PaperlayerView exact revision on arXiv

Source-linked AI summary

Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Logan Engstrom, Andrew Ilyas, Anish Athalye

arXiv:1807.10272v2stat.MLcs.CRcs.CVcs.LG

TL;DR

Adversarial examples challenge neural-network classifiers, and prior defense claims have sometimes been invalidated by new attacks. This paper evaluates ALP with PGD-based attacks and examines its formulation and loss landscape. Under the considered targeted threat model, the attack reduces the ALP-trained model's accuracy to 0.6%.

  • Problem

    Neural networks are susceptible to adversarial examples, and evaluating whether proposed defenses withstand attacks within their stated threat models remains important.

    Source: §2 · p. 1

  • Method

    The authors evaluate ALP using PGD-based targeted and untargeted attacks, and analyze its formulation, implementation, and loss landscape.

    Source: §2 · p. 2, §4.2 · p. 4, §5 · p. 4

  • Results

    0.6% accuracy under the targeted threat model, with a 98.6% attack success rate at ϵ = 16.

    Source: §4.2 · p. 4

  • Takeaways & Limitations

    ALP is not robust under the considered threat model, and the evaluation methods may help enhance evaluation standards for adversarial defenses.

    Source: §5 · p. 4

    The evaluation considers a white-box threat model on an ImageNet ALP-trained ResNet with an ℓ∞ perturbation bound of 16/255; the untargeted analysis is outside the proposed claims.

    Source: §3 · pp. 2–3

Abstract

from arXiv · show

We evaluate the robustness of Adversarial Logit Pairing, a recently proposed defense against adversarial examples. We find that a network trained with Adversarial Logit Pairing achieves 0.6% accuracy in the threat model in which the defense is considered. We provide a brief overview of the defense and the threat models/claims considered, as well as a discussion of the methodology and results of our attack, which may offer insights into the reasons underlying the vulnerability of ALP to adversarial attack.

1 Contributions

The paper evaluates ALP robustness, examines how its loss differs from robust optimization, and studies the loss landscape through visualizations of losses and attack trajectories. It also suggests these experiments as another way to evaluate adversarial defenses.

Robustness

  • 0.6% correct-classification rate under the specified white-box targeted threat model, with targeted and untargeted attack success rates of 98.6% and 99.9%, respectively.The contribution summary reports an upper bound of 0.6% on the defense's correct-classification rate.Source: §1 · p. 1

Formulation

  • The analysis contrasts ALP's loss with Madry et al.'s robust-optimization objective and identifies conceptual differences.Source: §1 · p. 1

Loss landscape

  • The paper analyzes ALP's loss landscape by visualizing loss landscapes and adversarial attack trajectories.Source: §1 · p. 1
  • The authors suggest their experiments as another evaluation method for adversarial defenses.Source: §1 · p. 1

2 Introduction

The introduction situates ALP among defenses against adversarial examples and describes its logit-pairing objective. The evaluation uses released ImageNet models, while the authors report that the original results used different, unreleased models.

2 Introduction

  • Prior defenses' claims have often been invalidated by new attacks, while Madry et al.'s robust-optimization approach was empirically evaluated on CIFAR-10 and MNIST under small ℓ∞ perturbations.Source: §2 · pp. 1–2
  • ALP trains a classifier to make logits similar for clean and adversarial versions of an image, alongside a loss term intended to maintain original-training-set accuracy.Source: §2 · p. 2
  • ALP adds a logit-distance regularizer to adversarial training, intended to promote better internal representations; the paper says PGD-based attacks can circumvent it.Source: §2 · p. 2

2.1 Setup details

  • The evaluation uses the authors' released ImageNet-pretrained models; the authors said Kannan et al.'s results came from different, unreleased models.Source: §2.1 · p. 2

3 Threat model and claims

The paper considers a white-box ImageNet threat model for an ALP-trained ResNet, focusing on the targeted attacks used in the defense's original evaluation. It also reports untargeted results, but outside the scope of the stated claims.

Threat model and claims

  • The table compares Kannan et al.'s claimed targeted-attack robustness on ImageNet with this work's lower bound on attacker success rate.Source: Table 1 · p. 2
  • The stated setting is a white-box attack on an ImageNet ALP-trained ResNet, with the defense's claimed robustness evaluated under an ℓ∞ bound of 16/255.Source: §3 · pp. 2–3
  • At 16/255, the targeted random-label attack reaches 98.6% success and 0.6% correct classification; the untargeted attack leaves 0.1% accuracy.Source: Figure 1 · p. 3, Figure 2 · p. 3
  • The original claim concerns targeted attacks; the paper's untargeted analysis is presented as a brief demonstration of lack of robustness, not as part of that claim.Source: §3 · p. 3
  • The paper distinguishes attack strength: an attack that can generate targeted examples is stronger, while a defense robust only to targeted examples is weaker than one robust to untargeted examples.Source: §3 · p. 3

4 Evaluation

The section contrasts ALP’s training objective with robust optimization and evaluates its empirical robustness using PGD attacks. Despite a bumpier landscape and slower attack convergence, ALP is not robust under the considered threat model.

4.1 Analyzing the defense objective

  • ALP adds clean-data loss regularization and uses targeted adversarial examples, departing from robust optimization over adversarial inputs.The inner objective minimizes loss for another class rather than maximizing loss for the true class.Source: §4.1 · pp. 3–4

4.2 Analyzing empirical robustness

  • The evaluation reimplements PGD and runs attacks for up to 1000 steps or until convergence, testing untargeted attacks and targeted attacks with random targets.Increasing the provided attack code’s steps from 20 to 100 significantly degraded accuracy.Source: §4.2 · p. 4
  • 98.6% targeted attack success at ϵ = 16 reduces ALP accuracy to 0.6%.Source: §4.2 · p. 4
  • 0.1% accuracy at ϵ = 16/255 is reported for the ALP-trained model under untargeted attack.Source: §4.2 · p. 4
  • ALP sometimes produces a bumpier, locally depressed loss landscape around test inputs.The plots vary inputs along the gradient-sign direction and a random Rademacher-vector direction.Source: §4.2 · p. 4
  • ALP attacks require more gradient steps to converge, yet at ϵ = 16/255 both networks have roughly 0% accuracy.Source: §4.2 · p. 4

5 Conclusion

The paper evaluates ALP and finds it is not robust under the considered threat model. It also studies the defense’s formulation, implementation, and loss landscape, proposing its evaluation methods as potentially useful for adversarial-defense evaluation.

5 Conclusion

  • The evaluation finds that ALP is not robust under the considered threat model.Source: §5 · p. 4
  • The paper studies ALP’s formulation, implementation, and loss landscape.Source: §5 · p. 4
  • The evaluation methods may help enhance evaluation standards for adversarial defenses.Source: §5 · p. 4

Related papers

Loading 1807.10272v2…