Where Does the Robustness Come from? A Study of the Transformation-based Ensemble Defence
arXiv:2009.13033 · doi:10.1145/3411508.3421380
Abstract
This paper aims to provide a thorough study on the effectiveness of the transformation-based ensemble defence for image classification and its reasons. It has been empirically shown that they can enhance the robustness against evasion attacks, while there is little analysis on the reasons. In particular, it is not clear whether the robustness improvement is a result of transformation or ensemble. In this paper, we design two adaptive attacks to better evaluate the transformation-based ensemble defence. We conduct experiments to show that 1) the transferability of adversarial examples exists among the models trained on data records after different reversible transformations; 2) the robustness gained through transformation-based ensemble is limited; 3) this limited robustness is mainly from the irreversible transformations rather than the ensemble of a number of models; and 4) blindly increasing the number of sub-models in a transformation-based ensemble does not bring extra robustness gain.
arXiv commentThe 27th ACM Conference on Computer and Communications Security (CCS) Workshop, AISec 2020
References in corpus (11)
- Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Evasion Attacks against Machine Learning at Test Time
- Improving Adversarial Robustness via Promoting Ensemble Diversity
- Improving Black-box Adversarial Attacks with a Transfer-based Prior
- Evasion and Hardening of Tree Ensemble Classifiers
- Metric Learning for Adversarial Robustness
- Robustness to Adversarial Examples through an Ensemble of Specialists
- EMPIR: Ensembles of Mixed Precision Deep Networks for Increased Robustness against Adversarial Attacks
- ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense