Source-linked AI summary
On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
Anish Athalye, Nicholas Carlini
TL;DR
This note examines whether two CVPR 2018 defenses withstand white-box adversaries. Applying existing attack techniques, it finds both defenses ineffective, reducing defended accuracy to 0%.
Problem
Robust training against adversarial examples remains a major challenge, including for two CVPR 2018 defenses evaluated here.
Method
The note evaluates Pixel Deflection and HGD under the white-box threat model using unmodified PGD attacks bounded by ℓ∞ distortion of 4/255.
Results
Both defenses are not robust: defended accuracy falls to 0%, while targeted attacks achieve over 97% success overall and 100% against HGD.
Takeaways & Limitations
Security against oblivious attacks is insufficient for practical evaluation, so defenses should be assessed against white-box attacks that account for the defense.
Takeaways & Limitations
The evaluation is scoped to white-box security and contrasts with claims against attackers unaware that a defense is applied.
Abstract
from arXiv · showhide
Neural networks are known to be vulnerable to adversarial examples. In this note, we evaluate the two white-box defenses that appeared at CVPR 2018 and find they are ineffective: when applying existing techniques, we can reduce the accuracy of the defended models to 0%.
1. Introduction
The note evaluates two CVPR 2018 defenses for adversarial examples and finds them ineffective under the white-box threat model. Existing techniques reduce defended ImageNet classifier accuracy to 0% under a small perturbation bound.
- Robust training against adversarial examples remains a major neural-network challenge.
- The evaluated defenses are Pixel Deflection and High-level Representation Guided Denoiser.
- 0% defended-classifier accuracy is achieved on ImageNet with an ℓ∞ perturbation of 4/255.
- The attacks construct targeted adversarial examples with over 97% success.
- The methods are direct applications of existing techniques.
2. Background
The paper defines adversarial examples and introduces the two defenses before specifying a white-box evaluation threat model. It emphasizes that defenses must be tested against attackers aware that a defense is present.
- Adversarial examples are inputs close to an original instance under a distance metric but receiving a different classification.
- Targeted adversarial examples are assigned a specified target label.
- Pixel Deflection randomly replaces selected pixels with nearby pixels and then applies denoising to restore accuracy.
- HGR denoises inputs with a trained differentiable, non-randomized neural network before standard classification.
- 2.1. Methods: The evaluation uses white-box PGD attacks maximizing cross-entropy loss under ℓ∞ distortion of 4/255.
- 2.1. Methods: Oblivious-attack security is insufficient because practical attackers can account for the defense and attempt to circumvent it.
3. Methodology
The evaluation attacks each defense in the white-box setting using established methods. Both defenses lose all defended accuracy, while targeted attack success is very high.
- 3.1. Pixel Deflection: Pixel Deflection is analyzed as implemented by its authors using publicly available evaluation code.
- 3.1. Pixel Deflection: BPDA handles Pixel Deflection’s non-differentiable replacement operation and reduces defended accuracy to 0%.
- 3.1. Pixel Deflection: 97% targeted attack success is obtained against Pixel Deflection, counted when the target label appears 9 of 10 times.
- 3.2. High-Level Representation Guided Denoiser: PGD is applied end-to-end without modification against HGR.
- 3.2. High-Level Representation Guided Denoiser: 0% defended accuracy and 100% targeted-example success are achieved against HGR.
4. Conclusion
The conclusion reports that neither Pixel Deflection nor HGR is robust to adversarial examples.
- Pixel Deflection and High-level representation Guided Denoiser are not robust to adversarial examples.