THERMOMETER ENCODING: ONE HOT WAY TO RESIST

By Adversarial Examples. 2017

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Unsupervised Learning of Object Keypoints for Perception and Control (2019, methodology): “Specifically, the agent observes the thermometer encoded [2] keypoint coordinates Ψ(xt), and also the features Φ(xt) under the keypoint locations obtained by spatially averaging the feature tensor (Φ) multiplied with (Gaussian) heat-maps (HΨ).”
Fast is better than free: Revisiting adversarial training (2020, methodology): “Adversarial defenses span a wide range of methods, such as preprocessing techniques (Guo et al., 2017; Buckman et al., 2018; Song et al., 2017), detection algorithms (Metzen et al., 2017; Feinman et al., 2017; Carlini & Wagner, 2017a), verification and provable defenses (Katz et al., 2017; Sinha et…”
Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality (2020, methodology): “These methods span an extremely wide spectrum including certiﬁcation [Raghunathan et al., 2018, Wong and Kolter, 2017], input transformation [Buckman et al., 2018, Guo et al., 2017], randomization [Xie et al., 2017], adversarial training Madry et al. [2018], etc. Recent studies on evaluating the…”
Overfitting in adversarially robust deep learning (2020, background): “…et al., 2017), and a large number of adversarial defenses were shown to be relying on obfus-cated gradients and ultimately rendered ineffective (Athalye et al., 2018), including thermometer encoding (Buckman et al., 2018) and various preprocessing techniques (Guo et al., 2017; Song et al., 2017).”
NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (2019, methodology): “We consider 13 defenses recently developed: adversarial training (A DV - TRAIN ) (Madry et al., 2018), adversarial training of Bayesian DNNs (A DV -BNN) (Liu et al., 2019), Thermometer encoding (T HERM ) (Buckman et al., 2018), T HERM -”
Adversarial Robustness through Local Linearization (2019, background): “Of the many approaches proposed [19, 2, 6, 21, 15, 17], adversarial training [14, 16] is empirically the best performing algorithm to train networks robust to adversarial perturbations.”
Logit Pairing Methods Can Fool Gradient-Based Attacks (2018, background): “Many recent papers [Buckman et al., 2018, Kannan et al., 2018, Yao et al., 2018] that claim robustness of their models mainly rely on the PGD attack from [Madry et al., 2017] with the default settings.”
The Pitfalls of Simplicity Bias in Neural Networks (2020, background): “Defense strategies based on heuristics such as feature squeezing [76], denoising [75], encoding [10], specialized nonlinearities [77] and distillation [53] have had limited success against stronger attacks [2].”