Defensive Distillation is Not Robust to Adversarial Examples

Abstract

We show that defensive distillation is not secure: it is no more resistant to targeted misclassification attacks than unprotected neural networks.

Cited by in corpus (104)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Synthesizing Robust Adversarial Examples
• On Evaluating Adversarial Robustness
• Certified Defenses against Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Fast is better than free: Revisiting adversarial training
• The Role of Machine Learning in Cybersecurity
• Adversarial Examples: Opportunities and Challenges
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Adversarial Active Learning for Deep Networks: a Margin Based Approach
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• On Adaptive Attacks to Adversarial Example Defenses
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Rademacher Complexity for Adversarially Robust Generalization
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Adversarial Examples that Fool Detectors
• Adversarial Training against Location-Optimized Adversarial Patches
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Maximal Jacobian-based Saliency Map Attack
• Adversarial Examples in Modern Machine Learning: A Review
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Robust Learning with Jacobian Regularization
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
• Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning
• QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attacks
• Security Matters: A Survey on Adversarial Machine Learning
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Mutual Adversarial Training: Learning together is better than going alone
• Generating 3D Adversarial Point Clouds
• Assessing Threat of Adversarial Examples on Deep Neural Networks
• PAC-learning in the presence of evasion adversaries
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• CopyCAT: Taking Control of Neural Policies with Constant Attacks
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• Detecting Backdoors in Neural Networks Using Novel Feature-Based Anomaly Detection
• Online Robustness Training for Deep Reinforcement Learning
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• Adversary Resistant Deep Neural Networks with an Application to Malware Detection
• Using Non-invertible Data Transformations to Build Adversarial-Robust Neural Networks
• Building Robust Deep Neural Networks for Road Sign Detection
• Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Blind Pre-Processing: A Robust Defense Method Against Adversarial Examples
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Towards Evaluating Driver Fatigue with Robust Deep Learning Models
• Image Transformation can make Neural Networks more robust against Adversarial Examples
• Inductive Bias of Gradient Descent based Adversarial Training on Separable Data
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks
• Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Training
• Perfectly Parallel Fairness Certification of Neural Networks
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• Neural Networks with Structural Resistance to Adversarial Attacks
• Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Entropy Minimization In Emergent Languages
• Predicting Adversarial Examples with High Confidence
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Minimax Defense against Gradient-based Adversarial Attacks
• FAT: Federated Adversarial Training
• Consistent Valid Physically-Realizable Adversarial Attack against Crowd-flow Prediction Models
• Bandlimiting Neural Networks Against Adversarial Attacks
• Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack
• ATRO: Adversarial Training with a Rejection Option
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Towards Deep Learning Models Resistant to Large Perturbations
• On the human-recognizability phenomenon of adversarially trained deep image classifiers
• Efficient detection of adversarial images
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• Clustering Effect of (Linearized) Adversarial Robust Models
• Multi-objective Search of Robust Neural Architectures against Multiple Types of Adversarial Attacks
• Controlled Caption Generation for Images Through Adversarial Attacks
• An Empirical Study of DNNs Robustification Inefficacy in Protecting Visual Recommenders
• Who is Responsible for Adversarial Defense?
• Ensemble Generative Cleaning with Feedback Loops for Defending Adversarial Attacks
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• Clipping free attacks against artificial neural networks
• An Information-Theoretic Explanation for the Adversarial Fragility of AI Classifiers
• Non-Determinism in Neural Networks for Adversarial Robustness
• Delving into the pixels of adversarial samples
• Rethinking Uncertainty in Deep Learning: Whether and How it Improves Robustness
• Are L2 adversarial examples intrinsically different?
• Adversarial Ranking Attack and Defense
• Target Training Does Adversarial Training Without Adversarial Samples
• Multi-way Encoding for Robustness
• FUNN: Flexible Unsupervised Neural Network
• Enhancing Resilience of Deep Learning Networks by Means of Transferable Adversaries
• Tricking Adversarial Attacks To Fail
• Training Machine Learning Models by Regularizing their Explanations
• Orthogonal Deep Models As Defense Against Black-Box Attacks
• A New Family of Neural Networks Provably Resistant to Adversarial Attacks
• Strategies to architect AI Safety: Defense to guard AI from Adversaries
• Can Intelligent Hyperparameter Selection Improve Resistance to Adversarial Examples?
• Group-Structured Adversarial Training
• Attack to Fool and Explain Deep Networks