MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples

By Nicholas Carlini, David A. Wagner. 2017

257 citations recorded by the source corpus.

MagNet and "Efficient Defenses..." were recently proposed as a defense to adversarial examples. We find that we can construct adversarial examples that defeat these defenses with only a slight increase in distortion.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Online Adversarial Attacks (2021, methodology): “The classical secretary problem was originally proposed by Gardner [1960] and later solved in Dynkin [1963] with an (1/e)-optimal algorithm. Kleinberg [2005] introduced the k-secretary problem and an asymptotically optimal algorithm which achieves a competitive ratio of 1−Θ( √ 1/k).”
Adversarial Example Games (2020, background): “A popular setting in previous research is to focus on generating optimal attacks on a single classifier f [13, 53].”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “A number of defenses have been proposed [43], [44], [45], [46], [47], yet many have shown to be less effective against an adaptive adversary [48], [49], [50], [51].”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “Much of what we describe below has been discussed in prior work (Carlini & Wagner, 2017a; Madry et al., 2018); we repeat these points here and offer our own perspective for completeness.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, methodology): “Several methods train neural networks to project an image on the manifold [33, 42] but these are end-to-end diﬀerentiable and hence easy to attack [9].”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “According to their further study [96], [97], C&W’s Attack is effective for most of existing adversarial detecting defenses.”
One Pixel Attack for Fooling Deep Neural Networks (2017, background): “However, recent studies show that many of these defense and detection methods can be effectively evaded by conducting little modification on the original attacks [44], [45], [59].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “It is noteworthy that Carlini and Wagner [188] very recently demonstrated that this defense technique can also be defeated with slightly larger perturbations.”
On Evaluating Adversarial Robustness (2019, background): “Carlini & Wagner (2017a) considered this scenario only to demonstrate that some defenses were completely ineffective even against this very weak threat model.”
Evaluating and Understanding the Robustness of Adversarial Logit Pairing (2018, background): “Unfortunately, many proposed defenses have had their claims invalidated by new attacks within their corresponding threat models [4, 8, 5, 6, 2, 12, 1].”
Are adversarial examples inevitable? (2018, methodology): “Approaches based on auto-encoders (Meng & Chen, 2017) and GANs (Shen et al., 2017) were broken using optimization-based attacks (Carlini & Wagner, 2017b;a).”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, methodology): “Indeed, many of these defensive mechanism have been shown to be ineffective when more advanced attacks are used (Carlini & Wagner, 2017c;a;b; He et al., 2017).”
Certified Adversarial Robustness with Additive Noise (2018, background): “Note improving robustness to added Gaussian noise as a way of improving adversarial robustness has been proposed by [28] and was later shown ineffective [29].”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “These approaches have shown limited success on the image domain [4, 18] (where they were originally proposed) but we evaluate them here for completeness.”
Understanding the One Pixel Attack: Propagation Maps and Locality Analysis (2019, background): “(Carlini & Wagner, 2017c).”
Adversarial Examples on Object Recognition (2020, background): “Carlini and Wagner [24] also questioned this hypothesis by developing attacks that can easily bypass adversarial detectors.”
Model Agnostic Dual Quality Assessment for Adversarial Machine Learning and an Analysis of Current Neural Networks and Defenses (2019, background): “Having said that, many detection systems might fail when adversarial samples differ from test conditions [21], [22].”
DeepFense: Online Accelerated Defense Against Adversarial Deep Learning (2017, methodology): “The existing countermeasures, however, encounter (at least) two sets of limitations: (i) Although the prior-art methods have reported promising results in addressing adversarial attacks in black-box settings [8–10], their performance has been shown to significantly drop in white-box scenarios where ”
MixTrain: Scalable Training of Formally Robust Neural Networks (2018, unknown): “Thus, stronger attacks still can be proposed to break them [47], [14], [48], [49], [13], [50], [51], [12], [52], [53], [54], [55], [56], [57].”