Ryan Feng

(5/5) Why this is cool: FoCal allows us to extend invariance and robustness ideas to much more complex transforms and bigger models, all without specialized training or architectures. Let's chat more at tomorrow's ICML poster session! w/ @utksinghal @atulprakash & Stella Yu

(4/5) Our "vary & rank" approach: (1) Generate transformed versions of input, (2) Compute CLIP + Stable Diffusion energies (3) Select the most "canonical" view → Feed to any downstream model. Works for any task/model, no training required!

(3/5) Our insight: foundation models already know what typical views look like from web-scale data. FOCAL finds these canonical views by minimizing energy over a set of transforms. No training, no fancy architectures. The same method works across wildly different transforms!

(2/5) Even modern models like CLIP/SAM are brittle against input variations like viewpoints, lighting, etc. Current fixes rely on transform-specific training or architectures. But you can't anticipate every real-world variation!

Q: How do we scale robustness/invariance to foundation models like CLIP? A: Test-time search! 🔍 Our new work FoCal finds canonical views to boost robustness to complex transforms (e.g. viewpoint): sutkarsh.github.io/projects/… 📍 ICML Poster: Tue 11–1:30, E. Hall A-B (E-2203) 🧵 1/5

(4/4) We find that OARS significantly enhances attack success rates against state-of-the-art stateful defense models to as high as 100%. See the paper for more details: arxiv.org/abs/2303.06280

(3/4) The key insight with OARS is that stateful defense models implicitly leak information about their similarity detection procedures every time they take preventative action. OARS thus automatically adapts key attack parameters to evade detection.

(2/4) We propose an adaptive black-box attack strategy, Oracle-guided Adaptive Rejection Sampling (OARS). OARS is an attack designed to evade stateful defenses, a popular approach against black-box attacks that rejects "similar" queries to prevent the attack from completing.

(1/4) New work alert! "Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attacks" was presented this week at CCS 2023. With: @NealMangaokar, @AshishHoodaCS, Kassem Fawaz, @jhasomesh, and @atulprakash.

Check out our new ICML 2023 paper with collaborators at Wisconsin below!

Attending my first conference today @IEEEEUROSP! Come see my presentation on “GRAPHITE: Generating Automatic Physical Examples for Machine-Learning Attacks on Computer Vision Systems” this Thursday, June 10th.

(3/3) Preprint: arxiv.org/abs/2002.07088

(2/3) GRAPHITE is the first automatic, hard-label, physical attack on machine learning systems, demonstrating attacks in a more practical setting in the real-world with limited info. GRAPHITE can also trade-off certain characteristics depending on attack or testing constraints.

(1/3) Excited to announce my first publication as first author! “GRAPHITE: Generating Automatic Physical Examples for Machine-Learning Attacks on Computer Vision Systems” has been accepted @IEEEEUROSP. With: @NealMangaokar, @jiefengchen1, @EarlenceF, @jhasomesh, @atulprakash.