On the Effectiveness of Defensive Distillation

By Nicolas Papernot, Patrick Drew McDaniel. 2016

68 citations recorded by the source corpus.

We report experimental results indicating that defensive distillation successfully mitigates adversarial samples crafted using the fast gradient sign method, in addition to those crafted using the Jacobian-based iterative attack on which the defense mechanism was originally evaluated.

Subfields: Artificial Intelligence, Computational Theory and Mathematics, Control and Systems Engineering, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Nicholas Carlini
2. Aleksander Madry
3. Nicolas Papernot
4. Percy Liang
5. Matthias Hein
6. Cho-Jui Hsieh
7. Dimitris Tsipras
8. Michael I. Jordan

In Computational Theory and Mathematics

1. Nicholas Carlini
2. Ajmal Saeed Mian
3. Naveed Akhtar
4. Michael P. Wellman
5. Arunesh Sinha
6. Guy Katz
7. Clark W. Barrett
8. Nicolas Papernot

In Control and Systems Engineering

1. Michael P. Wellman
2. Arunesh Sinha
3. Nicholas Carlini
4. Nicolas Papernot
5. Patrick Drew McDaniel
6. Aleksander Madry
7. Xinyu Xing
8. Sahil Singla

In Safety, Robustness & Interpretability

1. Nicholas Carlini
2. Aleksander Madry
3. Nicolas Papernot
4. Matthias Hein
5. Dimitris Tsipras
6. Patrick Drew McDaniel
7. Ludwig Schmidt
8. Cho-Jui Hsieh

Citations in the corpus

• Towards the Science of Security and Privacy in Machine Learning (2016, methodology): “In experiments with the fast gradient sign method [85] and the Jacobian attack [84], larger perturbations are required to achieve misclassification of adversarial examples by the distilled model.”
• Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “Examples include defensive distillation [3, 16, 17], feature squeezing [30, 10], and several other adversarial example detection approaches [5].”
• Stochastic Activation Pruning for Robust Adversarial Defense (2018, background): “Robustness to adversarial attack has recently emerged as a serious topic in machine learning (Good-fellow et al., 2014; Kurakin et al., 2016; Papernot & McDaniel, 2016; Tramèr et al., 2017b; Fawzi et al., 2018).”
• SoK: Security and Privacy in Machine Learning (2018, methodology): “In experiments with the fast gradient sign method [84] and the Jacobian attack [83], larger perturbations are required to achieve misclassification of adversarial examples by the distilled model.”
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “Further empirical evidence in this regard is also provided in [108].”
• Certifiably Robust Interpretation in Deep Learning (2019, background): “[12, 13, 14, 15, 16, 17, 18, 19, 20, 21]), to the best of our knowledge, there is no practical defense for deep learning interpretation against adversarial examples [22].”
• DeepSafe: A Data-driven Approach for Checking Adversarial Robustness in Neural Networks (2017, background): “Orthogonal approaches have also been proposed for training networks that are robust against adversarial perturbations, but these, too, provide no formal assurances [16].”
• Learning Adversary-Resistant Deep Neural Networks (2016, result): “This experiment result is consistent with that reported in [26].”
• Evaluation and Design of Robust Neural Network Defenses (2018, background): “However, something interesting happens if we attempt the same division trick and divide the logits by T before feeding them to the softmax function: distillation still remains effective [99].”