Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

Abstract

We identify obfuscated gradients, a kind of gradient masking, as a phenomenon that leads to a false sense of security in defenses against adversarial examples. While defenses that cause obfuscated gradients appear to defeat iterative optimization-based attacks, we find defenses relying on this effect can be circumvented. We describe characteristic behaviors of defenses exhibiting the effect, and for each of the three types of obfuscated gradients we discover, we develop attack techniques to overcome it. In a case study, examining non-certified white-box-secure defenses at ICLR 2018, we find obfuscated gradients are a common occurrence, with 7 of 9 defenses relying on obfuscated gradients. Our new attacks successfully circumvent 6 completely, and 1 partially, in the original threat model each paper considers.

ICML 2018. Source code at https://github.com/anishathalye/obfuscated-gradients

References in corpus (16)

• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
• Wide Residual Networks
• Improved Training of Wasserstein GANs
• Synthesizing Robust Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Countering Adversarial Images using Input Transformations
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Stochastic Activation Pruning for Robust Adversarial Defense
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Early Methods for Detecting Adversarial Images
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Cited by in corpus (437)

• Ensemble Adversarial Training: Attacks and Defenses
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Synthesizing Robust Adversarial Examples
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Evaluating Adversarial Robustness
• Adversarially Robust Generalization Requires More Data
• Fast is better than free: Revisiting adversarial training
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Adversarial Attack and Defense on Graph Data: A Survey
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• A Review on Generative Adversarial Networks: Algorithms, Theory, and Applications
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Adversarial Weight Perturbation Helps Robust Generalization
• A General Framework for Adversarial Examples with Objectives
• On the Convergence and Robustness of Adversarial Training
• Are Labels Required for Improving Adversarial Robustness?
• A Dual Approach to Scalable Verification of Deep Networks
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Motivating the Rules of the Game for Adversarial Example Research
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• Adversarial examples from computational constraints
• Constructing Unrestricted Adversarial Examples with Generative Models
• Scalable agent alignment via reward modeling: a research direction
• Scaling provable adversarial defenses
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• Fooling Neural Network Interpretations via Adversarial Model Manipulation
• Rademacher Complexity for Adversarially Robust Generalization
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Controversial stimuli: pitting neural networks against each other as models of human recognition
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• RobustBench: a standardized adversarial robustness benchmark
• Attack of the Tails: Yes, You Really Can Backdoor Federated Learning
• Adversarial Attacks Against Medical Deep Learning Systems
• A Review of Adversarial Attack and Defense for Classification Methods
• The Conditional Entropy Bottleneck
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Provably Minimally-Distorted Adversarial Examples
• Smooth Adversarial Training
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Recent advances for quantum classifiers
• Understanding and Enhancing the Transferability of Adversarial Examples
• Unsolved Problems in ML Safety
• Training verified learners with learned verifiers
• The Pitfalls of Simplicity Bias in Neural Networks
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Your Classifier is Secretly an Energy Based Model and You Should Treat it Like One
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Certified Defenses for Adversarial Patches
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• Testing Robustness Against Unforeseen Adversaries
• Semantic Robustness of Models of Source Code
• Adversarial Robustness May Be at Odds With Simplicity
• Accurate, reliable and fast robustness evaluation
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Unrestricted Adversarial Examples
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• Adversarial Attack and Defense on Point Sets
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• Invisible Mask: Practical Attacks on Face Recognition with Infrared
• Unlabeled Data Improves Adversarial Robustness
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Hardware Trojan Attacks on Neural Networks
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• Understanding Straight-Through Estimator in Training Activation Quantized Neural Nets
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack
• Convergence of Adversarial Training in Overparametrized Neural Networks
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Towards robust sensing for Autonomous Vehicles: An adversarial perspective
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• RAB: Provable Robustness Against Backdoor Attacks
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Overfitting in adversarially robust deep learning
• Defending against Adversarial Images using Basis Functions Transformations
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Towards Robust Neural Networks via Random Self-ensemble
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Adversarial Spheres
• Learning Black-Box Attackers with Transferable Priors and Query Feedback
• Adversarially Robust Few-Shot Learning: A Meta-Learning Approach
• Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks
• On Adversarial Examples and Stealth Attacks in Artificial Intelligence Systems
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• On the Geometry of Adversarial Examples
• Robustness Verification of Tree-based Models
• Enhancing Adversarial Example Transferability with an Intermediate Level Attack
• Machine Learning (In) Security: A Stream of Problems
• Adversarially Robust Neural Architectures
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Fooling OCR Systems with Adversarial Text Images
• On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Them
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Defensive Quantization: When Efficiency Meets Robustness
• Natural Language Adversarial Defense through Synonym Encoding
• PRADA: Protecting against DNN Model Stealing Attacks
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Robust Out-of-distribution Detection for Neural Networks
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• L2-Nonexpansive Neural Networks
• How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?
• Randomized Smoothing of All Shapes and Sizes
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples
• Security Matters: A Survey on Adversarial Machine Learning
• Learning to Defend by Learning to Attack
• Sign-OPT: A Query-Efficient Hard-label Adversarial Attack
• Cross-Entropy Loss and Low-Rank Features Have Responsibility for Adversarial Examples
• Robustness of Bayesian Neural Networks to Gradient-Based Attacks
• Towards a Robust Deep Neural Network in Texts: A Survey
• A Closer Look at the Robustness of Vision-and-Language Pre-trained Models
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Robust Neural Networks using Randomized Adversarial Training
• Transfer of Adversarial Robustness Between Perturbation Types
• Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems
• Towards Understanding Fast Adversarial Training
• TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agents
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• Adversarial Machine Learning: Bayesian Perspectives
• Adversarial Defense Framework for Graph Neural Network
• Benchmarking Adversarial Robustness
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
• Quantifying the Preferential Direction of the Model Gradient in Adversarial Training With Projected Gradient Descent
• Adversarial Neural Pruning with Latent Vulnerability Suppression
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Deep Nets: What have they ever done for Vision?
• Stackelberg GAN: Towards Provable Minimax Equilibrium via Multi-Generator Architectures
• Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples
• A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuning
• HashTran-DNN: A Framework for Enhancing Robustness of Deep Neural Networks against Adversarial Malware Samples
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Randomization matters. How to defend against strong adversarial attacks
• White Paper Machine Learning in Certified Systems
• Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Interpretable Deep Learning under Fire
• Adversarial Training Versus Weight Decay
• Defending Against Adversarial Examples with K-Nearest Neighbor
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Certified Robustness to Adversarial Word Substitutions
• Adversarial Training with Voronoi Constraints
• Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
• MixUp as Directional Adversarial Training
• Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Non-Negative Networks Against Adversarial Attacks
• RANDOM MASK: Towards Robust Convolutional Neural Networks
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• Understanding the Interaction of Adversarial Training with Noisy Labels
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• Should Adversarial Attacks Use Pixel p-Norm?
• Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition
• A Spectral View of Adversarially Robust Features
• Breaking Transferability of Adversarial Samples with Randomness
• Playing the Game of Universal Adversarial Perturbations
• Adversarial Attacks on Monocular Depth Estimation
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Does Data Augmentation Improve Generalization in NLP?
• Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation
• An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Networks
• Geometry-Inspired Top-k Adversarial Perturbations
• On the Robustness of Cooperative Multi-Agent Reinforcement Learning
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Adversarial attacks hidden in plain sight
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• AdvDrop: Adversarial Attack to DNNs by Dropping Information
• CEB Improves Model Robustness
• Improving the Robustness of Deep Neural Networks via Adversarial Training with Triplet Loss
• Enhancing Gradient-based Attacks with Symbolic Intervals
• Bridging the Performance Gap between FGSM and PGD Adversarial Training
• Detecting Adversarial Examples through Nonlinear Dimensionality Reduction
• Projecting Trouble: Light Based Adversarial Attacks on Deep Learning Classifiers
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Manifold Regularization for Locally Stable Deep Neural Networks
• Distributionally Adversarial Attack
• A Marauder's Map of Security and Privacy in Machine Learning
• Query-Efficient Black-Box Attack by Active Learning
• Universal Lipschitz Approximation in Bounded Depth Neural Networks
• On Certifying Non-uniform Bound against Adversarial Attacks
• Anomalous Example Detection in Deep Learning: A Survey
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• PDA: Progressive Data Augmentation for General Robustness of Deep Neural Networks
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks
• Robust Encodings: A Framework for Combating Adversarial Typos
• Bayesian Inference with Certifiable Adversarial Robustness
• Security and Machine Learning in the Real World
• Mathematical Analysis of Adversarial Attacks
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Detection based Defense against Adversarial Examples from the Steganalysis Point of View
• Limitations of the Lipschitz constant as a defense against adversarial examples
• Ulixes: Facial Recognition Privacy with Adversarial Machine Learning
• Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Setting
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses
• Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
• Decision-based Universal Adversarial Attack
• Gradient Masking and the Underestimated Robustness Threats of Differential Privacy in Deep Learning
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Training
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Trust Region Based Adversarial Attack on Neural Networks
• A critique of the DeepSec Platform for Security Analysis of Deep Learning Models
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Second-Order Provable Defenses against Adversarial Attacks
• PointCloud Saliency Maps
• Computational Limitations in Robust Classification and Win-Win Results
• An Efficient Adversarial Attack for Tree Ensembles
• Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Neural Population Geometry Reveals the Role of Stochasticity in Robust Perception
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain
• Black-box Gradient Attack on Graph Neural Networks: Deeper Insights in Graph-based Attack and Defense
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Detection Defense Against Adversarial Attacks with Saliency Map
• Temporal Shuffling for Defending Deep Action Recognition Models against Adversarial Attacks
• An Empirical Evaluation of Adversarial Robustness under Transfer Learning
• Adversarial Attack and Defense in Deep Ranking
• Semantics Preserving Adversarial Learning
• CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification
• Adversarial Robustness of Supervised Sparse Coding
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• On Training Robust PDF Malware Classifiers
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• A Multiversion Programming Inspired Approach to Detecting Audio Adversarial Examples
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• Using Single-Step Adversarial Training to Defend Iterative Adversarial Examples
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• SEC4SR: A Security Analysis Platform for Speaker Recognition
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Adversarial Classification: Necessary conditions and geometric flows
• Adversarial Learning Guarantees for Linear Hypotheses and Neural Networks
• Discovering Robust Convolutional Architecture at Targeted Capacity: A Multi-Shot Approach
• Rearchitecting Classification Frameworks For Increased Robustness
• Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis
• Stateful Detection of Black-Box Adversarial Attacks
• GanDef: A GAN based Adversarial Training Defense for Neural Network Classifier
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Distortion Agnostic Deep Watermarking
• A Method for Computing Class-wise Universal Adversarial Perturbations
• On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks
• Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Estimating the Brittleness of AI: Safety Integrity Levels and the Need for Testing Out-Of-Distribution Performance
• Noisy Computations during Inference: Harmful or Helpful?
• Adversarial Defense by Stratified Convolutional Sparse Coding
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Data Quality Matters For Adversarial Training: An Empirical Study
• CAAD 2018: Generating Transferable Adversarial Examples
• Fooling Adversarial Training with Inducing Noise
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Adversarial Transfer Attacks With Unknown Data and Class Overlap
• A randomized gradient-free attack on ReLU networks
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• Intermediate Level Adversarial Attack for Enhanced Transferability
• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
• Ensemble Federated Adversarial Training with Non-IID data
• Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers
• Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Bounds
• Predicting Adversarial Examples with High Confidence
• Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder
• Input Hessian Regularization of Neural Networks
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Secure Detection of Image Manipulation by means of Random Feature Selection
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Learning Diverse-Structured Networks for Adversarial Robustness
• ATRO: Adversarial Training with a Rejection Option
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• Weight-Covariance Alignment for Adversarially Robust Neural Networks
• Understanding Catastrophic Overfitting in Adversarial Training
• On the Noise Stability and Robustness of Adversarially Trained Networks on NVM Crossbars
• Medical Aegis: Robust adversarial protectors for medical images
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Defending Adversarial Attacks by Correcting logits
• Ensemble Defense with Data Diversity: Weak Correlation Implies Strong Robustness
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• Most ReLU Networks Suffer from ${\ell }^2$ Adversarial Perturbations
• Exposing the Robustness and Vulnerability of Hybrid 8T-6T SRAM Memory Architectures to Adversarial Attacks in Deep Neural Networks
• FAT: Federated Adversarial Training
• Gradient-Free Adversarial Attacks for Bayesian Neural Networks
• Improving the robustness of ImageNet classifiers using elements of human visual cognition
• Provable robustness against all adversarial $l_p$-perturbations for $p\ge 1$
• RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy
• Mitigating Gradient-based Adversarial Attacks via Denoising and Compression
• A Self-supervised Approach for Adversarial Robustness
• Green Lighting ML: Confidentiality, Integrity, and Availability of Machine Learning Systems in Deployment
• Benchmarking adversarial attacks and defenses for time-series data
• Vision-based Navigation of Autonomous Vehicle in Roadway Environments with Unexpected Hazards
• Minimax Defense against Gradient-based Adversarial Attacks
• The Random Conditional Distribution for Higher-Order Probabilistic Inference
• Reducing Adversarial Example Transferability Using Gradient Regularization
• Generative adversarial network based on chaotic time series
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Bandlimiting Neural Networks Against Adversarial Attacks
• MUTEN: Boosting Gradient-Based Adversarial Attacks via Mutant-Based Ensembles
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• To Make Yourself Invisible with Adversarial Semantic Contours
• CCA: Exploring the Possibility of Contextual Camouflage Attack on Object Detection
• New CleverHans Feature: Better Adversarial Robustness Evaluations with Attack Bundling
• AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
• Regional Image Perturbation Reduces $L_p$ Norms of Adversarial Examples While Maintaining Model-to-model Transferability
• Understanding the Error in Evaluating Adversarial Robustness
• Fundamental Tradeoffs in Distributionally Adversarial Training
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Noise Optimization for Artificial Neural Networks
• Diminishing the Effect of Adversarial Perturbations via Refining Feature Representation
• Robust GANs against Dishonest Adversaries
• Provable Robust Classification via Learned Smoothed Densities
• What Do Adversarially Robust Models Look At?
• On Norm-Agnostic Robustness of Adversarial Training
• On the human-recognizability phenomenon of adversarially trained deep image classifiers
• Robustness via Cross-Domain Ensembles
• MAD-VAE: Manifold Awareness Defense Variational Autoencoder
• ZK-GanDef: A GAN based Zero Knowledge Adversarial Training Defense for Neural Networks
• Certifiably Robust Variational Autoencoders
• AuxBlocks: Defense Adversarial Example via Auxiliary Blocks
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Defective Convolutional Networks
• AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks
• A Frequency Perspective of Adversarial Robustness
• Towards Deep Learning Models Resistant to Large Perturbations
• Detecting and Correcting Adversarial Images Using Image Processing Operations
• Adversarial Embedding: A robust and elusive Steganography and Watermarking technique
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• Robust Single-step Adversarial Training with Regularizer
• Bio-inspired Robustness: A Review
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Why Blocking Targeted Adversarial Perturbations Impairs the Ability to Learn
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Rethinking Empirical Evaluation of Adversarial Robustness Using First-Order Attack Methods
• On the transferability of adversarial examples between convex and 01 loss models
• The Outer Product Structure of Neural Network Derivatives
• Challenging the adversarial robustness of DNNs based on error-correcting output codes
• A Generative Model based Adversarial Security of Deep Learning and Linear Classifier Models
• Feature Distillation With Guided Adversarial Contrastive Learning
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• On ${\ell }_p$-norm Robustness of Ensemble Stumps and Trees
• An Empirical Study of DNNs Robustification Inefficacy in Protecting Visual Recommenders
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• The Human Visual System and Adversarial AI
• Sampling Prediction-Matching Examples in Neural Networks: A Probabilistic Programming Approach
• Verisimilar Percept Sequences Tests for Autonomous Driving Intelligent Agent Assessment
• Robustness from Simple Classifiers
• Robust Ensemble Model Training via Random Layer Sampling Against Adversarial Attack
• A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attacks
• Augmenting Model Robustness with Transformation-Invariant Attacks
• Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model
• Unifying Bilateral Filtering and Adversarial Training for Robust Neural Networks
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Removing Undesirable Feature Contributions Using Out-of-Distribution Data
• Cloth Manipulation Planning on Basis of Mesh Representations with Incomplete Domain Knowledge and Voxel-to-Mesh Estimation
• Generating Structured Adversarial Attacks Using Frank-Wolfe Method
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Effectiveness of random deep feature selection for securing image manipulation detectors against adversarial examples
• Thwarting finite difference adversarial attacks with output randomization
• Adversarial Examples as an Input-Fault Tolerance Problem
• Calibrated Adversarial Training
• Investigating Image Applications Based on Spatial-Frequency Transform and Deep Learning Techniques
• Linking average- and worst-case perturbation robustness via class selectivity and dimensionality
• Defense Through Diverse Directions
• On Connections between Regularizations for Improving DNN Robustness
• Reinforcement Based Learning on Classification Task Could Yield Better Generalization and Adversarial Accuracy
• Contextual Fusion For Adversarial Robustness
• Harnessing adversarial examples with a surprisingly simple defense
• Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness
• Trace-Norm Adversarial Examples
• Using Intuition from Empirical Properties to Simplify Adversarial Training Defense
• Target Training Does Adversarial Training Without Adversarial Samples
• Polarizing Front Ends for Robust CNNs
• Spatiotemporal Attacks for Embodied Agents
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• Adversarial Robustness Across Representation Spaces
• Multi-way Encoding for Robustness
• Tricking Adversarial Attacks To Fail
• Enhancing Transformation-based Defenses using a Distribution Classifier
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• The many faces of deep learning
• AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defense
• Sparse Coding Frontend for Robust Neural Networks
• Neural Network Repair with Reachability Analysis
• Towards adversarial robustness with 01 loss neural networks
• State-Reification Networks: Improving Generalization by Modeling the Distribution of Hidden Representations
• Delving into the pixels of adversarial samples
• Localized Uncertainty Attacks
• Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness
• A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• Recent Advancements in Self-Supervised Paradigms for Visual Feature Representation
• High-Robustness, Low-Transferability Fingerprinting of Neural Networks
• Adversarial Training with Stochastic Weight Average
• Shape Defense Against Adversarial Attacks
• Absum: Simple Regularization Method for Reducing Structural Sensitivity of Convolutional Neural Networks
• An Integrated Approach to Produce Robust Models with High Efficiency
• Erratum Concerning the Obfuscated Gradients Attack on Stochastic Activation Pruning
• Training Efficiency and Robustness in Deep Learning
• Learning to Disentangle Robust and Vulnerable Features for Adversarial Detection
• Bridged Adversarial Training
• Adversarial Ranking Attack and Defense
• Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemble
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks