# Bypassing Feature Squeezing by Increasing Adversary Strength

arXiv: https://arxiv.org/abs/1803.09868 · HTML: https://mlsanity.com/paper/1803.09868/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Mar 2018.

## Built on by (most cited first, 8 of 8)

- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs](https://mlsanity.com/paper/2105.06512/) (2021)
- [Adversarial Sampling for Fairness Testing in Deep Neural Network](https://mlsanity.com/paper/2303.02874/) (2023)
- [Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2107.09804/) (2021)
- [Aliasing is a Driver of Adversarial Attacks](https://mlsanity.com/paper/2212.11760/) (2022)
- [HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2106.05825/) (2021)
- [HoneyModels: Machine Learning Honeypots](https://mlsanity.com/paper/2202.10309/) (2022)
- [DNNShield: Dynamic Randomized Model Sparsification, A Defense Against Adversarial Machine Learning](https://mlsanity.com/paper/2208.00498/) (2022)

## Abstract (arXiv)

Feature Squeezing is a recently proposed defense method which reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. It has been shown that feature squeezing defenses can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks. However, we demonstrate on the MNIST and CIFAR-10 datasets that by increasing the adversary strength of said state-of-the-art attacks, one can bypass the detection framework with adversarial examples of minimal visual distortion. These results suggest for proposed defenses to validate against stronger attack configurations.