Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples

Abstract

Deep learning classifiers are known to be vulnerable to adversarial examples. A recent paper presented at ICML 2019 proposed a statistical test detection method based on the observation that logits of noisy adversarial examples are biased toward the true class. The method is evaluated on CIFAR-10 dataset and is shown to achieve 99% true positive rate (TPR) at only 1% false positive rate (FPR). In this paper, we first develop a classifier-based adaptation of the statistical test method and show that it improves the detection performance. We then propose Logit Mimicry Attack method to generate adversarial examples such that their logits mimic those of benign images. We show that our attack bypasses both statistical test and classifier-based methods, reducing their TPR to less than 2:2% and 1:6%, respectively, even at 5% FPR. We finally show that a classifier-based detector that is trained with logits of mimicry adversarial examples can be evaded by an adaptive attacker that specifically targets the detector. Furthermore, even a detector that is iteratively trained to defend against adaptive attacker cannot be made robust, indicating that statistics of logits cannot be used to detect adversarial examples.

References in corpus (6)

• On Evaluating Adversarial Robustness
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples?

Cited by in corpus (7)

• On Adaptive Attacks to Adversarial Example Defenses
• Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions
• Towards Feature Space Adversarial Attack
• Deflecting Adversarial Attacks
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection