Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust

• URL: http://arxiv.org/abs/2411.14834v1
• Date: Fri, 22 Nov 2024 10:17:32 GMT
• Title: Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust
• Authors: Jie Zhang, Kristina Nikolić, Nicholas Carlini, Florian Tramèr,
• Abstract summary: Ensemble everything everywhere is a defense to adversarial examples. We show that this defense is not robust to adversarial attack. We then use standard adaptive attack techniques to reduce the defense's robust accuracy.
• Score: 65.95797963483729
• License:
• Abstract: Ensemble everything everywhere is a defense to adversarial examples that was recently proposed to make image classifiers robust. This defense works by ensembling a model's intermediate representations at multiple noisy image resolutions, producing a single robust classification. This defense was shown to be effective against multiple state-of-the-art attacks. Perhaps even more convincingly, it was shown that the model's gradients are perceptually aligned: attacks against the model produce noise that perceptually resembles the targeted class. In this short note, we show that this defense is not robust to adversarial attack. We first show that the defense's randomness and ensembling method cause severe gradient masking. We then use standard adaptive attack techniques to reduce the defense's robust accuracy from 48% to 1% on CIFAR-100 and from 62% to 4% on CIFAR-10, under the $\ell_\infty$-norm threat model with $\varepsilon=8/255$.

Related papers

• Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attacks [62.036798488144306]
  Current defense mainly focuses on the known attacks, but the adversarial robustness to the unknown attacks is seriously overlooked. We propose an attack-agnostic defense method named Meta Invariance Defense (MID) We show that MID simultaneously achieves robustness to the imperceptible adversarial perturbations in high-level image classification and attack-suppression in low-level robust image regeneration.
  arXiv  Detail & Related papers  (2024-04-04T10:10:38Z)
• PubDef: Defending Against Transfer Attacks From Public Models [6.0012551318569285]
  We propose a new practical threat model where the adversary relies on transfer attacks through publicly available surrogate models. We evaluate the transfer attacks in this setting and propose a specialized defense method based on a game-theoretic perspective. Under this threat model, our defense, PubDef, outperforms the state-of-the-art white-box adversarial training by a large margin with almost no loss in the normal accuracy.
  arXiv  Detail & Related papers  (2023-10-26T17:58:08Z)
• The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attacks [91.56314751983133]
  $A5$ is a framework to craft a defensive perturbation to guarantee that any attack towards the input in hand will fail. We show effective on-the-fly defensive augmentation with a robustifier network that ignores the ground truth label. We also show how to apply $A5$ to create certifiably robust physical objects.
  arXiv  Detail & Related papers  (2023-05-23T16:07:58Z)
• MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attack [26.37741124166643]
  Adversarial attacks can deceive neural networks by adding tiny perturbations to their input data. We show that adversarial attack strategies cannot reliably evaluate ensemble defenses, sizeably overestimating their robustness. We introduce MORA, a model-reweighing attack to steer adversarial example synthesis by reweighing the importance of sub-model gradients.
  arXiv  Detail & Related papers  (2022-11-15T09:45:32Z)
• Adversarial Defense via Image Denoising with Chaotic Encryption [65.48888274263756]
  We propose a novel defense that assumes everything but a private key will be made available to the attacker. Our framework uses an image denoising procedure coupled with encryption via a discretized Baker map.
  arXiv  Detail & Related papers  (2022-03-19T10:25:02Z)
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks [72.59081183040682]
  We propose dynamic defenses, to adapt the model and input during testing, by defensive entropy minimization (dent) dent improves the robustness of adversarially-trained defenses and nominally-trained models against white-box, black-box, and adaptive attacks on CIFAR-10/100 and ImageNet.
  arXiv  Detail & Related papers  (2021-05-18T17:55:07Z)
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models [71.91835408379602]
  adversarial examples have been long considered a real threat to machine learning models. We propose an alternative deployment-based defense paradigm that goes beyond the traditional white-box and black-box threat models.
  arXiv  Detail & Related papers  (2021-02-09T20:07:13Z)
• Ensemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks [17.551718914117917]
  We propose a voting ensemble of models trained by using block-wise transformed images with secret keys for an adversarially robust defense. Key-based adversarial defenses were demonstrated to outperform state-of-the-art defenses against gradient-based (white-box) attacks. We aim to enhance robustness against black-box attacks by using a voting ensemble of models.
  arXiv  Detail & Related papers  (2020-11-16T02:48:37Z)
• Encryption Inspired Adversarial Defense for Visual Classification [17.551718914117917]
  We propose a new adversarial defense inspired by image encryption methods. The proposed method utilizes a block-wise pixel shuffling with a secret key. It achieves high accuracy (91.55 on clean images and (89.66 on adversarial examples with noise distance of 8/255 on CIFAR-10 dataset)
  arXiv  Detail & Related papers  (2020-05-16T14:18:07Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.