Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

Abstract

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

Cited by in corpus (111)

• Certified Defenses against Adversarial Examples
• Deep Reinforcement Learning: An Overview
• Guiding Deep Learning System Testing using Surprise Adequacy
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection
• Adversarial Examples: Opportunities and Challenges
• Natural Adversarial Examples
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Algorithmic decision-making in AVs: Understanding ethical and technical concerns for smart cities
• Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Training verified learners with learned verifiers
• Towards quantum enhanced adversarial robustness in machine learning
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Unlabeled Data Improves Adversarial Robustness
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Automated Verification of Neural Networks: Advances, Challenges and Perspectives
• Towards robust sensing for Autonomous Vehicles: An adversarial perspective
• WAF-A-MoLE: Evading Web Application Firewalls through Adversarial Machine Learning
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks
• Towards Robust Neural Networks via Random Self-ensemble
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Reliability and Interpretability in Science and Deep Learning
• Robustness Verification of Quantum Classifiers
• PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks
• Toward Robust Image Classification
• Quantifying Perceptual Distortion of Adversarial Examples
• A survey on Adversarial Recommender Systems: from Attack/Defense strategies to Generative Adversarial Networks
• Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis
• Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems
• Perfect density models cannot guarantee anomaly detection
• Morphence: Moving Target Defense Against Adversarial Examples
• Towards Visual Distortion in Black-Box Attacks
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks
• PAC-learning in the presence of evasion adversaries
• Interpretable Deep Learning under Fire
• DeepLaser: Practical Fault Attack on Deep Neural Networks
• Metamorphic Detection of Adversarial Examples in Deep Learning Models With Affine Transformations
• Breaking Transferability of Adversarial Samples with Randomness
• Robust Image Classification Using A Low-Pass Activation Function and DCT Augmentation
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Interpretability is a Kind of Safety: An Interpreter-based Ensemble for Adversary Defense
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• When Attackers Meet AI: Learning-empowered Attacks in Cooperative Spectrum Sensing
• Perturbation Analysis of Gradient-based Adversarial Attacks
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Block Switching: A Stochastic Approach for Deep Learning Security
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Dimensionality reduction, regularization, and generalization in overparameterized regressions
• Query-Efficient Black-Box Attack by Active Learning
• Detection based Defense against Adversarial Examples from the Steganalysis Point of View
• Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
• Controlling Over-generalization and its Effect on Adversarial Examples Generation and Detection
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Adversarial Defense of Image Classification Using a Variational Auto-Encoder
• How Wrong Am I? - Studying Adversarial Examples and their Impact on Uncertainty in Gaussian Process Machine Learning Models
• Adversarial Exposure Attack on Diabetic Retinopathy Imagery Grading
• Second-Order Provable Defenses against Adversarial Attacks
• Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces
• Detecting Overfitting via Adversarial Examples
• Black-box Gradient Attack on Graph Neural Networks: Deeper Insights in Graph-based Attack and Defense
• Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• RoVISQ: Reduction of Video Service Quality via Adversarial Attacks on Deep Learning-based Video Compression
• Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
• Subset Scanning Over Neural Network Activations
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• AED-PADA:Improving Generalizability of Adversarial Example Detection via Principal Adversarial Domain Adaptation
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding
• Stochastic Substitute Training: A Gray-box Approach to Craft Adversarial Examples Against Gradient Obfuscation Defenses
• Neural Networks with Structural Resistance to Adversarial Attacks
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Secure Detection of Image Manipulation by means of Random Feature Selection
• Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder
• Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples
• Data Quality Matters For Adversarial Training: An Empirical Study
• Adversarial Robustness in Deep Learning: Attacks on Fragile Neurons
• A Singular Value Perspective on Model Robustness
• Teacher Model Fingerprinting Attacks Against Transfer Learning
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification
• To Make Yourself Invisible with Adversarial Semantic Contours
• Utilizing Network Properties to Detect Erroneous Inputs
• New CleverHans Feature: Better Adversarial Robustness Evaluations with Attack Bundling
• Scalable Multi-Class Bayesian Support Vector Machines for Structured and Unstructured Data
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Neural Belief Reasoner
• Adversarial Examples in Remote Sensing
• Clipping free attacks against artificial neural networks
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Models of Computational Profiles to Study the Likelihood of DNN Metamorphic Test Cases
• Tangent Space Sensitivity and Distribution of Linear Regions in ReLU Networks
• Linking average- and worst-case perturbation robustness via class selectivity and dimensionality
• Delving into the pixels of adversarial samples
• Adversarial Examples and Metrics
• Robust Machine Learning via Privacy/Rate-Distortion Theory
• Sparse Coding Frontend for Robust Neural Networks
• Are You Tampering With My Data?
• A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification
• A New Family of Neural Networks Provably Resistant to Adversarial Attacks
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability