Certified Robustness to Adversarial Examples with Differential Privacy
Open accessAbstract
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set of certified defenses have been introduced, which provide guarantees of robustness to norm-bounded attacks. However these defenses either do not scale to large datasets or are limited in the types of models they can support. This paper presents the first certified defense that both scales to large networks and datasets (such as Google's Inception network for ImageNet) and applies broadly to arbitrary model types. Our defense, called PixelDP, is based on a novel connection between robustness against adversarial examples and differential privacy, a cryptographically-inspired privacy formalism, that provides a rigorous, generic, and flexible foundation for defense.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Fully decentralized variants of SGD and other optimization algorithms have recently been considered in machine learning both for improved scalability in datacenters and for decentralized networks of devices.
“fully decentralized variants of SGD and other optimization algorithms have recently been considered in machine learning both for improved scalability in datacenters [29] as well as for decentralized networks of devices [127, 459, 443, 59, 278, 291, 173].”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [459]
The Architecture section says PixelDP training can use an optimizer such as stochastic gradient descent, but does not discuss fully decentralized SGD. Searches for decentralized device networks, distributed optimization, and datacenter scalability found no passage addressing the attributed claim; page numbers were unavailable in our copy. (LLM, conf=0.76)
Experimental — accuracy not yet measuredA reliable and powerful central server may not always be available or desirable in more collaborative learning scenarios.
“While large companies or organizations can play this role in some application scenarios, a reliable and powerful central server may not always be available or desirable in more collaborative learning scenarios [459].”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [459]
The Introduction and Conclusion discuss certified defenses against adversarial examples, not the availability or desirability of a central server. Searches for the quoted claim and for central servers in collaborative or distributed learning found no passage addressing that point. (LLM, conf=0.75)
Experimental — accuracy not yet measuredFully decentralized algorithms have been introduced to collaboratively learn a personalized model for each client by smoothing model parameters across clients that have similar tasks.
“The work of [459, 59] introduces fully decentralized algorithms to collaboratively learn a personalized model for each client by smoothing model parameters across clients that have similar tasks (i.e., similar data distributions).”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [459]
The Introduction describes PixelDP as a certified defense against adversarial examples, and the Differentially Private ML section describes its goal as making predictions robust to changes in input features. Neither section addresses fully decentralized learning, client-specific models, or smoothing parameters across clients with similar tasks. Searches for those terms and their paraphrases found no supporting passage in our copy. (LLM, conf=0.77)
Experimental — accuracy not yet measuredRecent work demonstrates that DP can reduce susceptibility of models to back-door attacks, attributable to increased robustness from regularising properties of noise addition.
“recent work demonstrates that DP can reduce the susceptibility of models to other adversarial interference such as back-door attacks26, which can be attributed to the increased robustness of DP models imparted through the regularising properties of noise addition27.”
From Medical imaging deep learning with differential privacy (2021) · cites this paper as [26]
TEE is applicable in FL and multiparty machine learning in general to mainly defend against algorithmic attacks.
“TEE is applicable in FL [100], [101] and multiparty machine learning in general [102] to mainly defend against algorithmic attacks.”
From Vulnerabilities in federated learning (2021) · cites this paper as [100]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., & Fei-Fei, L. (2009) · 2009 IEEE Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2009.5206848 · Cited by 65,333 · see citing works
Rethinking the Inception Architecture for Computer Vision
Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., & Wojna, Z. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.308 · Cited by 32,138 · see citing works
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
Ioffe, S., & Szegedy, C. (2015) · arXiv · doi:10.48550/arxiv.1502.03167 · Cited by 27,818 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Zagoruyko, S., & Komodakis, N. (2016) · Procedings of the British Machine Vision Conference 2016 · doi:10.5244/c.30.87 · Cited by 7,244 · see citing works
Probability Inequalities for sums of Bounded Random Variables
Hoeffding, W. (1994) · Springer series in statistics · doi:10.1007/978-1-4612-0865-5_26 · Cited by 6,683 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · see citing works
Probability Inequalities for Sums of Bounded Random Variables
Hoeffding, W. (1963) · Journal of the American Statistical Association · doi:10.1080/01621459.1963.10500830 · Cited by 4,869 · see citing works
(2010) · Journal of Machine Learning Research · doi:10.5555/1756006.1953039 · Cited by 4,051 · see citing works
The Algorithmic Foundations of Differential Privacy
Dwork, C., & Roth, A. (2013) · doi:10.1561/9781601988195 · Cited by 3,856 · see citing works
End to End Learning for Self-Driving Cars
Bojarski, M., Del Testa, D., Dworakowski, D., Firner, B., Flepp, B., Goyal, P., Jackel, L. D., Monfort, M., Muller, U., Zhang, J., et al. (2016) · arXiv · doi:10.48550/arxiv.1604.07316 · Cited by 3,198 · see citing works
Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks
Papernot, N., McDaniel, P. D., Wu, X., Jha, S., & Swami, A. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.41 · Cited by 3,123 · see citing works
Ensemble Adversarial Training: Attacks and Defenses
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv · doi:10.48550/arxiv.1705.07204 · Cited by 2,176 · see citing works
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172 · see citing works
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
Carlini, N., & Wagner, D. (2017) · AISec@CCS · doi:10.1145/3128572.3140444 · Cited by 2,079 · see citing works
Wide Residual NetworksPreprint
Zagoruyko, S., & Komodakis, N. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1605.07146 · Cited by 1,850 · see citing works
Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks
Katz, G., Barrett, C., Dill, D. L., Julian, K., & Kochenderfer, M. J. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-63387-9_5 · Cited by 1,706 · see citing works
Provable defenses against adversarial examples via the convex outer adversarial polytopePreprint
Wong, E., & Kolter, J. (2017) · International Conference on Machine Learning · doi:10.48550/arxiv.1711.00851 · Cited by 1,658 · see citing works
Pei, K., Cao, Y., Yang, J., & Jana, S. (2017) · ACM SIGOPS Symposium on Operating Systems Principles (SOSP) · doi:10.1145/3132747.3132785 · Cited by 1,296 · see citing works
Self-citationAI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation
Gehr, T., Mirman, M., Drachsler-Cohen, D., Tsankov, P., Chaudhuri, S., & Vechev, M. T. (2018) · IEEE Symposium on Security and Privacy · doi:10.1109/sp.2018.00058 · Cited by 1,038 · see citing works
Meng, D., & Chen, H. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134057 · Cited by 1,013 · see citing works
(2011) · PubMed · Cited by 990 · see citing works
Generating Adversarial Examples with Adversarial Networks
Xiao, C., Li, B., Zhu, J.-Y., He, W., Liu, M., & Song, D. X. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/543 · Cited by 988 · see citing works
Synthesizing Robust Adversarial ExamplesPreprint
Athalye, A., Engstrom, L., Ilyas, A., & Kwok, K. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.07397 · Cited by 973 · see citing works
Safety Verification of Deep Neural Networks
Huang, X., Kwiatkowska, M., Wang, S., & Wu, M. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-63387-9_1 · Cited by 854 · see citing works
On Detecting Adversarial PerturbationsPreprint
Metzen, J. H., Genewein, T., Fischer, V., & Bischoff, B. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.04267 · Cited by 747 · see citing works
Empirical Bernstein Bounds and Sample-Variance PenalizationPreprint
Maurer, A., & Pontil, M. (2009) · Annual Conference Computational Learning Theory · doi:10.48550/arxiv.0907.3740 · Cited by 678 · see citing works
