Abstract
Machine learning has been empirically successful in solving a plethora of tasks, more so when using deep neural networks in computer vision, natural language processing, cyber-security, or reinforcement learning. Its high efficacy has attracted attention from both academia and industry to push the state-of-the-art and develop innovative solutions. Unfortunately, machine learning models have been found to suffer from a phenomenon known as adversarial attacks. Such attacks cause misprediction behaviours in these models, through imperceptible perturbations to the input sample. With ever-increasing reliance on such models in the industry, it is paramount to place efforts analysing the impact and exploring defences against such attacks. Hence, this thesis adopts a two-pronged approach, with the aim of obtaining further insights. The first part discusses the impact of adversarial attacks on the robustness of machine learning models in two different contexts. The first being in the behavioural mouse authentication setting, where the robustness of various models are evaluated using three proposed black-box adversarial attacks, under a realistic and challenging scenario. Next, lesser-explored variants of neural networks are analysed for their adversarial vulnerability properties, namely binary stochastic networks. For this context, an improved black-box surrogate attack is proposed in this thesis. In the above contexts, we found that both were susceptible to improved adversarial attacks. In the second half, we first explore a stochasticity-based defence mechanism, which aims to reach competitive classification rates and achieving better robustness compared to baselines. In this regard, we propose an adaptive noise injection mechanism that can potentially be applied at any part of a network, and an approach to training stochastic networks, initialising them from deterministic ones. Next, due to a current gap in adversarial machine learning research for few-shot classifiers, we propose a detection strategy to identify adversarial support sets, which an attacker may create in order to poison the understanding of a certain class by a few-shot classifier, which to the best of our knowledge, has not yet been explored. Our results show very encouraging detection rates, performing better than baselines.