TEAM: An Taylor Expansion-Based Method for Generating Adversarial Examples
School of Big-Data Science, Zhejiang University of Science and Technology（浙江科技学院大数据学院）；Network and Information Security Laboratory of Hangzhou Hikvision Digital Technology Co., Ltd.（杭州海康威视数字技术股份有限公司网络与信息安全实验室）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；School of Information and Electronic Engineering, Zhejiang University of Science and Technology（浙江科技学院信息与电子工程学院）；Laboratoire ETIS UMR-CNRS 8051, CY Cergy Paris Université（CY塞尔吉巴黎大学ETIS实验室（法国国家科学研究中心联合研究单位））
Ya-guan Qian, Xi-Ming Zhang, Wassim Swaileh, Li Wei, Bin Wang, Jian-Hai Chen, Wu-Jie Zhou, Jing-Sheng Lei
Although Deep Neural Networks(DNNs) have achieved successful applications in many fields, they are vulnerable to adversarial examples.Adversarial training is one of the most effective methods to improve the robustness of DNNs, and it is generally considered as solving a saddle point problem that minimizes risk and maximizes perturbation.Therefore, powerful adversarial examples can effectively replicate the situation of perturbation maximization to solve the saddle point problem.The method proposed in this paper approximates the output of DNNs in the input neighborhood by using the Taylor expansion, and then optimizes it by using the Lagrange multiplier method to generate adversarial examples. If it is used for adversarial training, the DNNs can be effectively regularized and the defects of the model can be improved.
University of Toronto（多伦多大学）；Vector Institute（向量研究所）
Adversarial training is a common approach to improving the robustness of deep neural networks against adversarial examples. In this work, we propose a novel regularization approach as an alternative. To derive the regularizer, we formulate the adversarial robustness problem under the robust optimization framework and approximate the loss function using a second-order Taylor series expansion. Our proposed second-order adversarial regularizer (SOAR) is an upper bound based on the Taylor approximation of the inner-max in the robust optimization objective. We empirically show that the proposed met…
Institute of Software, CAS（中国科学院软件研究所）；University of Liverpool（利物浦大学）；Lancaster University（兰卡斯特大学）
In recent years, there has been an explosion of research into developing more robust deep neural networks against adversarial examples. Adversarial training appears as one of the most successful methods. To deal with both the robustness against adversarial examples and the accuracy over clean examples, many works develop enhanced adversarial training methods to achieve various trade-offs between them. Leveraging over the studies that smoothed update on weights during training may help find flat minima and improve generalization, we suggest reconciling the robustness-accuracy trade-off from ano…
Google Brain（谷歌大脑）；Tsinghua University（清华大学）；The Johns Hopkins University（约翰斯·霍普金斯大学）；Baidu Research USA（百度美国研究院）；Snap Inc.（阅后即焚公司）；Sony Mobile Communications（索尼移动通信公司）；Microsoft corp.（微软公司）；Yale Univerisity（耶鲁大学）；Smule Inc.（斯穆尔公司）；Preferred Networks, Inc.（优选网络公司）
To accelerate research on adversarial examples and robustness of machine learning classifiers, Google Brain organized a NIPS 2017 competition that encouraged researchers to develop new methods to generate adversarial examples as well as to develop new ways to defend against them. In this chapter, we describe the structure and organization of the competition and the solutions developed by several of the top-placing teams.
Zhejiang University of Science and Technology（浙江科技大学）；Hangzhou Hikvision Digital Technology Co., Ltd（杭州海康威视数字技术股份有限公司）；Guangzhou University（广州大学）；CY Cergy Paris University（塞尔吉巴黎大学）
Although deep neural networks (DNNs) have achieved success in many application fields, it is still vulnerable to imperceptible adversarial examples that can lead to misclassification of DNNs easily. To overcome this challenge, many defensive methods are proposed. Indeed, a powerful adversarial example is a key benchmark to measure these defensive mechanisms. In this paper, we propose a novel method (TEAM, Taylor Expansion-Based Adversarial Methods) to generate more powerful adversarial examples than previous methods. The main idea is to craft adversarial examples by minimizing the confidence o…
Deep neural networks (DNNs) are vulnerable to adversarial examples, perturbations carefully crafted to fool the targeted DNN, in both the non-targeted and targeted case. In the non-targeted case, the attacker simply aims to induce misclassification. In the targeted case, the attacker aims to induce classification to a specified target class. In addition, it has been observed that strong adversarial examples can transfer to unknown models, yielding a serious security concern. The NIPS 2017 competition was organized to accelerate research in adversarial attacks and defenses, taking place in the …
We describe our solution approach for Pommerman TeamRadio, a competition environment associated with NeurIPS 2019. The defining feature of our algorithm is achieving sample efficiency within a restrictive computational budget while beating the previous years learning agents. The proposed algorithm (i) uses imitation learning to seed the policy, (ii) explicitly defines the communication protocol between the two teammates, (iii) shapes the reward to provide a richer feedback signal to each agent during training and (iv) uses masking for catastrophic bad actions. We describe extensive tests again…
University of California, Irvine（加州大学欧文分校）；Carnegie Mellon University（卡内基梅隆大学）；Columbia University（哥伦比亚大学）；University of California, Santa Cruz（加州大学圣克鲁兹分校）
Computing Nash equilibrium policies is a central problem in multi-agent reinforcement learning that has received extensive attention both in theory and in practice. However, provable guarantees have been thus far either limited to fully competitive or cooperative scenarios or impose strong assumptions that are difficult to meet in most practical applications. In this work, we depart from those prior results by investigating infinite-horizon \emph{adversarial team Markov games}, a natural and well-motivated class of games in which a team of identically-interested players -- in the absence of an…
University of Cambridge（剑桥大学）；Polytechnique Montréal（蒙特利尔综合理工学院）
Privacy is an important facet of defence against adversaries. In this letter, we introduce the problem of private flocking. We consider a team of mobile robots flocking in the presence of an adversary, who is able to observe all robots' trajectories, and who is interested in identifying the leader. We present a method that generates private flocking controllers that hide the identity of the leader robot. Our approach towards privacy leverages a data-driven adversarial co-optimization scheme. We design a mechanism that optimizes flocking control parameters, such that leader inference is hindere…
Detection of adversarial intent in Human-AI teams using LLMs
Department of Mechanical Engineering, University of California at Santa Barbara（加州大学圣巴巴拉分校机械工程系）；Department of Computer Science, University of California at Santa Barbara（加州大学圣巴巴拉分校计算机科学系）
Many real-world scenarios involve teams of agents that have to coordinate their actions to reach a shared goal. We focus on the setting in which a team of agents faces an opponent in a zero-sum, imperfect-information game. Team members can coordinate their strategies before the beginning of the game, but are unable to communicate during the playing phase of the game. This is the case, for example, in Bridge, collusion in poker, and collusion in bidding. In this setting, model-free RL methods are oftentimes unable to capture coordination because agents' policies are executed in a decentralized …
