Gradient Obfuscation Checklist Test Gives a False Sense of Security
Not on the map. Why?
Abstract (arXiv)
One popular group of defense techniques against adversarial attacks is based on injecting stochastic noise into the network. The main source of robustness of such stochastic defenses however is often due to the obfuscation of the gradients, offering a false sense of security. Since most of the popular adversarial attacks are optimization-based, obfuscated gradients reduce their attacking ability, while the model is still susceptible to stronger or specifically tailored adversarial attacks. Recently, five characteristics have been identified, which are commonly observed when the improvement in robustness is mainly caused by gradient obfuscation. It has since become a trend to use these five characteristics as a sufficient test, to determine whether or not gradient obfuscation is the main source of robustness. However, these characteristics do not perfectly characterize all existing cases of gradient obfuscation, and therefore can not serve as a basis for a conclusive test. In this work, we present a counterexample, showing this test is not sufficient for concluding that gradient obfuscation is not the main cause of improvements in robustness.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 25 of its 30 references that are in the map. First posted on arXiv 3 Jun 2022.
Builds on
25 of 30 references.
References · 25
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2016Adversarial Machine Learning at Scalecited by 934
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2021ResNet strikes back: An improved training procedure in timmcited by 365
13 more
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 288
- 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
- 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
- 2018Improving DNN Robustness to Adversarial Attacks using Jacobian Regularizationcited by 88
- 2021HIRE-SNN: Harnessing the Inherent Robustness of Energy-Efficient Deep Spiking Neural Networks by Training with Crafted Input Noisecited by 61
- 2018Provable Robustness of ReLU networks via Maximization of Linear Regionscited by 51
- 2019Scaleable input gradient regularization for adversarial robustnesscited by 45
- 2021GradDiv: Adversarial Robustness of Randomized Neural Networks via Gradient Diversity Regularizationcited by 34
- 2020Learn2Perturb: an End-to-end Feature Perturbation Learning to Improve Adversarial Robustnesscited by 27
- 2020Weight-Covariance Alignment for Adversarially Robust Neural Networkscited by 9
- 2022Rethinking Feature Uncertainty in Stochastic Neural Networks for Adversarial Robustnesscited by 2
Built on by
Citing papers per year: 2024: 1.
1 paper.