Combining Machine Learning Defenses without Conflicts
Not on the map. Why?
Abstract (arXiv)
Machine learning (ML) defenses protect against various risks to security, privacy, and fairness. Real-life models need simultaneous protection against multiple different risks which necessitates combining multiple defenses. But combining defenses with conflicting interactions in an ML model can be ineffective, incurring a significant drop in the effectiveness of one or more defenses being combined. Practitioners need a way to determine if a given combination can be effective. Experimentally identifying effective combinations can be time-consuming and expensive, particularly when multiple defenses need to be combined. We need an inexpensive, easy-to-use combination technique to identify effective combinations. Ideally, a combination technique should be (a) accurate (correctly identifies whether a combination is effective or not), (b) scalable (allows combining multiple defenses), (c) non-invasive (requires no change to the defenses being combined), and (d) general (is applicable to different types of defenses). Prior works have identified several ad-hoc techniques but none satisfy all the requirements above. We propose a principled combination technique, DefCon, to identify effective defense combinations. DefCon meets all requirements, achieving 90% accuracy on eight combinations explored in prior work and 81% in 30 previously unexplored combinations that we empirically evaluate in this paper.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 141 of its 189 references that are in the map. First posted on arXiv 14 Nov 2024.
Builds on
141 of 189 references.
References · 141
- 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
- 2017Axiomatic Attribution for Deep Networkscited by 3,350
- 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
- 2016Deep Learning with Differential Privacycited by 2,682
- 2016Equality of Opportunity in Supervised Learningcited by 2,000
- 2019A Survey on Bias and Fairness in Machine Learningcited by 1,911
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2017Learning Important Features Through Propagating Activation Differencescited by 1,454
38 more
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2017Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)cited by 1,309
- 2017SmoothGrad: removing noise by adding noisecited by 1,097
- 2017Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPRcited by 1,086
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2018A Survey Of Methods For Explaining Black Box Modelscited by 970
- 2018Robustness May Be at Odds with Accuracycited by 873
- 2014Certifying and removing disparate impactcited by 715
- 2016Making Deep Neural Networks Robust to Label Noise: a Loss Correction Approachcited by 663
- 2018Mitigating Unwanted Biases with Adversarial Learningcited by 663
- 2018A Reductions Approach to Fair Classificationcited by 585
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2020Captum: A unified and generic model interpretability library for PyTorchcited by 542
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2022Diffusion Models for Adversarial Purificationcited by 469
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2018Spectral Signatures in Backdoor Attackscited by 457
- 2019On Evaluating Adversarial Robustnesscited by 442
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2020Backdoor Learning: A Surveycited by 412
- 2017On Fairness and Calibrationcited by 406
- 2017Preventing Fairness Gerrymandering: Auditing and Learning for Subgroup Fairnesscited by 381
- 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
- 2017Measuring Catastrophic Forgetting in Neural Networkscited by 359
- 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2019Differential Privacy Has Disparate Impact on Model Accuracycited by 316
- 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2018Differentially Private Generative Adversarial Networkcited by 235
- 2020Differentially Private Learning Needs Better Features (or Much More Data)cited by 233
- 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
- 2017Embedding Watermarks into Deep Neural Networkscited by 227
- 2021Data Augmentation Can Improve Robustnesscited by 193
50 most cited of 141 All 141 (JSON)
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.