{"id":{"repo_id":"colo-mines","oai_identifier":"oai:repository.mines.edu:11124/176450"},"canonical_url":"https://search.dev.ndltd.org/etd/colo-mines/oai:repository.mines.edu:11124/176450","repository":{"repo_id":"colo-mines","name":"Colorado School of Mines","base_url":"https://repository.mines.edu/server/oai/request"},"display":{"title":"Adversarial machine learning in computer vision: attacks and defenses on machine learning models","abstract":"Machine learning models, including neural networks, have gained great popularity in recent years. Deep neural networks are able to directly learn from raw data and can outperform traditional machine learning models. As a result, they have been increasingly used in a variety of application domains such as image classification, natural language processing, and malware detection. However, deep neural networks are demonstrated to be vulnerable to adversarial examples at the test time. Adversarial examples are malicious inputs generated from the legitimate inputs by adding small perturbations in order to fool machine learning models to misclassify. We mainly aim to answer two research questions in this thesis: How are machine learning models vulnerable to adversarial examples? How can we better defend against the adversarial examples? We first improve the effectiveness of adversarial training by designing an experimental framework to study Method-Based Ensemble Adversarial Training (MBEAT) and Round Gap Of Adversarial Training (RGOAT). We then demonstrate the strong distinguishability of adversarial examples and design a simple yet effective approach called defensive distinction under the formulation of multi-label classification to protect against adversarial examples. We also propose fuzzing-based hard-label black-box attacks against machine learning models. We design an AdvFuzzer to explore multiple paths between a source image and a guidance image, and design a LocalFuzzer to explore the nearby space around a given input for identifying potential adversarial examples. Lastly, we propose a key-based input transformation defense to defend against adversarial examples.","abstract_html":"Machine learning models, including neural networks, have gained great popularity in recent years. Deep neural networks are able to directly learn from raw data and can outperform traditional machine learning models. As a result, they have been increasingly used in a variety of application domains such as image classification, natural language processing, and malware detection. However, deep neural networks are demonstrated to be vulnerable to adversarial examples at the test time. Adversarial examples are malicious inputs generated from the legitimate inputs by adding small perturbations in order to fool machine learning models to misclassify. We mainly aim to answer two research questions in this thesis: How are machine learning models vulnerable to adversarial examples? How can we better defend against the adversarial examples? We first improve the effectiveness of adversarial training by designing an experimental framework to study Method-Based Ensemble Adversarial Training (MBEAT) and Round Gap Of Adversarial Training (RGOAT). We then demonstrate the strong distinguishability of adversarial examples and design a simple yet effective approach called defensive distinction under the formulation of multi-label classification to protect against adversarial examples. We also propose fuzzing-based hard-label black-box attacks against machine learning models. We design an AdvFuzzer to explore multiple paths between a source image and a guidance image, and design a LocalFuzzer to explore the nearby space around a given input for identifying potential adversarial examples. Lastly, we propose a key-based input transformation defense to defend against adversarial examples.","abstract_has_math":false,"creators":["Qin, Yi"],"institution":"Colorado School of Mines. Arthur Lakes Library","degree_name":"Doctor of Philosophy (Ph.D.)","degree_level":"Doctoral","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":[],"advisors":["Yue, Chuan"],"committee_chairs":[],"committee_members":["Camp, Tracy","Han, Qi","Belviranli, Mehmet E.","Mohagheghi, Salman"],"year":2021,"date_issued":"2021","date_published":"2021","updated_at":"2026-07-24T01:42:22Z","subjects":[],"languages":["eng","English"],"rights":["Copyright of the original work is retained by the author."],"rights_urls":[],"identifier_entries":[{"key":"dc:identifier","label":"Identifier","values":["T 9114"],"render_values":[{"text":"T 9114","href":null,"code":true}]}]},"links":{"outbound_url":"https://hdl.handle.net/11124/176450","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Yue, Chuan"]},{"key":"dc:contributor.committeemember","label":"Committee Member","values":["Camp, Tracy","Han, Qi","Belviranli, Mehmet E.","Mohagheghi, Salman"]},{"key":"dc:creator","label":"Author","values":["Qin, Yi"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2021-06-28T10:14:15Z","2022-02-03T13:23:53Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2021-06-28T10:14:15Z","2022-02-03T13:23:53Z"]},{"key":"dc:date.issued","label":"Date","values":["2021"]},{"key":"dc:publisher","label":"Institution","values":["Colorado School of Mines. Arthur Lakes Library"]},{"key":"dc:type","label":"Dc Type","values":["Text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Doctoral"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Doctor of Philosophy (Ph.D.)"]