Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Understand

Ongoing research has proposed several methods to defend neural networks against adversarial examples, many of which researchers have shown to be ineffective.

• We ask whether a strong defense can be created by combining multiple (possibly weak) defenses.
• To answer this question, we study three defenses that follow this approach.
• Two of these are recently proposed defenses that intentionally combine components designed to work well together.