Source-linked AI summary
On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
Anish Athalye, Nicholas Carlini
TL;DR
This note examines whether two CVPR 2018 defenses withstand white-box adversaries. Applying existing attack techniques, it finds both defenses ineffective, reducing defended accuracy to 0%.
Problem
Robust training against adversarial examples remains a major challenge, including for two CVPR 2018 defenses evaluated here.
Source: §1 · p. 1Method
The note evaluates Pixel Deflection and HGD under the white-box threat model using unmodified PGD attacks bounded by ℓ∞ distortion of 4/255.
Source: §2.1 · pp. 1–2, §1 · p. 1Results
Both defenses are not robust: defended accuracy falls to 0%, while targeted attacks achieve over 97% success overall and 100% against HGD.
Source: §1 · p. 1, §3.2 · p. 2, §4 · p. 2Takeaways & Limitations
Security against oblivious attacks is insufficient for practical evaluation, so defenses should be assessed against white-box attacks that account for the defense.
Source: §2.1 · p. 2The evaluation is scoped to white-box security and contrasts with claims against attackers unaware that a defense is applied.
Source: §2.1 · p. 2
Abstract
from arXiv · showhide
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
1. Introduction
The note evaluates two CVPR 2018 defenses for adversarial examples and finds them ineffective under the white-box threat model. Existing techniques reduce defended ImageNet classifier accuracy to 0% under a small perturbation bound.
- Robust training against adversarial examples remains a major neural-network challenge.Source: §1 · p. 1
- The evaluated defenses are Pixel Deflection and High-level Representation Guided Denoiser.Source: §1 · p. 1
- 0% defended-classifier accuracy is achieved on ImageNet with an ℓ∞ perturbation of 4/255.Source: §1 · p. 1
- The attacks construct targeted adversarial examples with over 97% success.Source: §1 · p. 1
- The methods are direct applications of existing techniques.Source: §1 · p. 1
2. Background
The paper defines adversarial examples and introduces the two defenses before specifying a white-box evaluation threat model. It emphasizes that defenses must be tested against attackers aware that a defense is present.
- Adversarial examples are inputs close to an original instance under a distance metric but receiving a different classification.Source: §2 · p. 1
- Targeted adversarial examples are assigned a specified target label.Source: §2 · p. 1
- Pixel Deflection randomly replaces selected pixels with nearby pixels and then applies denoising to restore accuracy.Source: §2 · p. 1
- HGR denoises inputs with a trained differentiable, non-randomized neural network before standard classification.Source: §2 · p. 1
2.1. Methods
- The evaluation uses white-box PGD attacks maximizing cross-entropy loss under ℓ∞ distortion of 4/255.Source: §2.1 · pp. 1–2
- Oblivious-attack security is insufficient because practical attackers can account for the defense and attempt to circumvent it.Source: §2.1 · p. 2
3. Methodology
The evaluation attacks each defense in the white-box setting using established methods. Both defenses lose all defended accuracy, while targeted attack success is very high.
3.1. Pixel Deflection
- Pixel Deflection is analyzed as implemented by its authors using publicly available evaluation code.Source: §3.1 · p. 2
- BPDA handles Pixel Deflection’s non-differentiable replacement operation and reduces defended accuracy to 0%.Source: §3.1 · p. 2
- 97% targeted attack success is obtained against Pixel Deflection, counted when the target label appears 9 of 10 times.Source: §3.1 · p. 2
3.2. High-Level Representation Guided Denoiser
- PGD is applied end-to-end without modification against HGR.Source: §3.2 · p. 2
- 0% defended accuracy and 100% targeted-example success are achieved against HGR.Source: §3.2 · p. 2
4. Conclusion
The conclusion reports that neither Pixel Deflection nor HGR is robust to adversarial examples.
- Pixel Deflection and High-level representation Guided Denoiser are not robust to adversarial examples.Source: §4 · p. 2