Ali H. Sayed · Cambridge University Press eBooks · 2022
This extraordinary three-volume work, written in an engaging and rigorous style by a world authority in the field, provides an accessible, comprehensive introduction to the full spectrum of mathematical and statistical techniques underpinning contemporary methods in data-driven learning and inference. This final volume, Learning, builds on the foundational topics established in volume I to provide a thorough introduction to learning methods, addressing techniques such as least-squares methods, regularization, online learning, kernel methods, feedforward and recurrent neural networks, meta-learning, and adversarial attacks. A consistent structure and pedagogy is employed throughout this volume to reinforce student understanding, with over 350 end-of-chapter problems (including complete solutions for instructors), 280 figures, 100 solved examples, datasets and downloadable Matlab code. Supported by sister volumes Foundations and Inference, and unique in its scale and depth, this textbook sequence is ideal for early-career researchers and graduate students across many courses in signal processing, machine learning, data and inference.
Cited by 0
Minoru Kuribayashi · Studies in autonomic, data-driven and industrial computing · 2022
Cited by 0
Akshat Jain, Sanskar Agarwal, Armaan Pareek et al. · Darpan International Research Analysis · 2024
In recent years, the fields of Artificial Intelligence (AI) and Deep learning (DL) techniques along with Neural Networks (NNs) have shown great progress and scope for future research. Along with all the developments comes the threats and security vulnerabilities to Neural Networks and AI models. A few fabricated inputs/samples can lead to deviations in the results of the models. Patch based Adversarial Attacks can change the output of a neural network to a completely different result just by making a few changes to the input of the neural network. These attacks employ a patch that is applied to the input image in order to cause the classifier to misclassify and make the incorrect prediction. The goal of this research is to develop effective defense strategies against these types of attacks and make the model/Neural Network more robust.
Cited by 1Open access
Michael Hughes, Sven Schewe · 2024
We study robust, efficient, and stealthy attacks on object detector types of classifiers. Such adversarial attacks are meant to suppress the correct classification of objects in a real world scenario, in our case the classification of road signs by a self-driving car. In this scenario, we need to design a physical attack, e.g. in the form of adding a sticker that looks natural (like an algae patina or marks left by a bird), so that it does not arouse suspicion, but reliably suppresses the classification during an approach without being affected by minor changes in brightness or distance. We show that such an attack can be achieved against a known network, applying a multi-phase approach to successively learn how to place and mildly adjust bird marks to robustly and effectively fool Yolo while retaining a natural look.
Cited by 0
Xiaofeng Mao, Yuefeng Chen, Shuhui Wang et al. · arXiv (Cornell University) · 2020
Adversarial attack is a technique for deceiving Machine Learning (ML) models, which provides a way to evaluate the adversarial robustness. In practice, attack algorithms are artificially selected and tuned by human experts to break a ML system. However, manual selection of attackers tends to be sub-optimal, leading to a mistakenly assessment of model security. In this paper, a new procedure called Composite Adversarial Attack (CAA) is proposed for automatically searching the best combination of attack algorithms and their hyper-parameters from a candidate pool of \textbf{32 base attackers}. We design a search space where attack policy is represented as an attacking sequence, i.e., the output of the previous attacker is used as the initialization input for successors. Multi-objective NSGA-II genetic algorithm is adopted for finding the strongest attack policy with minimum complexity. The experimental result shows CAA beats 10 top attackers on 11 diverse defenses with less elapsed time (\textbf{6 $\times$ faster than AutoAttack}), and achieves the new state-of-the-art on $l_{\infty}$, $l_{2}$ and unrestricted adversarial attacks.
Cited by 4Open access
Mertzanis, Nick (author) · Research Repository (Delft University of Technology) · 2021
Convolutional Neural Networks are particularly vulnerable to attacks that manipulate their data, which are usually called adversarial attacks. In this paper, a method of filtering images using the Fast Fourier Transform is explored, along with its potential to be used as a defense mechanism to such attacks. The main contribution that differs from other methods that use the Fourier Transform as a filtering element in neural networks is the use of labeled data to determine how to filter the pictures. This paper concludes that, while the filtering proposed is hardly better than a simple low-pass filter, it still manages to improve resistance to adversarial attacks with a minimal drop in the standard accuracy of the network.
Cited by 0Open access
Lucas Beerens, Desmond J. Higham · Lecture notes in computer science · 2023
Cited by 1
Αμίτση, Χριστίνα - Βασιλική · Dione (University of Piraeus) · 2025
Machine learning models, and in particular deep neural networks, are now widely deployed in applications that demand high levels of accuracy and reliability. However, over the past decade, researchers have shown that these systems are not inherently robust, as they are vulnerable to adversarial interventions that can manipulate their behavior in subtle but highly effective ways. This growing body of research, known as adversarial machine learning, has revealed a broad range of attack strategies that question both the trustworthiness and the security of modern AI. This thesis presents a comprehensive exploration of adversarial threats by examining forty distinct attack methods that cover the principal categories in the field: model extraction, data poisoning and backdoors, evasion through adversarial examples, and privacy or inference attacks. The study systematically evaluates the impact of these attacks on neural networks and goes beyond traditional accuracy measurements by employing richer indicators of performance, including precision, recall, F1-score, attack success rate, and confusion matrix analysis. The results highlight not only the diversity of adversarial techniques but also the common vulnerabilities they exploit. By presenting these attacks within a unified and reproducible framework, the thesis provides both a benchmark for future research and a practical resource for those seeking to understand the risks posed by adversarial machine learning. In doing so, it contributes to a more comprehensive view of the challenges involved in building secure and trustworthy AI systems.
Cited by 0
Yu–Gang Jiang, Xingjun Ma, Zuxuan Wu · Elsevier eBooks · 2025
Cited by 0
Minoru Kuribayashi · Studies in autonomic, data-driven and industrial computing · 2022
Cited by 0
Manon Césaire, Lucas Schott, Hatem Hajri et al. · 2021 IEEE 33rd International Conference on Tools with Artificial Intelligence (ICTAI) · 2021
This paper introduces stochastic sparse adversarial attacks (SSAA), standing as simple, fast and purely noise-based targeted and untargeted attacks of neural network classifiers (NNC). SSAA offer new examples of sparse (or L <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</inf> ) attacks for which only few methods have been proposed previously. These attacks are devised by exploiting a small-time expansion idea widely used for Markov processes. Experiments on small and large datasets (CIFAR-10 and ImageNet) illustrate several advantages of SSAA in comparison with the-state-of-the-art methods. For instance, in the untargeted case, our method called Voting Folded Gaussian Attack (VFGA) scales efficiently to ImageNet and achieves a significantly lower L <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</inf> score than SparseFool (up to $\frac{2}{5}$) while being faster. Moreover, VFGA achieves better L <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</inf> scores on ImageNet than Sparse-RS when both attacks are fully successful on a large number of samples.
Cited by 5Open access
Pin‐Yu Chen, Cho‐Jui Hsieh · Elsevier eBooks · 2022
Cited by 0
Hatem Hajri, Manon Césaire, Théo Combey et al. · HAL (Le Centre pour la Communication Scientifique Directe) · 2021
This paper introduces stochastic sparse adversarial attacks (SSAA), simple, fast and purely noise-based targeted and untargeted $L_0$ attacks of neural network classifiers (NNC). SSAA are devised by exploiting a simple small-time expansion idea widely used for Markov processes and offer new examples of $L_0$ attacks whose studies have been limited. They are designed to solve the known scalability issue of the family of Jacobian-based saliency maps attacks to large datasets and they succeed in solving it. Experiments on small and large datasets (CIFAR-10 and ImageNet) illustrate further advantages of SSAA in comparison with the-state-of-the-art methods. For instance, in the untargeted case, our method called Voting Folded Gaussian Attack (VFGA) scales efficiently to ImageNet and achieves a significantly lower $L_0$ score than SparseFool (up to $\frac{2}{5}$ lower) while being faster. Moreover, VFGA achieves better $L_0$ scores on ImageNet than Sparse-RS when both attacks are fully successful on a large number of samples. Codes are publicly available through the link this https URL
Cited by 2
Junyoung Byun, Kyujin Shim, Hyojun Go et al. · 2022 IEEE International Conference on Image Processing (ICIP) · 2022
Deep neural networks are vulnerable to maliciously crafted inputs called adversarial examples. Research on unprecedented adversarial attacks is significant since it can help strengthen the reliability of neural networks by alarming potential threats against them. However, since existing adversarial attacks disturb models unconditionally, the resulting adversarial examples increase their detectability through statistical observations or human inspection. To tackle this limitation, we propose hidden conditional adversarial attacks whose resultant adversarial examples disturb models only if the input images satisfy attackers’ pre-defined conditions. These hidden conditional adversarial examples have better stealthiness and controllability of their attack ability. Our experimental results on the CIFAR-10 and ImageNet datasets show their effectiveness and raise a serious concern about the vulnerability of CNNs against the novel attacks.
Cited by 0
Yifan Tan, Zikui Cai, M. Salman Asif · arXiv (Cornell University) · 2024
Deep networks are highly vulnerable to adversarial attacks, yet conventional attack methods utilize static adversarial perturbations that induce fixed mispredictions. In this work, we exploit an overlooked property of adversarial perturbations--their dependence on image transforms--and introduce transform-dependent adversarial attacks. Unlike traditional attacks, our perturbations exhibit metamorphic properties, enabling diverse adversarial effects as a function of transformation parameters. We demonstrate that this transform-dependent vulnerability exists across different architectures (e.g., CNN and transformer), vision tasks (e.g., image classification and object detection), and a wide range of image transforms. Additionally, we show that transform-dependent perturbations can serve as a defense mechanism, preventing sensitive information disclosure when image enhancement transforms pose a risk of revealing private content. Through analysis in blackbox and defended model settings, we show that transform-dependent perturbations achieve high targeted attack success rates, outperforming state-of-the-art transfer attacks by 17-31% in blackbox scenarios. Our work introduces novel, controllable paradigm for adversarial attack deployment, revealing a previously overlooked vulnerability in deep networks.
Cited by 1Open access
Mohsen H. Alhazmi (22756263) · Figshare · 2025
<div> Federated learning (FL) struggles with scalability in decentralized big data platforms due to data heterogeneity, communication bottlenecks, and computational inefficiencies. We propose Adaptive Federated Clustering (AFC), a novel framework that addresses these challenges through three key innovations: (1) adaptive client selection based on computational capacity and data relevance, (2) hierarchical aggregation organizing clients into clusters for localized updates, and (3) sparsity- and quantization-based model compression. Experiments on CIFAR-10, CIFAR-100, Fashion-MNIST, and MIMIC-III demonstrate AFC achieves 4.3% higher accuracy than FedAvg, 49% lower communication cost, and 35% faster convergence. Under backdoor attacks, AFC shows only 2.8% accuracy degradation versus 7% for FedAvg. While AFC assumes relatively stable network connectivity and does not yet support fine-grained personalization, it significantly outperforms existing algorithms in scalability, robustness, and efficiency. These results demonstrate AFC’s practical value for secure collaborative learning on decentralized platforms, particularly in healthcare and IoT applications where bandwidth constraints and data heterogeneity are prevalent. </div>
Cited by 0Open access
Han Xu, Yaxin Li, Wei Jin et al. · 2020
Deep neural networks (DNN) have achieved unprecedented success in numerous machine learning tasks in various domains. However, the existence of adversarial examples leaves us a big hesitation when applying DNN models on safety-critical tasks such as autonomous vehicles and malware detection. These adversarial examples are intentionally crafted instances, either appearing in the train or test phase, which can fool the DNN models to make severe mistakes. Therefore, people are dedicated to devising more robust models to resist adversarial examples, but usually they are broken by new stronger attacks. This arms-race between adversarial attacks and defenses has been drawn increasing attention in recent years. In this tutorial, we provide a comprehensive overview on the frontiers and advances of adversarial attacks and their countermeasures. In particular, we give a detailed introduction of different types of attacks under different scenarios, including evasion and poisoning attacks, white-box and black box attacks. We will also discuss how the defending strategies develop to compete against these attacks, and how new attacks come out to break these defenses. Moreover, we will discuss the story of adversarial attacks and defenses in other data domains, especially in graph structured data. Then, we introduce DeepRobust, a Pytorch adversarial learning library which aims to build a comprehensive and easy-to-use platform to foster this research field. Finally, we summarize the tutorial with discussions on open issues and challenges about adversarial attacks and defenses. Via our tutorial, our audience can grip the main idea and key approaches of the game between adversarial attacks and defenses.
Cited by 20Open access
Rahul Ambati, Naveed Akhtar, Ajmal Mian et al. · arXiv (Cornell University) · 2023
Intrinsic susceptibility of deep learning to adversarial examples has led to a plethora of attack techniques with a broad common objective of fooling deep models. However, we find slight compositional differences between the algorithms achieving this objective. These differences leave traces that provide important clues for attacker profiling in real-life scenarios. Inspired by this, we introduce a novel problem of PRofiling Adversarial aTtacks (PRAT). Given an adversarial example, the objective of PRAT is to identify the attack used to generate it. Under this perspective, we can systematically group existing attacks into different families, leading to the sub-problem of attack family identification, which we also study. To enable PRAT analysis, we introduce a large Adversarial Identification Dataset (AID), comprising over 180k adversarial samples generated with 13 popular attacks for image specific/agnostic white/black box setups. We use AID to devise a novel framework for the PRAT objective. Our framework utilizes a Transformer based Global-LOcal Feature (GLOF) module to extract an approximate signature of the adversarial attack, which in turn is used for the identification of the attack. Using AID and our framework, we provide multiple interesting benchmark results for the PRAT problem.
Cited by 0Open access
Battista, Biggio · Zenodo (CERN European Organization for Nuclear Research) · 2025
Cited by 0Open access
Zhibo Jin, Jing Zhang, Zhiyu Zhu et al. · 2024
The robustness of deep learning models against adversarial attacks remains a pivotal concern.This study presents, for the first time, an exhaustive review of the transferability aspect of adversarial attacks.It systematically categorizes and critically evaluates various methodologies developed to augment the transferability of adversarial attacks.This study encompasses a spectrum of techniques, including Generative Structure, Semantic Similarity, Gradient Editing, Target Modification, and Ensemble Approach.Concurrently, this paper introduces a benchmark framework TAA-Bench, integrating ten leading methodologies for adversarial attack transferability, thereby providing a standardized and systematic platform for comparative analysis across diverse model architectures.Through comprehensive scrutiny, we delineate the efficacy and constraints of each method, shedding light on their underlying operational principles and practical utility.This review endeavors to be a quintessential resource for both scholars and practitioners in the field, charting the complex terrain of adversarial transferability and setting a foundation for future explorations in this vital sector.
Cited by 5Open access