Jul 2026· Journal of Intelligent Decision Making and Information Science· 0 citations· 19 references
TL;DR
This paper introduces a new anagram based attack into the literature and trains the model to learn these representations by adding a novel label to the dataset which is used as a feature for training the model.
Abstract
Natural Language Processing models are vulnerable to adversarial perturbations which can derail the model’s classification ability. Existing works focus on correcting the training data in order to be resilient to these attacks. In this paper, we propose the idea of multi label classification for adversarial attacks. First, we introduce a new anagram based attack into the literature and second, we train our model to learn these representations by adding a novel label to the dataset which is used as a feature for training the model. Our results show that our method succeeds in separating clean samples from adversarial ones without changing the actual data in the process. We conducted our experiments on the internet movie database dataset. Results show that our method makes a model reliable and robust against character-level perturbations.
Deep neural networks (DNNs) are vulnerable to adversarial samples crafted by adding imperceptible perturbations to clean data, potentially leading to incorrect and dangerous predictions. Adversarial purification has been an effective means to improve DNNs robustness by removing these perturbations before feeding the data into the model. However, it faces significant challenges in preserving key structural and semantic information of data, as the imperceptible nature of adversarial perturbations makes it hard to avoid over-correcting, which can destroy important information and degrade model performance. In this paper, we break away from traditional adversarial purification methods by focusing on the clean data manifold. To this end, we reveal that samples generated by a well-trained generative model are close to clean ones but far from adversarial ones. Leveraging this insight, we propose Consistency Model-based Adversarial Purification (CMAP), which optimizes vectors within the latent space of a pre-trained consistency model to generate samples for restoring clean data. Specifically, 1) we propose a Perceptual consistency restoration mechanism by minimizing the discrepancy between generated samples and input samples in both pixel and perceptual spaces. 2) To maintain the optimized latent vectors within the valid data manifold, we introduce a Latent distribution consistency constraint strategy to align generated samples with the clean data distribution. 3) We also apply a Latent vector consistency prediction scheme via an ensemble approach to enhance prediction reliability. (CMAP) fundamentally addresses adversarial perturbations at their source, providing a robust purification. Extensive experiments on CIFAR-10 and ImageNet-100 show that our (CMAP) significantly enhances robustness against strong adversarial attacks while preserving high natural accuracy.
Shuhai Zhang, Jiahao Yang, Hui Luo et al.· IEEE Transactions on Pattern...· 0 citations
Adversarial examples are purposely crafted to fool Artificial Neural Networks (ANNs) into producing erroneous outputs. Understanding what makes these models vulnerable to such attacks is an open research topic and constitutes a first step toward devising defenses. Focusing on ANNs designed for image classification, we propose a method to analyze these models from an adversarial robustness perspective. The approach is based on the t-distributed Stochastic Neighbor Embedding (t-SNE) technique and allows the visual inspection of the representations learned by an ANN throughout its different layers. Additionally, we propose the Embedding Overlap Robustness RatiO (EORRO) metric to identify potential weak spots in the network by quantifying differences between clean and perturbed images on the t-SNE maps. We validated our approach by studying two ANNs, one designed by humans and another by NeuroEvolution, on CIFAR-10 and CIFAR-100. Our results indicate that differences between clean and perturbed images start to emerge early on in the models, namely in the feature extraction layers of the networks. Guided by the proposed metric, we implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models. More specifically, the post-attack accuracy of the neuroevolved ANN on CIFAR-10 changed from 0% to at least 63.5% in \(L_{2}\) and 27.2% in \(L_{\infty}\) .
Adversarial purification is a defense technique that employs generative models to remove adversarial perturbations. Current methods often rely on powerful generators, typically diffusion models, and focus on reducing the gap between adversarial and clean samples in the feature space, while overlooking semantic correlation within a single sample. To address this issue, we explore adversarial purification from the perspective of preserving semantic relationships among image patches. We employ an Attentive Mask Reconstruction Model (AMRM), which shows superior performance. Our theoretical and experimental analysis reveals that AMRM is highly sensitive to adversarial noise, as such noise significantly distorts patch relationships. Based on this observation, we propose AMRM-Pure, a purification framework that denoises adversarial inputs by preserving patch-level semantics, and formulate this process as a tractable optimization problem with respect to the input. To further enhance robustness, we finetune AMRM-Pure with classification loss to strengthen semantic consistency. We apply our insight to two AMRM architectures, including Mask Autoencoder (MAE) and MaskDiT. Extensive experiments confirm the effectiveness of our method, establishing new state-of-the-art performance across multiple benchmarks.
Zhihao Dou, Zhiqiang Gao, Dongfei Cui et al.· 0 citations
Model-specific adversarial attacks have been extensively studied. We study a different failure mode: naturally occurring statistical signals in vision data that can behave as backdoor-like triggers without being maliciously inserted. We call these signals statistical adversaries. We analyse ImageNet to find patterns that are strongly linked to certain labels. We then use statistical controls to remove random correlations from our candidate signals. Finally, we demonstrate that these signals directly and predictably alter model predictions. These statistical adversaries are more targeted than generic corruptions and transfer across different model architectures. This suggests that some vulnerabilities are driven by dataset structure and distribution rather than a single model's idiosyncrasies. We conclude that ordinary datasets can contain exploitable adversarial surfaces even in the absence of poisoning, and suggest that dataset audits should treat spurious structure not only as a source of bias or interpretability failure, but also as a latent attack surface for vision models.
Paul K. Mandal, Pavan Reddy, Tristan Malatynski· 0 citations
Deep neural networks (DNNs) have achieved remarkable success in classical machine learning problems. However, they are known to be vulnerable to adversarial attacks. Countermeasures proposed in the literature, notably Information Bottleneck Distillation (IBD) introduced by Kuang et al., degrade the classification accuracy on clean inputs while improving the robustness to adversarial inputs. In this work, we extend the IBD framework by introducing an extra teacher model (clean teacher) trained with only clean inputs, into the distillation process from a robust teacher model trained by adversarial training. The features of both clean and robust teachers are transferred to the student through a cross-layer attention matrix. Experimental results on the CIFAR-10 and CIFAR-100 datasets show that the proposed method improves classification accuracy on clean samples compared to the original IBD, while maintaining similar accuracy on adversarial samples. Furthermore, our methods are competitive with state-of-the-art approaches, including the recent dual-teacher distillation framework B-MTARD, particularly in terms of the harmonic mean between clean and robust accuracy. We also analyze the impact of different training settings that have different influences on the attention module.
Vincent Ryusuke Takahashi, Yoshinari Takeishi, Jun'ichi Takeuchi et al.· 0 citations
Deep Neural Networks are vulnerable to adversarial perturbations, which can cause failures in safety-critical systems. State-of-the-art countermeasures often incur prohibitive overheads, creating a need for cost-efficient robustness strategies. This paper proposes a hybrid hardening technique integrating Triple Modular Redundancy with Adversarial Training, Label Smoothing, and Iterative Pruning to reduce hardening cost while preserving accuracy. Experimental results demonstrate that our approach maintains up to 86.7% accuracy under strong adversarial perturbations (ϵ = 0.1), outperforming unprotected models by a factor of 4.8x while reducing memory footprint up to 76% through pruning.
L. D. de Melo, M. Gani, Alberto Bosio et al.· IEEE International Symposium...· 0 citations