Fetching the paper…

Reading the bibliography…

2018

Towards the first adversarially robust neural network model on MNIST

Schott, Lukas, Rauber, Jonas, Bethge, Matthias et al.

Original
PDF
Post on X

Understand

Despite much effort, deep neural networks remain highly susceptible to tiny input perturbations and even for MNIST, one of the most common toy datasets in computer vision, no neural network model exists for which adversarial perturbations are large and make semantic sense to humans.

We show that even the widely recognized and by far most successful defense by Madry et al.
(1) overfits on the L-infinity metric (it's highly susceptible to L2 and L0 perturbations), (2) classifies unrecognizable images with high certainty, (3) performs not much better than simple input binarization and (4) features adversarial perturbations that make little sense to humans.
These results suggest that MNIST is far from being solved in terms of adversarial robustness.

Towards the first adversarially robust neural network model on MNIST · Around

Built on

Estimating or propagating gradients through stochastic neurons for conditional computation
Original
Yoshua Bengio, Nicholas Léonard, and Aaron Courville · 2013
Earlier work this paper cites.
Auto-encoding variational bayes
Original
Diederik P Kingma and Max Welling · 2013
Earlier work this paper cites.
Intriguing properties of neural networks
Original
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus · 2013
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Original
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy · 2014
Earlier work this paper cites.
Towards deep neural network architectures robust to adversarial examples
Original
Shixiang Gu and Luca Rigazio · 2014
Earlier work this paper cites.
Adam: A method for stochastic optimization
Original
Diederik P Kingma and Jimmy Ba · 2014
Earlier work this paper cites.
Fast and accurate deep network learning by exponential linear units (elus)
Original
Djork-Arné Clevert, Thomas Unterthiner, and Sepp Hochreiter · 2015
Earlier work this paper cites.
Batch normalization: Accelerating deep network training by reducing internal covariate shift
Original
Sergey Ioffe and Christian Szegedy · 2015
Earlier work this paper cites.
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Anh Nguyen, Jason Yosinski, and Jeff Clune · 2015
Earlier work this paper cites.
Adversarial examples in the physical world
Original
Alexey Kurakin, Ian Goodfellow, and Samy Bengio · 2016
Earlier work this paper cites.
Comment on “biologically inspired protection of deep networks from adversarial attacks”
Original
W. Brendel and M. Bethge · 2017
Earlier work this paper cites.
Boosting adversarial attacks with momentum. arxiv preprint
Original
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Xiaolin Hu, Jianguo Li, and Jun Zhu · 2017
Earlier work this paper cites.
Formal guarantees on the robustness of a classifier against adversarial manipulation
Matthias Hein and Maksym Andriushchenko · 2017
Earlier work this paper cites.

Similar

The robust manifold defense: Adversarial training using generative models
Original
Andrew Ilyas, Ajil Jalal, Eirini Asteri, Constantinos Daskalakis, and Alexandros G Dimakis · 2017
Cited alongside, same era.
Defense against adversarial attacks using high-level representation guided denoiser
Original
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Jun Zhu, and Xiaolin Hu · 2017
Cited alongside, same era.
Magnet: a two-pronged defense against adversarial examples
Dongyu Meng and Hao Chen · 2017
Cited alongside, same era.
Foolbox: A python toolbox to benchmark the robustness of machine learning models
Original
Jonas Rauber, Wieland Brendel, and Matthias Bethge · 2017
Cited alongside, same era.
Ape-gan: Adversarial perturbation elimination with gan
Original

Then

Countering adversarial images using input transformations
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten · 2018
Closest in time.
Black-box adversarial attacks with limited queries and information
Original
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin · 2018
Closest in time.
Vectordefense: Vectorization as a defense to adversarial examples
Original
Vishaal Munusamy Kabilan, Brandon Morris, and Anh Nguyen · 2018
Closest in time.
Towards deep learning models resistant to adversarial attacks
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu · 2018
Closest in time.
Deflecting adversarial attacks with pixel deflection
Original
Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer · 2018
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Shiwei Shen, Guoqing Jin, Ke Gao, and Yongdong Zhang · 2017

Cited alongside, same era.

Ensemble adversarial training: Attacks and defenses

Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel · 2017

Cited alongside, same era.

On the robustness of the cvpr 2018 white-box adversarial example defenses

Anish Athalye and Nicholas Carlini · 2018

Cited alongside, same era.

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Anish Athalye, Nicholas Carlini, and David Wagner · 2018

Cited alongside, same era.

Decision-based adversarial attacks: Reliable attacks against black-box machine learning models

Wieland Brendel, Jonas Rauber, and Matthias Bethge · 2018

Cited alongside, same era.

Thermometer encoding: One hot way to resist adversarial examples

Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow · 2018

Cited alongside, same era.

Stochastic activation pruning for robust adversarial defense

Guneet S. Dhillon, Kamyar Azizzadenesheli, Jeremy D. Bernstein, Jean Kossaifi, Aran Khanna, Zachary C. Lipton, and Animashree Anandkumar · 2018

Cited alongside, same era.

Adversarial spheres

Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow · 2018

Cited alongside, same era.

Certified defenses against adversarial examples

Aditi Raghunathan, Jacob Steinhardt, and Percy Liang · 2018

Closest in time.

Defense-GAN: Protecting classifiers against adversarial attacks using generative models

Pouya Samangouei, Maya Kabkab, and Rama Chellappa · 2018

Closest in time.

Adversarially robust generalization requires more data

Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry · 2018

Closest in time.

Pixeldefend: Leveraging generative models to understand and defend against adversarial examples

Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman · 2018

Closest in time.

Adversarial risk and the dangers of evaluating against weak attacks

Jonathan Uesato, Brendan O’Donoghue, Pushmeet Kohli, and Aaron van den Oord · 2018

Closest in time.

Mitigating adversarial effects through randomization

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille · 2018

Closest in time.

Distributionally adversarial attack

Tianhang Zheng, Changyou Chen, and Kui Ren · 2018

Closest in time.