Comment on "Biologically inspired protection of deep networks from adversarial attacks"

Abstract

A recent paper suggests that Deep Neural Networks can be protected from gradient-based adversarial perturbations by driving the network activations into a highly saturated regime. Here we analyse such saturated networks and show that the attacks fail due to numerical limitations in the gradient computations. A simple stabilisation of the gradient estimates enables successful and efficient attacks. Thus, it has yet to be shown that the robustness observed in highly saturated networks is not simply due to numerical limitations.

arXiv comment4 pages, 3 figures

References in corpus (1)

• Biologically inspired protection of deep networks from adversarial attacks

Cited by in corpus (11)

• Ensemble Adversarial Training: Attacks and Defenses
• On Evaluating Adversarial Robustness
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Adversarial Training against Location-Optimized Adversarial Patches
• Extending Defensive Distillation
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
• Bio-inspired Robustness: A Review
• Evaluating adversarial robustness in simulated cerebellum
• And/or trade-off in artificial neurons: impact on adversarial robustness