The Efficacy of SHIELD under Different Threat Models

Abstract

In this appraisal paper, we evaluate the efficacy of SHIELD, a compression-based defense framework for countering adversarial attacks on image classification models, which was published at KDD 2018. Here, we consider alternative threat models not studied in the original work, where we assume that an adaptive adversary is aware of the ensemble defense approach, the defensive pre-processing, and the architecture and weights of the models used in the ensemble. We define scenarios with varying levels of threat and empirically analyze the proposed defense by varying the degree of information available to the attacker, spanning from a full white-box attack to the gray-box threat model described in the original work. To evaluate the robustness of the defense against an adaptive attacker, we consider the targeted-attack success rate of the Projected Gradient Descent (PGD) attack, which is a strong gradient-based adversarial attack proposed in adversarial machine learning research. We also experiment with training the SHIELD ensemble from scratch, which is different from re-training using a pre-trained model as done in the original work. We find that the targeted PGD attack has a success rate of 64.3% against the original SHIELD ensemble in the full white box scenario, but this drops to 48.9% if the models used in the ensemble are trained from scratch instead of being retrained. Our experiments further reveal that an ensemble whose models are re-trained indeed have higher correlation in the cosine similarity space, and models that are trained from scratch are less vulnerable to targeted attacks in the white-box and gray-box scenarios.

arXiv commentAppraisal paper of existing method accepted for oral presentation at KDD LEMINCS 2019

References in corpus (10)

• Ensemble Adversarial Training: Attacks and Defenses
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Machine Learning at Scale
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Patch
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Defense Against the Dark Arts: An overview of adversarial example security research and future research directions

Cited by in corpus (2)

• On Evaluating Adversarial Robustness
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks