Intriguing properties of neural networks

2013/12/21 by Christian Szegedy, Wojciech Zaremba, Szegedy, Christian +11 · 3 voices · 360 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Neural Networks and Applications #cs.CV #cs.LG #cs.NE

paper · pdf · doi:10.48550/arxiv.1312.6199

openalex publication_date 2013/12/21 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/29

Abstract

Deep neural networks are highly expressive models that have recently achieved state of the art performance on speech and visual recognition tasks. While their expressiveness is the reason they succeed, it also causes them to learn uninterpretable solutions that could have counter-intuitive properties. In this paper we report two such properties. First, we find that there is no distinction between individual high level units and random linear combinations of high level units, according to various methods of unit analysis. It suggests that it is the space, rather than the individual units, that contains of the semantic information in the high layers of neural networks. Second, we find that deep neural networks learn input-output mappings that are fairly discontinuous to a significant extend. We can cause the network to misclassify an image by applying a certain imperceptible perturbation, which is found by maximizing the network's prediction error. In addition, the specific nature of these perturbations is not a random artifact of learning: the same perturbation can cause a different network, that was trained on a different subset of the dataset, to misclassify the same input.

Citations

• Deep Neural Networks for Acoustic Modeling in Speech Recognition: The Shared Views of Four Research Groups
• Visualizing and Understanding Convolutional Networks

Cited by

• Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluation
• Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors
• Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attacks
• Certified Training for Convolutional Perturbations
• Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning
• A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic
• Cross-Branch Conflict as a Shield: Safeguarding Facial Identities in Unified Multimodal Image Editing
• ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectors
• BadWAM: When World-Action Models Dream Right but Act Wrong
• GeoDetect: Geometric Adversarial Detection for VLPs
• Adversarial Concept Search: Predicting Compositional Errors From Feature Geometry
• Beyond the reducing valve: towards a computational neurophenomenology of altered states via deep neural networks
• LBA: Textual Hard-Label Adversarial Attack under Low Query Budgets
• A Survey on the Verification of Reinforcement Learning Policies
• Subliminal Effects in Your Data: A General Mechanism via Log-Linearity
• The Illusion of Readiness in Health AI
• Beyond Statistical Learning: Exact Learning Is Essential for General Intelligence
• Adopting a human developmental visual diet yields robust, shape-based AI vision
• The in-context inductive biases of vision-language models differ across modalities
• Towards end-to-end automation of AI research
• A Multi-stage Constrained Optimization Framework for Data-driven Problems
• Game of Coding under Computation-Dependent Adversarial Noise
• Latent Stability Analysis of Malware Representations Under Feature-Space Perturbations
• A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection
• Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy
• Concept-based Visual Counterfactual Explanations with Diffusion Models
• Scaling Adversarial Training via Data Selection
• Exact and Asymptotically Complete Robust Verifications of Neural Networks via Ising Solvers
• Few Tokens Matter: Entropy Guided Attacks on Vision-Language Models
• LLM-Driven Feature-Level Adversarial Attacks on Android Malware Detectors
• Beyond Context: Large Language Models Failure to Grasp Users Intent
• Bridging Efficiency and Safety: Formal Verification of Neural Networks with Early Exits
• SCAR: Semantic Cardiac Adversarial Representation via Spatiotemporal Manifold Optimization in ECG
• Can We Test Consciousness Theories on AI? Ablations, Markers, and Robustness
• SafeMed-R1: Adversarial Reinforcement Learning for Generalizable and Robust Medical Reasoning in Vision-Language Models
• Learning-Based Automated Adversarial Red-Teaming for Robustness Evaluation of Large Language Models
• Generating Risky Samples with Conformity Constraints via Diffusion Models
• Adversarial Robustness in Zero-Shot Learning:An Empirical Study on Class and Concept-Level Vulnerabilities
• Adversarial Robustness of Vision in Open Foundation Models
• TTP: Test-Time Padding for Adversarial Detection and Robust Adaptation on Vision-Language Models
• Quantifying and Bridging the Fidelity Gap: A Decisive-Feature Approach to Comparing Synthetic and Real Imagery
• TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training
• Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrix
• On Improving Deep Active Learning with Formal Verification
• Behavior-Aware and Generalizable Defense Against Black-Box Adversarial Attacks for ML-Based IDS
• PHANTOM: PHysical ANamorphic Threats Obstructing Connected Vehicle Mobility
• GradID: Adversarial Detection via Intrinsic Dimensionality of Gradients
• Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks
• Learning to Split: A Reinforcement-Learning-Guided Splitting Heuristic for Neural Network Verification
• Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillation
• Closing the Train-Test Gap in World Models for Gradient-Based Planning
• ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
• Disrupting Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Models
• HOLE: Homological Observation of Latent Embeddings for Neural Network Interpretability
• Rethinking Robustness: A New Approach to Evaluating Feature Attribution Methods
• SPOOF: Simple Pixel Operations for Out-of-Distribution Fooling
• Adversarial Limits of Quantum Certification: When Eve Defeats Detection
• Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering
• RapidUn: Influence-Driven Parameter Reweighting for Efficient Large Language Model Unlearning
• Studying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
• Fast and Flexible Robustness Certificates for Semantic Segmentation
• Exploiting Domain Properties in Language-Driven Domain Generalization for Semantic Segmentation
• Instant Video Models: Universal Adapters for Stabilizing Image-Based Networks
• Physical ID-Transfer Attacks against Multi-Object Tracking via Adversarial Trajectory
• Systems Security Foundations for Agentic Computing
• Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas
• TIE: A Training-Inversion-Exclusion Framework for Visually Interpretable and Uncertainty-Guided Out-of-Distribution Detection
• ABLE: Using Adversarial Pairs to Construct Local Models for Explaining Model Predictions
• The Double-Edged Nature of the Rashomon Set for Trustworthy Machine Learning
• Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation
• FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization
• Semantic Prioritization in Visual Counterfactual Explanations with Weighted Segmentation and Auto-Adaptive Region Selection
• Learning the principles of T cell antigen discernment
• Robust Physical Adversarial Patches Using Dynamically Optimized Clusters
• Foundations of Artificial Intelligence Frameworks: Notion and Limits of AGI
• Enhancing Adversarial Transferability through Block Stretch and Shrink
• Layer-wise Noise Guided Selective Wavelet Reconstruction for Robust Medical Image Segmentation
• Lost in Vagueness: Towards Context-Sensitive Standards for Robustness Assessment under the EU AI Act
• Attacking Autonomous Driving Agents with Adversarial Machine Learning: A Holistic Evaluation with the CARLA Leaderboard
• Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks using Hyperparameter Tuning
• Calibrated Adversarial Sampling: Multi-Armed Bandit-Guided Generalization Against Unforeseen Attacks
• Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attacks
• Tight Robustness Certification through the Convex Hull of ℓ₀ Attacks
• MiniFool -- Physics-Constraint-Aware Minimizer-Based Adversarial Attacks in Deep Neural Networks
• A Generative Adversarial Approach to Adversarial Attacks Guided by Contrastive Language-Image Pre-trained Model
• Proof Minimization in Neural Network Verification
• Filtered-ViT: A Robust Defense Against Multiple Adversarial Patch Attacks
• On the Probabilistic Learnability of Compact Neural Network Preimage Bounds
• From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledge
• 3D-ANC: Adaptive Neural Collapse for Robust 3D Point Cloud Recognition
• Probably Approximately Global Robustness Certification
• Solving bilevel optimization via sequential minimax optimization
• Enhancing Adversarial Robustness of IoT Intrusion Detection via SHAP-Based Attribution Fingerprinting
• Runtime Safety Monitoring of Deep Neural Networks for Perception: A Survey
• Injecting Falsehoods: Adversarial Man-in-the-Middle Attacks Undermining Factual Recall in LLMs
• Quantifying the Risk of Transferred Black Box Attacks
• Deep learning models are vulnerable, but adversarial examples are even more vulnerable
• Learning Fourier shapes to probe the geometric world of deep neural networks
• Probing the Probes: Methods and Metrics for Concept Alignment
• Deep Roto-Translation Scattering for Object Classification
• SAAIPAA: Optimizing aspect-angles-invariant physical adversarial attacks on SAR target recognition models
• Adapt under Attack and Domain Shift: Unified Adversarial Meta-Learning and Domain Adaptation for Robust Automatic Modulation Classification
• Trustworthy Quantum Machine Learning: A Roadmap for Reliability, Robustness, and Security in the NISQ Era
• Probabilistic Robustness for Free? Revisiting Training via a Benchmark
• T-MLA: A targeted multiscale log-exponential attack framework for neural image compression
• C-LEAD: Contrastive Learning for Enhanced Adversarial Defense
• Trans-defense: Transformer-based Denoiser for Adversarial Defense with Spatial-Frequency Domain Representation
• A Step Toward World Models: A Survey on Robotic Manipulation
• BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
• ANCHOR: Integrating Adversarial Training with Hard-mined Supervised Contrastive Learning for Robust Representation Learning
• Diffusion LLMs are Natural Adversaries for any LLM
• BI-DCGAN: A Theoretically Grounded Bayesian Framework for Efficient and Diverse GANs
• ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models
• What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation
• Adversarially Robust Quantum Transfer Learning
• Lipschitz-aware Linearity Grafting for Certified Robustness
• Learning Low Rank Neural Representations of Hyperbolic Wave Dynamics from Data
• Bilevel Models for Adversarial Learning and A Case Study
• SmoothGuard: Defending Multimodal Large Language Models with Noise Perturbation and Clustering Aggregation
• Aggregation Hides Out-of-Distribution Generalization Failures from Spurious Correlations
• Enhancing CLIP Robustness via Cross-Modality Alignment
• Dual-Domain Constraints: Designing Covert and Efficient Adversarial Examples for Secure Communication
• A Versatile Framework for Designing Group-Sparse Adversarial Attacks
• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• Floating-Point Neural Network Verification at the Software Level
• Stable neural networks and connections to continuous dynamical systems
• Toward Understanding the Transferability of Adversarial Suffixes in Large Language Models
• Attacking Optical Flow
• Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization
• An Empirical Study of Sample Selection Strategies for Large Language Model Repair
• Integrating Machine Learning into Belief-Desire-Intention Agents: Current Advances and Open Challenges
• Revisiting the Relation Between Robustness and Universality
• Collaborative penetration testing suite for emerging generative AI algorithms
• No Intelligence Without Statistics: The Invisible Backbone of Artificial Intelligence
• A New Type of Adversarial Examples
• The Black Tuesday Attack: how to crash the stock market with adversarial examples to financial forecasting models
• S2AP: Score-space Sharpness Minimization for Adversarial Pruning
• GPTFace: Generative Pre-training of Facial-Linguistic Transformer by Span Masking and Weakly Correlated Text-image Data
• Ensuring Robustness in ML-enabled Software Systems: A User Survey
• Investigating Adversarial Robustness against Preprocessing used in Blackbox Face Recognition
• Black-box Optimization of LLM Outputs by Asking for Directions
• Constrained Adversarial Perturbation
• Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness
• A Hard-Label Black-Box Evasion Attack against ML-based Malicious Traffic Detection Systems
• LeapFactual: Reliable Visual Counterfactual Explanation Using Conditional Flow Matching
• Structured Universal Adversarial Attacks on Object Detection for Video Sequences
• When Flatness Does (Not) Guarantee Adversarial Robustness
• NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations
• KoALA: KL-L0 Adversarial Detector via Label Agreement
• MS-GAGA: Metric-Selective Guided Adversarial Generation Attack
• Readout Representation: Redefining Neural Codes by Input Recovery
• Adversarial Attacks Leverage Interference Between Features in Superposition
• StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions
• Mirage Fools the Ear, Mute Hides the Truth: Precise Targeted Adversarial Attacks on Polyphonic Sound Event Detection Systems
• PENEX: AdaBoost-Inspired Neural Network Regularization
• Semantic Network Interpretation
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Minimal data poisoning attack in federated learning for medical image classification: An attacker perspective
• Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networks
• Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Trading
• Text Prompt Injection of Vision Language Models
• A deep architecture for unified aesthetic prediction
• SynthID-Image: Image watermarking at internet scale
• Improved Network Robustness with Adversary Critic
• MemLoss: Enhancing Adversarial Training with Recycling Adversarial Examples
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Uncolorable Examples: Preventing Unauthorized AI Colorization via Perception-Aware Chroma-Restrictive Perturbation
• Evaluating the Robustness of a Production Malware Detection System to Transferable Adversarial Attacks
• Self-Training With Noisy Student Improves ImageNet Classification
• PAC Learnability in the Presence of Performativity
• Get RICH or Die Scaling: Profitably Trading Inference Compute for Robustness
• Stable Robot Motions on Manifolds: Learning Lyapunov-Constrained Neural Manifold ODEs
• Attacking Graph-based Classification via Manipulating the Graph Structure
• ECLipsE-Gen-Local: Efficient Compositional Local Lipschitz Estimates for Deep Neural Networks
• Technical Report: When Does Machine Learning FAIL? Generalized\n Transferability for Evasion and Poisoning Attacks
• Transductive and Learning-Augmented Online Regression
• Understanding Neural Networks through Representation Erasure
• Density of States Estimation for Out-of-Distribution Detection
• Improving Adversarial Robustness of Zero-Shot CLIP with Confidence-Aware Weighting
• Towards Adversarial Training under Hyperspectral Images
• Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based properties
• ZQBA: Zero Query Black-box Adversarial Attack
• Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed
• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
• Optimization by Directional Attacks: Solving Problems with Neural Network Surrogates
• Stealing AI Model Weights Through Covert Communication Channels
• Indirect Attention: Turning Context Misalignment into a Feature
• The Impact of Scaling Training Data on Adversarial Robustness
• MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification
• SecInfer: Preventing Prompt Injection via Inference-time Scaling
• VAGUEGAN: Stealthy Poisoning and Backdoor Attacks on Image Generative Pipelines
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• Foveated Retinotopy Improves Classification and Localization in Convolutional Neural Networks
• AI Safety, Alignment, and Ethics (AI SAE)
• Influence-Guided Concolic Testing of Transformer Robustness
• Merge Now, Regret Later: The Hidden Cost of Model Merging is Adversarial Transferability
• Accuracy-Robustness Trade Off via Spiking Neural Network Gradient Sparsity Trail
• Overfitting or perfect fitting? Risk bounds for classification and regression rules that interpolate
• Real-World Transferable Adversarial Attack on Face-Recognition Systems
• Targeted perturbations reveal brain-like local coding axes in robustified, but not standard, ANN-based brain models
• Seeing Isn't Believing: Context-Aware Adversarial Patch Synthesis via Conditional GAN
• Troubles with mathematical contents
• Countering adversarial evasion in regression analysis
• Factor-Based Conditional Diffusion Model for Portfolio Optimization
• Latent Diffusion : Multi-Dimension Stable Diffusion Latent Space Explorer
• Adversarial training with restricted data manipulation
• Parameterized Hardness of Zonotope Containment and Neural Network Verification
• Classification Uncertainty of Deep Neural Networks Based on Gradient\n Information
• The Use of the Simplex Architecture to Enhance Safety in Deep-Learning-Powered Autonomous Systems
• Practical do-Shapley Explanations with Estimand-Agnostic Causal Inference
• Generative Model Inversion Through the Lens of the Manifold Hypothesis
• Adversarial Attacks on Deep Models for Financial Transaction Records
• Benchmarking Gaslighting Attacks Against Speech Large Language Models
• Localizing Adversarial Attacks To Produces More Imperceptible Noise
• Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation
• Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
• Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers
• VETO: Towards Protecting Images From Frontier AI Editing
• Does the brain's ventral visual pathway compute object shape?
• Enchanted Determinism: Power without Responsibility in Artificial Intelligence
• Adversarial machine learning :
• Advances and Open Problems in Federated Learning
• VisualBackProp: efficient visualization of CNNs
• Seeing eye-to-eye? A comparison of object recognition performance in\n humans and deep convolutional neural networks under image manipulation
• Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction
• Attacking LLMs and AI Agents: Advertisement Embedding Attacks Against Large Language Models
• Lipschitz-Based Robustness Certification for Recurrent Neural Networks via Convex Relaxation
• BASFuzz: Towards Robustness Evaluation of LLM-based NLP Software via Automated Fuzz Testing
• Randomized Smoothing Meets Vision-Language Models
• An Adversarial Robust Behavior Sequence Anomaly Detection Approach Based on Critical Behavior Unit Learning
• Backdoor Mitigation via Invertible Pruning Masks
• Explainable Deep Learning Based Adversarial Defense for Automatic Modulation Classification
• Semantic Representation Attack against Aligned Large Language Models
• Adversarial Examples Are Not Bugs, They Are Superposition
• Discrete optimal transport is a strong audio adversarial attack
• CLMTracing: Black-box User-level Watermarking for Code Language Model Tracing
• A Deep Value-network Based Approach for Multi-Driver Order Dispatching
• DiffHash: Text-Guided Targeted Attack via Diffusion Models against Deep Hashing Image Retrieval
• AdaGAT: Adaptive Guidance Adversarial Training for the Robustness of Deep Neural Networks
• CIARD: Cyclic Iterative Adversarial Robustness Distillation
• Sy-FAR: Symmetry-based Fair Adversarial Robustness
• ReachNN: Reachability Analysis of Neural-Network Controlled Systems
• Advancing Weakly-Supervised Change Detection in Satellite Images via Adversarial Class Prompting
• Diffusion Models Beat GANs on Image Synthesis
• Deep Convolutional Networks as shallow Gaussian Processes
• Artificial Neural Networks for Neuroscientists: A Primer
• Hardware Trojan Attacks on Neural Networks
• A Practical Adversarial Attack against Sequence-based Deep Learning Malware Classifiers
• DARD: Dice Adversarial Robustness Distillation against Adversarial Attacks
• From Firewalls to Frontiers: AI Red-Teaming is a Domain-Specific Evolution of Cyber Red-Teaming
• On the Escaping Efficiency of Distributed Adversarial Training Algorithms
• RanAT4BIE: Random Adversarial Training for Biomedical Information Extraction
• Robustifying Diffusion-Denoised Smoothing Against Covariate Shift
• Adversarial robustness through Lipschitz-Guided Stochastic Depth in Neural Networks
• Shortcut learning in deep neural networks
• Deep convolutional neural networks in the face of caricature
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Natural Perturbed Training for General Robustness of Neural Network\n Classifiers
• Nearest Neighbor Projection Removal Adversarial Training
• Rethinking the Artificial Neural Networks: A Mesh of Subnets with a Central Mechanism for Storing and Predicting the Data
• Learning Automata Based Q-learning for Content Placement in Cooperative Caching
• Evaluating the visualization of what a Deep Neural Network has learned
• Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
• Are Targeted Data Poisoning Attacks as Effective as We Think?
• Evaluating the Impact of Adversarial Attacks on Traffic Sign Classification using the LISA Dataset
• A probabilistic approach to tomography and adjoint state methods, with an application to full waveform inversion in medical ultrasound
• IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks
• From Noise to Narrative: Tracing the Origins of Hallucinations in Transformers
• Measuring the Vulnerability Disclosure Policies of AI Vendors
• Dataset Ownership in the Era of Large Language Models
• On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning
• RobQFL: Robust Quantum Federated Learning in Adversarial Environment
• Robust Experts: the Effect of Adversarial Training on CNNs with Sparse Mixture-of-Experts Layers
• Sample Efficient Certification of Discrete-Time Control Barrier Functions
• Identifying Audio Adversarial Examples via Anomalous Pattern Detection
• Simpler Certified Radius Maximization by Propagating Covariances
• Minimizing Perceived Image Quality Loss Through Adversarial Attack\n Scoping
• FedAPT: Federated Adversarial Prompt Tuning for Vision-Language Models
• The gap between theory and practice in function approximation with deep neural networks
• An Investigation of Visual Foundation Models Robustness
• Learning to Compare Image Patches via Convolutional Neural Networks
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Partial success in closing the gap between human and machine vision
• Entropy-Based Non-Invasive Reliability Monitoring of Convolutional Neural Networks
• I Stolenly Swear That I Am Up to (No) Good: Design and Evaluation of Model Stealing Attacks
• Adversarial Patch Attack for Ship Detection via Localized Augmentation
• Theoretically Principled Trade-off between Robustness and Accuracy
• Generalizing Across Domains via Cross-Gradient Training
• Understanding and Mitigating Exploding Inverses in Invertible Neural\n Networks
• Surveying the Operational Cybersecurity and Supply Chain Threat Landscape when Developing and Deploying AI Systems
• Mini-Batch Robustness Verification of Deep Neural Networks
• The Ramon Llull's Thinking Machine for Automated Ideation
• MDD: a Mask Diffusion Detector to Protect Speaker Verification Systems from Adversarial Perturbations
• Novel Approaches to Artificial Intelligence Development Based on the Nearest Neighbor Method
• Exploring the Vulnerability of Single Shot Module in Object Detectors via Imperceptible Background Patches
• Does simple trump complex? Comparing strategies for adversarial robustness in DNNs
• Adversarial Agent Behavior Learning in Autonomous Driving Using Deep Reinforcement Learning
• On Evaluating the Adversarial Robustness of Foundation Models for Multimodal Entity Linking
• Explainable AI (XAI): A systematic meta-survey of current challenges and future opportunities
• Do Explanations Reflect Decisions? A Machine-centric Strategy to Quantify the Performance of Explainability Algorithms
• Universal and Transferable Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent
• Distributional Adversarial Attacks and Training in Deep Hedging
• Towards Unified Probabilistic Verification and Validation of Vision-Based Autonomy
• The AI-Fraud Diamond: A Novel Lens for Auditing Algorithmic Deception
• Timestep-Compressed Attack on Spiking Neural Networks through Timestep-Level Backpropagation
• Optimization problems for machine learning: A survey
• Delving into adversarial attacks on deep policies
• Adversarial Attack on Graph Structured Data
• How can we trust opaque systems? Criteria for robust explanations in XAI
• Adversarial Robustness in Distributed Quantum Machine Learning
• Rigorous Feature Importance Scores based on Shapley Value and Banzhaf Index
• Regularized Ensembles and Transferability in Adversarial Learning
• Robust Convolution Neural ODEs via Contractivity-promoting regularization
• Model Interpretability and Rationale Extraction by Input Mask Optimization
• Semantically Guided Adversarial Testing of Vision Models Using Language Models
• Using Mode Connectivity for Loss Landscape Analysis
• Using Videos to Evaluate Image Model Robustness
• Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving
• Contrastive ECOC: Learning Output Codes for Adversarial Defense
• Improving Robustness and Generality of NLP Models Using Disentangled Representations
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• CAAD 2018: Iterative Ensemble Adversarial Attack
• Constrained Black-Box Attacks Against Multi-Agent Reinforcement Learning
• Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples
• AI Security Map: Holistic Organization of AI Security Technologies and Impacts on Stakeholders
• A Guide to Robust Generalization: The Impact of Architecture, Pre-training, and Optimization Strategy
• Never compromise with vulnerabilities: a comprehensive survey on AI governance
• Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
• Certifiably robust malware detectors by design
• Representation Understanding via Activation Maximization
• Deepfake Detection that Generalizes Across Benchmarks
• ETA: Energy-based Test-time Adaptation for Depth Completion
• Re-evaluating Evaluation
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Physical Adversarial Camouflage through Gradient Calibration and Regularization
• DocVCE: Diffusion-based Visual Counterfactual Explanations for Document Image Classification
• Guided Perturbation Sensitivity (GPS): Detecting Adversarial Text via Embedding Stability and Word Importance
• Model Compression vs. Adversarial Robustness: An Empirical Study on Language Models for Code
• Are Inherently Interpretable Models More Robust? A Study In Music Emotion Recognition
• When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs
• Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation
• Multiplicative Normalizing Flows for Variational Bayesian Neural Networks
• Superior resilience to poisoning and amenability to unlearning in quantum machine learning
• Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training
• The Architecture of Trust: A Framework for AI-Augmented Real Estate Valuation in the Era of Structured Data
• MetAdv: A Unified and Interactive Adversarial Testing Platform for Autonomous Driving
• Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems
• Eigen Neural Network: Unlocking Generalizable Vision with Eigenbasis
• DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification
• Maximally Invariant Data Perturbation as Explanation
• Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictions
• Solution-aware vs global ReLU selection: partial MILP strikes back for DNN verification
• Wiggling Weights to Improve the Robustness of Classifiers
• Investigating the Invertibility of Multimodal Latent Spaces: Limitations of Optimization-Based Methods
• DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion
• RCR-AF: Enhancing Model Generalization via Rademacher Complexity Reduction Activation Function
• Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss
• On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbations
• Pulling Back the Curtain on Deep Networks
• Teach Me to Trick: Exploring Adversarial Transferability via Knowledge Distillation

Discussions

• Intriguing Properties of Neural Networks [pdf] [hn, 19 points, 4 comments]
• Intriguing properties of neural networks (2014) [hn, 2 points, 0 comments]
• Intriguing properties of neural networks [hn, 1 points, 0 comments]

Related

• Deep Neural Networks
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• Leveraging Model Interpretability and Stability to increase Model Robustness
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• What do Deep Networks Like to See?