Accurate, reliable and fast robustness evaluation

Abstract

Throughout the past five years, the susceptibility of neural networks to minimal adversarial perturbations has moved from a peculiar phenomenon to a core issue in Deep Learning. Despite much attention, however, progress towards more robust models is significantly impaired by the difficulty of evaluating the robustness of neural network models. Today's methods are either fast but brittle (gradient-based attacks), or they are fairly reliable but slow (score- and decision-based attacks). We here develop a new set of gradient-based adversarial attacks which (a) are more reliable in the face of gradient-masking than other gradient-based attacks, (b) perform better and are more query efficient than current state-of-the-art gradient-based attacks, (c) can be flexibly adapted to a wide range of adversarial criteria and (d) require virtually no hyperparameter tuning. These findings are carefully validated across a diverse set of six different models and hold for L0, L1, L2 and Linf in both targeted as well as untargeted scenarios. Implementations will soon be available in all major toolboxes (Foolbox, CleverHans and ART). We hope that this class of attacks will make robustness evaluations easier and more reliable, thus contributing to more signal in the search for more robust machine learning models.

Accepted at the 2019 Conference on Neural Information Processing Systems

References in corpus (6)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Towards the first adversarially robust neural network model on MNIST
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Distributionally Adversarial Attack

Cited by in corpus (14)

• On Adaptive Attacks to Adversarial Example Defenses
• Security and Privacy Issues in Deep Learning
• Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Voting based ensemble improves robustness of defensive models
• Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• Towards Defending Multiple ${\ell }_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization
• Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples
• Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Bio-inspired Robustness: A Review
• Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs