Adversarial machine learning

Researchers introduce the Visible, Semantic, Sample-specific, and Compatible (VSSC) trigger for backdoor attacks on deep neural networks. They present an automated pipeline that selects triggers with large language models, inserts them into images with generative models, and checks insertion quality with vision-language models. The authors report that VSSC stays effective under visual distortions and works in physical scenarios using corresponding real-world objects.

This research tests a deep neuro-fuzzy system (DNFS) for medical image classification under six noise types and adversarial attacks. The DNFS matched state-of-the-art models on original images across seven biomedical datasets and showed superior average accuracy on noisy data. It was also tested for susceptibility to adversarial perturbations, which the authors report exposes weaknesses in deep learning.

Researchers study backdoor attacks on reinforcement learning agents in partially observable multiagent systems. Instead of modifying a victim's observations directly, an adversary agent uses its own actions to affect what other agents observe, and a trained trigger policy, guided by auxiliary rewards, lets it activate their backdoors with few actions. Experiments show the method triggers others' backdoors efficiently, and the authors also study defenses.

AI-Shielder is a defense that deliberately embeds backdoors in a DNN so that adversarial perturbations fail while the main task keeps working. Evaluated against sixteen adversarial example generation approaches, it reduces the attack success rate from 91.8% to 3.8%, outperforming state-of-the-art works by 37.2%, with a 0.6% decline in clean data accuracy and 1.43% overhead to model prediction time.

Researchers introduce the certified local transferable region, a connected area of inputs where a single adversarial perturbation is mathematically guaranteed to fool a deep neural network. They propose reverse attack oracle-based search (RAOS) to estimate the maximum size of this region, using a minimal distance attack and state-of-the-art verifiers at each step. The region's size serves as a metric for the local transferability of perturbations across model structures and adversarial training scenarios.

The author evaluates Microsoft Counterfit, a command-line tool for testing machine learning models and endpoints against adversarial attacks. Counterfit hosts attack modules from the Adversarial Robustness Toolbox and TextAttacks, and it can be extended with new attacks and targets. The author builds a custom Husky AI target that loads a Keras model and sample images, with the goal of turning Shadowbunny into a husky through adversarial examples.

Johann Rehberger (wunderwuzzi23) demonstrates the Adversarial Robustness Toolbox (ART), originally created by IBM and moved to the Linux AI Foundation in July 2020, to generate adversarial examples against his Husky AI binary image classifier. Using ART's FastGradientMethod with targeted=True and eps=0.04, he perturbs an image of a plush bunny so the model's prediction shifts from about 0.002 to 66% husky. The post presents this as an easier alternative to his earlier manual perturbation attacks.