Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
Making classifiers robust to adversarial examples is hard. Thus, many defenses tackle the seemingly easier task of detecting perturbed inputs. We show a barrier towards this goal. We prove a general hardness reduction between detection and classification of adversarial examples: given a robust detector for attacks at distance {\epsilon} (in some metric), we can build a similarly robust (but inefficient) classifier for attacks at distance {\epsilon}/2. Our reduction is computationally inefficient, and thus cannot be used to build practical classifiers. Instead, it is a useful sanity check to test whether empirical detection results imply something much stronger than the authors presumably anticipated. To illustrate, we revisit 13 detector defenses. For 11/13 cases, we show that the claimed detection results would imply an inefficient classifier with robustness far beyond the state-of-the-art.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
Making classifiers robust to adversarial examples is hard. Thus, many defenses tackle the seemingly easier task of \emph{detecting} perturbed inputs. We show a barrier towards this goal. We prove a general \emph{hardne…
Training Ensembles to Detect Adversarial Examples
We propose a new ensemble method for detecting and classifying adversarial examples generated by state-of-the-art attacks, including DeepFool and C&W. Our method works by training the members of an ensemble to have low c…
General ClassificationUsing Anomaly Feature Vectors for Detecting, Classifying and Warning of Outlier Adversarial Examples
We present DeClaW, a system for detecting, classifying, and warning of adversarial inputs presented to a classification neural network. In contrast to current state-of-the-art methods that, given an input, detect whether…
Adversarial AttackAdversarial Attack DetectionAttackGNN: Red-Teaming GNNs in Hardware Security Using Reinforcement Learning
Machine learning has shown great promise in addressing several critical hardware security problems. In particular, researchers have developed novel graph neural network (GNN)-based techniques for detecting intellectual p…
Graph Neural NetworkRed Teamingreinforcement-learningReinforcement Learning+1Evaluating Defensive Distillation For Defending Text Processing Neural Networks Against Adversarial Examples
Adversarial examples are artificially modified input samples which lead to misclassifications, while not being detectable by humans. These adversarial examples are a challenge for many tasks such as image and text classi…
Adversarial TextClassificationGeneral Classificationimage-classification+3