Intriguing properties of neural networks

2013/12/21 by Christian Szegedy, Wojciech Zaremba, Szegedy, Christian +11 · 3 voices · 5,744 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Artifact (error) #Artificial intelligence #Artificial neural network #Computer science #Deep neural networks #Machine learning #Neural Networks and Applications #Perturbation (astronomy) #cs.CV #cs.LG #cs.NE

paper · pdf · doi:10.48550/arxiv.1312.6199

published in arXiv (Cornell University) (Cornell University)

openalex publication_date 2013/12/21 · arxiv created 2014/02/19 · arxiv updated 2014/02/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

Deep neural networks are highly expressive models that have recently achieved state of the art performance on speech and visual recognition tasks. While their expressiveness is the reason they succeed, it also causes them to learn uninterpretable solutions that could have counter-intuitive properties. In this paper we report two such properties. First, we find that there is no distinction between individual high level units and random linear combinations of high level units, according to various methods of unit analysis. It suggests that it is the space, rather than the individual units, that contains of the semantic information in the high layers of neural networks. Second, we find that deep neural networks learn input-output mappings that are fairly discontinuous to a significant extend. We can cause the network to misclassify an image by applying a certain imperceptible perturbation, which is found by maximizing the network's prediction error. In addition, the specific nature of these perturbations is not a random artifact of learning: the same perturbation can cause a different network, that was trained on a different subset of the dataset, to misclassify the same input.

Citations

• Deep Neural Networks for Acoustic Modeling in Speech Recognition: The Shared Views of Four Research Groups
• Visualizing and Understanding Convolutional Networks

Cited by

• Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluation
• Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors
• Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attacks
• Certified Training for Convolutional Perturbations
• Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning
• A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic
• Cross-Branch Conflict as a Shield: Safeguarding Facial Identities in Unified Multimodal Image Editing
• ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors
• BadWAM: When World-Action Models Dream Right but Act Wrong
• GeoDetect: Geometric Adversarial Detection for VLPs
• Adversarial Concept Search: Predicting Compositional Errors From Feature Geometry
• Beyond the reducing valve: towards a computational neurophenomenology of altered states via deep neural networks
• LBA: Textual Hard-Label Adversarial Attack under Low Query Budgets
• A Survey on the Verification of Reinforcement Learning Policies
• Subliminal Effects in Your Data: A General Mechanism via Log-Linearity
• The Illusion of Readiness in Health AI
• Beyond Statistical Learning: Exact Learning Is Essential for General Intelligence
• Adopting a human developmental visual diet yields robust, shape-based AI vision
• Adversarial Surrogate Risk Bounds for Binary Classification
• The in-context inductive biases of vision-language models differ across modalities
• Towards end-to-end automation of AI research
• A Multi-stage Constrained Optimization Framework for Data-driven Problems
• Game of Coding under Computation-Dependent Adversarial Noise
• Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations
• A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection
• Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy
• Concept-based Visual Counterfactual Explanations with Diffusion Models
• Scaling Adversarial Training via Data Selection
• Exact and Asymptotically Complete Robust Verifications of Neural Networks via Ising Solvers
• High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models
• LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors
• Beyond Context: Large Language Models' Failure to Grasp Users' Intent
• Bridging Efficiency and Safety: Formal Verification of Neural Networks with Early Exits
• SCAR: Semantic Cardiac Adversarial Representation via Spatiotemporal Manifold Optimization in ECG
• Can We Test Consciousness Theories on AI? Ablations, Markers, and Robustness
• SafeMed-R1: Adversarial Reinforcement Learning for Generalizable and Robust Medical Reasoning in Vision-Language Models
• Learning-Based Automated Adversarial Red-Teaming for Robustness Evaluation of Large Language Models
• Generating Risky Samples with Conformity Constraints via Diffusion Models
• Adversarial Robustness in Zero-Shot Learning:An Empirical Study on Class and Concept-Level Vulnerabilities
• Adversarial Robustness of Vision in Open Foundation Models
• TTP: Test-Time Padding for Adversarial Detection and Robust Adaptation on Vision-Language Models
• Quantifying and Bridging the Fidelity Gap: A Decisive-Feature Approach to Comparing Synthetic and Real Imagery
• TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training
• Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrix
• On Improving Deep Active Learning with Formal Verification
• Behavior-Aware and Generalizable Defense Against Black-Box Adversarial Attacks for ML-Based IDS
• PHANTOM: PHysical ANamorphic Threats Obstructing Connected Vehicle Mobility
• GradID: Adversarial Detection via Intrinsic Dimensionality of Gradients
• Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks
• Learning to Split: A Reinforcement-Learning-Guided Splitting Heuristic for Neural Network Verification
• Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillation
• Closing the Train-Test Gap in World Models for Gradient-Based Planning
• ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
• The Domain Shift Problem of Medical Image Segmentation and Vendor-Adaptation by Unet-GAN
• Disrupting Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Models
• HOLE: Homological Observation of Latent Embeddings for Neural Network Interpretability
• Rethinking Robustness: A New Approach to Evaluating Feature Attribution Methods
• SPOOF: Simple Pixel Operations for Out-of-Distribution Fooling
• Adversarial Limits of Quantum Certification: When Eve Defeats Detection
• Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering
• RapidUn: Influence-Driven Parameter Reweighting for Efficient Large Language Model Unlearning
• Studying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
• Fast and Flexible Robustness Certificates for Semantic Segmentation
• Exploiting Domain Properties in Language-Driven Domain Generalization for Semantic Segmentation
• Instant Video Models: Universal Adapters for Stabilizing Image-Based Networks
• Physical ID-Transfer Attacks against Multi-Object Tracking via Adversarial Trajectory
• Systems Security Foundations for Agentic Computing
• Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas
• TIE: A Training-Inversion-Exclusion Framework for Visually Interpretable and Uncertainty-Guided Out-of-Distribution Detection
• ABLE: Using Adversarial Pairs to Construct Local Models for Explaining Model Predictions
• The Double-Edged Nature of the Rashomon Set for Trustworthy Machine Learning
• Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation
• FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization
• Semantic Prioritization in Visual Counterfactual Explanations with Weighted Segmentation and Auto-Adaptive Region Selection
• Learning the principles of T cell antigen discernment
• Robust Physical Adversarial Patches Using Dynamically Optimized Clusters
• Foundations of Artificial Intelligence Frameworks: Notion and Limits of AGI
• Enhancing Adversarial Transferability through Block Stretch and Shrink
• Layer-wise Noise Guided Selective Wavelet Reconstruction for Robust Medical Image Segmentation
• Lost in Vagueness: Towards Context-Sensitive Standards for Robustness Assessment under the EU AI Act
• Attacking Autonomous Driving Agents with Adversarial Machine Learning: A Holistic Evaluation with the CARLA Leaderboard
• Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks using Hyperparameter Tuning
• Stabilizing Multi-Attack Adversarial Training via Bandit Optimization
• Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attacks
• Tight Robustness Certification Through the Convex Hull of ℓ₀ Attacks
• MiniFool -- Physics-Constraint-Aware Minimizer-Based Adversarial Attacks in Deep Neural Networks
• A Generative Adversarial Approach to Adversarial Attacks Guided by Contrastive Language-Image Pre-trained Model
• Proof Minimization in Neural Network Verification
• Filtered-ViT: A Robust Defense Against Multiple Adversarial Patch Attacks
• On the Probabilistic Learnability of Compact Neural Network Preimage Bounds
• From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledge
• 3D-ANC: Adaptive Neural Collapse for Robust 3D Point Cloud Recognition
• Probably Approximately Global Robustness Certification
• Solving bilevel optimization via sequential minimax optimization
• Enhancing Adversarial Robustness of IoT Intrusion Detection via SHAP-Based Attribution Fingerprinting
• Runtime Safety Monitoring of Deep Neural Networks for Perception: A Survey
• Injecting Falsehoods: Adversarial Man-in-the-Middle Attacks Undermining Factual Recall in LLMs
• Quantifying the Risk of Transferred Black Box Attacks
• Deep learning models are vulnerable, but adversarial examples are even more vulnerable
• Learning Fourier shapes to probe the geometric world of deep neural networks
• Probing the Probes: Methods and Metrics for Concept Alignment
• Deep Roto-Translation Scattering for Object Classification
• SAAIPAA: Optimizing aspect-angles-invariant physical adversarial attacks on SAR target recognition models
• Adapt under Attack and Domain Shift: Unified Adversarial Meta-Learning and Domain Adaptation for Robust Automatic Modulation Classification
• Trustworthy Quantum Machine Learning: A Roadmap for Reliability, Robustness, and Security in the NISQ Era
• PRBench: A Standardized Probabilistic Robustness Benchmark
• T-MLA: A targeted multiscale log-exponential attack framework for neural image compression
• C-LEAD: Contrastive Learning for Enhanced Adversarial Defense
• Trans-defense: Transformer-based Denoiser for Adversarial Defense with Spatial-Frequency Domain Representation
• A Step Toward World Models: A Survey on Robotic Manipulation
• BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
• ANCHOR: Integrating Adversarial Training with Hard-mined Supervised Contrastive Learning for Robust Representation Learning
• Diffusion LLMs are Natural Adversaries for any LLM
• BI-DCGAN: A Theoretically Grounded Bayesian Framework for Efficient and Diverse GANs
• ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models
• What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation
• Adversarially Robust Quantum Transfer Learning
• Lipschitz-aware Linearity Grafting for Certified Robustness
• Learning Low Rank Neural Representations of Hyperbolic Wave Dynamics from Data
• Bilevel Models for Adversarial Learning and A Case Study
• SmoothGuard: Defending Multimodal Large Language Models with Noise Perturbation and Clustering Aggregation
• Aggregation Hides Out-of-Distribution Generalization Failures from Spurious Correlations
• Enhancing CLIP Robustness via Cross-Modality Alignment
• Dual-Domain Constraints: Designing Covert and Efficient Adversarial Examples for Secure Communication
• A Versatile Framework for Designing Group-Sparse Adversarial Attacks
• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• Floating-Point Neural Network Verification at the Software Level
• Stable neural networks and connections to continuous dynamical systems
• Toward Understanding the Transferability of Adversarial Suffixes in Large Language Models
• Attacking Optical Flow
• Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization
• An Empirical Study of Sample Selection Strategies for Large Language Model Repair
• Integrating Machine Learning into Belief-Desire-Intention Agents: Current Advances and Open Challenges
• Revisiting the Relation Between Robustness and Universality
• Collaborative penetration testing suite for emerging generative AI algorithms
• No Intelligence Without Statistics: The Invisible Backbone of Artificial Intelligence
• A New Type of Adversarial Examples
• The Black Tuesday Attack: how to crash the stock market with adversarial examples to financial forecasting models
• S2AP: Score-space Sharpness Minimization for Adversarial Pruning
• GPTFace: Generative Pre-training of Facial-Linguistic Transformer by Span Masking and Weakly Correlated Text-image Data
• Ensuring Robustness in ML-enabled Software Systems: A User Survey
• Investigating Adversarial Robustness against Preprocessing used in Blackbox Face Recognition
• Black-box Optimization of LLM Outputs by Asking for Directions
• Constrained Adversarial Perturbation
• Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness
• A Hard-Label Black-Box Evasion Attack against ML-based Malicious Traffic Detection Systems
• LeapFactual: Reliable Visual Counterfactual Explanation Using Conditional Flow Matching
• Structured Universal Adversarial Attacks on Object Detection for Video Sequences
• When Flatness Does (Not) Guarantee Adversarial Robustness
• NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations
• KoALA: KL-L0 Adversarial Detector via Label Agreement
• MS-GAGA: Metric-Selective Guided Adversarial Generation Attack
• Readout Representation: Redefining Neural Codes by Input Recovery
• Adversarial Attacks Leverage Interference Between Features in Superposition
• StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions
• Mirage Fools the Ear, Mute Hides the Truth: Precise Targeted Adversarial Attacks on Polyphonic Sound Event Detection Systems
• PENEX: AdaBoost-Inspired Neural Network Regularization
• Semantic Network Interpretation
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Minimal data poisoning attack in federated learning for medical image classification: An attacker perspective
• Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networks
• Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Trading
• Text Prompt Injection of Vision Language Models
• A deep architecture for unified aesthetic prediction
• SynthID-Image: Image watermarking at internet scale
• Improved Network Robustness with Adversary Critic
• MemLoss: Enhancing Adversarial Training with Recycling Adversarial Examples
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Uncolorable Examples: Preventing Unauthorized AI Colorization via Perception-Aware Chroma-Restrictive Perturbation
• Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks
• Self-Training With Noisy Student Improves ImageNet Classification
• PAC Learnability in the Presence of Performativity
• Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness
• Stable Robot Motions on Manifolds: Learning Lyapunov-Constrained Neural Manifold ODEs
• Attacking Graph-based Classification via Manipulating the Graph Structure
• ECLipsE-Gen-Local: Efficient Compositional Local Lipschitz Estimates for Deep Neural Networks
• Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks
• Transductive and Learning-Augmented Online Regression
• Understanding Neural Networks through Representation Erasure
• Density of States Estimation for Out-of-Distribution Detection
• Improving Adversarial Robustness of Zero-Shot CLIP with Confidence-Aware Weighting
• Revisiting Adversarial Training under Hyperspectral Image
• Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based properties
• ZQBA: Zero Query Black-box Adversarial Attack
• Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed
• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
• Optimization by Directional Attacks: Solving Problems with Neural Network Surrogates
• Stealing AI Model Weights Through Covert Communication Channels
• Indirect Attention: Turning Context Misalignment into a Feature
• The Impact of Scaling Training Data on Adversarial Robustness
• MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification
• SecInfer: Preventing Prompt Injection via Inference-time Scaling
• VAGUEGAN: Stealthy Poisoning and Backdoor Attacks on Image Generative Pipelines
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• Foveated Retinotopy Improves Classification and Localization in Convolutional Neural Networks
• AI Safety, Alignment, and Ethics (AI SAE)
• Influence-Guided Concolic Testing of Transformer Robustness
• Merge Now, Regret Later: The Hidden Cost of Model Merging is Adversarial Transferability
• Accuracy-Robustness Trade Off via Spiking Neural Network Gradient Sparsity Trail
• Overfitting or perfect fitting? Risk bounds for classification and regression rules that interpolate
• Real-World Transferable Adversarial Attack on Face-Recognition Systems
• Targeted perturbations reveal brain-like local coding axes in robustified, but not standard, ANN-based brain models
• Seeing Isn't Believing: Context-Aware Adversarial Patch Synthesis via Conditional GAN
• Troubles with mathematical contents
• Countering adversarial evasion in regression analysis
• Factor-Based Conditional Diffusion Model for Contextual Portfolio Optimization
• Latent Diffusion : Multi-Dimension Stable Diffusion Latent Space Explorer
• Adversarial training with restricted data manipulation
• Parameterized Hardness of Zonotope Containment and Neural Network Verification
• Classification Uncertainty of Deep Neural Networks Based on Gradient Information
• The Use of the Simplex Architecture to Enhance Safety in Deep-Learning-Powered Autonomous Systems
• Practical do-Shapley Explanations with Estimand-Agnostic Causal Inference
• Generative Model Inversion Through the Lens of the Manifold Hypothesis
• Adversarial Attacks on Deep Models for Financial Transaction Records
• Benchmarking Gaslighting Attacks Against Speech Large Language Models
• Localizing Adversarial Attacks To Produces More Imperceptible Noise
• Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation
• Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
• Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers
• VETO: Towards Protecting Images From Frontier AI Editing
• Does the brain's ventral visual pathway compute object shape?
