Logit Pairing Methods Can Fool Gradient-Based Attacks

By Marius Mosbach, Maksym Andriushchenko, Thomas Alexander Trost, Matthias Hein, Dietrich Klakow. 2018

87 citations recorded by the source corpus.

Recently, Kannan et al. [2018] proposed several logit regularization methods to improve the adversarial robustness of classifiers. We show that the computationally fast methods they propose - Clean Logit Pairing (CLP) and Logit Squeezing (LSQ) - just make the gradient-based optimization problem of crafting adversarial examples harder without providing actual robustness. We find that Adversarial Logit Pairing (ALP) may indeed provide robustness against adversarial examples, especially when combined with adversarial training, and we examine it in a variety of settings. However, the increase in adversarial accuracy is much smaller than previously claimed. Finally, our results suggest that the evaluation against an iterative PGD attack relies heavily on the parameters used and may result in false conclusions regarding robustness of a model.

Subfields: Artificial Intelligence, Molecular Biology

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Adversarial Training for Free! (2019, background): “Another popular defense strategy is to regularize the training loss using label smoothing, logit squeezing, or a Jacobian regularization [Shafahi et al., 2019a, Mosbach et al., 2018, Ross and Doshi-Velez, 2018, Hein and Andriushchenko, 2017, Jakubovitz and Giryes, 2018, Yu et al., 2018].”
On Evaluating Adversarial Robustness (2019, neutral): “…Brendel & Bethge, 2017; Carlini & Wagner, 2017a; He et al., 2017; Carlini & Wagner, 2017b; Athalye et al., 2018; Engstrom et al., 2018; Athalye & Carlini, 2018; Uesato et al., 2018; Mosbach et al., 2018; He et al., 2018; Sharma & Chen, 2018; Lu et al., 2018a;b; Cornelius, 2019; Carlini, 2019).”
Fast is better than free: Revisiting adversarial training (2020, background): “…tricks like momentum to improve the adversary (Dong et al., 2018), combination with other heuristic defenses like matrix estimation (Yang et al., 2019) or logit pairing (Mosbach et al., 2018), and generalization to multiple types of adversarial attacks (Tram`er & Boneh, 2019; Maini et al., 2019).”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, methodology): “However, it has been shown that even PGD can fail (Mosbach et al., 2018; Croce et al., 2019b) leading to significant overestimation of robustness: we identify i) the fixed step size and ii) the widely used cross-entropy loss as two reasons for potential failure.”
Intriguing properties of adversarial training (2019, background): “[10, 14] also show that adversarial training with clean images can secure robustness on small datasets, i.”
Improving Robustness using Generated Data (2021, methodology): “It is widely regarded as one of the most successful method to train robust deep neural networks [30], and it has been augmented in different ways – with changes in the attack procedure [25], loss function [50, 82] or model architecture [76, 85].”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “, the step size 80 and the number of iterations) can make the models appear more robust than they actually are [34, 86], 81 especially in the presence of phenomena like gradient obfuscation [5].”
Inverting Gradients - How easy is it to break privacy in federated learning? (2020, methodology): “3,22,1]. As such, we minimize eq. (4) only based on the sign of its gradient, which we optimize with Adam [18] with step size decay. We further augment this \attack" by employing random restarts [27]. Aside from this basic setting, we consider two improvements for special cases. First, for deep”
Metric Learning for Adversarial Robustness (2019, methodology): “However, this method has a distorted loss function and is not scalable to untargeted attack [11, 22].”
Adversarial Robustness Against the Union of Multiple Perturbation Models (2019, methodology): “However, as time goes by, the original robustness claims of these defenses typically don’t hold up to more advanced adversaries or more thorough attacks (Carlini & Wagner, 2017; Engstrom et al., 2018; Mosbach et al., 2018).”
Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack (2019, background): “…have been proposed to fix this issue (Gu & Rigazio, 2015; Zheng et al., 2016; Papernot et al., 2016; Huang et al., 2016; Bastani et al., 2016; Madry et al., 2018), but with limited success, as new more powerful attacks showed (Carlini & Wagner, 2017b; Athalye et al., 2018; Mosbach et al., 2018).”
Data Augmentation Can Improve Robustness (2021, background): “It has been augmented in different ways – with changes in the attack procedure (e.g., by incorporating momentum [16]), loss function (e.g., logit pairing [34]) or model architecture (e.g., feature denoising [56]).”
Provable Robustness of ReLU networks via Maximization of Linear Regions (2018, background): “In the end it turned out that for many proposed defenses there exists still a way to attack the classifier successfully [5, 2, 22], with the notable exception of [19] which was shown to be empirically robust wrt the l∞-norm.”
Square Attack: a query-efficient black-box adversarial attack via random search (2019, methodology): “Gradient-based attacks are most often affected by this phenomenon (white-box attacks but also black-box attacks based on ﬁnite difference approximations [35]).”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, methodology): “It has been augmented in different ways – with changes in the attack procedure (e.g., by incorporating momentum; Dong et al., 2018), loss function (e.g., logit pairing; Mosbach et al., 2018) or model architecture (e.g., feature denoising; Xie et al., 2019).”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, background): “, 2017), loss function (e.g., logit pairing; Mosbach et al., 2018) or model architecture (e.”