2026-09-19T07:09:10Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/117625 2025-11-07 col_2142_5131 col_2142_8888 com_2142_5130 com_2142_8887 com_2142_234

Moulin, Pierre Moulin, Pierre Schwing, Alexander Li, Bo Raginsky, Maxim Veeravalli, Venugopal V. 2022-12 application/pdf en text Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2024-12-01 The student, Amish Goel, accepted the attached license on 2022-08-19 at 11:12. The student, Amish Goel, submitted this Dissertation for approval on 2022-08-19 at 11:26. This Dissertation was approved for publication on 2022-08-25 at 14:33. DSpace SAF Submission Ingestion Package generated from Vireo submission #18464 on 2023-04-12 at 08:10:24 Locally optimal detection and randomization defenses against universal adversarial perturbations Goel, Amish 2022-08-25 universal adversarial perturbations deep learning hypothesis testing locally optimal test generalized likelihood ratio test This thesis investigates a detection-based approach to safeguard a machine-learning based classifier from adversarial perturbations of its input. In particular, we consider input agnostic universal adversarial perturbations which are selected to force the input to a desired target class. The detector is designed by application of fundamental concepts of statistical decision theory, including locally optimal testing. Since locally optimal detectors depend on the input distribution, which is unknown in real-world datasets, a tractable surrogate input distribution is used instead. The thesis also defines several metrics for joint classification and detection, and evaluates them on several image datasets and popular image classifiers. We demonstrate through the experimental results that our detection-based approach is successful and outperforms the prior state of the art. We also show that detector-aware universal adversarial perturbations can be constructed in a way that evades our detector and achieves high target success rate on the classifier. To mitigate this problem, we propose and evaluate several relevant randomization schemes. Among the proposed methods, we observe that randomized smoothing offers better defense against the stronger detector-aware attacks. Thesis eng https://hdl.handle.net/2142/117625 Copyright 2022 Amish Goel Ph.D. Dissertation Electrical & Computer Engr University of Illinois at Urbana-Champaign Electrical & Computer Eng