Adversarial Attacks on ML Defense Models Competition

Abstract

Due to the vulnerability of deep neural networks (DNNs) to adversarial examples, a large number of defense techniques have been proposed to alleviate this problem in recent years. However, the progress of building more robust models is usually hampered by the incomplete or incorrect robustness evaluation. To accelerate the research on reliable evaluation of adversarial robustness of the current defense models in image classification, the TSAIL group at Tsinghua University and the Alibaba Security group organized this competition along with a CVPR 2021 workshop on adversarial machine learning (https://aisecureworkshop.github.io/amlcvpr2021/). The purpose of this competition is to motivate novel attack algorithms to evaluate adversarial robustness more effectively and reliably. The participants were encouraged to develop stronger white-box attack algorithms to find the worst-case robustness of different defenses. This competition was conducted on an adversarial robustness evaluation platform -ARES (https://github.com/thu-ml/ares), and is held on the TianChi platform (https://tianchi. aliyun.com/competition/entrance/531847/ introduction) as one of the series of AI Security Challengers Program. After the competition, we summarized the results and established a new adversarial robustness benchmark at https://ml.cs.tsinghua.edu.cn/ ares-bench/, which allows users to upload adversarial attack algorithms and defense models for evaluation.

A Roadmap for Big Model

“…Adversarial training. The idea of adversarial training (AT) stems from the seminal work of [783], while other AT frameworks like PGD-AT [866] and TRADES [884] occupied the winner solutions in the adversarial competitions [885,886,887,888]. Based on these primary AT frameworks, many improvements have been proposed via encoding the mechanisms inspired from other domains, including ensemble learning [889,890], metric learning [891,892,893,894], generative modeling [895,896,897,898], weight perturbing [899], semi-supervised learning [900,901,902], and self-supervised learning [903,904,905,906].…”