Towards Deep Learning Models Resistant to Adversarial Attacks

Abstract

Recent work has demonstrated that deep neural networks are vulnerable to adversarial examples---inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models. Code and pre-trained models are available at https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge.

ICLR'18

References in corpus (4)

• The Space of Transferable Adversarial Examples
• Towards the first adversarially robust neural network model on MNIST
• Certified Adversarial Robustness with Additive Noise
• On the Effectiveness of Defensive Distillation

Cited by in corpus (387)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• On Evaluating Adversarial Robustness
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Adversarial Attack and Defense on Graph Data: A Survey
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Var-CNN: A Data-Efficient Website Fingerprinting Attack Based on Deep Learning
• Generating Adversarial Examples with Adversarial Networks
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Stochastic Activation Pruning for Robust Adversarial Defense
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Quantum noise protects quantum classifiers against adversaries
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• A Survey on Long-Tailed Visual Recognition
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Adversarial examples from computational constraints
• Scalable agent alignment via reward modeling: a research direction
• Scaling provable adversarial defenses
• Fooling Neural Network Interpretations via Adversarial Model Manipulation
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Rademacher Complexity for Adversarially Robust Generalization
• The Butterfly Effect in Artificial Intelligence Systems: Implications for AI Bias and Fairness
• The Conditional Entropy Bottleneck
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Implicit Generation and Generalization in Energy-Based Models
• SaliencyMix: A Saliency Guided Data Augmentation Strategy for Better Regularization
• Understanding and Enhancing the Transferability of Adversarial Examples
• Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
• Practical Blind Membership Inference Attack via Differential Comparisons
• Low Frequency Adversarial Perturbation
• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• Adversarial Robustness May Be at Odds With Simplicity
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Robust Pre-Training by Adversarial Contrastive Learning
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Reverse KL-Divergence Training of Prior Networks: Improved Uncertainty and Adversarial Robustness
• What is Local Optimality in Nonconvex-Nonconcave Minimax Optimization?
• Detection of Face Recognition Adversarial Attacks
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Training individually fair ML models with Sensitive Subspace Robustness
• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Rigorous Agent Evaluation: An Adversarial Approach to Uncover Catastrophic Failures
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Robust Learning with Jacobian Regularization
• Adversarially Robust Few-Shot Learning: A Meta-Learning Approach
• On Robustness of Neural Ordinary Differential Equations
• Attack on practical speaker verification system using universal adversarial perturbations
• Robustness Verification of Tree-based Models
• Enhancing Adversarial Example Transferability with an Intermediate Level Attack
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Defensive Quantization: When Efficiency Meets Robustness
• Adversarial Examples Make Strong Poisons
• Global Convergence and Variance-Reduced Optimization for a Class of Nonconvex-Nonconcave Minimax Problems
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restoration
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• When and How to Fool Explainable Models (and Humans) with Adversarial Examples
• A Closer Look at the Robustness of Vision-and-Language Pre-trained Models
• Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin
• Uncertainty-Aware Reliable Text Classification
• Task dependent Deep LDA pruning of neural networks
• On the Resilience of Biometric Authentication Systems against Random Inputs
• Query-Efficient Black-box Adversarial Examples (superceded)
• Neural Networks with Recurrent Generative Feedback
• Towards Understanding Fast Adversarial Training
• Intriguing Properties of Adversarial Examples
• Attacking Binarized Neural Networks
• Morphence: Moving Target Defense Against Adversarial Examples
• Adversarial Machine Learning: Bayesian Perspectives
• GraphDefense: Towards Robust Graph Convolutional Networks
• How Does Mixup Help With Robustness and Generalization?
• Towards resilient machine learning for ransomware detection
• Adversarial Defense Framework for Graph Neural Network
• Fooling a Real Car with Adversarial Traffic Signs
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Simple black-box universal adversarial attacks on medical image classification based on deep neural networks
• Deep Nets: What have they ever done for Vision?
