Analyzing and defending against adverserial samples in machine learning algorithms
Why this work is in the frame
A frame that forgets how it found something cannot be audited. These are the routes that admitted this work.
Bibliographic record
Abstract
The work in this thesis explores the problem of adversarial samples -inputs that are crafted in order to fool machine learning models.These adversarial samples are generated by attacking a trained model in a white-box scenario in which the attacker has all the knowledge about the model like its training data, parameters and hyper-parameters.These carefully-perturbed adversarial samples fool the classifier, resulting in misclassification at test time with very high probability; while being imperceptible to the human eye.This problem has renewed interest in the research field known as adversarial machine learning in the recent years and has given us a new outlook on how we should evaluate and understand the security properties of learning algorithms.We observe that with the help of regularizers, we can learn a more compact embedding of the training data, which can make these models more robust to adversarial samples by causing the adversary to generate more highly distorted samples and sometimes even fail to generate them.We then use this knowledge about the distortion pattern in the adversary samples to more efficiently utilize a previously debunked framework to either detect adversarial samples or try to recreate these adversarial samples to their true labels by utilizing the reconstruction loss in autoencoders.The data used for the testing of these algorithms are highly adopted by the researchers in the adversarial machine learning field, namely the SommarieLe travail dans cette thse explore le problme de adversarial samples et leur impact sur les dernires technologies de pointe dans le domaine des rseaux neuronaux.Ces adversarial samples sont gnrs en attaquant un modle inform dans un scnario de bote blanche, dans lequel l'assaillant a toutes les informations sur le modle, comme par exemple les donnes formatives, les paramtres et les hyperparamtres.Ces adversarial samples sont perturbs de manire attentive et imprvisible, ainsi trompant le classeur avec une haute probabilit pendant que des tests sont effectus.De tels changements sont imperceptibles au niveau humain.Ce problme a attir beaucoup d'intrt dans le domaine de recherche rcemment dvelopp de l'apprentissage automatique adverse, et nous a permis d'valuer les proprits de scurit des algorithmes d'apprentissage automatique sous une nouvelle perspective.On observe qu'avec l'aide des agents de rgularisation, on peut crer une intgration plus optimale des donnes d'apprentissage.Ceci peut rendre ces modles plus robustes contre les adversarial samples en forant l'adversaire de produire des chantillons de plus en plus dforms ou mme de faire chouer toute nouvelle tentative.Ensuite, nous utilisons ce que nous savons sur les tendances de distortion dans ces chantillons pour utiliser un ancien cadre informatique de manire plus efficace.En employant ce carde dans ce contexte, nous pouvons soit dtecter les adversarial samples,
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.003 |
| Meta-epidemiology (narrow) | 0.001 | 0.001 |
| Meta-epidemiology (broad) | 0.001 | 0.000 |
| Bibliometrics | 0.001 | 0.002 |
| Science and technology studies | 0.002 | 0.000 |
| Scholarly communication | 0.000 | 0.002 |
| Open science | 0.002 | 0.001 |
| Research integrity | 0.001 | 0.004 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from it