• Enchanted Determinism: Power without Responsibility in Artificial Intelligence
• Adversarial machine learning :
• VisualBackProp: efficient visualization of CNNs
• Seeing eye-to-eye? A comparison of object recognition performance in humans and deep convolutional neural networks under image manipulation
• Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction
• Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models
• Lipschitz-Based Robustness Certification for Recurrent Neural Networks via Convex Relaxation
• BASFuzz: Towards Robustness Evaluation of LLM-based NLP Software via Automated Fuzz Testing
• Randomized Smoothing Meets Vision-Language Models
• An Adversarial Robust Behavior Sequence Anomaly Detection Approach Based on Critical Behavior Unit Learning
• Backdoor Mitigation via Invertible Pruning Masks
• Explainable Deep Learning Based Adversarial Defense for Automatic Modulation Classification
• Semantic Representation Attack against Aligned Large Language Models
• Adversarial Examples Are Not Bugs, They Are Superposition
• Discrete optimal transport is a strong audio adversarial attack
• CLMTracing: Black-box User-level Watermarking for Code Language Model Tracing
• A Deep Value-network Based Approach for Multi-Driver Order Dispatching
• DiffHash: Text-Guided Targeted Attack via Diffusion Models against Deep Hashing Image Retrieval
• AdaGAT: Adaptive Guidance Adversarial Training for the Robustness of Deep Neural Networks
• CIARD: Cyclic Iterative Adversarial Robustness Distillation
• Sy-FAR: Symmetry-based Fair Adversarial Robustness
• ReachNN: Reachability Analysis of Neural-Network Controlled Systems
• Advancing Weakly-Supervised Change Detection in Satellite Images via Adversarial Class Prompting
• Diffusion Models Beat GANs on Image Synthesis
• Deep Convolutional Networks as shallow Gaussian Processes
• Artificial neural networks for neuroscientists: A primer
• Hardware Trojan Attacks on Neural Networks
• A Practical Adversarial Attack against Sequence-based Deep Learning Malware Classifiers
• DARD: Dice Adversarial Robustness Distillation against Adversarial Attacks
• From Firewalls to Frontiers: AI Red-Teaming is a Domain-Specific Evolution of Cyber Red-Teaming
• On the Escaping Efficiency of Distributed Adversarial Training Algorithms
• RanAT4BIE: Random Adversarial Training for Biomedical Information Extraction
• Robustifying Diffusion-Denoised Smoothing Against Covariate Shift
• Adversarial robustness through Lipschitz-Guided Stochastic Depth in Neural Networks
• Shortcut learning in deep neural networks
• Deep Convolutional Neural Networks in the Face of Caricature: Identity and Image Revealed
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Natural Perturbed Training for General Robustness of Neural Network Classifiers
• Nearest Neighbor Projection Removal Adversarial Training
• Rethinking the Artificial Neural Networks: A Mesh of Subnets with a Central Mechanism for Storing and Predicting the Data
• Learning Automata Based Q-learning for Content Placement in Cooperative Caching
• Evaluating the visualization of what a Deep Neural Network has learned
• Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
• Are Targeted Data Poisoning Attacks as Effective as We Think?
• Evaluating the Impact of Adversarial Attacks on Traffic Sign Classification using the LISA Dataset
• A probabilistic approach to tomography and adjoint state methods, with an application to full waveform inversion in medical ultrasound
• IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks
• From Noise to Narrative: Tracing the Origins of Hallucinations in Transformers
• "Abuse Risks are Often Inherent to Product Features": Exploring AI Vendors' Bug Bounty and Responsible Disclosure Policies
• Dataset Ownership in the Era of Large Language Models
• On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning
• RobQFL: Robust Quantum Federated Learning in Adversarial Environment
• Robust Experts: the Effect of Adversarial Training on CNNs with Sparse Mixture-of-Experts Layers
• Sample Efficient Certification of Discrete-Time Control Barrier Functions
• Identifying Audio Adversarial Examples via Anomalous Pattern Detection
• Simpler Certified Radius Maximization by Propagating Covariances
• Minimizing Perceived Image Quality Loss Through Adversarial Attack Scoping
• FedAPT: Federated Adversarial Prompt Tuning for Vision-Language Models
• The gap between theory and practice in function approximation with deep neural networks
• An Investigation of Visual Foundation Models Robustness
• Learning to Compare Image Patches via Convolutional Neural Networks
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Partial success in closing the gap between human and machine vision
• Entropy-Based Non-Invasive Reliability Monitoring of Convolutional Neural Networks
• I Stolenly Swear That I Am Up to (No) Good: Design and Evaluation of Model Stealing Attacks
• Adversarial Patch Attack for Ship Detection via Localized Augmentation
• Theoretically Principled Trade-off between Robustness and Accuracy
• Generalizing Across Domains via Cross-Gradient Training
• Understanding and Mitigating Exploding Inverses in Invertible Neural Networks
• Surveying the Operational Cybersecurity and Supply Chain Threat Landscape when Developing and Deploying AI Systems
• Mini-Batch Robustness Verification of Deep Neural Networks
• The Ramon Llull's Thinking Machine for Automated Ideation
• MDD: a Mask Diffusion Detector to Protect Speaker Verification Systems from Adversarial Perturbations
• Novel Approaches to Artificial Intelligence Development Based on the Nearest Neighbor Method
• Exploring the Vulnerability of Single Shot Module in Object Detectors via Imperceptible Background Patches
• Does simple trump complex? Comparing strategies for adversarial robustness in DNNs
• Adversarial Agent Behavior Learning in Autonomous Driving Using Deep Reinforcement Learning
• On Evaluating the Adversarial Robustness of Foundation Models for Multimodal Entity Linking
• Explainable AI (XAI): A systematic meta-survey of current challenges and future opportunities
• Do Explanations Reflect Decisions? A Machine-centric Strategy to Quantify the Performance of Explainability Algorithms
• Universal and Transferable Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent
• Distributional Adversarial Attacks and Training in Deep Hedging
• Towards Unified Probabilistic Verification and Validation of Vision-Based Autonomy
• The AI-Fraud Diamond: A Novel Lens for Auditing Algorithmic Deception
• Timestep-Compressed Attack on Spiking Neural Networks through Timestep-Level Backpropagation
• Optimization Problems for Machine Learning: A Survey
• Delving into adversarial attacks on deep policies
• Adversarial Attack on Graph Structured Data
• How can we trust opaque systems? Criteria for robust explanations in XAI
• Adversarial Robustness in Distributed Quantum Machine Learning
• Rigorous Feature Importance Scores based on Shapley Value and Banzhaf Index
• Regularized Ensembles and Transferability in Adversarial Learning
• Robust Convolution Neural ODEs via Contractivity-promoting regularization
• Model Interpretability and Rationale Extraction by Input Mask Optimization
• Semantically Guided Adversarial Testing of Vision Models Using Language Models
• Using Mode Connectivity for Loss Landscape Analysis
• Using Videos to Evaluate Image Model Robustness
• Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving
• Contrastive ECOC: Learning Output Codes for Adversarial Defense
• Improving Robustness and Generality of NLP Models Using Disentangled Representations
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• CAAD 2018: Iterative Ensemble Adversarial Attack
• Constrained Black-Box Attacks Against Multi-Agent Reinforcement Learning
• Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples
• AI Security Map: Holistic Organization of AI Security Technologies and Impacts on Stakeholders
• A Guide to Robust Generalization: The Impact of Architecture, Pre-training, and Optimization Strategy
• Never compromise with vulnerabilities: a comprehensive survey on AI governance
• Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
• Certifiably robust malware detectors by design
• Representation Understanding via Activation Maximization
• Universal Stego Post-processing for Enhancing Image Steganography
• Deepfake Detection that Generalizes Across Benchmarks
• ETA: Energy-based Test-time Adaptation for Depth Completion
• Re-evaluating Evaluation
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Physical Adversarial Camouflage through Gradient Calibration and Regularization
• Contextual Explanation Networks
• DocVCE: Diffusion-based Visual Counterfactual Explanations for Document Image Classification
• Guided Perturbation Sensitivity (GPS): Detecting Adversarial Text via Embedding Stability and Word Importance
• Adversarially Robust and Explainable Model Compression with On-Device Personalization for Text Classification
• Model Compression vs. Adversarial Robustness: An Empirical Study on Language Models for Code
• The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for ℓ₂ Norm Estimation
• Are Inherently Interpretable Models More Robust? A Study In Music Emotion Recognition
• When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs
• Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation
• Multiplicative Normalizing Flows for Variational Bayesian Neural Networks
• Superior resilience to poisoning and amenability to unlearning in quantum machine learning
• Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training
• The Architecture of Trust: A Framework for AI-Augmented Real Estate Valuation in the Era of Structured Data
• MetAdv: A Unified and Interactive Adversarial Testing Platform for Autonomous Driving
• Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems
• Eigen Neural Network: Unlocking Generalizable Vision with Eigenbasis
• DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification
• Maximally Invariant Data Perturbation as Explanation
• Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictions
• Solution-aware vs global ReLU selection: partial MILP strikes back for DNN verification
• Wiggling Weights to Improve the Robustness of Classifiers
• Training Transformers with Enforced Lipschitz Constants
• Investigating the Invertibility of Multimodal Latent Spaces: Limitations of Optimization-Based Methods
• DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion
• RCR-AF: Enhancing Model Generalization via Rademacher Complexity Reduction Activation Function
• Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss
• On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbations
• Pulling Back the Curtain on Deep Networks
• Teach Me to Trick: Exploring Adversarial Transferability via Knowledge Distillation
• Bayesian Neural Network Surrogates for Bayesian Optimization of Carbon Capture and Storage Operations
• Deep Likelihood Network for Image Restoration with Multiple Degradation Levels
• Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removal
• NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples
• Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation
• Class Subset Selection for Transfer Learning using Submodularity
• Understanding Neural Networks Through Deep Visualization
• On Lipschitz Bounds of General Convolutional Neural Networks
• Handling Out-of-Distribution Data: A Survey
• Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
• Efficient Project Gradient Descent for Ensemble Adversarial Attack
• Live Trojan Attacks on Deep Neural Networks
• The Endless Tuning. An Artificial Intelligence Design To Avoid Human Replacement and Trace Back Responsibilities
• Adversarial Destabilization Attacks to Direct Data-Driven Control
• A note on hyperparameters in black-box adversarial examples
• Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree
• Boosting Black-Box Adversarial Attacks with Meta Learning
• A Comprehensive Survey on Source-Free Domain Adaptation
• A Reflection on Learning from Data: Epistemology Issues and Limitations
• To Drop or Not to Drop: Robustness, Consistency and Differential Privacy Properties of Dropout
• And/or trade-off in artificial neurons: impact on adversarial robustness
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• Manifold Regularization for Locally Stable Deep Neural Networks
• Limited-Memory Matrix Adaptation for Large Scale Black-box Optimization
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• Blind Adversarial Network Perturbations
• Volumetric emission tomography for combustion processes
• Measuring and Understanding Sensory Representations within Deep Networks Using a Numerical Optimization Framework
• Gray-box Adversarial Testing for Control Systems with Machine Learning Component
• On Inductive Biases for Machine Learning in Data Constrained Settings
• Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics
• On the Interaction of Compressibility and Adversarial Robustness
• Warp: a method for neural network interpretability applied to gene expression profiles
• Perception Matters: Exploring Imperceptible and Transferable Anti-forensics for GAN-generated Fake Face Imagery Detection
• Understanding Generalization, Robustness, and Interpretability in Low-Capacity Neural Networks
• AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant T2I Adversarial Patches
• Neural Architecture Search with Mixed Bio-inspired Learning Rules
• Emergence of Quantised Representations Isolated to Anisotropic Functions
• Advances and Open Problems in Federated Learning
• Assaying Out-Of-Distribution Generalization in Transfer Learning
• A Physics-Informed Data-Driven Discovery for Constitutive Modeling of Compressible, Nonlinear, History-Dependent Soft Materials under Multiaxial Cyclic Loading
• Non-Adaptive Adversarial Face Generation
• Are All Layers Created Equal?
• Adversarial Text Generation with Dynamic Contextual Perturbation
• On educating machines
• A Robust Classification-autoencoder to Defend Outliers and Adversaries
• GAP++: Learning to generate target-conditioned adversarial examples
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• What do CNN neurons learn: Visualization & Clustering
• Spectral Principal Paths: A Spectral Perspective on Linear Representation Formation in LLMs
• The interplay of robustness and generalization in quantum machine learning
• Offset-free setpoint tracking using neural network controllers
• Laplacian Networks: Bounding Indicator Function Smoothness for Neural Network Robustness
• RobustBench: a standardized adversarial robustness benchmark
• LyAm: Robust Non-Convex Optimization for Stable Learning in Noisy Environments
• Data-Dependent Randomized Smoothing
• Crafting Imperceptible On-Manifold Adversarial Attacks for Tabular Data
• Intriguing Properties of Input-dependent Randomized Smoothing
• Improved Detection of Adversarial Images Using Deep Neural Networks
• Kaleidoscopic Background Attack: Disrupting Pose Estimation with Multi-Fold Radial Symmetry Textures
• On the Importance of Consistency in Training Deep Neural Networks
• On the Efficiency of Training Robust Decision Trees
• Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation
• Towards Robust Deep Reinforcement Learning against Environmental State Perturbation
• Formal Verification of Variational Quantum Circuits
• AdvGrasp: Adversarial Attacks on Robotic Grasping from a Physical Perspective
• A Theoretical Explanation for Perplexing Behaviors of Backpropagation-based Visualizations
• Design Patterns for Securing LLM Agents against Prompt Injections
• PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies
• Admissibility of Stein Shrinkage for Batch Normalization in the Presence of Adversarial Attacks
• VIP: Visual Information Protection through Adversarial Attacks on Vision-Language Models
• Web-Scale Training for Face Identification
• SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples
• Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion
• TRIX- Trading Adversarial Fairness via Mixed Adversarial Training
• Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine Learning
• IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization
• AR2: Attention-Guided Repair for the Robustness of CNNs Against Common Corruptions
• Improved Algorithms for White-Box Adversarial Streams
• ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
• Examining the Impact of Blur on Recognition by Convolutional Networks
• VERITAS: Verification and Explanation of Realness in Images for Transparency in AI Systems
• Probabilistically Tightened Linear Relaxation-based Perturbation Analysis for Neural Network Verification
• Data Supplement to the paper "Intervening to Learn and Compose Causally Disentangled Representations"
• Applications of artificial intelligence in dentistry: A comprehensive review
• Robustifying 3D Perception via Least-Squares Graphs for Multi-Agent Object Tracking
• Thousand-Brains Systems: Sensorimotor Intelligence for Rapid, Robust Learning and Inference
• Evaluating the Evaluators: Trust in Adversarial Robustness Tests
• Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense
• Explainability-Aware One Point Attack for Point Cloud Neural Networks
• AEGIS: A Semantic GAN and Evidential Learning Framework for Robust Adversarial Detection in Vision Sensors
• Minimum sharpness: Scale-invariant parameter-robustness of neural networks
• Towards Crafting Text Adversarial Samples
• Can Artificial Intelligence solve the blockchain oracle problem? Unpacking the Challenges and Possibilities
• The Thin Line Between Comprehension and Persuasion in LLMs
• Are Vision Transformer Representations Semantically Meaningful? A Case Study in Medical Imaging
• Beyond Categorical Label Representations for Image Classification
• Bit Error Robustness for Energy-Efficient DNN Accelerators
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Evaluating Robustness of Monocular Depth Estimation with Procedural Scene Perturbations
• Visual Anagrams Reveal Hidden Differences in Holistic Shape Processing Across Vision Models
• Towards Safety Verification of Direct Perception Neural Networks
• Consensus-based optimization for closed-box adversarial attacks and a connection to evolution strategies
• SHIELD: Secure Hypernetworks for Incremental Expansion Learning Defense
• PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection
• Defending against Adversarial Images using Basis Functions Transformations
• Concept-based Adversarial Attack: a Probabilistic Perspective
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• A Scalable Approach for Safe and Robust Learning via Lipschitz-Constrained Networks
• Securing AI Systems: A Guide to Known Attacks and Impacts
• Detecting Adversarial Examples in Convolutional Neural Networks
• Single Image Inpainting and Super-Resolution with Simultaneous Uncertainty Guarantees by Universal Reproducing Kernels
• Robust Single-step Adversarial Training with Regularizer
• Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models
• Adversarial Attack Classification and Robustness Testing for Large Language Models for Code
• Intervening in Black Box: Concept Bottleneck Model for Enhancing Human Neural Network Mutual Understanding
• Assuring the Machine Learning Lifecycle: Desiderata, Methods, and Challenges
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Mitigating Semantic Collapse in Generative Personalization with Test-Time Embedding Adjustment
• Are Fast Methods Stable in Adversarially Robust Transfer Learning?
• ProARD: progressive adversarial robustness distillation: provide wide range of robust students
• FedServing: A Federated Prediction Serving Framework Based on Incentive Mechanism
• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• Efficient Certified Reasoning for Binarized Neural Networks
• Preventing Clean Label Poisoning using Gaussian Mixture Loss
• Toward the Explainability of Protein Language Models
• Amplifying Machine Learning Attacks Through Strategic Compositions
• Diffusion models under low-noise regime
• Optimization-Induced Dynamics of Lipschitz Continuity in Neural Networks
• NSFW-Classifier Guided Prompt Sanitization for Safe Text-to-Image Generation
• Improving Black-Box Generative Attacks via Generator Semantic Consistency
• Multimodal neural networks better explain multivoxel patterns in the\n hippocampus
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• Unifying Adversarial Training Algorithms with Flexible Deep Data Gradient Regularization
• DRO-Augment Framework: Robustness by Synergizing Wasserstein Distributionally Robust Optimization and Data Augmentation
• A Data Augmentation-based Defense Method Against Adversarial Attacks in Neural Networks
• Boosting Adversarial Attacks with Momentum
• Stretching Beyond the Obvious: A Gradient-Free Framework to Unveil the Hidden Landscape of Visual Invariance
• Off-Policy Actor-Critic for Adversarial Observation Robustness: Virtual Alternative Training via Symmetric Policy Evaluation
• Transition of AI Models in dependence of noise
• Adversarial Attacks and Detection in Visual Place Recognition for Safer Robot Navigation
• SyncMapV2: Robust and Adaptive Unsupervised Segmentation
• Clustered Federated Learning via Embedding Distributions
• Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review
• Towards Desiderata-Driven Design of Visual Counterfactual Explainers
• Towards Frequency-Based Explanation for Robust CNN
• Position: Certified Robustness Does Not (Yet) Imply Model Security
• D2R: dual regularization loss with collaborative adversarial generation for model robustness
• Towards Interpretable Adversarial Examples via Sparse Adversarial Attack
• Intriguing Frequency Interpretation of Adversarial Robustness for CNNs and ViTs
• Understanding Catastrophic Overfitting in Adversarial Training
• Benchmarking the Trustworthiness in Multimodal LLMs for Video Understanding
• Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on \mathbbso(d)
• On the existence of consistent adversarial attacks in high-dimensional linear classification
• Fast Approximate Spectral Normalization for Robust Deep Neural Networks
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• On the Natural Robustness of Vision-Language Models Against Visual Perception Attacks in Autonomous Driving
• Learning Based on CC1 and CC4 Neural Networks
• KCES: Training-Free Defense for Robust Graph Neural Networks via Kernel Complexity
• Robust In-Context Reinforcement Learning Under Reward Poisoning Attacks
• Assessing the Resilience of Automotive Intrusion Detection Systems to Adversarial Manipulation
• SAFE: Finding Sparse and Flat Minima to Improve Pruning
• Interior-Point Vanishing Problem in Semidefinite Relaxations for Neural Network Verification
• Boosting Adversarial Transferability for Hyperspectral Image Classification Using 3D Structure-invariant Transformation and Intermediate Feature Distance
• A look at adversarial attacks on radio waveforms from discrete latent space
• Bridging the Performance Gap between FGSM and PGD Adversarial Training
• Advancing Neural Network Verification through Hierarchical Safety Abstract Interpretation
• KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search
• SDP-CROWN: Efficient Bound Propagation for Neural Network Verification with Tightness of Semidefinite Programming
• DriveSuprim: Towards Precise Trajectory Selection for End-to-End Planning
• What Really is a Member? Discrediting Membership Inference via Poisoning
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• AdvSumm: Adversarial Training for Bias Mitigation in Text Summarization
• Rethinking Empirical Evaluation of Adversarial Robustness Using First-Order Attack Methods
• The best defense is a good offense: Countering black box attacks by predicting slightly wrong labels
• Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification
• Stable Vision Concept Transformers for Medical Diagnosis
• Normative Conflicts and Shallow AI Alignment
• X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP
• Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
• Coordinated Robustness Evaluation Framework for Vision-Language Models
• Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors
• Incorporating Unlabeled Data into Distributionally Robust Learning
• Neural Network Reprogrammability: A Unified Theme on Model Reprogramming, Prompt Tuning, and Prompt Instruction
• Mitigating Confounding in Speech-Based Dementia Detection through Weight Masking
• Practical Manipulation Model for Robust Deepfake Detection
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Real Time Image Saliency for Black Box Classifiers
• Appending Adversarial Frames for Universal Video Attack
• Maximal Jacobian-based Saliency Map Attack
• RAID: A Dataset for Testing the Adversarial Robustness of AI-Generated Image Detectors
• Adversarially Robust Neural Architectures
• On the Geometry of Adversarial Examples
• Boosting the Robustness Verification of DNN by Identifying the Achilles's Heel
• Lipschitz Properties for Deep Convolutional Networks
• Black-box Adversarial Attacks with Limited Queries and Information
• Can audio-visual integration strengthen robustness under multimodal attacks?
• Input-Specific and Universal Adversarial Attack Generation for Spiking Neural Networks in the Spiking Domain
• Security and Machine Learning in the Real World
• Efficient Proximal Mapping of the 1-path-norm of Shallow Networks
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Fooling a Real Car with Adversarial Traffic Signs
• The Convergence of Machine Learning and Communications
• The Tensor Track VII: From Quantum Gravity to Artificial Intelligence
• Interpretabilité des modèles : état des lieux des méthodes et application à l'assurance
• MUC-G4: Minimal Unsat Core-Guided Incremental Verification for Deep Neural Network Compression
• How stealthy is stealthy? Studying the Efficacy of Black-Box Adversarial Attacks in the Real World
• Robustness in Both Domains: CLIP Needs a Robust Text Encoder
• Adversarial Attacks on Robotic Vision Language Action Models
• Through a Steerable Lens: Magnifying Neural Network Interpretability via Phase-Based Extrapolation
• Quantifying task-relevant representational similarity using decision variable correlation
• Adversarial Attacks in Multimodal Systems: A Practitioner's Survey
• Robust Satisficing Gaussian Process Bandits Under Adversarial Attacks
• No Soundness in the Real World: On the Challenges of the Verification of Deployed Neural Networks
• LoRA as a Flexible Framework for Securing Large Vision Systems
• The Security Threat of Compressed Projectors in Large Vision-Language Models
• Revisiting Model Inversion Evaluation: From Misleading Standards to Reliable Privacy Assessment
• A Self-supervised Approach for Adversarial Robustness
• Data-Driven Falsification of Cyber-Physical Systems
• On the Lipschitz Continuity of Set Aggregation Functions and Neural Networks for Sets
• The Butterfly Effect in Pathology: Exploring Security in Pathology Foundation Models
• TRAPDOC: Deceiving LLM Users by Injecting Imperceptible Phantom Tokens into Documents
• Synthesizing Robust Adversarial Examples
• Inference-time Scaling of Diffusion Models through Classical Search
• Network Inversion for Uncertainty-Aware Out-of-Distribution Detection
• Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition
• Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates
• Understanding Adversarial Training with Energy-based Models
• Are classical deep neural networks weakly adversarially robust?
• Test-time augmentation improves efficiency in conformal prediction
• How Do Diffusion Models Improve Adversarial Robustness?
• A Survey of Behavior Learning Applications in Robotics -- State of the Art and Perspectives
• FGAS: Fixed Decoder Network-Based Audio Steganography with Adversarial Perturbation Generation
• A New Approach to Backtracking Counterfactual Explanations: A Unified Causal Framework for Efficient Model Interpretability
• Local Stability and Region of Attraction Analysis for Neural Network Feedback Systems under Positivity Constraints
• VideoMarkBench: Benchmarking Robustness of Video Watermarking
• Preventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study
• Is Your LLM Overcharging You? Tokenization, Transparency, and Incentives
• Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space
• Red-Teaming Text-to-Image Systems by Rule-based Preference Modeling
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• TabAttackBench: A Benchmark for Adversarial Attacks on Tabular Data
• Robust Neural Machine Translation with Joint Textual and Phonetic Embedding
• NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion
• Attention! Your Vision Language Model Could Be Maliciously Manipulated
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• Are Time-Series Foundation Models Deployment-Ready? A Systematic Study of Adversarial Robustness Across Domains
• Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless l^p Norm Solution for Fast Adversarial Training
• Impact Analysis of Inference Time Attack of Perception Sensors on Autonomous Vehicles
• Novel Loss-Enhanced Universal Adversarial Patches for Sustainable Speaker Privacy
• Adversarial Attack and Defense in Deep Ranking
• Adversarial Robustness Analysis of Vision-Language Models in Medical Image Segmentation
• Recursive Inference for Variational Autoencoders
• A Comprehensive Survey on the Risks and Limitations of Concept-based Models
• Robust Stability Analysis of Positive Lure System with Neural Network Feedback
• Engineering problems in machine learning systems
• Robustness in Large Language Models: A Survey of Mitigation Strategies and Evaluation Metrics
• LORE: Lagrangian-Optimized Robust Embeddings for Visual Encoders
• An Outlook on the Opportunities and Challenges of Multi-Agent AI Systems
• Towards more transferable adversarial attack in black-box manner
• FastCAV: Efficient Computation of Concept Activation Vectors for Explaining Deep Neural Networks
• Seeing in the dark with recurrent convolutional neural networks
• VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Models
• Adversarial Robustness of Nonparametric Regression
• Exactly Computing the Local Lipschitz Constant of ReLU Networks
• MoAPT: Mixture of Adversarial Prompt Tuning for Vision-Language Models
• Training individually fair ML models with Sensitive Subspace Robustness
• Training on Plausible Counterfactuals Removes Spurious Correlations
• SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models
• TRAIL: Transferable Robust Adversarial Images via Latent diffusion
• Accelerating Targeted Hard-Label Adversarial Attacks in Low-Query Black-Box Settings
• Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models
• Robust Vision-Based Runway Detection through Conformal Prediction and Conformal mAP
• Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses
• Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
• A Linear Approach to Data Poisoning
• Neuromorphic Mimicry Attacks Exploiting Brain-Inspired Computing for Covert Cyber Intrusions
• Enhancing Certified Robustness via Block Reflector Orthogonal Layers and Logit Annealing Loss
• Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval
• ReLUSyn: Synthesizing Stealthy Attacks for Deep Neural Network Based Cyber-Physical Systems
• Graph Neural Networks with Continual Learning for Fake News Detection from Social Media
• Few-Shot Adversarial Low-Rank Fine-Tuning of Vision-Language Models
• Fighting Fire with Fire: On the Feasibility of Protecting Exercises Against AI Cheating
• Adversarially Pretrained Transformers may be Universally Robust In-Context Learners
• Spatiotemporal Attacks for Embodied Agents
• Are L2 adversarial examples intrinsically different?
• Do ideas have shape? Idea registration as the continuous limit of artificial neural networks
• Sampling Prediction-Matching Examples in Neural Networks: A Probabilistic Programming Approach
• Adversarial Detection and Correction by Matching Prediction Distributions
• Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiency
• Two out of Three (ToT): using self-consistency to make robust predictions
• Language Models That Walk the Talk: A Framework for Formal Fairness Certificates
• A Note on the Inception Score
• FlowPure: Continuous Normalizing Flows for Adversarial Purification
• Robust learning of halfspaces under log-concave marginals
• BadNAVer: Exploring Jailbreak Attacks On Vision-and-Language Navigation
• Approximation theory for 1-Lipschitz ResNets
• Safe Delta: Consistently Preserving Safety when Fine-Tuning LLMs on Diverse Datasets
• How Can We Be So Dense? The Benefits of Using Highly Sparse Representations
• Adversarially Robust Spiking Neural Networks with Sparse Connectivity
• WebInject: Prompt Injection Attack to Web Agents
• A Unified and Scalable Membership Inference Method for Visual Self-supervised Encoder via Part-aware Capability
• Adversarial Attack on Large Language Models using Exponentiated Gradient Descent
• How many measurements are enough? Bayesian recovery in inverse problems with general distributions
• Towards a safe and efficient clinical implementation of machine learning in radiation oncology by exploring model interpretability, explainability and data-model dependency
• Progressive²: A Teacher-Student Progressive Co-Evolving Knowledge Distillation Method for Substantial Model Compression
• A Spectral View of Adversarially Robust Features
• MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakes
• Subset Scanning Over Neural Network Activations
• neuralGAM: An R Package for Fitting Generalized Additive Neural Networks
• Rearchitecting Classification Frameworks For Increased Robustness
• Adversarial Robustness May Be at Odds With Simplicity
• Where the Devil Hides: Deepfake Detectors Can No Longer Be Trusted
• AI and Generative AI Transforming Disaster Management: A Survey of Damage Assessment and Response Techniques
• Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples
• DArFace: Deformation Aware Robustness for Low Quality Face Recognition
• Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores
• Wasserstein Distributionally Robust Nonparametric Regression
• Large Margin Deep Networks for Classification
• Interpretable Convolutional Neural Networks
• Convergent Learning: Do different neural networks learn the same representations?
• Security through the Eyes of AI: How Visualization is Shaping Malware Detection
• A Formally Verified Robustness Certifier for Neural Networks (Extended Version)
• DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protection
• Stochastic Activation Pruning for Robust Adversarial Defense
• PRUNE: A Patching Based Repair Framework for Certifiable Unlearning of Neural Networks
• Learning from the Good Ones: Risk Profiling-Based Defenses Against Evasion Attacks on DNNs
• TAROT: Towards Essentially Domain-Invariant Robustness with Theoretical Justification
• The Spotlight Resonance Method: Resolving the Alignment of Embedded Activations
• Remote Rowhammer Attack using Adversarial Observations on Federated Learning Clients
• Engineering Risk-Aware, Security-by-Design Frameworks for Assurance of Large-Scale Autonomous AI Models
• Explaining and Harnessing Adversarial Examples
• Unpacking Robustness in Inflectional Languages: Adversarial Evaluation and Mechanistic Insights
• QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuits
• Quality Resilient Deep Neural Networks
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
• Distribution Density, Tails, and Outliers in Machine Learning: Metrics and Applications
• Quantum Support Vector Regression for Robust Anomaly Detection
• Constrained Network Adversarial Attacks: Validity, Robustness, and Transferability
• Transferable Adversarial Attacks on Black-Box Vision-Language Models
• Risk Analysis and Design Against Adversarial Actions
• LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasures
• On the Importance of Gaussianizing Representations
• The Future of Misinformation Detection: New Perspectives and Trends
• AdvSplat: Adversarial Attacks on Feed-Forward Gaussian Splatting Models
• The art of defense: letting networks fool the attacker
• πCreds: Privately Inferred Credentials
• An Enigma of Artificial Reason: Investigating the Production-Evaluation Gap in Large Reasoning Models
• Adversarial examples from computational constraints
• Exploring Adversarial Examples for Efficient Active Learning in Machine Learning Classifiers
• A Framework for Generating Semantically Ambiguous Images to Probe Human and Machine Perception
• Streaming Networks: Enable A Robust Classification of Noise-Corrupted Images
• Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamics
• Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs
• Robustness Guarantees for Deep Neural Networks on Videos
• ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
• Verification for Machine Learning, Autonomy, and Neural Networks Survey
• Low-Cost Transfer Learning of Face Tasks
• SOAR: Second-Order Adversarial Regularization
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• A bibliometric retrospective of Computers & Security
• Robustness Cannot be Reduced to Regularization: Studying Adversarial Training Beyond the Linear Case
• Intermediate Level Adversarial Attack for Enhanced Transferability
• Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study
• Deep Neural Networks for Choice Analysis: A Statistical Learning Theory Perspective
• TorchLean: Formalizing Neural Networks in Lean
• A General Framework for Property-Driven Machine Learning
• A4 : Evading Learning-based Adblockers
• TFL: Targeted Bit-Flip Attack on Large Language Model
• Intent Laundering: AI Safety Datasets Are Not What They Seem
• Trust The Typical
• XBreaking: Understanding how LLMs security alignment can be broken
• A Test Suite for Efficient Robustness Evaluation of Face Recognition Systems
• Designing Control Barrier Function via Probabilistic Enumeration for Safe Reinforcement Learning Navigation
• How to Backdoor the Knowledge Distillation
• Enabling Adversarial Robustness in AI Models through Kubeflow MLOps
• Erased but Not Forgotten: How Backdoors Compromise Concept Erasure
• Atmospheric Predictability Beyond 30 Days with Machine Learning
• Laplace-Bridged Randomized Smoothing for Fast Certified Robustness
• XFACTORS: Disentangled Information Bottleneck via Contrastive Supervision
• A Cryptographic Perspective on Mitigation vs. Detection in Machine Learning
• A Multi-Language Perspective on the Robustness of LLM Code Generation
• Unveiling and Mitigating Adversarial Vulnerabilities in Iterative Optimizers
• Augmenting Perceptual Super-Resolution via Image Quality Predictors
• Deep Reinforcement Learning Policies Learn Shared Adversarial Features across MDPs
• Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMs
• Robust Privacy: Inference-Stage Privacy through Certified Robustness
• Game Theoretical Adversarial Deep Learning With Variational Adversaries
• A Black-Box Attack Method against Machine-Learning-Based Anomaly Network Flow Detection Models
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• A multi-disciplinary perspective on emergent and future innovations in peer review
• Stability of Electrical Impedance Tomography with Anisotropies and its Application to the Deep Caldeón Method
• ConformalShift: Targeted Event Reordering Against Adaptive ECG Monitoring
• RaPA: Enhancing Transferable Targeted Attacks via Random Parameter Pruning
• Neural Belief Reasoner
• Evaluating the Vulnerability of ML-Based Ethereum Phishing Detectors to Single-Feature Adversarial Perturbations
• Enhancing Variational Autoencoders with Smooth Robust Latent Encoding
• Unsupervised Corpus Poisoning Attacks in Continuous Space for Dense Retrieval
• ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection
• Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle
• The Neural Echo: A Signal Processing Perspective for Understanding Neural Networks
• Perturbation analysis of gradient-based adversarial attacks
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines †
• Optimal Transport as a Defense Against Adversarial Attacks
• Rethinking Reflection in Pre-Training
• Adversarial Attacks for Optical Flow-Based Action Recognition Classifiers
• Architectural Resilience to Foreground-and-Background Adversarial Noise
• Eliciting Intrinsic Hallucinations in LLMs via Semantically Equivalent Adversarial Attacks
• Understanding Fault Tolerance of Adversarially Robust Pruned Models
• The SP Theory of Intelligence: Distinctive Features and Advantages
• On the Robustness of GUI Grounding Models Against Image Attacks
• It’s Morphin’ Time! Combating Linguistic Discrimination with Inflectional Perturbations
• FrogDogNet: Fourier frequency Retained visual prompt Output Guidance for Domain Generalization of CLIP in Remote Sensing
• Reducing the Amortization Gap in Variational Autoencoders: A Bayesian Random Function Approach
• Markov Chain Monte Carlo-Based Machine Unlearning: Unlearning What Needs to be Forgotten
• HDXplore: Automated Blackbox Testing of Brain-Inspired Hyperdimensional Computing
• Latent Cognizance: What Machine Really Learns
• Adversarial Attacks on Deep Neural Networks for Time Series Classification
• Reachable Set Computation and Safety Verification for Neural Networks with ReLU Activations
• Two Sides of the Same Coin
• Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models
• From Heatmaps to Structural Explanations of Image Classifiers
• Unifying Image Counterfactuals and Feature Attributions with Latent-Space Adversarial Attacks
• Ensemble Kalman inversion: a derivative-free technique for machine learning tasks
• Towards Model Resistant to Transferable Adversarial Examples via Trigger Activation
• Adversarial Attack for RGB-Event based Visual Object Tracking
• Scattering Networks for Hybrid Representation Learning
• AutoGAN: Robust Classifier Against Adversarial Attacks
• A Low-Cost Attack against the hCaptcha System
• The Emergence of Canalization and Evolvability in an Open-Ended, Interactive Evolutionary System
• Search Space of Adversarial Perturbations against Image Filters
• Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes
• Low-Interception Waveform: To Prevent the Recognition of Spectrum Waveform Modulation via Adversarial Examples
• Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors
• Quantum noise protects quantum classifiers against adversaries
• Deep Neural Networks and Tabular Data: A Survey
• Hadamard product in deep learning: Introduction, Advances and Challenges
• Learnable Bernoulli Dropout for Bayesian Deep Learning
• Quantum Computing Supported Adversarial Attack-Resilient Autonomous Vehicle Perception Module for Traffic Sign Classification
• Proof-Carrying Neuro-Symbolic Code
• RDI: An adversarial robustness evaluation metric for deep neural networks based on model statistical features
• The Optimal Condition Number for ReLU Function
• SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Models
• Universal Concept Disruption for SAM3 Image Segmentation
• CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal
• Facial attributes: Accuracy and adversarial robustness
• QAVA: Query-Agnostic Visual Attack to Large Vision-Language Models
• R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning
• Defending Against Frequency-Based Attacks with Diffusion Models
• Towards Interpretable Deep Generative Models via Causal Representation Learning
• ZipIR: Latent Pyramid Diffusion Transformer for High-Resolution Image Restoration
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• Trustworthy AI Must Account for Interactions
• Exploring Gradient-Guided Masked Language Model to Detect Textual Adversarial Attacks
• Two is Better than One: Efficient Ensemble Defense for Robust and Compact Models
• Don't Lag, RAG: Training-Free Adversarial Detection Using RAG
• Quantifying Robustness: A Benchmarking Framework for Deep Learning Forecasting in Cyber-Physical Systems
• Fast Facial Landmark Detection and Applications: A Survey
• SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers
• Gotta Catch'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Multifaceted Evaluation of Audio-Visual Capability for MLLMs: Effectiveness, Efficiency, Generalizability and Robustness
• LightDefense: A Lightweight Uncertainty-Driven Defense against Jailbreaks via Shifted Token Distribution

Discussions

• Intriguing Properties of Neural Networks [pdf] [hn, 19 points, 4 comments]
• Intriguing properties of neural networks (2014) [hn, 2 points, 0 comments]
• Intriguing properties of neural networks [hn, 1 points, 0 comments]

Related

• Deep Neural Networks
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• Leveraging Model Interpretability and Stability to increase Model Robustness
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• What do Deep Networks Like to See?