On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses

Abstract

Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.

References in corpus (2)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks

Cited by in corpus (45)

• On Evaluating Adversarial Robustness
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• A General Framework for Adversarial Examples with Objectives
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• On Adaptive Attacks to Adversarial Example Defenses
• Adversarial Training against Location-Optimized Adversarial Patches
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Responsible and Regulatory Conform Machine Learning for Medicine: A Survey of Challenges and Solutions
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Deep Learning Theory Review: An Optimal Control and Dynamical Systems Perspective
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Randomized Smoothing of All Shapes and Sizes
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Second-Order Provable Defenses against Adversarial Attacks
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• CAAD 2018: Generating Transferable Adversarial Examples
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Bandlimiting Neural Networks Against Adversarial Attacks
• Purifying Adversarial Perturbation with Adversarially Trained Auto-encoders
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• Connecting Lyapunov Control Theory to Adversarial Attacks
• Towards Deep Learning Models Resistant to Large Perturbations
• Topological Effects on Attacks Against Vertex Classification
• Who is Responsible for Adversarial Defense?
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Defending from adversarial examples with a two-stream architecture
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Towards Model-Agnostic Adversarial Defenses using Adversarially Trained Autoencoders
• Perturbation Analysis of Learning Algorithms: A Unifying Perspective on Generation of Adversarial Examples
• Simpler Certified Radius Maximization by Propagating Covariances
• Investigating Image Applications Based on Spatial-Frequency Transform and Deep Learning Techniques
• Learning Defense Transformers for Counterattacking Adversarial Examples
• Intriguing Properties of Input-dependent Randomized Smoothing
• Attack to Fool and Explain Deep Networks
• On Robustness of Neural Semantic Parsers
• Adversarial Ranking Attack and Defense