{"id":{"repo_id":"buffalo","oai_identifier":"oai:ubir.buffalo.edu:10477/79871"},"canonical_url":"https://search.dev.ndltd.org/etd/buffalo/oai:ubir.buffalo.edu:10477/79871","repository":{"repo_id":"buffalo","name":"Buffalo","base_url":"https://ubir.buffalo.edu/oai/request"},"display":{"title":"Adversarial Attack and Defense","abstract":"M.S.","abstract_html":"M.S.","abstract_has_math":false,"creators":["Zheng, Tianhang"],"institution":"State University of New York at Buffalo","degree_name":null,"degree_level":null,"degree_discipline":null,"degree_department":null,"school":null,"contributors":["Ren, Kui","Computer Science and Engineering"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2019,"date_issued":"2019-07-30T15:10:38Z","date_published":"2019-07-30T15:10:38Z","updated_at":"2026-07-27T19:05:19Z","subjects":["computer science"],"languages":["eng"],"rights":["Users of works found in University at Buffalo Institutional Repository (UBIR) are responsible for identifying and contacting the copyright owner for permission to reuse. University at Buffalo Libraries do not manage rights for copyright-protected works and cannot assist with permissions.","Copyright retained by author."],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/10477/79871","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Ren, Kui","Computer Science and Engineering"]},{"key":"dc:creator","label":"Author","values":["Zheng, Tianhang"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2019-07-30T15:10:38Z","2019","2019-04-09 10:20:33"]},{"key":"dc:publisher","label":"Institution","values":["State University of New York at Buffalo"]},{"key":"dc:type","label":"Dc Type","values":["Text","Thesis"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["computer science"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Users of works found in University at Buffalo Institutional Repository (UBIR) are responsible for identifying and contacting the copyright owner for permission to reuse. University at Buffalo Libraries do not manage rights for copyright-protected works and cannot assist with permissions.","Copyright retained by author."]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/10477/79871"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["M.S.","The accuracies of almost all the Machine Learning tasks were significantly improved by Deep Learning in the past few years. However, all those remarkable successes were achieved in a benign environment, while the robustness of Deep Learning models in adversarial settings was not well-studied until recently. Recent work shows that Deep Learning is vulnerable to a new type of attacks, called adversarial attack, where adversaries can manipulate deep-learning outputs by adding imperceptible perturbations on benign data. Adversarial attack is considered as a severe threat to the systems/appliances controlled by Deep Learning techniques, e.g., autonomous vehicles, and thus attracts broad attention from both the Deep Learning and the security communities. So in this thesis, I will describe my research efforts on three specific topics for exploring new adversarial attack and defense. The first topic is about a new adversarial attack called Distributionally Adversarial Attack (DAA), which achieves state-of-the-art attack results on several defensive models. Although recent work shows Projected Gradient Descent (PGD) Adversary is probably a universal first-order adversary, we found that PGD generates adversarial samples independently for each data point, which does not lead to optimal generalization since the objective of Deep Learning relies on a data distribution. Therefore, we generalize PGD on the space of data distributions and learn an adversarial distribution by simultaneously maximizing the adversarial loss and the KL divergence between the learned adversarial distribution and the original benign distribution. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by MIT MadryLab. DAA is a top-ranked attack on MadryLab's white-box leaderboards, reducing the accuracy of their secret MNIST model to 88.56% and the accuracy of their secret CIFAR model to 44.71%.The second topic is about a new adversarial attack and adversarial robustness analysis on point cloud data. 3D point-cloud recognition with deep neural network (DNN) has received remarkable progress on obtaining both high-accuracy recognition and robustness to random point missing (or dropping). However, we found that those point-cloud recognition models are actually not robust to adversarial point dropping. We construct a saliency map for a whole point cloud, which assigns each point a score reflecting its contribution to the model-recognition loss. Based on the learned saliency map, maliciously point-dropping attack can be achieved by dropping points with the highest scores, leading to significant increase of model loss.The third topic is about an efficient adversarial defense. PGD adversarial training is currently the most successful adversarial defense against Linf attacks. However, huge computational cost hinders the application of PGD adversarial training in production. We reformulate the min-max objective in PGD adversarial training by a minimization problem to minimize the original network loss plus L1 norms of its gradients evaluated on the inputs (including adversarial samples). The original loss can be solved by natural training; for the L1-norm loss, we propose a computationally-feasible solution by embedding a differentiable soft-quantization layer after the input layer of a network. We show that the soft-quantization layer trained with noisy-natural samples may be an alternative approach to minimizing the L1-gradient norms as in PGD adversarial training. Empirically, our method achieves comparable network robustness under the black-box adversarial setting."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Adversarial Attack and Defense"]}]}],"canonical_facts":{"dc:contributor":["Ren, Kui","Computer Science and Engineering"],"dc:creator":["Zheng, Tianhang"],"dc:date":["2019-07-30T15:10:38Z","2019","2019-04-09 10:20:33"],"dc:description":["M.S.","The accuracies of almost all the Machine Learning tasks were significantly improved by Deep Learning in the past few years. However, all those remarkable successes were achieved in a benign environment, while the robustness of Deep Learning models in adversarial settings was not well-studied until recently. Recent work shows that Deep Learning is vulnerable to a new type of attacks, called adversarial attack, where adversaries can manipulate deep-learning outputs by adding imperceptible perturbations on benign data. Adversarial attack is considered as a severe threat to the systems/appliances controlled by Deep Learning techniques, e.g., autonomous vehicles, and thus attracts broad attention from both the Deep Learning and the security communities. So in this thesis, I will describe my research efforts on three specific topics for exploring new adversarial attack and defense. The first topic is about a new adversarial attack called Distributionally Adversarial Attack (DAA), which achieves state-of-the-art attack results on several defensive models. Although recent work shows Projected Gradient Descent (PGD) Adversary is probably a universal first-order adversary, we found that PGD generates adversarial samples independently for each data point, which does not lead to optimal generalization since the objective of Deep Learning relies on a data distribution. Therefore, we generalize PGD on the space of data distributions and learn an adversarial distribution by simultaneously maximizing the adversarial loss and the KL divergence between the learned adversarial distribution and the original benign distribution. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by MIT MadryLab. DAA is a top-ranked attack on MadryLab's white-box leaderboards, reducing the accuracy of their secret MNIST model to 88.56% and the accuracy of their secret CIFAR model to 44.71%.The second topic is about a new adversarial attack and adversarial robustness analysis on point cloud data. 3D point-cloud recognition with deep neural network (DNN) has received remarkable progress on obtaining both high-accuracy recognition and robustness to random point missing (or dropping). However, we found that those point-cloud recognition models are actually not robust to adversarial point dropping. We construct a saliency map for a whole point cloud, which assigns each point a score reflecting its contribution to the model-recognition loss. Based on the learned saliency map, maliciously point-dropping attack can be achieved by dropping points with the highest scores, leading to significant increase of model loss.The third topic is about an efficient adversarial defense. PGD adversarial training is currently the most successful adversarial defense against Linf attacks. However, huge computational cost hinders the application of PGD adversarial training in production. We reformulate the min-max objective in PGD adversarial training by a minimization problem to minimize the original network loss plus L1 norms of its gradients evaluated on the inputs (including adversarial samples). The original loss can be solved by natural training; for the L1-norm loss, we propose a computationally-feasible solution by embedding a differentiable soft-quantization layer after the input layer of a network. We show that the soft-quantization layer trained with noisy-natural samples may be an alternative approach to minimizing the L1-gradient norms as in PGD adversarial training. Empirically, our method achieves comparable network robustness under the black-box adversarial setting."],"dc:format":["application/pdf"],"dc:identifier":["http://hdl.handle.net/10477/79871"],"dc:language":["eng"],"dc:publisher":["State University of New York at Buffalo"],"dc:rights":["Users of works found in University at Buffalo Institutional Repository (UBIR) are responsible for identifying and contacting the copyright owner for permission to reuse. University at Buffalo Libraries do not manage rights for copyright-protected works and cannot assist with permissions.","Copyright retained by author."],"dc:subject":["computer science"],"dc:title":["Adversarial Attack and Defense"],"dc:type":["Text","Thesis"]},"updated_at":"2026-07-27T19:05:19Z"}