Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Abstract

We evaluate the robustness of Adversarial Logit Pairing, a recently proposed defense against adversarial examples. We find that a network trained with Adversarial Logit Pairing achieves 0.6% accuracy in the threat model in which the defense is considered. We provide a brief overview of the defense and the threat models/claims considered, as well as a discussion of the methodology and results of our attack, which may offer insights into the reasons underlying the vulnerability of ALP to adversarial attack.

arXiv commentNeurIPS SECML 2018. Source code at https://github.com/labsix/adversarial-logit-pairing-analysis

References in corpus (5)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Defensive Distillation is Not Robust to Adversarial Examples
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses

Cited by in corpus (50)

• Theoretically Principled Trade-off between Robustness and Accuracy
• On Evaluating Adversarial Robustness
• AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty
• Fast is better than free: Revisiting adversarial training
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• RobustBench: a standardized adversarial robustness benchmark
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Adversarial Training against Location-Optimized Adversarial Patches
• Feature Denoising for Improving Adversarial Robustness
• Testing Robustness Against Unforeseen Adversaries
• Accurate, reliable and fast robustness evaluation
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Unlabeled Data Improves Adversarial Robustness
• Boosting Adversarial Training with Hypersphere Embedding
• Adversarial Examples in Modern Machine Learning: A Review
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Recent Advances in Adversarial Training for Adversarial Robustness
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
• Robustness properties of Facebook's ResNeXt WSL models
• Adversarial Neural Pruning with Latent Vulnerability Suppression
• On the effectiveness of adversarial training against common corruptions
• Intriguing properties of adversarial training at scale
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples
• Multitask Learning Strengthens Adversarial Robustness
• Attribution-driven Causal Analysis for Detection of Adversarial Examples
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Improved Adversarial Robustness via Logit Regularization Methods
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Towards Defending Multiple ${\ell }_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization
• A Method for Computing Class-wise Universal Adversarial Perturbations
• Regularizers for Single-step Adversarial Training
• Stateful Detection of Black-Box Adversarial Attacks
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Data Quality Matters For Adversarial Training: An Empirical Study
• Improved Adversarial Training via Learned Optimizer
• Robustness through Data Augmentation Loss Consistency
• Smoothness Analysis of Adversarial Training
• Generating Adversarial Computer Programs using Optimized Obfuscations
• THAT: Two Head Adversarial Training for Improving Robustness at Scale
• A Useful Taxonomy for Adversarial Robustness of Neural Networks
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• Multi-way Encoding for Robustness
• Understanding (Non-)Robust Feature Disentanglement and the Relationship Between Low- and High-Dimensional Adversarial Attacks
• Constraining Logits by Bounded Function for Adversarial Robustness
• Graphs for deep learning representations