Logit Pairing Methods Can Fool Gradient-Based Attacks

Abstract

Recently, Kannan et al. [2018] proposed several logit regularization methods to improve the adversarial robustness of classifiers. We show that the computationally fast methods they propose - Clean Logit Pairing (CLP) and Logit Squeezing (LSQ) - just make the gradient-based optimization problem of crafting adversarial examples harder without providing actual robustness. We find that Adversarial Logit Pairing (ALP) may indeed provide robustness against adversarial examples, especially when combined with adversarial training, and we examine it in a variety of settings. However, the increase in adversarial accuracy is much smaller than previously claimed. Finally, our results suggest that the evaluation against an iterative PGD attack relies heavily on the parameters used and may result in false conclusions regarding robustness of a model.

arXiv commentAccepted to NeurIPS 2018 Workshop on Security in Machine Learning

References in corpus (11)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Certified Defenses against Adversarial Examples
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Scaling provable adversarial defenses
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Hessian-based Analysis of Large Batch Training and Robustness to Adversaries
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Cited by in corpus (23)

• On Evaluating Adversarial Robustness
• Fast is better than free: Revisiting adversarial training
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• RobustBench: a standardized adversarial robustness benchmark
• Fixing Data Augmentation to Improve Adversarial Robustness
• Adversarial Training against Location-Optimized Adversarial Patches
• Overfitting in adversarially robust deep learning
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• On the effectiveness of adversarial training against common corruptions
• Intriguing properties of adversarial training at scale
• Label Smoothing and Adversarial Robustness
• Data Quality Matters For Adversarial Training: An Empirical Study
• Improving Robustness using Generated Data
• Provable robustness against all adversarial $l_p$-perturbations for $p\ge 1$
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Understanding Catastrophic Overfitting in Adversarial Training
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• Understanding the Logit Distributions of Adversarially-Trained Deep Neural Networks
• Constraining Logits by Bounded Function for Adversarial Robustness
• Adversarial Machine Learning in Text Analysis and Generation