Abstract
It has been empirically observed that defense mechanisms designed to protect neural networks against \(\ell _\infty \) adversarial examples offer poor performance against \(\ell _2\) adversarial examples and vice versa. In this paper we conduct a geometrical analysis that validates this observation. Then, we provide a number of empirical insights to illustrate the effect of this phenomenon in practice. Then, we review some of the existing defense mechanisms that attempt to defend against multiple attacks by mixing defense strategies. Thanks to our numerical experiments, we discuss the relevance of this method and state open questions for the adversarial examples community.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
With \(p \in \{0, \cdots , \infty \}\).
- 2.
For example, if \(\mathcal {L}\) is the 0/1 loss, any \(c>0\) is acceptable.
- 3.
As it has a more flexible geometry than the Loss Maximization attacks.
- 4.
Theorem 1 can easily be extended to any two balls with different norms. For clarity, we restrict to the case of \(\ell _\infty \) and \(\ell _2\) norms.
- 5.
Due to the projection operator, all PGD attacks saturate the constraint, which makes them all lies in a very small part of the ball.
- 6.
To do so, we use the same experimental setting as in Sect. 4 with \(\epsilon _\infty \) and \(\epsilon _2\) such that the volumes of the two balls are equal.
- 7.
All experiments in this section are conducted on CIFAR-10, and the experimental setting is fully detailed in Sect. 4.1.
References
Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. In: Dy, J., Krause, A. (eds.) Proceedings of the 35th International Conference on Machine Learning. Proceedings of Machine Learning Research, vol. 80, pp. 274–283, Stockholmsmässan, Stockholm Sweden, 10–15 July 2018. PMLR (2018)
Athalye, A. Engstrom, L., Ilyas, A., Kwok, K.: Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397 (2017)
Biggio, B., et al.: Evasion attacks against machine learning at test time. In: Blockeel, H., Kersting, K., Nijssen, S., Železný, F. (eds.) ECML PKDD 2013. LNCS (LNAI), vol. 8190, pp. 387–402. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40994-3_25
Carlini, N., et al.: On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 (2019)
Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39–57. IEEE (2017)
Cohen, J.M., Rosenfeld, E., Kolter, J.Z.: Certified adversarial robustness via randomized smoothing. CoRR, abs/1902.02918 (2019)
Globerson, A., Roweis, S.: Nightmare at test time: robust learning by feature deletion. In: Proceedings of the 23rd International Conference on Machine Learning, pp. 353–360 (2006)
Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: International Conference on Learning Representations (2015)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016
Hinton, G., et al.: Deep neural networks for acoustic modeling in speech recognition. IEEE Signal Process. Mag. 29 (2012)
Kumar, A., Levine, A., Goldstein, T., Feizi, S.: Curse of dimensionality on randomized smoothing for certifiable robustness. arXiv preprint arXiv:2002.03239 (2020)
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016)
Lecuyer, M., Atlidakais, V., Geambasu, R., Hsu, D., Jana, S.: Certified robustness to adversarial examples with differential privacy. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 727–743 (2018)
Li, B., Chen, C., Wang, W., Carin, L.: Certified adversarial robustness with additive noise. In: Advances in Neural Information Processing Systems, vol. 32, pp. 9459–9469. Curran Associates Inc. (2019)
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018)
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372–387. IEEE (2016)
Pinot, R., Ettedgui, R., Rizk, G., Chevaleyre, Y., Atif, J.: Randomization matters. How to defend against strong adversarial attacks. arXiv preprint arXiv:2002.11565 (2020)
Pinot, R., et al.: Theoretical evidence for adversarial robustness through randomization. In: Advances in Neural Information Processing Systems, vol. 32, pp. 11838–11848 (2019)
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I.: Language models are unsupervised multitask learners. Technical report, OpenAi (2018)
Salman, H., et al.: Provably robust deep learning via adversarially trained smoothed classifiers. In: Advances in Neural Information Processing Systems, pp. 11289–11300 (2019)
Sinha, A., Namkoong, H., Volpi, R. Duchi, J.: Certifying some distributional robustness with principled adversarial training (2017)
Szegedy, C., et al.: Intriguing properties of neural networks. In: International Conference on Learning Representations (2014)
Tramèr, F., Boneh, D.: Adversarial training and robustness for multiple perturbations. arXiv preprint arXiv:1904.13000 (2019)
Zagoruyko, S., Komodakis, N.: Wide residual networks. arXiv preprint arXiv:1605.07146 (2016)
Zhang, H., Yu, Y., Jiao, J., Xing, E.P., Ghaoui, L.E., Jordan, M.I.: Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv:1901.08573 (2019)
Acknowledgement
This work was granted access to the HPC resources of IDRIS under the allocation 2020-101141 made by GENCI. We would like to thank Jamal Atif, Florian Yger and Yann Chevaleyre for their valuable insights.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Araujo, A., Meunier, L., Pinot, R., Negrevergne, B. (2020). Advocating for Multiple Defense Strategies Against Adversarial Examples. In: Koprinska, I., et al. ECML PKDD 2020 Workshops. ECML PKDD 2020. Communications in Computer and Information Science, vol 1323. Springer, Cham. https://doi.org/10.1007/978-3-030-65965-3_11
Download citation
DOI: https://doi.org/10.1007/978-3-030-65965-3_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-65964-6
Online ISBN: 978-3-030-65965-3
eBook Packages: Computer ScienceComputer Science (R0)
