Adversarial Attack and Defense for Non-Parametric Two-Sample Tests
Not on the map. Why?
Abstract (arXiv)
Non-parametric two-sample tests (TSTs) that judge whether two sets of samples are drawn from the same distribution, have been widely used in the analysis of critical data. People tend to employ TSTs as trusted basic tools and rarely have any doubt about their reliability. This paper systematically uncovers the failure mode of non-parametric TSTs through adversarial attacks and then proposes corresponding defense strategies. First, we theoretically show that an adversary can upper-bound the distributional shift which guarantees the attack's invisibility. Furthermore, we theoretically find that the adversary can also degrade the lower bound of a TST's test power, which enables us to iteratively minimize the test criterion in order to search for adversarial pairs. To enable TST-agnostic attacks, we propose an ensemble attack (EA) framework that jointly minimizes the different types of test criteria. Second, to robustify TSTs, we propose a max-min optimization that iteratively generates adversarial pairs to train the deep kernels. Extensive experiments on both simulated and real-world datasets validate the adversarial vulnerabilities of non-parametric TSTs and the effectiveness of our proposed defense. Source code is available at https://github.com/GodXuxilie/Robust-TST.git.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 84 of its 126 references that are in the map. First posted on arXiv 7 Feb 2022.
Builds on
84 of 126 references.
References · 84
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Natural Adversarial Examplescited by 1,401
- 2018Demystifying MMD GANscited by 1,268
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
38 more
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2018Adversarially Robust Generalization Requires More Datacited by 318
- 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
- 2019FreeLB: Enhanced Adversarial Training for Natural Language Understandingcited by 261
- 2016Revisiting Classifier Two-Sample Testscited by 258
- 2017Detecting Adversarial Samples from Artifactscited by 244
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
- 2021Improving Robustness using Generated Datacited by 233
- 2017On Detecting Adversarial Perturbationscited by 232
- 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
- 2020Bag of Tricks for Adversarial Trainingcited by 199
- 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2021Data Augmentation Can Improve Robustnesscited by 193
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
- 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
- 2017On the (Statistical) Detection of Adversarial Examplescited by 180
- 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
- 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
- 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
- 2019Adversarial Robustness through Local Linearizationcited by 146
- 2020Learning Deep Kernels for Non-Parametric Two-Sample Testscited by 129
- 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
- 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
- 2016Generative Models and Model Criticism via Optimized Maximum Mean Discrepancycited by 99
- 2020Rethinking Importance Weighting for Deep Learning under Distribution Shiftcited by 92
- 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
- 2018Curriculum Adversarial Trainingcited by 89
- 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
- 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
50 most cited of 84 All 84 (JSON)
Built on by
Citing papers per year: 2024: 1; 2025: 0; 2026: 1.
2 papers.