Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent

Abstract

Evading adversarial example detection defenses requires finding adversarial examples that must simultaneously (a) be misclassified by the model and (b) be detected as non-adversarial. We find that existing attacks that attempt to satisfy multiple simultaneous constraints often over-optimize against one constraint at the cost of satisfying another. We introduce Orthogonal Projected Gradient Descent, an improved attack technique to generate adversarial examples that avoids this problem by orthogonalizing the gradients when running standard gradient-based attacks. We use our technique to evade four state-of-the-art detection defenses, reducing their accuracy to 0% while maintaining a 0% detection rate.

References in corpus (6)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Certified Defenses against Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Detecting Adversarial Samples from Artifacts
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain

Cited by in corpus (1)

• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction