Designing models that are robust to small adversarial perturbations of their inputs has proven remarkably difficult. In this work we show that the reverse problem---making models more vulnerable---is surprisingly easy. After presenting some proofs of concept on MNIST, we introduce a generic tilting attack that injects vulnerabilities into the linear layers of pre-trained networks by increasing their sensitivity to components of low variance in the training data without affecting their performance on test data. We illustrate this attack on a multilayer perceptron trained on SVHN and use it to design a stand-alone adversarial module which we call a steganogram decoder. Finally, we show on CIFAR-10 that a poisoning attack with a poisoning rate as low as 0.1% can induce vulnerabilities to chosen imperceptible backdoor signals in state-of-the-art networks. Beyond their practical implications, these different results shed new light on the nature of the adversarial example phenomenon.
Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models
School of Computer Science and Technology, China University of Mining and Technology（中国矿业大学（北京）计算机科学与技术学院）；Department of Computer Science, City University of Hong Kong（香港城市大学计算机科学系）；Department of Engineering and Design, Technische Universität München（慕尼黑工业大学工程与设计系）
Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Driving
Shenzhen Institute for Advanced Study, University of Electronic Science and Technology of China（深圳先进研究院，电子科技大学）；School of Mechanical and Aerospace Engineering, Nanyang Technological University（南洋理工大学机械与航空航天工程学院）；School of Mechanical and Electrical Engineering, University of Electronic Science and Technology of China（电子科技大学机械与电气工程学院）
Transcending Adversarial Perturbations: Manifold-Aided Adversarial Examples with Legitimate Semantics
College of Information Science and Engineering, Northeastern University（东北大学信息科学与工程学院）；Foshan Graduate School, Northeastern University（东北大学佛山研究生院）；College of Control Science and Engineering, Zhejiang University（浙江大学控制科学与工程学院）
T-MLA: A targeted multiscale log-exponential attack framework for neural image compression
Skolkovo Institute of Science and Technology（斯克尔科沃科学与技术研究所）；University of Electronic Science and Technology of China（电子科学与技术大学）；Artificial Intelligence Research Institute (AIRI)（人工智能研究 institute (AIRI)）
Scale-Invariant Adversarial Attack against Arbitrary-scale Super-resolution
Nanyang Technological University（南洋理工大学）；East China Normal University（华东师范大学）；Agency for Science, Technology and Research (A*STAR)（新加坡科技研究局）；New York University（纽约大学）
A Survey on Transferability of Adversarial Examples across Deep Neural Networks
University of Oxford（牛津大学）；Nanyang Technological University（南洋理工大学）；Wuhan University（武汉大学）；University of Chinese Academy of Sciences（中国科学院大学）；University of Toronto（多伦多大学）；Sun Yat-sen University（中山大学）
Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；Northwestern Polytechnical University（西北工业大学）；The Chinese University of Hong Kong（香港中文大学）；The University of Hong Kong（香港大学）；City University of Hong Kong（香港城市大学）；Chinese Academy of Sciences（中国科学院）；The Hong Kong Polytechnic University（香港理工大学）
GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception
Harbin Institute of Technology(Shenzhen)（哈尔滨工业大学（深圳））；South China University of Technology（华南理工大学）；Harbin Institute of Technology（哈尔滨工业大学）；Shenzhen Internation Graduate School, Tsinghua University（深圳国际研究生院，清华大学）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；Huawei Manufacturing（华为制造）
