Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

2017/05/20 by Carlini, Nicholas, Wagner, David · 18 citations
#Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.1705.07263

Abstract

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

Cited by

• TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training
• Studying Various Activation Functions and Non-IID Data for Machine Learning Model Robustness
• FeatureLens: A Highly Generalizable and Interpretable Framework for Detecting Adversarial Examples Based on Image Features
• Robust Physical Adversarial Patches Using Dynamically Optimized Clusters
• Protecting the Neural Networks against FGSM Attack Using Machine Unlearning
• Probably Approximately Global Robustness Certification
• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• SynthID-Image: Image watermarking at internet scale
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Microsaccade-Inspired Probing: Positional Encoding Perturbations Reveal LLM Misbehaviours
• WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents
• Better Privilege Separation for Agents by Restricting Data Types
• Learning-Based Testing for Deep Learning: Enhancing Model Robustness with Adversarial Input Prioritization
• Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting
• Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation
• Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Model Compression vs. Adversarial Robustness: An Empirical Study on Language Models for Code

Related

• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Adversarial Examples: Attacks and Defenses for Deep Learning
• TREATED:Towards Universal Defense against Textual Adversarial Attacks
• Explaining and Harnessing Adversarial Examples
• Generalizable Adversarial Examples Detection Based on Bi-model Decision Mismatch