2020

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

Croce, Francesco, Hein, Matthias

Understand

The field of defense strategies against adversarial attacks has significantly grown over the last years, but progress is hampered as the evaluation of adversarial defenses is often insufficient and thus gives a wrong impression of robustness.

Many promising defenses could be broken later on, making it difficult to identify the state-of-the-art.
Frequent pitfalls in the evaluation are improper tuning of hyperparameters of the attacks, gradient obfuscation or masking.
In this paper we first propose two extensions of the PGD-attack overcoming failures due to suboptimal step size and problems of the objective function.

Built on

Explaining and harnessing adversarial examples
Goodfellow, I. J., Shlens, J., and Szegedy, C · 2015
Earlier work this paper cites.
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., and Bengio, S · 2017
Earlier work this paper cites.
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., and Wagner, D. A · 2018
Earlier work this paper cites.
Towards deep learning models resistant to adversarial attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Valdu, A · 2018
Earlier work this paper cites.
Differentiable abstract interpretation for provably robust neural networks
Mirman, M., Gehr, T., and Vechev, M · 2018
Earlier work this paper cites.
Logit pairing methods can fool gradient-based attacks
Mosbach, M., Andriushchenko, M., Trost, T., Hein, M., and Klakow, D · 2018
Earlier work this paper cites.
Scaling provable adversarial defenses
Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z · 2018
Earlier work this paper cites.
Are labels required for improving adversarial robustness?
Alayrac, J.-B., Uesato, J., Huang, P.-S., Fawzi, A., Stanforth, R., and Kohli, P · 2019
Earlier work this paper cites.
Controlling neural level sets
Atzmon, M., Haim, N., Yariv, L., Israelov, O., Maron, H., and Lipman, Y · 2019
Earlier work this paper cites.
On evaluating adversarial robustness
Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Madry, A., and Kurakin, A · 2019
Earlier work this paper cites.
Unlabeled data improves adversarial robustness
Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J. C., and Liang, P. S · 2019
Earlier work this paper cites.
Certified adversarial robustness via randomized smoothing
Cohen, J. M., Rosenfeld, E., and Kolter, J. Z · 2019
Earlier work this paper cites.
AdverTorch v0.1: An adversarial robustness toolbox based on pytorch
Original
Ding, G. W., Wang, L., and Jin, X · 2019
Earlier work this paper cites.
Robustness (python library), 2019
Engstrom, L., Ilyas, A., Santurkar, S., and Tsipras, D · 2019
Earlier work this paper cites.
On the effectiveness of interval bound propagation for training verifiably robust models
Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arandjelovic, R., Mann, T. A., and Kohli, P · 2019
Earlier work this paper cites.
Using pre-training can improve model robustness and uncertainty
Hendrycks, D., Lee, K., and Mazeika, M · 2019
Earlier work this paper cites.

Similar

Adversarial defense via learning to generate diverse attacks
Jang, Y., Zhao, T., Hong, S., and Lee, H · 2019
Cited alongside, same era.
Harnessing the vulnerability of latent layers in adversarially trained models
Kumari, N., Singh, M., Sinha, A., Machiraju, H., Krishnamurthy, B., and Balasubramanian, V. N · 2019
Cited alongside, same era.
Certified robustness to adversarial examples with differential privacy
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S · 2019
Cited alongside, same era.
Certified adversarial robustness with additive noise
Li, B., Chen, C., Wang, W., and Carin, L · 2019
Cited alongside, same era.
Metric learning for adversarial robustness
Mao, C., Zhong, Z., Yang, J., Vondrick, C., and Ray, B · 2019
Cited alongside, same era.
Robustness via curvature regularization, and vice versa
Moosavi-Dezfooli, S.-M., Fawzi, A., Uesato, J., and Frossard, P · 2019
Cited alongside, same era.
Adversarial defense by restricting the hidden space of deep neural networks
Mustafa, A., Khan, S., Hayat, M., Goecke, R., Shen, J., and Shao, L · 2019
Cited alongside, same era.
Improving adversarial robustness via promoting ensemble diversity
Pang, T., Xu, K., Du, C., Chen, N., and Zhu, J · 2019
Cited alongside, same era.
Adversarial robustness through local linearization
Qin, C., Martens, J., Gowal, S., Krishnan, D., Dvijotham, K., Fawzi, A., De, S., Stanforth, R., and Kohli, P · 2019
Cited alongside, same era.
Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses
Rony, J., Hafemann, L. G., Oliveira, L. S., Ayed, I. B., Sabourin, R., and Granger, E · 2019
Cited alongside, same era.
Adversarial training for free!
Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T · 2019
Cited alongside, same era.
Improving the generalization of adversarial training with domain adaptation
Song, C., He, K., Wang, L., and Hopcroft, J. E · 2019
Cited alongside, same era.

Then

ME-net: Towards effective adversarial robustness with matrix estimation
Yang, Y., Zhang, G., Katabi, D., and Xu, Z · 2019
Later among the works it cites.
Defense against adversarial attacks using feature scattering-based adversarial training
Zhang, H. and Wang, J · 2019
Later among the works it cites.
Square attack: a query-efficient black-box adversarial attack via random search
Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M · 2020
Closest in time.
Adversarial robustness on in-and out-distribution improves explainability
Augustin, M., Meinke, A., and Hein, M · 2020
Closest in time.
Jacobian adversarially regularized networks for robustness
Chan, A., Tay, Y., Ong, Y. S., and Fu, J · 2020
Closest in time.
Minimally distorted adversarial examples with a fast adaptive boundary attack
Croce, F. and Hein, M · 2020
Closest in time.
Mma training: Direct input space margin maximization through adversarial training
Ding, G. W., Sharma, Y., Lui, K. Y. C., and Huang, R · 2020
Closest in time.
Your classifier is secretly an energy based model and you should treat it like one
Grathwohl, W., Wang, K.-C., Jacobsen, J.-H., Duvenaud, D., Norouzi, M., and Swersky, K · 2020
Closest in time.
Sensible adversarial learning, 2020
Kim, J. and Wang, X · 2020
Closest in time.
Rethinking softmax cross-entropy loss for adversarial robustness
Pang, T., Xu, K., Dong, Y., Du, C., Chen, N., and Zhu, J · 2020
Closest in time.
Overfitting in adversarially robust deep learning
Rice, L., Wong, E., and Kolter, J. Z · 2020
Closest in time.
Fast is better than free: Revisiting adversarial training
Wong, E., Rice, L., and Kolter, J. Z · 2020
Closest in time.
Enhancing adversarial defense by k-winners-take-all
Xiao, C., Zhong, P., and Zheng, C · 2020
Closest in time.
Adversarial interpolation training: A simple approach for improving model robustness, 2020
Zhang, H. and Xu, W · 2020
Closest in time.
Towards stable and efficient training of verifiably robust neural networks
Original
Zhang, H., Chen, H., Xiao, C., Gowal, S., Stanforth, R., Li, B., Boning, D., and Hsieh, C.-J · 2020
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…