Synthesizing Robust Adversarial Examples

By Anish Athalye, Ilya Sutskever. 2017

95 citations recorded by the source corpus.

Neural networks are susceptible to adversarial examples: small, carefully-crafted perturbations can cause networks to misclassify inputs in arbitrarily chosen ways. However, some studies have showed that adversarial examples crafted following the usual methods are not tolerant to small transformations: for example, zooming in on an adversarial image can cause it to be classified correctly again. This raises the question of whether adversarial examples are a concern in practice, because many real-world systems capture images from multiple scales and perspectives. This paper shows that adversarial examples can be made robust to distributions of transformations. Our approach produces single images that are simultaneously adversarial under all transformations in a chosen distribution, showing that we cannot rely on transformations such as rescaling, translation, and rotation to protect against adversarial examples.

Subfields: Artificial Intelligence, Hardware and Architecture, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, neutral): “Therefore, their result of minutely perturbing the geometry is effectively similar to that of perturbing textures [6].”
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, background): “Some examples include wearing adversarial 3D printed glasses to fool facial recognition (Sharif et al., 2017), the use of adversarial grafﬁti to attack trafﬁc sign classiﬁcation (Eykholt et al., 2018), and printing adversarial textures on objects to attack image classiﬁers (Athalye et al., 2018b).”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, positive): “We compute gradients of randomized defenses by applying Expectation Over Transformation (Athalye et al., 2017).”
Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition (2019, methodology): “In the same manner as the Expectation over Transformation in (Athalye et al., 2018), we optimize the expectation of the loss function over different transformations t ∼ T as follows: Rather than directly targeting f ( x + δ ) = y , we apply the loss function l net (the cross entropy loss in the…”
LiveSketch: Query Perturbations for Guided Sketch-Based Visual Search (2019, background): “The manipulation of input imagery with the goal of affecting change in the output embedding is common in the context of adversarial perturbations (APs) where image pixels are altered to change the clas-siﬁcation (softmax) output of a CNN [24, 2].”
Defining Explainable AI for Requirements Analysis (2018, unknown): “After all, if an image recognition system on an autonomous military agent incorrectly recognises a turtle as a weapon [1], then not only would the humans in charge be interested in knowing the Attribute explanation but they would also want the Model explanation, which may suggest where else the…”