Thermometer Encoding: One Hot Way To Resist Adversarial Examples

By Jacob Buckman, Aurko Roy, Colin Raffel, Ian J. Goodfellow. 2018

647 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Example Games (2020, methodology): “Such an application falls in line with other general approaches to red teaming AI systems [10] and veriﬁability in AI development.”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “These defenses include model distialltion [44], automated detection of adversarial examples [22], [41], [40], application of different input transformations [27], [10], randomization [21], [11], and application of generative models [49], [25], [60].”
Adversarial Training for Free! (2019, background): “Adversarial training can be traced back to [Goodfellow et al., 2015 [Xie et al., 2019], Defensive Quantization [Lin et al., 2019], Thermometer Encoding [Buckman et al., 2018], PixelDefend [Song et al., 2017], Robust Manifold Defense [Ilyas et al., 2017], L2-nonexpansive nets [Qian and Wegman, 2018],”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “We have found applying BPDA is often necessary: replacing f i(·) with g(·) on both the forward and backward pass is either completely ineffective (e.g. with Song et al. (2018)) or many times less effective (e.g. with Buckman et al. (2018)).”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “chers to always consider both white-box and black-box adversaries when evaluating defensive strategies. Notably, a similar discrepancy between white-box and black-box attacks was recently observed in Buckman et al. (2018). Attacks crafted on adversarial models are found to be weaker even against und”
Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, methodology): “Most of the later works [19, 36] have followed this path to supplement their defense with adversarial training.”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “It is worth mentioning that there are many defense algorithms ( r.f. [3,19,13,8,36,27,25]) against white box attacks in literature.”
Unsupervised Learning of Object Keypoints for Perception and Control (2019, methodology): “nt of the neural ﬁtted Q-learning framework [30] with learned keypoints as input and a recurrent neural network Q function to output behaviors. Speciﬁcally, the agent observes the thermometer encoded [2] keypoint coordinates (x t), and also the features ( x t)under the keypoint locations obtained by”
Towards the first adversarially robust neural network model on MNIST (2018, background): “• Preprocessing: Inputs or hidden activations are quantized, projected into a different representation or are otherwise preprocessed (Buckman et al., 2018; Guo et al., 2018; Kabilan et al., 2018).”
Adversarial Logit Pairing (2018, methodology): “Multiple methods to defend against adversarial examples have been proposed (Buckman et al., 2018; Goodfellow et al., 2014; Kolter & Wong, 2017; Madry et al., 2017; Papernot et al., 2016; Szegedy et al., 2013; Tram`er et al., 2018; Xu et al., 2017).”
Interpretation of Neural Networks is Fragile (2017, background): “…of high dimensionality and non-linearity (see section 5), we believe that techniques that discretize inputs, such as thermometer encoding (Buckman et al. 2018), and train neural networks in a way to constrain the non-linearity of the network (Cisse et al. 2017a), may be useful in…”
Are adversarial examples inevitable? (2018, background): “…by Athalye et al. (2018) and Athalye & Sutskever (2017) that broke an entire suite of defenses presented in ICLR 2018 including thermometer encoding (Buckman et al., 2018), detection using local intrinsic dimensionality (Ma et al., 2018), input transformations such as compression and image…”
Fast is better than free: Revisiting adversarial training (2020, methodology): “Adversarial defenses span a wide range of methods, such as preprocessing techniques (Guo et al., 2017; Buckman et al., 2018; Song et al., 2017), detection algorithms (Metzen et al., 2017; Feinman et al., 2017; Carlini & Wagner, 2017a), veriﬁcation and provable defenses (Katz et al., 2017; Sinha et…”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
Adversarial Attack on Graph Structured Data (2018, background): “There are also some works working on the attack with discrete functions (Buckman et al., 2018) but not the combinatorial structures.”