarial Examples Improve Image Recognition
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Certified Adversarial Robustness for Deep Reinforcement Learning
• BERT Loses Patience: Fast and Robust Inference with Early Exit
• Understanding and Improving Fast Adversarial Training
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Towards Robust Neural Networks via Random Self-ensemble
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection
• On Robustness of Neural Ordinary Differential Equations
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• Understanding and Combating Robust Overfitting via Input Loss Landscape Analysis and Regularization
• Fooling OCR Systems with Adversarial Text Images
• A Causal View on Robustness of Neural Networks
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Defensive Quantization: When Efficiency Meets Robustness
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Max-Mahalanobis Linear Discriminant Analysis Networks
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• PRADA: Protecting against DNN Model Stealing Attacks
• Adversarial Distributional Training for Robust Deep Learning
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Bypassing Feature Squeezing by Increasing Adversary Strength
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• Task-generalizable Adversarial Attack based on Perceptual Metric
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• L2-Nonexpansive Neural Networks
• Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
• Software Testing for Machine Learning
• Towards a Robust Deep Neural Network in Texts: A Survey
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Divide, Denoise, and Defend against Adversarial Attacks
• Exploiting vulnerabilities of deep neural networks for privacy protection
• Defense against Universal Adversarial Perturbations
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• DeepHunter: Hunting Deep Neural Network Defects via Coverage-Guided Fuzzing
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Mutual Adversarial Training: Learning together is better than going alone
• Lipschitz regularized Deep Neural Networks generalize and are adversarially robust
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• Exploring Connections Between Active Learning and Model Extraction
• Improved robustness to adversarial examples using Lipschitz regularization of the loss
• Convolutional Neural Networks Rarely Learn Shape for Semantic Segmentation
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection
• Stochasticity and Robustness in Spiking Neural Networks
• Towards Visual Distortion in Black-Box Attacks
• Boundary thickness and robustness in learning models
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• Fooling a Real Car with Adversarial Traffic Signs
• Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples
• Evolving Robust Neural Architectures to Defend from Adversarial Attacks
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Learning More Robust Features with Adversarial Training
• Adversarial Training Versus Weight Decay
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples
• Interpretable Deep Learning under Fire
• PAC-learning in the presence of evasion adversaries
• Cyber Vaccine for Deepfake Immunity
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• Percival: Making In-Browser Perceptual Ad Blocking Practical With Deep Learning
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Intriguing properties of adversarial training at scale
• ConvNets and ImageNet Beyond Accuracy: Understanding Mistakes and Uncovering Biases
• A Provable Defense for Deep Residual Networks
• Membership Leakage in Label-Only Exposures
• Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
• SimAug: Learning Robust Representations from Simulation for Trajectory Prediction
• Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attacks
• Playing the Game of Universal Adversarial Perturbations
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Solving smooth min-min and min-max problems by mixed oracle algorithms
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Breaking Transferability of Adversarial Samples with Randomness
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• Zeroth-Order Algorithms for Smooth Saddle-Point Problems
• DaST: Data-free Substitute Training for Adversarial Attacks
• Learning Transferable Adversarial Examples via Ghost Networks
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• Adversarial Example Games
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Risk Bounds for Robust Deep Learning
• When Attackers Meet AI: Learning-empowered Attacks in Cooperative Spectrum Sensing
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• PDF-Malware: An Overview on Threats, Detection and Evasion Attacks
• AdvGAN++ : Harnessing latent layers for adversary generation
• Towards Security Threats of Deep Learning Systems: A Survey
• A Thorough Comparison Study on Adversarial Attacks and Defenses for Common Thorax Disease Classification in Chest X-rays
• Identifying and Resisting Adversarial Videos Using Temporal Consistency
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Efficient Adversarial Training with Transferable Adversarial Examples
• Adversarial Attacks Beyond the Image Space
• The Taboo Trap: Behavioural Detection of Adversarial Samples
• Convergence and Margin of Adversarial Training on Separable Data
• A Marauder's Map of Security and Privacy in Machine Learning
• Distributionally Adversarial Attack
• Towards Efficiently Evaluating the Robustness of Deep Neural Networks in IoT Systems: A GAN-based Method
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Evaluation of Momentum Diverse Input Iterative Fast Gradient Sign Method (M-DI2-FGSM) Based Attack Method on MCS 2018 Adversarial Attacks on Black Box Face Recognition System
• Universal, transferable and targeted adversarial attacks
• SegMatch: A semi-supervised learning method for surgical instrument segmentation
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Optimal Transport as a Defense Against Adversarial Attacks
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Defense against adversarial attacks on spoofing countermeasures of ASV
• Adversarial Machine Learning Phases of Matter
• Robust Opponent Modeling via Adversarial Ensemble Reinforcement Learning in Asymmetric Imperfect-Information Games
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses
• Mathematical Analysis of Adversarial Attacks
• Controlling Over-generalization and its Effect on Adversarial Examples Generation and Detection
• Accurate generation of stochastic dynamics based on multi-model Generative Adversarial Networks
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Deep Neural Network Ensembles against Deception: Ensemble Diversity, Accuracy and Robustness
• Detecting Overfitting via Adversarial Examples
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Improving Adversarial Robustness via Guided Complement Entropy
• Enhancing Adversarial Defense by k-Winners-Take-All
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Robustness via Deep Low-Rank Representations
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• Adversarially-Trained Nonnegative Matrix Factorization
• Fibres of Failure: Classifying errors in predictive processes
• Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples
• Improved Detection of Adversarial Images Using Deep Neural Networks
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Artificial Immune System of Secure Face Recognition Against Adversarial Attacks
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Towards Rapid and Robust Adversarial Training with One-Step Attacks
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Joint Adversarial Training: Incorporating both Spatial and Pixel Attacks
• The Efficacy of SHIELD under Different Threat Models
• Neural Networks with Structural Resistance to Adversarial Attacks
• Stochastic Substitute Training: A Gray-box Approach to Craft Adversarial Examples Against Gradient Obfuscation Defenses
• Adversarial Attacks on Multivariate Time Series
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation
• Aggregating explanation methods for stable and robust explainability
• On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Error
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• AutoGAN: Robust Classifier Against Adversarial Attacks
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• BUZz: BUffer Zones for defending adversarial examples in image classification
• CAAD 2018: Generating Transferable Adversarial Examples
• Regularization Effect of Fast Gradient Sign Method and its Generalization
• Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
• A Self-supervised Approach for Adversarial Robustness
• Patch-wise Attack for Fooling Deep Neural Network
• Weight Map Layer for Noise and Adversarial Attack Robustness
• Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery
• Statistically Robust Neural Network Classification
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection
• A New Angle on L2 Regularization
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• CoRPA: Adversarial Image Generation for Chest X-rays Using Concept Vector Perturbations and Generative Models
• Is Machine Learning in Power Systems Vulnerable?
• MEAT: Median-Ensemble Adversarial Training for Improving Robustness and Generalization
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• CAAD 2018: Iterative Ensemble Adversarial Attack
• A Robust Classification-autoencoder to Defend Outliers and Adversaries
• Robust GANs against Dishonest Adversaries
• Adversarial Feature Desensitization
• Targeted Attack for Deep Hashing based Retrieval
• Uncovering the Connections Between Adversarial Transferability and Knowledge Transferability
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• An Empirical Study on the Relation between Network Interpretability and Adversarial Robustness
• Can 3D Adversarial Logos Cloak Humans?
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• An Information-Theoretic Explanation for the Adversarial Fragility of AI Classifiers
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• A cryptographic approach to black box adversarial machine learning
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• An Empirical Investigation of Randomized Defenses against Adversarial Attacks
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Blind Adversarial Pruning: Balance Accuracy, Efficiency and Robustness
• Adversarial Learning with Cost-Sensitive Classes
• Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices
• Real World Robustness from Systematic Noise
• Adversarial Attacks on ML Defense Models Competition
• Robust Single-step Adversarial Training with Regularizer
• Generating Unrestricted Adversarial Examples via Three Parameters
• Can audio-visual integration strengthen robustness under multimodal attacks?
• Black-box Adversarial Sample Generation Based on Differential Evolution
• Relevant-features based Auxiliary Cells for Energy Efficient Detection of Natural Errors
• Search Space of Adversarial Perturbations against Image Filters
• Privacy against a Hypothesis Testing Adversary
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• ODE guided Neural Data Augmentation Techniques for Time Series Data and its Benefits on Robustness
• Are You Tampering With My Data?
• HAWKEYE: Adversarial Example Detector for Deep Neural Networks
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• A+D Net: Training a Shadow Detector with Adversarial Shadow Attenuation
• David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge
• Training Machine Learning Models by Regularizing their Explanations
• An Efficient Pre-processing Method to Eliminate Adversarial Effects
• FAdeML: Understanding the Impact of Pre-Processing Noise Filtering on Adversarial Machine Learning
• Denoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks
• PredCoin: Defense against Query-based Hard-label Attack
• Multi-way Encoding for Robustness
• Adversarial Example Decomposition
• On Configurable Defense against Adversarial Example Attacks
• Initializing Perturbations in Multiple Directions for Fast Adversarial Training
• Improved Dynamic Memory Network for Dialogue Act Classification with Adversarial Training
• A Black-box Adversarial Attack Strategy with Adjustable Sparsity and Generalizability for Deep Image Classifiers
• Harnessing adversarial examples with a surprisingly simple defense
• Enhancing Transformation-based Defenses using a Distribution Classifier
• Adversarial Imitation Attack
• Defense Through Diverse Directions
• Amicable Aid: Perturbing Images to Improve Classification Performance
• Using an ensemble color space model to tackle adversarial examples
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles