Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Robustness with Non-uniform Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with non-uniform target-class Mahalanobis perturbations instead of uniform perturbations | DNN adversarial training · PDF malware / EvadeML | defense success rate: 87.4% -> 92.9% | Helped |
| Train with non-uniform target-class Mahalanobis perturbations instead of uniform perturbations | DNN adversarial training · Twitter spam / FGSM, CW, JSMA, and DeepFool | defense success rate: For δ=0.1: FGSM ε=0.5 24.1 ± 0.25 -> 28.7 ± 0.17; CW 38.93 ± 0.54 -> 49.62 ± 0.33; DeepFool 39.3 ± 0.27 -> 51.73 ± 0.31 | Helped |
| Train with non-uniform target-class Mahalanobis perturbations instead of uniform perturbations | DNN adversarial training · Twitter spam / FGSM ε=0.5, δ=1 | defense success rate: 40.20 ± 0.57 -> 81.34 ± 0.83 | Helped |
| Use non-uniform target-class covariance constraints rather than uniform constraints in certification | LP certification · Twitter spam | certification success: 34.72±0.94% -> 81.3 ± 0.67% | Helped |
| Use target-class covariance noise rather than isotropic noise in randomized smoothing | Randomized smoothing · Twitter spam | certification success: 50.96% -> 90.11% | Helped |
| Use target-class Mahalanobis constraints rather than uniform perturbations to generate AEs | Adversarial example generation · Twitter spam | mean squared Mahalanobis distance: 2.1 -> 1.28 | Helped |
| Restrict perturbations to mutable features using a feature mask rather than perturbing all features uniformly | EMBER malware adversarial training · EMBER / GNN attack, δ=18 | successful evasions out of 1000: 152.2 -> 44.5 | Helped |
| Restrict perturbations to mutable features using a feature mask rather than perturbing all features uniformly | EMBER malware adversarial training · EMBER / GLGBM attack, δ=18 | successful evasions out of 1000: 57.3 -> 20.2 | Helped |
| Use Pearson, SHAP, masking, or Mahalanobis-based non-uniform perturbations instead of uniform perturbations | Adversarial training · Malware, credit risk, and spam realistic attacks | defense success rate | Helped |
| Use Pearson feature weights rather than the other non-uniform weighting choices | German Credit adversarial training · German Credit / LowProFool | defense success rate | Mixed |
| Replace full-data covariance with negative-class (target-class) covariance for Mahalanobis perturbations | Mahalanobis non-uniform adversarial training · EMBER / problem-space attacks | defense success rate | Helped |
| Replace uniform perturbations with target-class Mahalanobis perturbations | Twitter spam adversarial training · Twitter spam / clean accuracy | clean accuracy: At δ=0.1: 91.61 -> 91.93; at δ=1: 86.46 -> 87.64 | Helped |
Closest papers by meaning
- On Certifying Non-Uniform Bounds against Adversarial Attacks (ICML 2019 · similarity 0.91)
- Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution (NeurIPS 2018 · similarity 0.91)
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.91)
- Consistent Adversarially Robust Linear Classification: Non-Parametric Setting (ICML 2024 · similarity 0.88)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.