• A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuning
• Rethinking Non-idealities in Memristive Crossbars for Adversarial Robustness in Neural Networks
• Some models are useful, but how do we know which ones? Towards a unified Bayesian model taxonomy
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• Clean-Label Backdoor Attacks on Video Recognition Models
• Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATR
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• A Statistical Approach to Assessing Neural Network Robustness
• RANDOM MASK: Towards Robust Convolutional Neural Networks
• Investigating Vulnerability to Adversarial Examples on Multimodal Data Fusion in Deep Learning
• Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification
• On the Application of Danskin's Theorem to Derivative-Free Minimax Optimization
• Self-supervised Pre-training with Hard Examples Improves Visual Representations
• Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks
• A Formalization of Robustness for Deep Neural Networks
• Zeroth-Order Algorithms for Nonconvex Minimax Problems with Improved Complexities
• The Search for Sparse, Robust Neural Networks
• SenSeI: Sensitive Set Invariance for Enforcing Individual Fairness
• Evaluations and Methods for Explanation through Robustness Analysis
• Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network"
• A Decentralized Proximal Point-type Method for Saddle Point Problems
• Adversarially Robust Training through Structured Gradient Regularization
• Should Adversarial Attacks Use Pixel p-Norm?
• Robust Deep Reinforcement Learning through Adversarial Loss
• Deeply Explain CNN via Hierarchical Decomposition
• Online Supervised Training of Spaceborne Vision during Proximity Operations using Adaptive Kalman Filtering
• Playing the Game of Universal Adversarial Perturbations
• Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition
• A Spectral View of Adversarially Robust Features
• Puzzle-AE: Novelty Detection in Images through Solving Puzzles
• Achieving Adversarial Robustness via Sparsity
• VSMask: Defending Against Voice Synthesis Attack via Real-Time Predictive Perturbation
• Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World
• Verification of Recurrent Neural Networks Through Rule Extraction
• Geometry-Inspired Top-k Adversarial Perturbations
• Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Adversarial attacks hidden in plain sight
• Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks
• Convolutional Channel-wise Competitive Learning for the Forward-Forward Algorithm
• Risk Bounds for Robust Deep Learning
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Robustness Testing for Multi-Agent Reinforcement Learning: State Perturbations on Critical Agents
• Detecting Adversarial Examples through Nonlinear Dimensionality Reduction
• Concise Explanations of Neural Networks using Adversarial Training
• Counterexample-Guided Learning of Monotonic Neural Networks
• Interpretable Adversarial Training for Text
• CEB Improves Model Robustness
• Deep pNML: Predictive Normalized Maximum Likelihood for Deep Neural Networks
• Appending Adversarial Frames for Universal Video Attack
• Are Adversarial Perturbations a Showstopper for ML-Based CAD? A Case Study on CNN-Based Lithographic Hotspot Detection
• Distributed Saddle-Point Problems Under Similarity
• Incorporating Unlabeled Data into Distributionally Robust Learning
• Label Smoothing and Adversarial Robustness
• Complexity Lower Bounds for Nonconvex-Strongly-Concave Min-Max Optimization
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• SafeAMC: Adversarial training for robust modulation recognition models
• DSRNA: Differentiable Search of Robust Neural Architectures
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Improved Image Wasserstein Attacks and Defenses
• Universal Lipschitz Approximation in Bounded Depth Neural Networks
• Stochastic Gradient Descent with Nonlinear Conjugate Gradient-Style Adaptive Momentum
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Jacobian Adversarially Regularized Networks for Robustness
• Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detection
• Defense against adversarial attacks on spoofing countermeasures of ASV
• Effective and Robust Detection of Adversarial Examples via Benford-Fourier Coefficients
• Mathematical Analysis of Adversarial Attacks
• Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
• Security and Machine Learning in the Real World
• Controlling Over-generalization and its Effect on Adversarial Examples Generation and Detection
• Uncertainty-Encoded Multi-Modal Fusion for Robust Object Detection in Autonomous Driving
• AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Headless Horseman: Adversarial Attacks on Transfer Learning Models
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• DBIA: Data-free Backdoor Injection Attack against Transformer Networks
• Synthesizing Action Sequences for Modifying Model Decisions
• Detecting Overfitting via Adversarial Examples
• Truth or Backpropaganda? An Empirical Investigation of Deep Learning Theory
• Frequency Centric Defense Mechanisms against Adversarial Examples
• Towards Resistant Audio Adversarial Examples
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• Black Loans Matter: Distributionally Robust Fairness for Fighting Subgroup Discrimination
• Unrestricted Adversarial Attacks on ImageNet Competition
• Beyond $L_p$ clipping: Equalization-based Psychoacoustic Attacks against ASRs
• CAMERAS: Enhanced Resolution And Sanity preserving Class Activation Mapping for image saliency
• Adversarial Attack and Defense in Deep Ranking
• Artificial Immune System of Secure Face Recognition Against Adversarial Attacks
• Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• Calibration and Consistency of Adversarial Surrogate Losses
• Model-Based Domain Generalization
• Theory-based residual neural networks: A synergy of discrete choice models and deep neural networks
• A State-of-the-Art Review on IoT botnet Attack Detection
• Adversarial Robustness of Supervised Sparse Coding
• Protecting Classifiers From Attacks
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• Lipschitz Networks and Distributional Robustness
• How and When Adversarial Robustness Transfers in Knowledge Distillation?
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Uncertainty Prediction for Deep Sequential Regression Using Meta Models
• On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks
• Nudge Attacks on Point-Cloud DNNs
• Exploring the Back Alleys: Analysing The Robustness of Alternative Neural Network Architectures against Adversarial Attacks
• 3D Adversarial Attacks Beyond Point Cloud
• 3D Adversarial Augmentations for Robust Out-of-Domain Predictions
• Adversarial Attacks on Multivariate Time Series
• Adversarial robustness via robust low rank representations
• Using a GAN to Generate Adversarial Examples to Facial Image Recognition
• Data Curation with Deep Learning [Vision]
• Distributed generation of privacy preserving data with user customization
• Meta Dropout: Learning to Perturb Features for Generalization
• Detection as Regression: Certified Object Detection by Median Smoothing
• A Stochastic Subgradient Method for Distributionally Robust Non-Convex Learning
• AutoGAN: Robust Classifier Against Adversarial Attacks
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• Improve robustness of DNN for ECG signal classification:a noise-to-signal ratio perspective
• Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder
• Intermediate Level Adversarial Attack for Enhanced Transferability
• Unsupervised Visual Attention and Invariance for Reinforcement Learning
• Kryptonite: An Adversarial Attack Using Regional Focus
• Cloud-based Image Classification Service Is Not Robust To Simple Transformations: A Forgotten Battlefield
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes
• Adversarial Transfer Attacks With Unknown Data and Class Overlap
• Input Hessian Regularization of Neural Networks
• Sign-MAML: Efficient Model-Agnostic Meta-Learning by SignSGD
• Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey
• Adversarial Attacks on Co-Occurrence Features for GAN Detection
• Exploring the Hyperparameter Landscape of Adversarial Robustness
• Customizing an Adversarial Example Generator with Class-Conditional GANs
• Exploiting the Inherent Limitation of L0 Adversarial Examples
• Towards Query Efficient Black-box Attacks: An Input-free Perspective
• QAIR: Practical Query-efficient Black-Box Attacks for Image Retrieval
• Brain-inspired reverse adversarial examples
• Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness
• Improving Model Robustness with Latent Distribution Locally and Globally
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• A Singular Value Perspective on Model Robustness
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Adversarial Defense Through Network Profiling Based Path Extraction
• Minimax Defense against Gradient-based Adversarial Attacks
• Improving the robustness of ImageNet classifiers using elements of human visual cognition
• Bandlimiting Neural Networks Against Adversarial Attacks
• Self-supervised Adversarial Training
• Asymptotic Behavior of Adversarial Training in Binary Classification
• Printing and Scanning Attack for Image Counter Forensics
• A Tunable Robust Pruning Framework Through Dynamic Network Rewiring of DNNs
• Robustness Out of the Box: Compositional Representations Naturally Defend Against Black-Box Patch Attacks
• Towards Deep Learning Models Resistant to Large Perturbations
• AdvCodeMix: Adversarial Attack on Code-Mixed Data
• What it Thinks is Important is Important: Robustness Transfers through Input Gradients
• Defective Convolutional Networks
• Towards transformation-resilient provenance detection of digital media
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• Collaborative Sampling in Generative Adversarial Networks
• DAFAR: Defending against Adversaries by Feedback-Autoencoder Reconstruction
• Robustifying deep networks for image segmentation
• Corner case data description and detection
• ROBY: Evaluating the Robustness of a Deep Model by its Decision Boundaries
• Coverage-Guaranteed Prediction Sets for Out-of-Distribution Data
• A Robust Classification-autoencoder to Defend Outliers and Adversaries
• Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
• AICAttack: Adversarial Image Captioning Attack with Attention-Based Optimization
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• XploreNAS: Explore Adversarially Robust & Hardware-efficient Neural Architectures for Non-ideal Xbars
• A New Angle on L2 Regularization
• Efficient detection of adversarial images
• Beneficial Perturbations Network for Defending Adversarial Examples
• Adversarial and Natural Perturbations for General Robustness
• Competitive Mirror Descent
• Differentially Private Federated Learning via Inexact ADMM
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• CDMA: A Practical Cross-Device Federated Learning Algorithm for General Minimax Problems
• Adversarial Feature Desensitization
• Residual Error: a New Performance Measure for Adversarial Robustness
• AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
• Multi-head Ensemble of Smoothed Classifiers for Certified Robustness
• Blind Adversarial Training: Balance Accuracy and Robustness
• Benchmarking the Accuracy and Robustness of Feedback Alignment Algorithms
• Robust Sensible Adversarial Learning of Deep Neural Networks for Image Classification
• Adversarial Robustness for Unsupervised Domain Adaptation
• New CleverHans Feature: Better Adversarial Robustness Evaluations with Attack Bundling
• Recurrent Attention Model with Log-Polar Mapping is Robust against Adversarial Attacks
• Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness
• FoveaTer: Foveated Transformer for Image Classification
• Robust and Information-theoretically Safe Bias Classifier against Adversarial Attacks
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Multi-Expert Adversarial Attack Detection in Person Re-identification Using Context Inconsistency
• A direct proof of a unified law of robustness for Bregman divergence losses
• Gentle Local Robustness implies Generalization
• BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization
• Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs
• Robust Training Using Natural Transformation
• Robust Partial-Label Learning by Leveraging Class Activation Values
• ExCon: Explanation-driven Supervised Contrastive Learning for Image Classification
• The Compact Support Neural Network
• Domain Invariant Adversarial Learning
• The art of defense: letting networks fool the attacker
• Removing Undesirable Feature Contributions Using Out-of-Distribution Data
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Towards Precise Observations of Neural Model Robustness in Classification
• Golden Grain: Building a Secure and Decentralized Model Marketplace for MLaaS
• Adversarial Attacks on Binary Image Recognition Systems
• Affine Disentangled GAN for Interpretable and Robust AV Perception
• Adversarial training applied to Convolutional Neural Network for photometric redshift predictions
• Substitutional Neural Image Compression
• Towards the Memorization Effect of Neural Networks in Adversarial Training
• Controlled Caption Generation for Images Through Adversarial Attacks
• Meta Gradient Adversarial Attack
• Excess Capacity and Backdoor Poisoning
• Conditional Adversarial Camera Model Anonymization
• Identification of Attack-Specific Signatures in Adversarial Examples
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Deep Latent Defence
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• A principled approach for generating adversarial images under non-smooth dissimilarity metrics
• Blurring Fools the Network -- Adversarial Attacks by Feature Peak Suppression and Gaussian Blurring
• Generating Structured Adversarial Attacks Using Frank-Wolfe Method
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Bio-inspired Robustness: A Review
• The Human Visual System and Adversarial AI
• Non-Determinism in Neural Networks for Adversarial Robustness
• Can audio-visual integration strengthen robustness under multimodal attacks?
• On The Utility of Conditional Generation Based Mutual Information for Characterizing Adversarial Subspaces
• Black-box Adversarial Sample Generation Based on Differential Evolution
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• Human Imperceptible Attacks and Applications to Improve Fairness
• Towards Quality Assurance of Software Product Lines with Adversarial Configurations
• Adversarial Training for EM Classification Networks
• ODE guided Neural Data Augmentation Techniques for Time Series Data and its Benefits on Robustness
• Self-Gradient Networks
• Perception Matters: Exploring Imperceptible and Transferable Anti-forensics for GAN-generated Fake Face Imagery Detection
• Robustifying Binary Classification to Adversarial Perturbation
• On Configurable Defense against Adversarial Example Attacks
• LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
• Fast Local Attack: Generating Local Adversarial Examples for Object Detectors
• Towards Optimal Randomized Strategies in Adversarial Example Game
• On sensitivity of meta-learning to support data
• Nuisance-Label Supervision: Robustness Improvement by Free Labels
• Compressive Sensing Based Adaptive Defence Against Adversarial Images
• Improving Adversarial Robustness for Free with Snapshot Ensemble
• Local Linearity and Double Descent in Catastrophic Overfitting
• A note on hyperparameters in black-box adversarial examples
• Individually Fair Gradient Boosting
• Mixing between the Cross Entropy and the Expectation Loss Terms
• Noisy Feature Mixup
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Harnessing adversarial examples with a surprisingly simple defense
• Constructing a provably adversarially-robust classifier from a high accuracy one
• Spatiotemporal Attacks for Embodied Agents
• Image Decomposition and Classification through a Generative Model
• Built-in Elastic Transformations for Improved Robustness
• Adversarial Attacks on Deep Models for Financial Transaction Records
• Tricking Adversarial Attacks To Fail
• Shape Defense Against Adversarial Attacks
• Polymatrix Competitive Gradient Descent
• An Integrated Approach to Produce Robust Models with High Efficiency
• Adversarial Data Encryption
• A New Family of Neural Networks Provably Resistant to Adversarial Attacks
• Nested Learning For Multi-Granular Tasks
• Derivation of Information-Theoretically Optimal Adversarial Attacks with Applications to Robust Machine Learning
• Leveraging Adversarial Training in Self-Learning for Cross-Lingual Text Classification
• Training Efficiency and Robustness in Deep Learning
• Feature Losses for Adversarial Robustness
• Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness
• Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption
• Adversarial Eigen Attack on Black-Box Models
• Exploring Adversarial Fake Images on Face Manifold
• Optimal Analysis of Method with Batching for Monotone Stochastic Finite-Sum Variational Inequalities
• Localizing Adversarial Attacks To Produces More Imperceptible Noise
• Intriguing Properties of Input-dependent Randomized Smoothing
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack
• Understanding Classifier Mistakes with Generative Models
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks
• Achieving Adversarial Robustness Requires An Active Teacher
• Adversarial attacks on neural networks through canonical Riemannian foliations
• Exploiting Vulnerability of Pooling in Convolutional Neural Networks by Strict Layer-Output Manipulation for Adversarial Attacks
• Towards Natural Robustness Against Adversarial Examples
• Adversarial Robustness Across Representation Spaces
• Reject Illegal Inputs with Generative Classifier Derived from Any Discriminative Classifier
• The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks
• PredCoin: Defense against Query-based Hard-label Attack
• ASK: Adversarial Soft k-Nearest Neighbor Attack and Defense
• Understanding Robustness in Teacher-Student Setting: A New Perspective