Attacking Adversarial Attacks as A Defense

Wu, Boxi; Pan, Heng; Shen, Li; Gu, Jindong; Zhao, Shuai; Li, Zhifeng; Cai, Deng; He, Xiaofei; Liu, Wei

doi:10.48550/arxiv.2106.04938

Cited by 7 publications

(14 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Five defenses (Yoon et al, 2021;Hwang et al, 2021;Qian et al, 2021;Shi et al, 2020;Chen et al, 2021) have robust accuracies well be- & Moosavi-Dezfooli, 2021). Most importantly, four defenses (Wu et al, 2021;Kang et al, 2021;Hwang et al, 2021;Mao et al, 2021) weaken the underlying static defense (when it is already robust), while the others provide minor improvements at the cost of more computation.…”

Section: Case Study Of Adaptive Methodsmentioning

confidence: 99%

“…Input purification (IP): A model (possibly pre-trained to be robust) is enhanced by adding a test-time optimization procedure that alters inputs before feeding them to it. The optimization procedure may rely on hand-crafted (Alfarra et al, 2022;Wu et al, 2021) or learned objectives (Qian et al, 2021;Mao et al, 2021;Hwang et al, 2021) which may involve auxiliary networks such as generative models (Samangouei et al, 2018).…”

Section: Principlesmentioning

confidence: 99%

“…It might be bound to (Mao et al, 2021;Hwang et al, 2021) and possibly trained jointly with (Qian et al, 2021;Shi et al, 2020;Chen et al, 2021) the static classifier, or used as a standalone component (Samangouei et al, 2018). Randomness (R): Three in nine defenses studied are ran-domized either explicitly (e.g., adding noise to the input; Wu et al, 2021) or implicitly (e.g., sampling different batches of inputs; Mao et al, 2021). As such, the same inputs may yield different outputs.…”

Section: Building Blocksmentioning

confidence: 99%

“…3.4. Attacking Adversarial Attacks as a Defense (Wu et al, 2021) Summary of method. The HD proposed by Wu et al aims to defend against adversarial perturbations by maximizing the cross-entropy loss of the classifier's predictions summed over all classes.…”

Section: Towards Robust Neural Network Via Close-loopmentioning

confidence: 99%

See 3 more Smart Citations

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Croce¹,

Gowal²,

Brunner³

et al. 2022

Preprint

View full text Add to dashboard Cite

Adaptive defenses that use test-time optimization promise to improve robustness to adversarial examples. We categorize such adaptive testtime defenses and explain their potential benefits and drawbacks. In the process, we evaluate some of the latest proposed adaptive defenses (most of them published at peer-reviewed conferences). Unfortunately, none significantly improve upon static models when evaluated appropriately. Some even weaken the underlying static model while simultaneously increasing inference cost. While these results are disappointing, we still believe that adaptive test-time defenses are a promising avenue of research and, as such, we provide recommendations on evaluating such defenses. We go beyond the checklist provided by Carlini et al. ( 2019) by providing concrete steps that are specific to this type of defense.

show abstract

Section: Case Study Of Adaptive Methodsmentioning

confidence: 99%

Section: Principlesmentioning

confidence: 99%

Section: Building Blocksmentioning

confidence: 99%

Section: Towards Robust Neural Network Via Close-loopmentioning

confidence: 99%

See 2 more Smart Citations

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Croce¹,

Gowal²,

Brunner³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Despite the unprecedented progress of Deep Neural Networks (DNNs) [20,21,23], the vulnerability to adversarial examples [17,39] poses serious threats to security-sensitive applications, e.g., face recognition [34], autonomous driving [16], etc. To securely deploy DNNs in various applications, it is necessary to conduct an in-depth analysis on the intrinsic properties of adversarial examples, which has inspired numerous researches on adversarial attacks [3-6, 9, 12, 14, 29, 30, 42] and defenses [19,28,36,44,45,49]. Existing attacks could be split into two categories: white-…”

Section: Introductionmentioning

confidence: 99%

Triangle Attack: A Query-efficient Decision-based Adversarial Attack

Wang¹,

Zhang²,

Tong³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Decision-based attack poses a severe threat to realworld applications since it regards the target model as a black box and only accesses the hard prediction label. Great efforts have been made recently to decrease the number of queries; however, existing decision-based attacks still require thousands of queries in order to generate good quality adversarial examples. In this work, we find that a benign sample, the current and the next adversarial examples could naturally construct a triangle in a subspace for any iterative attacks. Based on the law of sines, we propose a novel Triangle Attack (TA) to optimize the perturbation by utilizing the geometric information that the longer side is always opposite the larger angle in any triangle. However, directly applying such information on the input image is ineffective because it cannot thoroughly explore the neighborhood of the input sample in the high dimensional space. To address this issue, TA optimizes the perturbation in the low frequency space for effective dimensionality reduction owing to the generality of such geometric property. Extensive evaluations on the ImageNet dataset demonstrate that TA achieves a much higher attack success rate within 1,000 queries and needs a much less number of queries to achieve the same attack success rate under various perturbation budgets than existing decision-based attacks. With such high efficiency, we further demonstrate the applicability of TA on real-world API, i.e., Tencent Cloud API.

show abstract

Adversarial Deep Learning: A Survey on Adversarial Attacks and Defense Mechanisms on Image Classification

et al. 2022

View full text Add to dashboard Cite

The popularity of adapting deep neural networks (DNNs) in solving hard problems has increased substantially. Specifically, in the field of computer vision, DNNs are becoming a core element in developing many image and video classification and recognition applications. However, DNNs are vulnerable to adversarial attacks, in which, given a well-trained image classification model, a malicious input can be crafted by adding mere perturbations to misclassify the image. This phenomena raise many security concerns in utilizing DNNs in critical life applications which attracts the attention of academic and industry researchers. As a result, multiple studies have proposed discussing novel attacks that can compromise the integrity of state-of-the-art image classification neural networks. The raise of these attacks urges the research community to explore countermeasure methods to mitigate these attacks and increase the reliability of adapting DDNs in different major applications. Hence, various defense strategies have been proposed to protect DNNs against adversarial attacks. In this paper, we thoroughly review the most recent and state-of-the-art adversarial attack methods by providing an in-depth analysis and explanation of the working process of these attacks. In our review, we focus on explaining the mathematical concepts and terminologies of the adversarial attacks, which provide a comprehensive and solid survey to the research community. Additionally, we provide a comprehensive review of the most recent defense mechanisms and discuss their effectiveness in defending DNNs against adversarial attacks. Finally, we highlight the current challenges and open issues in this field as well as future research directions.

show abstract

Attacking Adversarial Attacks as A Defense

Cited by 7 publications

References 10 publications

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Triangle Attack: A Query-efficient Decision-based Adversarial Attack

Adversarial Deep Learning: A Survey on Adversarial Attacks and Defense Mechanisms on Image Classification

Contact Info

Product

Resources

About