Multi-label Adversarial Perturbations

Song, Qingquan; Jiang, Haifeng; Huang, Xiao; Hu, Xia

doi:10.1109/icdm.2018.00166

Cited by 33 publications

(38 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since the number of variables will be usually larger than the number of equalities, the system will be underdetermined. We can then still solve this set of equalities using the pseudo-inverse technique as applied in [10].…”

Section: A Heuristics To Solve the Inner Qp Problemmentioning

confidence: 99%

“…In fact, there might not even be such an intersection. Still, we include this algorithm for comparison with [10]. Also this algorithm could potentially be fast (ignoring pathological corner cases), since in every iteration we try to solve every constraint.…”

Section: A Heuristics To Solve the Inner Qp Problemmentioning

confidence: 99%

“…Figure 1 shows such a perturbation, found by our algorithm. In a recent work, Song et al investigated random target labels [10] in a multi-label classification setting. However, our setting is more challenging because we have a set of models trained on the same multi-class classification task.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Adversarial Robustness of Model Sets

Megyeri

Hegedűs

Jelasity

2020

2020 International Joint Conference on Neural Networks (IJCNN)

View full text Add to dashboard Cite

Machine learning models are vulnerable to very small adversarial input perturbations. Here, we study the question of whether the list of predictions made by a list of models can also be changed arbitrarily by a single small perturbation. Clearly, this is a harder problem since one has to simultaneously mislead several models using the same perturbation, where the target classes assigned to the models might differ. This attack has several applications over models designed by different manufacturers for a similar purpose. One might want a single perturbation that acts differently on each model; like only misleading a subset, or making each model predict a different label. Also, one might want a perturbation that misleads each model the same way and thereby create a transferable perturbation. Current approaches are not applicable for this general problem directly. Here, we propose an algorithm that is able to find a perturbation that satisfies several kinds of attack patterns. For example, all the models could have the same target class, or different random target classes, or target classes designed to be maximally contradicting. We evaluated our algorithm using three model sets consisting of publicly available pre-trained ImageNet models of varying capacity and architecture. We demonstrate that, in all the scenarios, our method is able to find visually insignificant perturbations that achieve our target adversarial patterns. 1 Index Terms-adversarial examples, multi-model attack, model set attack, DeepFool, deep neural networks

show abstract

Section: A Heuristics To Solve the Inner Qp Problemmentioning

confidence: 99%

Section: A Heuristics To Solve the Inner Qp Problemmentioning

confidence: 99%

See 1 more Smart Citation

Adversarial Robustness of Model Sets

Megyeri

Hegedűs

Jelasity

2020

2020 International Joint Conference on Neural Networks (IJCNN)

View full text Add to dashboard Cite

show abstract

“…This section shows the calculation of the weights of input neurons x 1 to x 4 using Eqs. (23)- (36).…”

Section: B Backpropagation For Hidden and Input Layersmentioning

confidence: 99%

“…Jung and Tewari proposed an approach for label ranking based on voting of the best learners and scoring the labels for ranking [23]. Song and Huang proposed a framework to solve the vulnerability of multi-label deep learning models [36]. Yan and Wang proposed a long short term memory (LSTM) based multi-label ranking model for document classification to identify the relation between labels [37].…”

Section: Introductionmentioning

confidence: 99%

Preference Neural Network

Elgharabawy¹,

Parsad²,

Lin³

2019

Preprint

View full text Add to dashboard Cite

This paper proposes a preference neural network (PNN) to address the problem of indifference preferences orders with new activation function. PNN also solves the Multi-label ranking problem, where labels may have indifference preference orders or subgroups are equally ranked. PNN follows a multi-layer feedforward architecture with fully connected neurons. Each neuron contains a novel smooth stairstep activation function based on the number of preference orders. PNN inputs represent data features and output neurons represent label indexes. The proposed PNN is evaluated using new preference mining dataset that contains repeated label values which have not experimented before. PNN outperforms five previously proposed methods for strict label ranking in terms of accurate results with high computational efficiency.

show abstract

Attack Transferability Characterization for Adversarially Robust Multi-label Classification

Yang

Han

Zhang

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Despite of the pervasive existence of multi-label evasion attack, it is an open yet essential problem to characterize the origin of the adversarial vulnerability of a multi-label learning system and assess its attackability. In this study, we focus on non-targeted evasion attack against multi-label classifiers. The goal of the threat is to cause miss-classification with respect to as many labels as possible, with the same input perturbation. Our work gains in-depth understanding about the multi-label adversarial attack by first characterizing the transferability of the attack based on the functional properties of the multi-label classifier. We unveil how the transferability level of the attack determines the attackability of the classifier via establishing an informationtheoretic analysis of the adversarial risk. Furthermore, we propose a transferability-centered attackability assessment, named Soft Attackability Estimator (SAE), to evaluate the intrinsic vulnerability level of the targeted multi-label classifier. This estimator is then integrated as a transferability-tuning regularization term into the multi-label learning paradigm to achieve adversarially robust classification. The experimental study on real-world data echos the theoretical analysis and verify the validity of the transferability-regularized multi-label learning method.

show abstract

Multi-label Adversarial Perturbations

Cited by 33 publications

References 34 publications

Adversarial Robustness of Model Sets

Adversarial Robustness of Model Sets

Preference Neural Network

Attack Transferability Characterization for Adversarially Robust Multi-label Classification

Contact Info

Product

Resources

About