Attacking the Madry Defense Model with L1-based Adversarial Examples

By Yash Sharma, Pin-Yu Chen. 2017

120 citations recorded by the source corpus.

The Madry Lab recently hosted a competition designed to test the robustness of their adversarially trained MNIST model. Attacks were constrained to perturb each pixel of the input image by a scaled maximal $L_\infty$ distortion $\epsilon$ = 0.3. This discourages the use of attacks which are not optimized on the $L_\infty$ distortion metric. Our experimental results demonstrate that by relaxing the $L_\infty$ constraint of the competition, the elastic-net attack to deep neural networks (EAD) can generate transferable adversarial examples which, despite their high average $L_\infty$ distortion, have minimal visual distortion. These results call into question the use of $L_\infty$ as a sole measure for visual distortion, and further demonstrate the power of EAD at generating robust adversarial examples.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

On Evaluating Adversarial Robustness (2019, background): “However, at this time the authors need to completely 5See for example the work of Sharma & Chen (2017); Song et al. (2018) who explicitly step outside of the threat model of the original defenses to evaluate their robustness. switch their frame of mind and try as hard as possible to show their…”
Adversarial Patch (2017, background): “Indeed recent work has demonstrated that state-of-the art adversarially trained models on MNIST are still vulnerable to larger perturbations than those used in training either by searching for a nearby adversarial example using a different metric for distance [14], or by applying large perturbations”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, methodology): “However, this method remains sensitive to slightly larger perturbations (Sharma & Chen, 2017).”
Disentangling Adversarial Robustness and Generalization (2018, background): “Generalization: Research also includes independent benchmarks of attacks and defenses [13, 15, 5, 6, 85], their properties [57, 84], as well as theoretical questions [34, 42, 23, 99, 27, 88, 102, 104].”
Transfer of Adversarial Robustness Between Perturbation Types (2019, background): “Prior work in this area (Sharma & Chen, 2017; Jordan et al., 2019; Tram`er & Boneh, 2019) has studied transfer using single values of ε for each attack on lower resolution datasets; we believe our larger-scale study provides a more comprehensive and interpretable view on transfer between these…”
Adversarial Spheres (2018, background): “Although this did increase the size, , of the perturbation needed to reliably produce an error, local errors still remain for larger than those adversarially trained for (Sharma & Chen, 2017).”
Adversarial Attacks and Defenses in Deep Learning (2020, background): “Moreover, Sharma and Chen [78] also show that EAD and CW 2 can bypass the input squeezing system with increasing adversary strength.”
Adversarial Training Versus Weight Decay (2018, background): “However, there is growing concern that this L ∞ norm threat model is unrealistically weak (Sharma and Chen, 2017; Tram ` er et al., 2018; Athalye et al., 2018; Galloway et al., 2018).”
Second-Order Adversarial Attack and Certifiable Robustness (2018, background): “Considering that Sharma & Chen (2017) has proposed (cid:96) 1 -based adversarial examples that breaks the Madry’s model, we believe the robustness of adversarially trained model may overﬁt to the choice of norms.”