MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples

Abstract

MagNet and "Efficient Defenses..." were recently proposed as a defense to adversarial examples. We find that we can construct adversarial examples that defeat these defenses with only a slight increase in distortion.

References in corpus (3)

• Intriguing properties of neural networks
• MagNet: a Two-Pronged Defense against Adversarial Examples
• APE-GAN: Adversarial Perturbation Elimination with GAN

Cited by in corpus (74)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• On Evaluating Adversarial Robustness
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Towards Fast Computation of Certified Robustness for ReLU Networks
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Adversarial Training against Location-Optimized Adversarial Patches
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Adversarial Examples in Modern Machine Learning: A Review
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Security Matters: A Survey on Adversarial Machine Learning
• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• Understanding the One-Pixel Attack: Propagation Maps and Locality Analysis
• PAC-learning in the presence of evasion adversaries
• Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• Adversarial Example Games
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines
• Enhancing Gradient-based Attacks with Symbolic Intervals
• Enhancing Certifiable Robustness via a Deep Model Ensemble
• The Taboo Trap: Behavioural Detection of Adversarial Samples
• Adversarial Robustness Assessment: Why both $L_0$ and $L_{\infty }$ Attacks Are Necessary
• Detecting Adversarial Examples via Key-based Network
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Detecting Adversarial Examples via Neural Fingerprinting
• Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• ATMPA: Attacking Machine Learning-based Malware Visualization Detection Methods via Adversarial Examples
• TextDecepter: Hard Label Black Box Attack on Text Classifiers
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
• BUZz: BUffer Zones for defending adversarial examples in image classification
• Minimax Defense against Gradient-based Adversarial Attacks
• Adversarial Robustness in Deep Learning: Attacks on Fragile Neurons
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Bandlimiting Neural Networks Against Adversarial Attacks
• Adversarial Defense Through Network Profiling Based Path Extraction
• A Computationally Efficient Method for Defending Adversarial Deep Learning Attacks
• Robustifying deep networks for image segmentation
• Towards Deep Learning Models Resistant to Large Perturbations
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• Attack as Defense: Characterizing Adversarial Examples using Robustness
• AuxBlocks: Defense Adversarial Example via Auxiliary Blocks
• Exploiting the Sensitivity of $L_2$ Adversarial Examples to Erase-and-Restore
• Who is Responsible for Adversarial Defense?
• Can the state of relevant neurons in a deep neural networks serve as indicators for detecting adversarial attacks?
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• An Empirical Investigation of Randomized Defenses against Adversarial Attacks
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Target Training Does Adversarial Training Without Adversarial Samples
• Online Adversarial Attacks
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• Tricking Adversarial Attacks To Fail
• TEAM: We Need More Powerful Adversarial Examples for DNNs
• Attack to Fool and Explain Deep Networks
• Delving into the pixels of adversarial samples
• Are L2 adversarial examples intrinsically different?
• TEAM: An Taylor Expansion-Based Method for Generating Adversarial Examples
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks