Extending Defensive Distillation

By Nicolas Papernot, Patrick Drew McDaniel. 2017

124 citations recorded by the source corpus.

Machine learning is vulnerable to adversarial examples: inputs carefully modified to force misclassification. Designing defenses against such inputs remains largely an open problem. In this work, we revisit defensive distillation---which is one of the mechanisms proposed to mitigate adversarial examples---to address its limitations. We view our results not only as an effective way of addressing some of the recently discovered attacks but also as reinforcing the importance of improved training techniques.

Subfields: Artificial Intelligence, Computational Theory and Mathematics

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computational Theory and Mathematics

Citations in the corpus

ZOO: Zeroth Order Optimization Based Black-box Attacks to Deep Neural Networks without Training Substitute Models (2017, background): “An extended version has been proposed to enhance its defense performance by incorporating model-agnostic uncertainty into retraining [33].”
DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, background): “This observation has inspired several researchers to try to improve the robustness and reliability of DNNs [9, 13, 17, 30, 32, 46, 51, 53, 62, 84, 89, 90].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “Moreover, in a follow-up work, Papernot and McDaniel [84] also extended the defensive distillation method by addressing the numerical instabilities that were encountered in [38].”
Adversarial Attacks and Defences: A Survey (2018, neutral): “[59, 62] recently proposed using it as a defensive mechanism against adversarial example crafting methods.”
DeepTest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars (2017, background): “Several prior works have explored defenses against these attacks with different effectiveness [28, 31, 34, 37, 40, 42, 47, 56, 63, 67, 73, 76, 79, 83, 85].”
Attack Strength vs. Detectability Dilemma in Adversarial Machine Learning (2018, background): “Much of the research in defending deep learning models has gone into increasing the robustness of the model though either adversarial training [32]–[34] or defensive distillation [35], [36].”
APE-GAN: Adversarial Perturbation Elimination with GAN (2017, background): “Adversarial training [6, 27] or defensive distillation [18, 22] belongs to this class.”
A survey on adversarial attacks and defences (2021, background): “Papernot et al. [23,73] showed that distillation [22] can be used as a adversarial training technique so that the model is less susceptible to adversarial inputs.”
MixTrain: Scalable Training of Formally Robust Neural Networks (2018, unknown): “Various defensive system are given [39], [9], [10], [40], [41], [42], [43], [44], [45], [46].”
Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning (2020, background): “Approaches range from adding stochasticity [7], to label smoothening and feature squeezing [27, 38], to denoising and training on adversarial examples [22, 19].”
Review of Artificial Intelligence Adversarial Attack and Defense Technologies (2019, background): “[50] proposed extensible defense distillation technology to guarantee the effectiveness in black-box attacks.”
Adversarially Robust Neural Architectures (2020, unknown): “Gradient Masking methods hided the gradient information to confound the adversaries [38], [39], however, they cannot defend attacks based on approximate gradient [40].”
Domain Robustness in Neural Machine Translation (2019, background): “Another application is defensive distillation (Papernot et al., 2016; Carlini and Wagner, 2017; Papernot and McDaniel, 2017), where the student shares the network architecture with the teacher, with the purpose not being model compression, but improving the model’s generalization to samples outside ”
Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight (2017, background): “Methods in this category include adversarial training [12, 18] and defensive distillation [31, 34].”