Ensemble Adversarial Training: Attacks and Defenses

Abstract

Adversarial examples are perturbed inputs designed to fool machine learning models. Adversarial training injects such examples into training data to increase robustness. To scale this technique to large datasets, perturbations are crafted using fast single-step methods that maximize a linear approximation of the model's loss. We show that this form of adversarial training converges to a degenerate global minimum, wherein small curvature artifacts near the data points obfuscate a linear approximation of the loss. The model thus learns to generate weak perturbations, rather than defend against strong ones. As a result, we find that adversarial training remains vulnerable to black-box attacks, where we transfer perturbations computed on undefended models, as well as to a powerful novel single-step attack that escapes the non-smooth vicinity of the input data via a small random step. We further introduce Ensemble Adversarial Training, a technique that augments training data with perturbations transferred from other models. On ImageNet, Ensemble Adversarial Training yields models with strong robustness to black-box attacks. In particular, our most robust model won the first round of the NIPS 2017 competition on Defenses against Adversarial Attacks. However, subsequent work found that more elaborate black-box attacks could significantly enhance transferability and reduce the accuracy of our models.

22 pages, 5 figures, International Conference on Learning Representations (ICLR) 2018 (amended in April 2020 to include subsequent attacks that significantly reduced the robustness of our models)

References in corpus (10)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Certified Defenses against Adversarial Examples
• The Space of Transferable Adversarial Examples
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Biologically inspired protection of deep networks from adversarial attacks
• Comment on "Biologically inspired protection of deep networks from adversarial attacks"
• Using Non-invertible Data Transformations to Build Adversarial-Robust Neural Networks

Cited by in corpus (333)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• A Unifying Review of Deep and Shallow Anomaly Detection
• Certified Defenses against Adversarial Examples
• Adversarial Attacks and Defences: A Survey
• Countering Adversarial Images using Input Transformations
• Synthetic and Natural Noise Both Break Neural Machine Translation
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Optimization Problems for Machine Learning: A Survey
• Spectral Signatures in Backdoor Attacks
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• CANet: An Unsupervised Intrusion Detection System for High Dimensional CAN Bus Data
• Adversarial Examples: Opportunities and Challenges
• Generating Adversarial Examples with Adversarial Networks
• Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Security and Privacy Approaches in Mixed Reality: A Literature Survey
• Adversarial Weight Perturbation Helps Robust Generalization
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Image Super-Resolution as a Defense Against Adversarial Attacks
• When Machine Unlearning Jeopardizes Privacy
• Are Labels Required for Improving Adversarial Robustness?
• On Adversarial Examples for Character-Level Neural Machine Translation
• Ten Years of Generative Adversarial Nets (GANs): A survey of the state-of-the-art
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• WaveCNet: Wavelet Integrated CNNs to Suppress Aliasing Effect for Noise-Robust Image Classification
• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• Adversarial Training and Robustness for Multiple Perturbations
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead
• Rethinking Bayesian Learning for Data Analysis: The Art of Prior and Inference in Sparsity-Aware Modeling
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• The Butterfly Effect in Artificial Intelligence Systems: Implications for AI Bias and Fairness
• Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivity
• Fixing Data Augmentation to Improve Adversarial Robustness
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Provably Minimally-Distorted Adversarial Examples
• LESSON: Multi-Label Adversarial False Data Injection Attack for Deep Learning Locational Detection
• Understanding and Enhancing the Transferability of Adversarial Examples
• Practical Blind Membership Inference Attack via Differential Comparisons
• Low Frequency Adversarial Perturbation
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Improving Transferability of Adversarial Examples with Input Diversity
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Adversarial Attack and Defense on Point Sets
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Boosting Adversarial Training with Hypersphere Embedding
• FDA3 : Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications
• Hardware Trojan Attacks on Neural Networks
• Neuron Shapley: Discovering the Responsible Neurons
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• Maximal Jacobian-based Saliency Map Attack
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Security and Privacy Issues in Deep Learning
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Watch out! Motion is Blurring the Vision of Your Deep Neural Networks
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Discretization based Solutions for Secure Machine Learning against Adversarial Attacks
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Dynamic Time Warping based Adversarial Framework for Time-Series Domain
• Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks
• Boosting Adversarial Attacks with Momentum
• Walking on the Edge: Fast, Low-Distortion Adversarial Examples
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Adversarial Examples Improve Image Recognition
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Certified Adversarial Robustness for Deep Reinforcement Learning
• BERT Loses Patience: Fast and Robust Inference with Early Exit
• Towards Robust Neural Networks via Random Self-ensemble
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Understanding and Improving Fast Adversarial Training
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• On Robustness of Neural Ordinary Differential Equations
• Understanding and Combating Robust Overfitting via Input Loss Landscape Analysis and Regularization
• Fooling OCR Systems with Adversarial Text Images
• A Causal View on Robustness of Neural Networks
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Max-Mahalanobis Linear Discriminant Analysis Networks
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Defensive Quantization: When Efficiency Meets Robustness
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• Adversarial Distributional Training for Robust Deep Learning
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• PRADA: Protecting against DNN Model Stealing Attacks
• Bypassing Feature Squeezing by Increasing Adversary Strength
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• L2-Nonexpansive Neural Networks
• Task-generalizable Adversarial Attack based on Perceptual Metric
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
• Software Testing for Machine Learning
• Towards a Robust Deep Neural Network in Texts: A Survey
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• Divide, Denoise, and Defend against Adversarial Attacks
• Are Generative Classifiers More Robust to Adversarial Attacks?
• Defense against Universal Adversarial Perturbations
• Exploiting vulnerabilities of deep neural networks for privacy protection
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• DeepHunter: Hunting Deep Neural Network Defects via Coverage-Guided Fuzzing
• Mutual Adversarial Training: Learning together is better than going alone
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Lipschitz regularized Deep Neural Networks generalize and are adversarially robust
• Exploring Connections Between Active Learning and Model Extraction
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• Convolutional Neural Networks Rarely Learn Shape for Semantic Segmentation
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Improved robustness to adversarial examples using Lipschitz regularization of the loss
• Towards Visual Distortion in Black-Box Attacks
• Boundary thickness and robustness in learning models
• COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection
• Stochasticity and Robustness in Spiking Neural Networks
• Fooling a Real Car with Adversarial Traffic Signs
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• Wild Networks: Exposure of 5G Network Infrastructures to Adversarial Examples
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• Evolving Robust Neural Architectures to Defend from Adversarial Attacks
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Adversarial Training Versus Weight Decay
• Learning More Robust Features with Adversarial Training
• PAC-learning in the presence of evasion adversaries
• ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples
• Interpretable Deep Learning under Fire
• ConvNets and ImageNet Beyond Accuracy: Understanding Mistakes and Uncovering Biases
• Cyber Vaccine for Deepfake Immunity
• Intriguing properties of adversarial training at scale
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• Percival: Making In-Browser Perceptual Ad Blocking Practical With Deep Learning
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Membership Leakage in Label-Only Exposures
• SimAug: Learning Robust Representations from Simulation for Trajectory Prediction
• A Provable Defense for Deep Residual Networks
• Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attacks
• Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Playing the Game of Universal Adversarial Perturbations
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Solving smooth min-min and min-max problems by mixed oracle algorithms
• Breaking Transferability of Adversarial Samples with Randomness
• Learning Transferable Adversarial Examples via Ghost Networks
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• DaST: Data-free Substitute Training for Adversarial Attacks
• Zeroth-Order Algorithms for Smooth Saddle-Point Problems
• Risk Bounds for Robust Deep Learning
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• When Attackers Meet AI: Learning-empowered Attacks in Cooperative Spectrum Sensing
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Adversarial Example Games
• AdvGAN++ : Harnessing latent layers for adversary generation
• A Thorough Comparison Study on Adversarial Attacks and Defenses for Common Thorax Disease Classification in Chest X-rays
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Towards Security Threats of Deep Learning Systems: A Survey
• Identifying and Resisting Adversarial Videos Using Temporal Consistency
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines
• PDF-Malware: An Overview on Threats, Detection and Evasion Attacks
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Distributionally Adversarial Attack
• Efficient Adversarial Training with Transferable Adversarial Examples
• The Taboo Trap: Behavioural Detection of Adversarial Samples
• A Marauder's Map of Security and Privacy in Machine Learning
• Adversarial Attacks Beyond the Image Space
• Convergence and Margin of Adversarial Training on Separable Data
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
• Evaluation of Momentum Diverse Input Iterative Fast Gradient Sign Method (M-DI2-FGSM) Based Attack Method on MCS 2018 Adversarial Attacks on Black Box Face Recognition System
• Towards Efficiently Evaluating the Robustness of Deep Neural Networks in IoT Systems: A GAN-based Method
• SegMatch: A semi-supervised learning method for surgical instrument segmentation
• Defense against adversarial attacks on spoofing countermeasures of ASV
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Adversarial Machine Learning Phases of Matter
• Universal, transferable and targeted adversarial attacks
• Mathematical Analysis of Adversarial Attacks
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Robust Opponent Modeling via Adversarial Ensemble Reinforcement Learning in Asymmetric Imperfect-Information Games
• Optimal Transport as a Defense Against Adversarial Attacks
• Controlling Over-generalization and its Effect on Adversarial Examples Generation and Detection
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Detecting Overfitting via Adversarial Examples
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Deep Neural Network Ensembles against Deception: Ensemble Diversity, Accuracy and Robustness
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Accurate generation of stochastic dynamics based on multi-model Generative Adversarial Networks
• Improving Adversarial Robustness via Guided Complement Entropy
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples
• Robustness via Deep Low-Rank Representations
• Artificial Immune System of Secure Face Recognition Against Adversarial Attacks
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• Fibres of Failure: Classifying errors in predictive processes
• Improved Detection of Adversarial Images Using Deep Neural Networks
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Adversarially-Trained Nonnegative Matrix Factorization
• TSS: Transformation-Specific Smoothing for Robustness Certification
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• Enhancing Adversarial Defense by k-Winners-Take-All
• Aggregating explanation methods for stable and robust explainability
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• The Efficacy of SHIELD under Different Threat Models
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Joint Adversarial Training: Incorporating both Spatial and Pixel Attacks
• Towards Rapid and Robust Adversarial Training with One-Step Attacks
• Stochastic Substitute Training: A Gray-box Approach to Craft Adversarial Examples Against Gradient Obfuscation Defenses
• Adversarial Attacks on Multivariate Time Series
• DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation
• Neural Networks with Structural Resistance to Adversarial Attacks
• On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Error
• CAAD 2018: Generating Transferable Adversarial Examples
• Regularization Effect of Fast Gradient Sign Method and its Generalization
• BUZz: BUffer Zones for defending adversarial examples in image classification
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
• AutoGAN: Robust Classifier Against Adversarial Attacks
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• A Self-supervised Approach for Adversarial Robustness
• Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery
• Statistically Robust Neural Network Classification
• Weight Map Layer for Noise and Adversarial Attack Robustness
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• Patch-wise Attack for Fooling Deep Neural Network
• MEAT: Median-Ensemble Adversarial Training for Improving Robustness and Generalization
• Uncovering the Connections Between Adversarial Transferability and Knowledge Transferability
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• CAAD 2018: Iterative Ensemble Adversarial Attack
• A Robust Classification-autoencoder to Defend Outliers and Adversaries
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• Adversarial Feature Desensitization
• Can 3D Adversarial Logos Cloak Humans?
• Is Machine Learning in Power Systems Vulnerable?
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Robust and Efficient Adversarial Defense in SNNs via Image Purification and Joint Detection
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• A New Angle on L2 Regularization
• Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• CoRPA: Adversarial Image Generation for Chest X-rays Using Concept Vector Perturbations and Generative Models
• An Empirical Study on the Relation between Network Interpretability and Adversarial Robustness
• Robust GANs against Dishonest Adversaries
• Targeted Attack for Deep Hashing based Retrieval
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• An Empirical Investigation of Randomized Defenses against Adversarial Attacks
• Generating Unrestricted Adversarial Examples via Three Parameters
• Representation Quality Of Neural Networks Links To Adversarial Attacks and Defences
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs
• Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices
• Copy and Paste: A Simple But Effective Initialization Method for Black-Box Adversarial Attacks
• An Information-Theoretic Explanation for the Adversarial Fragility of AI Classifiers
• Search Space of Adversarial Perturbations against Image Filters
• A cryptographic approach to black box adversarial machine learning
• Real World Robustness from Systematic Noise
• Adversarial Attacks on ML Defense Models Competition
• Relevant-features based Auxiliary Cells for Energy Efficient Detection of Natural Errors
• Black-box Adversarial Sample Generation Based on Differential Evolution
• Can audio-visual integration strengthen robustness under multimodal attacks?
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Adversarial Learning with Cost-Sensitive Classes
• Robust Single-step Adversarial Training with Regularizer
• Blind Adversarial Pruning: Balance Accuracy, Efficiency and Robustness
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Enhancing Transformation-based Defenses using a Distribution Classifier
• An Efficient Pre-processing Method to Eliminate Adversarial Effects
• Denoising and Verification Cross-Layer Ensemble Against Black-box Adversarial Attacks
• On Configurable Defense against Adversarial Example Attacks
• Adversarial Example Decomposition
• Improved Dynamic Memory Network for Dialogue Act Classification with Adversarial Training
• FAdeML: Understanding the Impact of Pre-Processing Noise Filtering on Adversarial Machine Learning
• Amicable Aid: Perturbing Images to Improve Classification Performance
• Training Machine Learning Models by Regularizing their Explanations
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• HAWKEYE: Adversarial Example Detector for Deep Neural Networks
• Are You Tampering With My Data?
• Privacy against a Hypothesis Testing Adversary
• ODE guided Neural Data Augmentation Techniques for Time Series Data and its Benefits on Robustness
• Initializing Perturbations in Multiple Directions for Fast Adversarial Training
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles
• A Black-box Adversarial Attack Strategy with Adjustable Sparsity and Generalizability for Deep Image Classifiers
• PredCoin: Defense against Query-based Hard-label Attack
• Harnessing adversarial examples with a surprisingly simple defense
• Adversarial Imitation Attack
• A+D Net: Training a Shadow Detector with Adversarial Shadow Attenuation
• Defense Through Diverse Directions
• Using an ensemble color space model to tackle adversarial examples
• Multi-way Encoding for Robustness