pwc-archive/papers-with-abstracts huggingface dataset:
Generate More Imperceptible Adversarial Examples for Object Detection
Authors: Siyuan Liang, Xingxing Wei, Xiaochun Cao
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Object, object-detection, Object Detection

Object detection methods based on deep neural networks are vulnerable to adversarial examples. The existing attack methods have the following problems: 1) the training generator takes a long time and is difﬁcult to extend to a large dataset; 2) the excessive destruction of the image features does not improve the black-box attack effect(the generated adversarial examples have poor transferability) and brings about visible perturbations. In response to these problems, we proposed a more imperceptible attack(MI attack) with a stopping condition of feature destruction and a noise cancellation mechanism. Finally, the generator generates subtle adversarial perturbations, which can not only attack the object detection models that are based on proposal and regression but also boost the training speed by 4-6 times. Experiments show that the MI method has achieved state-of-the-art attack performance in the large datasets PASCAL VOC.
Certified robustness against adversarial patch attacks via randomized cropping
Authors: Wan-Yi Lin, Fatemeh Sheikholeslami, Jinghao Shi, Leslie Rice, J Zico Kolter
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: image-classification, Image Classification

    This paper proposes a certifiable defense against adversarial patch attacks on image classification. Our approach classifies random crops from the original image independently and classifies the original image as the majority vote over predicted classes of the crops.  Leveraging the fact that a patch attack can only influence a certain number of pixels in the image, we derive certified robustness bounds for the classifier. Our method is particularly effective when realistic transformations are applied to the adversarial patch, such as affine transformations. Such transformations occur naturally when an adversarial patch is physically introduced in a scene. Our method improves upon the current state of the art in defending against patch attacks on CIFAR10 and ImageNet, both in terms of certified accuracy and inference time.
Generalizing Adversarial Training to Composite Semantic Perturbations
Authors: Yun-Yun Tsai, Lei Hsiung, Pin-Yu Chen, Tsung-Yi Ho
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Scheduling

Model robustness against adversarial examples has been widely studied, yet the lack of generalization to more realistic scenarios can be challenging. Specifically, recent works using adversarial training can successfully improve model robustness, but these works primarily consider adversarial threat models limited to $\ell_{p}$-norm bounded perturbations and might overlook semantic perturbations and their composition. In this paper, we firstly propose a novel method for generating composite adversarial examples. By utilizing component-wise PGD update and automatic attack- order scheduling, our method can find the optimal attack composition. We then propose generalized adversarial training (GAT) to extend model robustness from $\ell_{p}$ norm to composite semantic perturbations, such as Hue, Saturation, Brightness, Contrast, and Rotation. The results show that GAT can be robust not only on any single attack but also on combination of multiple attacks. GAT also outperforms baseline adversarial training approaches by a significant margin.
Attacking Graph Classification via Bayesian Optimisation
Authors: Xingchen Wan, Henry Kenlay, Binxin Ru, Arno Blaas, Michael Osborne, Xiaowen Dong
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Adversarial Robustness, Bayesian Optimisation, Classification, Graph Classification

Graph neural networks have been shown to be vulnerable to adversarial attacks. While the majority of the literature focuses on such vulnerability in node-level classification tasks, little effort has been dedicated to attacks on graph-level classification, an important problem with numerous real-life applications such as biochemistry and social network analysis. The few existing methods often require unrealistic setups, such as access to internal information of the victim models, or an impractically-large number of queries. We present a novel Bayesian optimisation-based attack method  for graph classification models. Our method is black-box, query-efficient and parsimonious with respect to the perturbation applied. We empirically validate the effectiveness and flexibility of the proposed method and analyse patterns behind the adversarial samples produced, which may shed further light on the adversarial robustness of graph classification models.
Adversarial EXEmples: Functionality-preserving Optimization of Adversarial Windows Malware
Authors: Luca Demetrio, Battista Biggio, Giovanni Lagorio, Alessandro Armando, Fabio Roli
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

Windows malware classifiers that rely on static analysis have been proven vulnerable to adversarial EXEmples, i.e., malware samples carefully manipulated to evade detection.
However, such attacks are typically optimized via query-inefficient algorithms that iteratively apply random manipulations on the input malware, and require checking that the malicious functionality is preserved after manipulation through computationally-expensive validations.
To overcome these limitations, we propose RAMEn, a general framework for creating adversarial EXEmples via  functionality-preserving manipulations.
RAMEn optimizes their parameters of such manipulations via gradient-based (white-box) and gradient-free (black-box) attacks, implementing many state-of-the-art attacks for crafting adversarial Windows malware. It also includes a family of black-box attacks, called GAMMA, which optimize the injection of benign content to facilitate evasion. Our experiments show that gradient-based and gradient-free attacks can bypass  malware detectors based on deep learning, non-differentiable models trained on hand-crafted features, and even some renowned commercial products.
On Frank-Wolfe Adversarial Training
Authors: Theodoros Tsiligkaridis, Jay Roberts
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

We develop a theoretical framework for adversarial training (AT) with FW optimization (FW-AT) that reveals a geometric connection between the loss landscape and the distortion of $\ell_\infty$ FW attacks (the attack's $\ell_2$ norm). Specifically, we show that high distortion of FW attacks is equivalent to low variation along the attack path. It is then experimentally demonstrated on various deep neural network architectures that $\ell_\infty$ attacks against robust models achieve near maximal $\ell_2$ distortion. To demonstrate the utility of our theoretical framework we develop FW-Adapt, a novel adversarial training algorithm which uses simple distortion measure to adapt the number of attack steps during training. FW-Adapt provides strong robustness against white- and black-box attacks at lower training times than PGD-AT.
SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Adversarial Robustness
Authors: Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, DoGuk Kim, Jinwoo Shin
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Adversarial Robustness

Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against $\ell_2$-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experiments show that the proposed method can significantly improve the certified $\ell_2$-robustness of smoothed classifiers compared to state-of-the-art robust training methods.
Hidden Patch Attacks for Optical Flow
Authors: Benjamin Wortman
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Object Recognition, Optical Flow Estimation, Semantic Segmentation

Adversarial patches have been of interest to researchers in recent years due to their easy implementation in real world attacks. In this paper we expand upon previous research by demonstrating a new "hidden" patch attack on optical flow. By altering the transparency during training we can generate patches that are invariant to their background meaning they can be inconspicuously applied using a transparent film to any number of objects. This also has the added benefit of reducing training costs when mass producing adversarial objects, since only one trained patch is needed for any application. Although this specific implementation is demonstrated using a white box attack on optical flow, it can be generalized to other scenarios such as object recognition or semantic segmentation.
Entropy Weighted Adversarial Training
Authors: Minseon Kim, Jihoon Tack, Jinwoo Shin, Sung Ju Hwang
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

Adversarial training methods, which minimizes the loss of adversarially-perturbed training examples, have been extensively studied as a solution to improve the robustness of the deep neural networks. However, most adversarial training methods treat all training examples equally, while each example may have a different impact on the model's robustness during the course of training. Recent works have exploited such unequal importance of adversarial samples to model's robustness, which has been shown to obtain high robustness against untargeted PGD attacks. However, we empirically observe that they make the feature spaces of adversarial samples across different classes overlap, and thus yield more high-entropy samples whose labels could be easily flipped. This makes them more vulnerable to targeted adversarial perturbations. Moreover, to address such limitations, we propose a simple yet effective weighting scheme, Entropy-Weighted Adversarial Training (EWAT), which weighs the loss for each adversarial training example proportionally to the entropy of its predicted distribution, to focus on examples whose labels are more uncertain. We validate our method on multiple benchmark datasets and show that it achieves an impressive increase of robust accuracy.
Defending Adversaries Using Unsupervised Feature Clustering VAE
Authors: Cheng Zhang, Pan Gao
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Clustering, image-classification, Image Classification

We propose a modified VAE (variational autoencoder) as a denoiser to remove adversarial perturbations for image classification. Vanilla VAE's purpose is to make latent variables approximating normal distribution, which reduces the latent inter-class distance of  data points. Our proposed VAE modifies this problem by adding a latent variable cluster. So the VAE can guarantee inter-class distance of latent variables and learn class-wised features. Our Feature Clustering VAE performs better on removing perturbations and reconstructing the image to defend adversarial attacks.
Audio Injection Adversarial Example Attack
Authors: Xiaolei Liu, Xingshu Chen, Mingyong Yin, Yulong Wang, Teng Hu, Kangyi Ding
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

We study the problem of audio adversarial example attacks with sparse perturbations. Compared with image adversarial example attacks, attacking audio is more challenging because the audio structure is more complex and the perturbation is difficult to conceal. To overcome this challenge, we propose an audio injection adversarial example attack, which provides a new sight light to increase the concealment of attack behavior. Experiments demonstrate that the proposed audio injection adversarial example attack can significantly reduce the perturbation proportion and achieve a better attack effect than traditional attack methods.
Towards Transferable Adversarial Perturbations with Minimum Norm
Authors: Fangcheng Liu, Chao Zhang, Hongyang Zhang
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7
Tasks: Model Selection

Transfer-based adversarial example is one of the most important classes of black-box attacks. Prior work in this direction often requires a fixed but large perturbation radius to reach a good transfer success rate. In this work, we propose a \emph{geometry-aware framework} to generate transferable adversarial perturbation with minimum norm for each input. Analogous to model selection in statistical machine learning, we leverage a validation model to select the optimal perturbation budget for each image. Extensive experiments verify the effectiveness of our framework on improving image quality of the crafted adversarial examples. The methodology is the foundation of our entry to the CVPR'21 Security AI Challenger: Unrestricted Adversarial Attacks on ImageNet, in which we ranked 1st place out of 1,559 teams and surpassed the runner-up submissions by 4.59\% and 23.91\% in terms of final score and average image quality level, respectively.
Uncovering Universal Features: How Adversarial Training Improves Adversarial Transferability
Authors: Jacob M. Springer, Melanie Mitchell, Garrett T. Kenyon
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

Adversarial examples for neural networks are known to be transferable: examples optimized to be misclassified by a “source” network are often misclassified by other “destination” networks. Here, we show that training the source network to be “slightly robust”---that is, robust to small-magnitude adversarial examples---substantially improves the transferability of targeted attacks, even between architectures as different as convolutional neural networks and transformers. In fact, we show that these adversarial examples can transfer representation (penultimate) layer features substantially better than adversarial examples generated with non-robust networks. We argue that this result supports a non-intuitive hypothesis: slightly robust networks exhibit universal features---ones that tend to overlap with the features learned by all other networks trained on the same dataset. This suggests that the features of a single slightly-robust neural network may be useful to derive insight about the features of every non-robust neural network trained on the same distribution.
Adversarial Sample Detection via Channel Pruning
Authors: Zuohui Chen, Renxuan Wang, Yao Lu, Jingyang Xiang, Qi Xuan
Date: 2021-06-18 00:00:00
Proceeding: ICML Workshop AML 2021 7

 Adversarial attacks are the main security issue of deep neural networks. Detecting adversarial samples is an effective mechanism for defending adversarial attacks. Previous works on detecting adversarial samples show superior in accuracy but consume too much memory and computing resources. In this paper, we propose an adversarial sample detection method based on pruned models. We find that pruned neural network models are sensitive to adversarial samples, i.e., the pruned models tend to output labels different from the original model when given adversarial samples. Moreover, the channel pruned model has an extremely small model size and actual computational cost. Experiments on CIFAR10 and SVHN show that the FLOPs and size of our generated model are only 24.46\% and 4.86\% of the original model. It outperforms the SOTA multi-model based detection method (87.47\% and 63.00\%) by 5.29\% and 30.92\% on CIFAR10 and SVHN, respectively, with significantly fewer models used.
Replacing the Ex-Def Baseline in AutoML by Naive AutoML
Authors: Felix Mohr, Marcel Wever
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: AutoML, Bayesian Optimization, BIG-bench Machine Learning

Automated Machine Learning (AutoML) is the problem of automatically finding the pipeline with the best generalization performance on some given dataset. AutoML has received enormous attention in the last decade and has been addressed with sophisticated black-box optimization techniques like Bayesian Optimization, Genetic Algorithms, or Tree Search. These approaches are almost never compared to simple baselines to see how much they improve over simple but easy to implement approaches. We present Naive AutoML, a very simple baseline for AutoML that exploits meta-knowledge about machine learning problems and makes simplifying, yet, effective assumptions to quickly come to high-quality solutions. In 1h experiments, state of the art approaches can hardly improve over Naive AutoML which in turn comes along with advantages such as interpretability and flexibility.
Meta Learning the Step Size in Policy Gradient Methods
Authors: Luca Sabbioni, Francesco Corda, Marcello Restelli
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: Meta-Learning, Meta Reinforcement Learning, Policy Gradient Methods

Policy-based algorithms are among the most widely adopted techniques in model-free RL, thanks to their strong theoretical groundings and good properties in continuous action spaces. Unfortunately, these methods require precise and problem-specific hyperparameter tuning to achieve good performance and, as a consequence, they tend to struggle when asked to accomplish a series of heterogeneous tasks. In particular, the selection of the step size has a crucial impact on the ability to learn a highly performing policy, affecting the speed and the stability of the training process, and often being the main culprit for poor results. In this paper, we tackle these issues with a Meta Reinforcement Learning approach, by introducing a new formulation, known as meta-MDP, that can be used to solve any hyperparameter selection problem in RL with contextual processes. After providing a theoretical Lipschitz bound to the performance in different tasks, we adopt the proposed framework to train a batch RL algorithm to dynamically recommend the most adequate step size for different policies and tasks. In conclusion, we present an experimental campaign to show the advantages of selecting an adaptive learning rate in heterogeneous environments.
On-the-fly learning of adaptive strategies with bandit algorithms
Authors: Rashid Bakirov, Damien Fay, Bogdan Gabrys
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: Model Selection

Automation of machine learning model development is increasingly becoming an established research area. While automated model selection and automated data pre-processing have been studied in depth, there is, however, a gap concerning automated model adaptation strategies for streaming data with non-stationarities. This has previously been addressed by heuristic generic adaptation strategies in the batch streaming setting. While showing promising performance, these strategies contain some limitations. In this work, we propose using multi-armed bandit algorithms for learning adaptive strategies from incrementally streaming data on-the-fly. Empirical results using established bandit algorithms show a comparable performance to two common stream learning algorithms.
Incorporating domain knowledge into neural-guided search via in situ priors and constraints
Authors: Brenden K Petersen, Claudio Santiago, Mikel Landajuela
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: AutoML, regression, Symbolic Regression

Many AutoML problems involve optimizing discrete objects under a black-box reward. Neural-guided search provides a flexible means of searching these combinatorial spaces using an autoregressive recurrent neural network. A major benefit of this approach is that builds up objects $\textit{sequentially}$—this provides an opportunity to incorporate domain knowledge into the search by directly modifying the logits emitted during sampling. In this work, we formalize a framework for incorporating such $\textit{in situ}$ priors and constraints into neural-guided search, and provide sufficient conditions for enforcing constraints. We integrate several priors and constraints from existing works into this framework, propose several new ones, and demonstrate their efficacy in informing the task of symbolic regression.
Ranking Architectures by Feature Extraction Capabilities
Authors: Debadeepta Dey, Shital Shah, Sebastien Bubeck
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: Neural Architecture Search

The fundamental problem in Neural Architecture Search (NAS) is to eﬃciently ﬁnd high-
performing ones from a search space of architectures. We propose a simple but powerful
method for ranking architectures FEAR in any search space. FEAR leverages the viewpoint
that neural networks are powerful non-linear feature extractors. By training diﬀerent
architectures in the search space to the same training or validation error and subsequently
comparing the usefulness of the features extracted on the task-dataset of interest by freezing
most of the architecture we obtain quick estimates of the relative performance. We validate
FEAR on Natsbench topology search space on three diﬀerent datasets against competing
baselines and show strong ranking correlation especially compared to recently proposed
zero-cost methods. FEAR especially excels at ranking high-performance architectures in the
search space. When used in the inner loop of discrete search algorithms like random search,
FEAR can cut down the search time by approximately 2.4x without losing accuracy. We additionally
empirically study very recently proposed zero-cost measures for ranking and ﬁnd that they
breakdown in ranking performance as training proceeds and also that data-agnostic ranking
scores which ignore the dataset do not generalize across dissimilar datasets.
Sequential Automated Machine Learning: Bandits-driven Exploration using a Collaborative Filtering Representation
Authors: Maxime Heuillet, Benoit Debaque, Audrey Durand
Date: 2021-05-20 00:00:00
Proceeding: ICML Workshop AutoML 2021 7
Tasks: AutoML, BIG-bench Machine Learning, Collaborative Filtering

The goal of Automated Machine Learning (AutoML) is to make Machine Learning (ML) tools more accessible. Collaborative Filtering (CF) methods have shown great success in automating the creation of machine learning pipelines. In this work, we frame the AutoML problem under a sequential setting where datasets arrive one at a time. On each dataset, an agent can try a small number of pipelines (exploration) before recommending a pipeline for this dataset (recommendation). The goal is to maximize the performance of the recommended pipelines over the sequence of datasets. More specifically, we focus on the exploration policy used for selecting the pipelines to explore before making the recommendation. We propose an approach based on the LinUCB bandit algorithm that leverages the latent representations extracted from matrix factorization (MF). We show that the exploration policy impacts the recommendation performance and that MF-based latent representations are more useful for exploration than for recommendation.