Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

2017/05/20 by Nicholas Carlini, David Wagner, Carlini, Nicholas +1 · 335 citations
Computer Science · #Adversarial Robustness in Machine Learning #Adversarial system #Artificial intelligence #Artificial neural network #Computer Vision and Pattern Recognition (cs.CV) #Computer science #Cryptography and Security (cs.CR) #Deep neural networks #Economics #Epistemology #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine learning #Order (exchange) #Philosophy #Simple (philosophy) #Space (punctuation) #cs.CR #cs.CV #cs.LG

paper · pdf · doi:10.48550/arxiv.1705.07263

published in arXiv (Cornell University) (Cornell University)

openalex publication_date 2017/05/20 · arxiv created 2017/11/01 · arxiv updated 2017/11/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

Cited by

• TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training
• Studying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
• FeatureLens: A Highly Generalizable and Interpretable Framework for Detecting Adversarial Examples Based on Image Features
• Robust Physical Adversarial Patches Using Dynamically Optimized Clusters
• Protecting the Neural Networks against FGSM Attack Using Machine Unlearning
• Probably Approximately Global Robustness Certification
• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• SynthID-Image: Image watermarking at internet scale
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Microsaccade-Inspired Probing: Positional Encoding Perturbations Reveal LLM Misbehaviours
• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
• Better Privilege Separation for Agents by Restricting Data Types
• Learning-Based Testing for Deep Learning: Enhancing Model Robustness with Adversarial Input Prioritization
• Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting
• Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation
• Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Model Compression vs. Adversarial Robustness: An Empirical Study on Language Models for Code
• On the Efficiency of Training Robust Decision Trees
• SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds
• Off-Policy Actor-Critic for Adversarial Observation Robustness: Virtual Alternative Training via Symmetric Policy Evaluation
• SyncMapV2: Robust and Adaptive Unsupervised Segmentation
• RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?
• Busting the Paper Ballot: Voting Meets Adversarial Machine Learning
• Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on \mathbbso(d)
• Neural Network Reprogrammability: A Unified Theme on Model Reprogramming, Prompt Tuning, and Prompt Instruction
• Adversarial Attacks in Multimodal Systems: A Practitioner's Survey
• PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches
• Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspective
• Assured Autonomy with Neuro-Symbolic Perception
• A Critical Evaluation of Defenses against Prompt Injection Attacks
• GradPCA: Leveraging NTK Alignment for Reliable Out-of-Distribution Detection
• WebInject: Prompt Injection Attack to Web Agents
• Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs
• What's Pulling the Strings? Evaluating Integrity and Attribution in AI Training and Inference through Concept Shift
• Examining the Impact of Optical Aberrations to Image Classification and Object Detection Models
• Defending Against Frequency-Based Attacks with Diffusion Models
• Security Risks in Vision-Based Beam Prediction: From Spatial Proxy Attacks to Feature Refinement

Related

• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Adversarial Examples: Attacks and Defenses for Deep Learning
• TREATED:Towards Universal Defense against Textual Adversarial Attacks
• Explaining and Harnessing Adversarial Examples
• Generalizable Adversarial Examples Detection Based on Bi-model Decision Mismatch