D3Adapter is presented, a threat-aware framework that unifies adversarial example detection (AED) and robust inference and scalability across datasets with varying numbers of classes is studied, showing that unified detection and robust inference can be achieved with predictable overhead proportional to the number of adapters.
This work proposes BMAT (Bilevel-Minimax Adversarial Transfer), an integrated bottom-up solver that combines a Soft Weight Modulator and an Implicit Gradient Approximator to enable ternary coupling among initialization, surrogate adaptation, and perturbation optimization.
Adversarial training has emerged as a leading strategy for enhancing the robustness of machine learning models against adversarial attacks. Its effectiveness often wanes when faced with unseen adversarial examples, resulting in suboptimal robust generalization. To address this issue, we introduce a novel energy-based optimization strategy to improve the robust generalization by incorporating the principles of energy-based models. Our framework models the energy of natural and adversarial examples, where natural samples are assigned to lower energy and adversarial samples to higher energy. During the inference phase, the influence of adversarial perturbation can be alleviated by energy minimization. Theoretically, we show that the proposed energy-based optimization strategy yields a tighter robust-generalization bound through an explicit energy-discrepancy term; this analysis provides an explanatory bound and should not be interpreted as certified robustness. Empirically, a series of evaluations provide evidence for the efficacy of the proposed methodology under the specified threat models and evaluation protocols, showing strong and competitive performance across three extensively utilized datasets. Specifically, EM-AT achieves 77.71% standard-AA robustness on CIFAR-10 and remains highly competitive under comparable lightweight settings. The source codes are available at https://github.com/LitterQ/EM-AT.
Machine learning models are increasingly adapted in various domains. However, adversarial examples pose a significant threat to the reliable deployment of these models. In recent years, some powerful adversarial example attacks have been proposed for the fast and query-efficient generation of adversarial examples, even in black-box scenarios, highlighting the need for scalable, low-cost, and powerful defenses. In this work, we present two contributions to the domain of black-box adversarial example attacks and defenses. First, we propose Random Logit Scaling (RLS), a randomization-based defense against black-box score-based adversarial example attacks. RLS is a plug-and-play, post-processing defense that can be implemented on top of any existing ML model with minimal effort. The idea behind RLS is to confuse an attacker by outputting falsified scores resulting from randomly scaled logits while maintaining the model accuracy. We show that RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving the accuracy and minimizing confidence score distortion compared to state-of-the-art randomization-based defenses. Second, we introduce a novel adaptive attack against AAA, a SOTA non-randomized black-box defense against black-box score-based attacks that also modifies output logits to confuse attackers, demonstrating its vulnerability against adaptive attacks.
Hamid Dashtbani, Mehdi Dousti Gandomani, A. M. Sadeghzadeh· 0 citations
This work comprehensively investigates computation-efficient strategies to speed up latent adversarial training from two complementary perspectives, and reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations