On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples

Abstract

In recent years, defending adversarial perturbations to natural examples in order to build robust machine learning models trained by deep neural networks (DNNs) has become an emerging research field in the conjunction of deep learning and security. In particular, MagNet consisting of an adversary detector and a data reformer is by far one of the strongest defenses in the black-box oblivious attack setting, where the attacker aims to craft transferable adversarial examples from an undefended DNN model to bypass an unknown defense module deployed on the same DNN model. Under this setting, MagNet can successfully defend a variety of attacks in DNNs, including the high-confidence adversarial examples generated by the Carlini and Wagner's attack based on the $L_2$ distortion metric. However, in this paper, under the same attack setting we show that adversarial examples crafted based on the $L_1$ distortion metric can easily bypass MagNet and mislead the target DNN image classifiers on MNIST and CIFAR-10. We also provide explanations on why the considered approach can yield adversarial examples with superior attack performance and conduct extensive experiments on variants of MagNet to verify its lack of robustness to $L_1$ distortion based attacks. Notably, our results substantially weaken the assumption of effective threat models on MagNet that require knowing the deployed defense technique when attacking DNNs (i.e., the gray-box attack setting).

arXiv commentAccepted to IEEE/IFIP International Conference on Dependable and Systems and Networks (DSN) 2018 Workshop on Dependable and Secure Machine Learning

References in corpus (11)

• Explaining and Harnessing Adversarial Examples
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Bypassing Feature Squeezing by Increasing Adversary Strength
• On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples

Cited by in corpus (8)

• On Evaluating Adversarial Robustness
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• On The Utility of Conditional Generation Based Mutual Information for Characterizing Adversarial Subspaces
• Detecting Deep Neural Network Defects with Data Flow Analysis