Enhancing Gradient-based Attacks with Symbolic Intervals

Abstract

Recent breakthroughs in defenses against adversarial examples, like adversarial training, make the neural networks robust against various classes of attackers (e.g., first-order gradient-based attacks). However, it is an open question whether the adversarially trained networks are truly robust under unknown attacks. In this paper, we present interval attacks, a new technique to find adversarial examples to evaluate the robustness of neural networks. Interval attacks leverage symbolic interval propagation, a bound propagation technique that can exploit a broader view around the current input to locate promising areas containing adversarial instances, which in turn can be searched with existing gradient-guided attacks. We can obtain such a broader view using sound bound propagation methods to track and over-approximate the errors of the network within given input ranges. Our results show that, on state-of-the-art adversarially trained networks, interval attack can find on average 47% relatively more violations than the state-of-the-art gradient-guided PGD attack.

References in corpus (15)

• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Countering Adversarial Images using Input Transformations
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Mitigating Adversarial Effects Through Randomization
• Efficient Formal Safety Analysis of Neural Networks
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Extending Defensive Distillation
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Cited by in corpus (7)

• Certified Defenses for Adversarial Patches
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• On Training Robust PDF Malware Classifiers
• Certifying Strategyproof Auction Networks
• Luring of transferable adversarial perturbations in the black-box paradigm
• BOSH: An Efficient Meta Algorithm for Decision-based Attacks