On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses

By Anish Athalye, Nicholas Carlini. 2018

175 citations recorded by the source corpus.

Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Hardware and Architecture, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Hardware and Architecture

In Safety, Robustness & Interpretability

Citations in the corpus

Certified Adversarial Robustness via Randomized Smoothing (2019, background): “In fact, most heuristic defenses proposed in the literature were later “broken” by stronger adversaries (Carlini & Wagner, 2017; Athalye et al., 2018; Uesato et al., 2018; Athalye & Carlini, 2018).”
Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, background): “2, a large number of adversarial defense works have been proposed recently, however, most of them are already broken by stronger attacks proposed in [3, 4].”
Towards Robust Neural Networks via Random Self-ensemble (2017, methodology): “Moreover, we assume C&W attack knows the randomization procedure of RSE, so the C&W objective function will change accordingly (as proposed in [1] for attacking an ensemble model).”
Towards the first adversarially robust neural network model on MNIST (2018, background): “There has been much work showing that basically all defenses suggested so far in the literature do not substantially increase robustness over undefended neural networks (Athalye et al., 2018; Brendel & Bethge, 2017).”
Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks (2018, background): “For instance, many ICLR 2018 and CVPR 2018 defense papers were reported as not effective measures soon after the announcement of their acceptance [3, 2].”
On Evaluating Adversarial Robustness (2019, neutral): “…2016; 2017c; Brendel & Bethge, 2017; Carlini & Wagner, 2017a; He et al., 2017; Carlini & Wagner, 2017b; Athalye et al., 2018; Engstrom et al., 2018; Athalye & Carlini, 2018; Uesato et al., 2018; Mosbach et al., 2018; He et al., 2018; Sharma & Chen, 2018; Lu et al., 2018a;b; Cornelius, 2019;…”
Evaluating and Understanding the Robustness of Adversarial Logit Pairing (2018, background): “Unfortunately, many proposed defenses have had their claims invalidated by new attacks within their corresponding threat models [4, 8, 5, 6, 2, 12, 1].”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “In fact, most empirical defenses proposed in the literature were later “broken” by stronger adversaries [4, 2, 34, 1].”
Distributionally Adversarial Attack (2018, background): “Moreover, among all the white-box defenses that appeared in ICLR-2018 and CVPR-2018, PGD-adversarial training is the only empirical defense that has not been further attacked (Athalye, Carlini, and Wagner 2018; Athalye and Carlini 2018).”
On Adaptive Attacks to Adversarial Example Defenses (2020, background): “There have been a number of defenses proposed with a similar randomized pre-processing step (Prakash et al., 2018; Guo et al., 2018) which have been broken by adaptive attacks (Athalye et al., 2018a; Athalye & Carlini, 2018).”
NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (2019, methodology): “T RANS , T HERM , and T HERM - DAV come from (Athalye et al., 2018), the defended models of G UIDED DENOISER and P IXEL DEFLECTION are based on (Athalye & Carlini, 2018), and the models defended by RSE, C AS - ADV , A DV - TRAIN , and A DV -GAN are respectively from the original papers.”
On the Robustness of Semantic Segmentation Models to Adversarial Attacks (2017, background): “This is not the case for many recently proposed defenses [41, 86, 13, 56] which have all subsequently been defeated [17, 5, 85, 4].”
Adversarial Attacks and Defenses in Deep Learning (2020, background): “However, many recent works [17,84,114,115] show that those schemes are not as effective as they claim to be.”
Logit Pairing Methods Can Fool Gradient-Based Attacks (2018, methodology): “Given the recent history of breaking most of the heuristical defenses accepted at ICLR 2018 in [Athalye et al., 2018], it is now natural to question any new heuristical defense.”
Recent Advances in Adversarial Training for Adversarial Robustness (2021, methodology): “Adversarial training is widely accepted as the most effective method in practice to improve the adversarial robustness of deep learning models [Athalye and Carlini, 2018].”
Towards Deep Learning Models Resistant to Large Perturbations (2020, methodology): “However, most of these methods have been shown to be ineffective (Athalye & Carlini, 2018; Athalye et al., 2018; Carlini, 2019; Carlini & Wagner, 2016; 2017), while many others are shown to lack scalability to large networks that are expressive enough to solve problems like ImageNet (Cohen et al.,…”
Simple Black-box Adversarial Attacks (2019, background): “Seemingly all models for classiﬁcation of natural images are susceptible to white-box attacks (Athalye et al., 2018), which indicates that natural images tend to be close to decision boundaries learned by machine learning classiﬁers.”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “However, often these defenses can be broken by considering adaptive attacks [13, 15, 5, 6].”