Attacking Adversarial Defences by Smoothing the Loss Landscape
This paper investigates a family of methods for defending against adversarial attacks that owe part of their success to creating a noisy, discontinuous, or otherwise rugged loss landscape that adversaries find difficult to navigate. A common, but not universal, way to achieve this effect is via the use of stochastic neural networks. We show that this is a form of gradient obfuscation, and propose a general extension to gradient-based adversaries based on the Weierstrass transform, which smooths the surface of the loss function and provides more reliable gradient estimates. We further show that the same principle can strengthen gradient-free adversaries. We demonstrate the efficacy of our loss-smoothing method against both stochastic and non-stochastic adversarial defences that exhibit robustness due to this type of obfuscation. Furthermore, we provide analysis of how it interacts with Expectation over Transformation; a popular gradient-sampling method currently used to attack stochastic defences.
Code (1)
Tasks
NavigateSimilar Papers 제목 키워드 기반
RDA: Robust Domain Adaptation via Fourier Adversarial Attacking
Unsupervised domain adaptation (UDA) involves a supervised loss in a labeled source domain and an unsupervised loss in an unlabeled target domain, which often faces more severe overfitting (than classical supervised lear…
Domain AdaptationUnsupervised Domain AdaptationLRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate
The transferability of adversarial examples is of central importance to transfer-based black-box adversarial attacks. Previous works for generating transferable adversarial examples focus on attacking \emph{given} pretra…
Adversarial RobustnessPreventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study
Adversarial artificial intelligence (AI) attacks pose a significant threat to autonomous transportation, such as maritime vessels, that rely on AI components. Malicious actors can exploit these systems to deceive and man…
Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences
We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using $f$-Differential Privacy to …
Adversarial Robustnessimage-classificationImage ClassificationCertified Defences Against Adversarial Patch Attacks on Semantic Segmentation
Adversarial patch attacks are an emerging security threat for real world deep learning applications. We present Demasked Smoothing, the first approach (up to our knowledge) to certify the robustness of semantic segmentat…
image-classificationImage ClassificationSegmentationSemantic Segmentation