Differentially private recommender systems
McSherry, F., & Mironov, I. (2009) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1557019.1557090 · Cited by 676 · see citing works
Differential privacy and robust statistics
Dwork, C., & Lei, J. (2009) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1536414.1536466 · Cited by 629 · see citing works
Certified Defenses against Adversarial ExamplesPreprint
Raghunathan, A., Steinhardt, J., & Liang, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.09344 · Cited by 572 · see citing works
Formal Security Analysis of Neural Networks using Symbolic IntervalsPreprint
Wang, S., Pei, K.-X., Whitehouse, J., Yang, J., & Jana, S. (2018) · USENIX Security Symposium · doi:10.48550/arxiv.1804.10829 · Cited by 549 · see citing works
Self-citationCertifying Some Distributional Robustness with Principled Adversarial TrainingPreprint
Sinha, A., Namkoong, H., Volpi, R., & Duchi, J. C. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1710.10571 · Cited by 515 · see citing works
SoK: Security and Privacy in Machine Learning
Papernot, N., McDaniel, P., Sinha, A., & Wellman, M. P. (2018) · 2018 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2018.00035 · Cited by 502 · see citing works
Thermometer Encoding: One Hot Way To Resist Adversarial Examples
Buckman, J., Roy, A., Raffel, C., & Goodfellow, I. (2018) · International Conference on Learning Representations · Cited by 483 · see citing works
Malware classification with recurrent networks
Pascanu, R., Stokes, J. W., Sanossian, H. Y. Y., Marinescu, M., & Thomas, A. (2015) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2015.7178304 · Cited by 454 · see citing works
Robust Physical-World Attacks on Deep Learning ModelsPreprint
Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., & Song, D. X. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.08945 · Cited by 443 · see citing works
Synthesizing Robust Adversarial Examples
Athalye, A., Engstrom, L., Ilyas, A., & Kwok, K. (2018) · International Conference on Machine Learning · Cited by 432 · see citing works
SoK: Towards the Science of security and privacy in machine learning
Papernot, N., McDaniel, P. D., Sinha, A., & Wellman, M. P. (2018) · Singapore Management University Institutional Knowledge (InK) (Singapore Management University) · Cited by 427 · see citing works
Towards Robust Neural Networks via Random Self-ensemble
Liu, X., Cheng, M., Zhang, H., & Hsieh, C. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01234-2_23 · Cited by 408 · see citing works
Spatially Transformed Adversarial ExamplesPreprint
Xiao, C., Zhu, J.-Y., Li, B., He, W., Liu, M., & Song, D. X. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.02612 · Cited by 370 · see citing works
Broadening the Scope of Differential Privacy Using Metrics
Konstantinos Chatzikokolakis, A., Andrés, M. E., Bordenabe, N. E., & Catuscia Palamidessi, A. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-39077-7_5 · Cited by 348 · see citing works
Evaluating Robustness of Neural Networks with Mixed Integer ProgrammingPreprint
Tjeng, V., Xiao, K., & Tedrake, R. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.07356 · Cited by 327 · see citing works
Evaluating the Robustness of Neural Networks: An Extreme Value Theory ApproachPreprint
Weng, T.-W., Zhang, H., Chen, P., Yi, J., Su, D., Gao, Y., Hsieh, C., & Daniel, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.10578 · Cited by 307 · see citing works
Output Range Analysis for Deep Feedforward Neural Networks
Dutta, S., Jha, S., Sankaranarayanan, S., & Tiwari, A. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-77935-5_9 · Cited by 292 · see citing works
Differentiable Abstract Interpretation for Provably Robust Neural Networks
Mirman, M., Gehr, T., & Vechev, M. (2018) · International Conference on Machine Learning · Cited by 287 · see citing works
Efficient Formal Safety Analysis of Neural NetworksPreprint
Wang, S., Pei, K., Whitehouse, J., Yang, J., & Jana, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.08098 · Cited by 264 · see citing works
Self-citationAdversarial Examples for Generative Models
Kos, J., Fischer, I., & Song, D. X. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00014 · Cited by 249 · see citing works
Towards the Science of Security and Privacy in Machine LearningPreprint
Papernot, N., McDaniel, P. D., Sinha, A., & Wellman, M. P. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1611.03814 · Cited by 217 · see citing works
NO Need to Worry about Adversarial Examples in Object Detection in Autonomous VehiclesPreprint
Lu, J., Sibai, H., Fabry, E., & Forsyth, D. A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.03501 · Cited by 194 · see citing works
Early Methods for Detecting Adversarial ImagesPreprint
Hendrycks, D., & Gimpel, K. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1608.00530 · Cited by 191 · see citing works
Algorithmic stability for adaptive data analysis
Bassily, R., Kobbi Nissim, B., Smith, A., Steinke, T., Stemmer, U., & Ullman, J. (2016) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/2897518.2897566 · Cited by 154 · see citing works
Delving into adversarial attacks on deep policies
Kos, J., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1705.06452 · Cited by 135 · see citing works
The Robust Manifold Defense: Adversarial Training using Generative ModelsPreprint
Jalal, A., Ilyas, A., Daskalakis, C., & Dimakis, A. G. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.09196 · Cited by 111 · see citing works
Training verified learners with learned verifiersPreprint
Dvijotham, K., Gowal, S., Stanforth, R., Arandjelović, R., O’Donoghue, B., Uesato, J., & Kohli, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.10265 · Cited by 103 · see citing works
Lower bounds on the robustness to adversarial perturbations
Peck, J., Roels, J., Goossens, B., & Saeys, Y. (2017) · Ghent University Academic Bibliography (Ghent University) · Cited by 51 · see citing works
Adversarial examples for generative modelsPreprint
Kos, J., Fischer, I., & Song, D. X. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.06832 · Cited by 31 · see citing works
Li, L., & USDOE Office of Science (SC), B. E. S. (. (.-2. (2017) · doi:10.2172/1346183 · Cited by 21 · see citing works
Deep Learning Based Forecasting of Critical Infrastructure Data
Zohrevand, Z., Glässer, U., Tayebi, M. A., Shahir, H. Y., Shirmaleki, M., & Shahir, A. Y. (2017) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3132847.3133031 · Cited by 17 · see citing works
Generative Adversarial Examples.Preprint
Song, Y., Shu, R., Kushman, N., et al. (2018) · arXiv (Cornell University) · Cited by 12 · see citing works
Bayesian Differential Privacy through Posterior SamplingPreprint
Dimitrakakis, C., Nelson, B. A., Zhang, A. Z., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1306.1066 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 9
- [10]10. Chuan Guo, Mayank Rana, Moustapha Cisse, Laurens van der Maaten. Countering adversarial images using input transformations. International Conference on Learning Rep- resentations, 2018.
- [11]11. Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, Alan Yuille. Mitigating adversarial effects through randomization. International Conference on Learning Representations, 2018.
- [12]12. M. Cisse, P. Bojanowski, E. Grave, Y. Dauphin, and N. Usunier. Parseval networks: Improving robustness to adversarial examples. In Proceedings of the 34th International Conference on Machine Learning, 2017.
- [21]21. I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In Proceedings of the 3rd ICLR, 2015.
- [23]23. Guneet S. Dhillon, Kamyar Azizzadenesheli, Jeremy D. Bernstein, Jean Kossaifi, Aran Khanna, Zachary C. Lipton, Animashree Anandkumar. Stochastic activation pruning for robust adversarial defense. International Conference on Learning Representations, 2018.
- [40]40. F. McSherry and I. Mironov. Differentially private rec- ommender systems: Building privacy into the netflix prize contenders. In Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2009.
- [50]50. K. Pei, Y. Cao, J. Yang, and S. Jana. Deepxplore: Automated whitebox testing of deep learning systems. In Proceedings of the 26th Symposium on Operating Systems Principles (SOSP), 2017.
- [51]51. Pouya Samangouei, Maya Kabkab, Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial at- tacks using generative models. International Conference on Learning Representations, 2018.
- [56]56. C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations, 2014.
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Trustworthy AI: From Principles to Practices
Li, B., Qi, P., Liu, B., Di, S., Liu, J., Pei, J., Yi, J., & Zhou, B. (2023) · ACM Computing Surveys · doi:10.1145/3555803 · Cited by 612 · see citing works
“DP is also used to improve the robustness of AI models against adversarial samples [204].”
MethodDataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims
Brundage, M., Avin, S., Wang, J., Belfield, H., Krueger, G., Hadfield, G., Khlaaf, H., Yang, J., Toner, H., Fong, R., et al. (2020) · arXiv · doi:10.48550/arxiv.2004.07213 · Cited by 306 · see citing works
“not generalizing well to unseen data [66] [67] [68]).”
BackgroundVulnerabilities in federated learning
Bouacida, N., & Mohapatra, P. (2021) · IEEE Access · doi:10.1109/access.2021.3075203 · Cited by 248 · see citing works
Backdoor Attacks to Graph Neural Networks
Zhang, Z., Jia, J., Wang, B., & Gong, N. Z. (2021) · Proceedings of the 26th ACM Symposium on Access Control Models and Technologies · doi:10.1145/3450569.3463560 · Cited by 220 · see citing works
Medical imaging deep learning with differential privacy
Ziller, A., Usynin, D., Braren, R., Makowski, M., Rueckert, D., & Kaissis, G. (2021) · Scientific Reports · doi:10.1038/s41598-021-93030-0 · Cited by 172 · see citing works
Stabilizing Differentiable Architecture Search via Perturbation-based Regularization
Chen, X., & Hsieh, C.-J. (2020) · arXiv · doi:10.48550/arxiv.2002.05283 · Cited by 126 · see citing works
Privacy in Deep Learning: A Survey
Mireshghallah, F., Taram, M., Vepakomma, P., Singh, A., Raskar, R., & Esmaeilzadeh, H. (2020) · arXiv · doi:10.48550/arxiv.2004.12254 · Cited by 106 · see citing works
Interpretable and Trustworthy Deepfake Detection via Dynamic Prototypes
Trinh, L., Tsang, M., Rambhatla, S., & Liu, Y. (2021) · 2021 IEEE Winter Conference on Applications of Computer Vision (WACV) · doi:10.1109/wacv48630.2021.00202 · Cited by 115 · see citing works
Introduction to Neural Network Verification
Albarghouthi, A. (2021) · Foundations and Trends® in Programming Languages · doi:10.1561/2500000051 · Cited by 78 · see citing works
A Systematic Review of Adversarial Machine Learning Attacks, Defensive Controls and Technologies
Malik, J., Muthalagu, R., & Pawar, P. M. (2024) · IEEE Access · doi:10.1109/access.2024.3423323 · Cited by 76 · see citing works
Property Inference from Poisoning
Mahloujifar, S., Ghosh, E., & Chase, M. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833623 · Cited by 67 · see citing works
A Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy
Manzoor, H. U., Shabbir, A., Chen, A., Flynn, D., & Zoha, A. (2024) · Future Internet · doi:10.3390/fi16100374 · Cited by 58 · see citing works
A Synergetic Attack against Neural Network Classifiers combining Backdoor and Adversarial Examples
Liu, G., Khalil, I., Khreishah, A., & Phan, N. (2021) · 2021 IEEE International Conference on Big Data (Big Data) · doi:10.1109/bigdata52589.2021.9671964 · Cited by 11 · see citing works
Quantifying and Localizing Usable Information Leakage from Neural Network Gradients
Mo, F., Borovykh, A., Malekzadeh, M., Demetriou, S., Gündüz, D., & Haddadi, H. (2021) · arXiv · doi:10.48550/arxiv.2105.13929 · Cited by 1 · see citing works
“Using different norms will help in capturing attackers with different capabilities, similarly to [55], [53], where p-norm reflects how the attacker measures distance between two data samples (e.”
Background
- Authors
- Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., & Jana, S.
- Affiliations
- Columbia University (US)
- Venue
- 2019 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2019-05
- Pages
- 656-672
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2883108656
- Cited by
- 750
- References
- 63
- Citations by year
- 2026: 45 · 2025: 58 · 2024: 92 · 2023: 117 · 2022: 91 · 2021: 169 · 2020: 125 · 2019: 47 · 2018: 6
- FWCI
- 40.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Licence
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Scientific Programming
- Funders
- National Science Foundation (1740833, 1514437, 1351089)
- Office of Naval Research (ONR-N00014, N00014-17-1, N00014, N00014-17)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- adversarial examples, certified robustness, differential privacy, adversarial defense, deep neural network, Inception network, ImageNet, robustness guarantees
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
