Synthesizing Robust Adversarial Examples

By Anish Athalye, Logan Engstrom, Andrew Ilyas, Kevin Tsz Chun Kwok. 2017

1,876 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Natural Adversarial Examples (2019, background): “Other work has shown how to print 2D [32, 5] or 3D [38, 1] objects that fool classiﬁers.”
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, methodology): “Therefore, their result of minutely perturbing the geometry is effectively similar to that of perturbing textures [5].”
Your Classifier is Secretly an Energy Based Model and You Should Treat it Like One (2019, background): “Recent work (Athalye et al., 2017) has demonstrated that classifiers trained to be adversarially robust can be re-purposed to generate convincing images, do in-painting, and translate examples from one class to another.”
Adversarial Example Games (2020, background): “Adversarial attacks on deep neural nets expose critical vulnerabilities in traditional machine learning systems [53, 3, 61, 8].”
Why do deep convolutional networks generalize so poorly to small image transformations? (2018, background): “Despite the excellent performance of CNNs on object recognition, the vulnerability to adversarial attacks suggests that superficial changes can result in highly non-human shifts in prediction [43, 35, 26, 1, 15, 41, 3, 40].”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, background): “However, [3] demonstrated a new attack strategy that is robust to rotation and scaling.”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “We refer the reader to [6] for further details, and to [74] (and references therein) for the problem of generating adversarial examples in the physical world.”
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, background): “…& Wagner, 2017), realistic transformations seen by vehicles were thought to be safe un- til more robust adversarial examples were created (Lu et al., 2017; Athalye et al., 2018b), and many defenses submitted to ICLR 2018 were broken before the review period even finished (Athalye et al., 2018a).”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, methodology): “More speciﬁcally we consider an adversary that makes use of localized universal malicious objects, e.g., printed patches [26], [3], [10], [9] or 3D objects [2] (see, e.g., Figure 1), that can fool a model under real-world conditions such as lighting, sensor noise, and rotation.”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “We compute gradients of randomized defenses by applying Expectation Over Transformation (Athalye et al., 2017).”
A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations (2017, methodology): “There is a long line of work (Szegedy et al., 2013; Goodfellow et al., 2014; Kurakin et al., 2016a;b; Sharif et al., 2016; Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2016; Papernot et al., 2017; Madry et al., 2017; Athalye et al., 2017) on methods for constructing adversarial perturbations Equ”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, background): “Defense based on randomization could be overcome by the Expectation Over Transformation technique proposed by [2] which consists in taking the expectation over the network to craft the perturbation.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “These adversarial examples are barely perceivable to humans, can be targeted to create desired labels even with black-box access to the classiﬁers and can be made robust as real objects in the physical world [36, 26, 5].”
Provable defenses against adversarial examples via the convex outer adversarial polytope (2017, background): “There is no need to worry about adversarial examples under “realistic” settings of rotation and scaling [Lu et al., 2017] until there is [Athalye and Sutskever, 2017].”
Evolving Robust Neural Architectures to Defend from Adversarial Attacks (2019, background): “ shown to behave strangely for nearly the same images [35]. Afterwards, a series of vulnerabilities were found [25],[23],[5],[34]. Such attacks can also be easily applied to real world scenarios [16],[2] which confers a big problem for current deep neural networks’ applications. Currently, there is ”