Machine learning models are increasingly adapted in various domains. However, adversarial examples pose a significant threat to the reliable deployment of these models. In recent years, some powerful adversarial example attacks have been proposed for the fast and query-efficient generation of adversarial examples, even in black-box scenarios, highlighting the need for scalable, low-cost, and powerful defenses. In this work, we present two contributions to the domain of black-box adversarial example attacks and defenses. First, we propose Random Logit Scaling (RLS), a randomization-based defense against black-box score-based adversarial example attacks. RLS is a plug-and-play, post-processing defense that can be implemented on top of any existing ML model with minimal effort. The idea behind RLS is to confuse an attacker by outputting falsified scores resulting from randomly scaled logits while maintaining the model accuracy. We show that RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving the accuracy and minimizing confidence score distortion compared to state-of-the-art randomization-based defenses. Second, we introduce a novel adaptive attack against AAA, a SOTA non-randomized black-box defense against black-box score-based attacks that also modifies output logits to confuse attackers, demonstrating its vulnerability against adaptive attacks.
Adversarial training is one of the most effective defenses against adversarial attacks, yet the computational cost remains prohibitive at modern scales, especially for large language models (LLMs). While existing mitigation strategies, e.g., latent adversarial training (LAT), have been developed, they still incur a high computational cost. In this work, we comprehensively investigate computation-efficient strategies to speed up LAT from two complementary perspectives: (1) Defense-side optimization: We explore the representation fine-tuning (ReFT) within LAT, and reveal a potential issue if there is a mismatch on which tokens to apply ReFT and the attack. (2) Attack-side optimization: When computing adversarial attacks in each LAT iteration, we extract only the relevant circuits from the LLM to construct a lightweight surrogate model, avoiding the computation in the forward-backward passes through the full model during the attack generation. For both perspectives, we provide theoretical justifications and numerical evidence to illustrate the effectiveness of the proposed strategies. Ultimately, compared to standard LAT with full fine-tuning, our method on average reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations
Adversarial deep learning has emerged as a critical area of research within computer vision, revealing both the vulnerabilities and resilience of modern neural networks. This study provides a comprehensive survey of adversarial attacks and corresponding defense mechanisms, bridging foundational concepts with recent advancements. The taxonomy of adversarial attacks is thoroughly examined, including white-box, limited-information, real-world, and modern attacks, each exploiting specific vulnerabilities in deep learning models. On the defense front, this paper explores an extensive range of strategies, from adversarial training and architectural modifications to certifiable robustness frameworks and semantic-level defenses, emphasizing their strengths and limitations. Despite significant progress, the dynamic and evolving nature of adversarial threats underscores the need for adaptive, human-centered solutions. Integrating robust defenses such as input reconstruction, ensemble-based models, and dynamic mechanisms highlights the field’s innovation, but challenges persist in achieving universal robustness and scalability. This survey emphasizes the importance of interdisciplinary collaboration, blending human perception, computational security, and explainable AI to design defenses that align with real-world complexities and ethical considerations. By critically analyzing current methodologies and proposing future directions, this paper contributes to advancing the security and reliability of computer vision applications. It advocates for a forward-thinking approach that balances technical sophistication with human-centric principles, ensuring that adversarial deep learning evolves into a discipline not just of technical defense, but also of trust, transparency, and accountability.
Maisam Abbas, Ran-Zan Wang· IEEE Open Journal of the Com...· 0 citations
The growing deployment of deep learning models in safety-critical domains has exposed the artificial intelligence
landscape to a widening array of adversarial threats, where imperceptible input perturbations reliably induce severe
misclassifications. This survey provides a comprehensive synthesis of adversarial attacks and defense mechanisms in modern
AI security. It introduces a structured taxonomy categorizing attacks into evasion, poisoning, and model inversion strategies,
evaluated across varying levels of attacker knowledge. Correspondingly, current defense techniques—including adversarial
training, anomaly detection, and gradient masking—are critically reviewed for their resilience against adaptive, real-world
adversaries. The survey further examines robustness benchmarking and success rate analysis frameworks, emphasizing the
gap between theoretical guarantees and practical deployment. By consolidating recent advances and persistent limitations,
this work identifies open research challenges and outlines emerging directions toward provably secure and trustworthy AI
systems for real-world applications.
P. Mahalakshmi, D. Jayalakshmi· International Journal of Inn...· 0 citations