arXiv Machine Learning
Oct 28

Attack logics, not outputs: Concept-based Property Attacks for Shortcut Elimination in Neural Networks

The paper introduces concept-based property attacks, which target logical inconsistencies in human‑interpretable concepts (e.g., “red ∧ octagonal → stop_sign”) rather than merely flipping final class labels. It formalizes these properties, proves that attacking them reduces the search space compared to class‑level attacks, and implements them using concept‑based explainable AI techniques. Empirical results across vision and code‑processing models show that retraining with these attacks preserves robustness gains while better eliminating semantic biases.

By Raik Dankworth, Felix M\"achtle, Thomas Eisenbarth, Gesina Schwalbe
arXiv AI
Sep 18

Information-Geometric Inverse Distillation for Enhancing Adversarial Transferability

The paper introduces Inverse Knowledge Distillation (IKD), an attack‑agnostic technique that enhances adversarial transferability by maximizing the discrepancy between benign and adversarial prediction distributions on a surrogate model. IKD employs a CE/KL‑equivalent soft‑label objective to push adversarial predictions away from a fixed benign anchor, leveraging Fisher‑sensitive surrogate directions. The authors provide theoretical analysis showing CE and KL induce identical gradients, derive a lower bound on Fisher‑subspace overlap, and demonstrate through extensive ImageNet experiments that IKD consistently improves black‑box attack performance across CNN, ViT, and defended models.

By Wenyuan Wu, Yuan Sun, Yingke Chen, Chao Su, Xi Peng, Dezhong Peng, Xu Wang