Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Abstract

Ongoing research has proposed several methods to defend neural networks against adversarial examples, many of which researchers have shown to be ineffective. We ask whether a strong defense can be created by combining multiple (possibly weak) defenses. To answer this question, we study three defenses that follow this approach. Two of these are recently proposed defenses that intentionally combine components designed to work well together. A third defense combines three independent defenses. For all the components of these defenses and the combined defenses themselves, we show that an adaptive adversary can create adversarial examples successfully with low distortion. Thus, our work implies that ensemble of weak defenses is not sufficient to provide strong defense against adversarial examples.

References in corpus (9)

• Categorical Reparameterization with Gumbel-Softmax
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Achieving Human Parity in Conversational Speech Recognition
• On the (Statistical) Detection of Adversarial Examples
• Practical Black-Box Attacks against Machine Learning
• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples
• Adversarial examples for generative models

Cited by in corpus (28)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• On Evaluating Adversarial Robustness
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Generating Adversarial Examples with Adversarial Networks
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Towards Fast Computation of Certified Robustness for ReLU Networks
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
• Security and Privacy Issues in Deep Learning
• Training Ensembles to Detect Adversarial Examples
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Detecting Backdoors in Neural Networks Using Novel Feature-Based Anomaly Detection
• Enhancing Gradient-based Attacks with Symbolic Intervals
• Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Amata: An Annealing Mechanism for Adversarial Training Acceleration
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Robust GANs against Dishonest Adversaries
• AuxBlocks: Defense Adversarial Example via Auxiliary Blocks
• BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability