Bypassing Feature Squeezing by Increasing Adversary Strength

2018/03/27 by Yash Sharma, Sharma, Yash, Pin-Yu Chen +1
Computer Science · Mathematics · #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1803.09868

arxiv created 2018/03/27 · arxiv updated 2018/03/28

Abstract

Feature Squeezing is a recently proposed defense method which reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. It has been shown that feature squeezing defenses can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks. However, we demonstrate on the MNIST and CIFAR-10 datasets that by increasing the adversary strength of said state-of-the-art attacks, one can bypass the detection framework with adversarial examples of minimal visual distortion. These results suggest for proposed defenses to validate against stronger attack configurations.

Related

• Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examples
• A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space
• Clipping free attacks against artificial neural networks
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• Attack-Agnostic Adversarial Detection