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["Colorado School of Mines"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["English"]},{"key":"dc:language.iso","label":"Language (ISO)","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright of the original work is retained by the author."]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["Qin_mines_0052E_12151.pdf","T 9114"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/11124/176450"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Includes bibliographical references.","2021 Spring."]},{"key":"dc:description.abstract","label":"Abstract","values":["Machine learning models, including neural networks, have gained great popularity in recent years. Deep neural networks are able to directly learn from raw data and can outperform traditional machine learning models. As a result, they have been increasingly used in a variety of application domains such as image classification, natural language processing, and malware detection. However, deep neural networks are demonstrated to be vulnerable to adversarial examples at the test time. Adversarial examples are malicious inputs generated from the legitimate inputs by adding small perturbations in order to fool machine learning models to misclassify. We mainly aim to answer two research questions in this thesis: How are machine learning models vulnerable to adversarial examples? How can we better defend against the adversarial examples? We first improve the effectiveness of adversarial training by designing an experimental framework to study Method-Based Ensemble Adversarial Training (MBEAT) and Round Gap Of Adversarial Training (RGOAT). We then demonstrate the strong distinguishability of adversarial examples and design a simple yet effective approach called defensive distinction under the formulation of multi-label classification to protect against adversarial examples. We also propose fuzzing-based hard-label black-box attacks against machine learning models. We design an AdvFuzzer to explore multiple paths between a source image and a guidance image, and design a LocalFuzzer to explore the nearby space around a given input for identifying potential adversarial examples. Lastly, we propose a key-based input transformation defense to defend against adversarial examples."]},{"key":"dc:format.medium","label":"Dc Format Medium","values":["born digital","doctoral dissertations"]},{"key":"dc:title","label":"Title","values":["Adversarial machine learning in computer vision: attacks and defenses on machine learning models"]}]}],"canonical_facts":{"dc:contributor.advisor":["Yue, Chuan"],"dc:contributor.committeemember":["Camp, Tracy","Han, Qi","Belviranli, Mehmet E.","Mohagheghi, Salman"],"dc:creator":["Qin, Yi"],"dc:date.accessioned":["2021-06-28T10:14:15Z","2022-02-03T13:23:53Z"],"dc:date.available":["2021-06-28T10:14:15Z","2022-02-03T13:23:53Z"],"dc:date.issued":["2021"],"dc:description":["Includes bibliographical references.","2021 Spring."],"dc:description.abstract":["Machine learning models, including neural networks, have gained great popularity in recent years. Deep neural networks are able to directly learn from raw data and can outperform traditional machine learning models. As a result, they have been increasingly used in a variety of application domains such as image classification, natural language processing, and malware detection. However, deep neural networks are demonstrated to be vulnerable to adversarial examples at the test time. Adversarial examples are malicious inputs generated from the legitimate inputs by adding small perturbations in order to fool machine learning models to misclassify. We mainly aim to answer two research questions in this thesis: How are machine learning models vulnerable to adversarial examples? How can we better defend against the adversarial examples? We first improve the effectiveness of adversarial training by designing an experimental framework to study Method-Based Ensemble Adversarial Training (MBEAT) and Round Gap Of Adversarial Training (RGOAT). We then demonstrate the strong distinguishability of adversarial examples and design a simple yet effective approach called defensive distinction under the formulation of multi-label classification to protect against adversarial examples. We also propose fuzzing-based hard-label black-box attacks against machine learning models. We design an AdvFuzzer to explore multiple paths between a source image and a guidance image, and design a LocalFuzzer to explore the nearby space around a given input for identifying potential adversarial examples. Lastly, we propose a key-based input transformation defense to defend against adversarial examples."],"dc:format.medium":["born digital","doctoral dissertations"],"dc:identifier":["Qin_mines_0052E_12151.pdf","T 9114"],"dc:identifier.uri":["https://hdl.handle.net/11124/176450"],"dc:language":["English"],"dc:language.iso":["eng"],"dc:publisher":["Colorado School of Mines. Arthur Lakes Library"],"dc:rights":["Copyright of the original work is retained by the author."],"dc:title":["Adversarial machine learning in computer vision: attacks and defenses on machine learning models"],"dc:type":["Text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Doctoral"],"thesis:degree_name":["Doctor of Philosophy (Ph.D.)"],"thesis:institution_name":["Colorado School of Mines"]},"updated_at":"2026-07-24T01:42:22Z"}