Adversarial Attacks and Defences Competition

By Alexey Kurakin, Ian J. Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie and 12 more. 2018

353 citations recorded by the source corpus.

To accelerate research on adversarial examples and robustness of machine learning classifiers, Google Brain organized a NIPS 2017 competition that encouraged researchers to develop new methods to generate adversarial examples as well as to develop new ways to defend against them. In this chapter, we describe the structure and organization of the competition and the solutions developed by several of the top-placing teams.

Subfields: Artificial Intelligence, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “Google Brain organized three competitions in NIPS 2017 competition track, including targeted adversarial attack, nontargeted adversarial attack, and defense against adversarial attack [146].”
Scaling provable adversarial defenses (2018, methodology): “…also been some methods that have proven empirically resistant to the current suite of attacks; the recent NIPS 2017 adversarial example challenge [Kurakin et al., 2018], for example, highlights some of the progress made on developing classiﬁers that appear much stronger in practice than many…”
Technical Report on the CleverHans v2.1.0 Adversarial Examples Library (2016, methodology): “BIM with incorporated momentum applied to an ensemble of models won ﬁrst place in both the NIPS 2017 Non-Targeted and Targeted Adversarial Attack Competitions [16].”
Unrestricted Adversarial Examples (2018, background): “Unlike prior contests (e.g., the 2017 NIPS Adversarial Examples Contest [Kurakin et al., 2018]), our contest (a) is ongoing with no ﬁxed end-date, (b) is fully white-box, and (c) allows completely unrestricted attacks.”
Are Generative Classifiers More Robust to Adversarial Attacks? (2018, background): “This denoising approach has been extensively investigated, and the “denoisers” in usage include generative adversarial networks (Samangouei et al., 2018), PixelCNNs (Song et al., 2018) and denoising auto-encoders (Kurakin et al., 2018).”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “The two challenges [79, 10] hosted at NeurIPS 2017 and 2018 aimed at finding the most robust models for specific attacks, but they had a predefined deadline, so they could capture the best defenses only at the time of the competition.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “Among them, HGD [32] and R&P [61] are the rank-1 submission and rank-2 submission in the NeurIPS 2017 defense competition [30], respectively.”
Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “Model Ensemble: An effective defense strategy in practice is to construct an ensemble of individual models [29].”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “, 2020) and dominated the winner solutions in adversarial competitions (Kurakin et al., 2018; Brendel et al., 2020).”
Bag of Tricks for Adversarial Training (2020, background): “The idea of adversarial training (AT) stems from the seminal work of Goodfellow et al. (2015), while other AT frameworks like PGD-AT (Madry et al., 2018) and TRADES (Zhang et al., 2019b) occupied the winner solutions in the adversarial competitions (Kurakin et al., 2018; Brendel et al., 2020).”
Action Robust Reinforcement Learning and Applications in Continuous Control (2019, methodology): “Similar to our approach, when using GANs for robustness, an adversary learns to create small perturbations in the input data in an attempt to cause a misclassification (Xiao et al., 2018; Samangouei et al., 2018; Kurakin et al., 2018).”
Adversarial Vision Challenge (2018, methodology): “NIPS 2017 Competition on adversarial attacks and defenses [16] .”
Improving Transferability of Adversarial Examples With Input Diversity (2018, methodology): “In order to verify the effectiveness of our proposed attack methods in practice, we here reproduce the top defense entries and official baselines from NIPS 2017 adversarial competition [17] for testing transferability.”