Attacking Bayes: On the Adversarial Robustness of Bayesian Neural Networks
Not on the map. Why?
Abstract (arXiv)
Adversarial examples have been shown to cause neural networks to fail on a wide range of vision and language tasks, but recent work has claimed that Bayesian neural networks (BNNs) are inherently robust to adversarial perturbations. In this work, we examine this claim. To study the adversarial robustness of BNNs, we investigate whether it is possible to successfully break state-of-the-art BNN inference methods and prediction pipelines using even relatively unsophisticated attacks for three tasks: (1) label prediction under the posterior predictive mean, (2) adversarial example detection with Bayesian predictive uncertainty, and (3) semantic shift detection. We find that BNNs trained with state-of-the-art approximate inference methods, and even BNNs trained with Hamiltonian Monte Carlo, are highly susceptible to adversarial attacks. We also identify various conceptual and experimental errors in previous works that claimed inherent adversarial robustness of BNNs and conclusively demonstrate that BNNs and uncertainty-aware Bayesian prediction pipelines are not inherently robust against adversarial attacks.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 56 of its 89 references that are in the map. First posted on arXiv 27 Apr 2024.
Builds on
56 of 89 references.
References · 56
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2015Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learningcited by 4,448
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016Adversarial examples in the physical worldcited by 1,769
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
38 more
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
- 2019On Evaluating Adversarial Robustnesscited by 447
- 2018Generating Natural Language Adversarial Examplescited by 424
- 2013Gaussian Processes for Big Datacited by 383
- 2017Detecting Adversarial Samples from Artifactscited by 245
- 2014Scalable Variational Gaussian Process Classificationcited by 228
- 2018Understanding Measures of Uncertainty for Adversarial Example Detectioncited by 177
- 2019Exact Gaussian Processes on a Million Data Pointscited by 119
- 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 69
- 2020Scaling Hamiltonian Monte Carlo Inference for Bayesian Neural Networks with Symmetric Splittingcited by 54
- 2022Benchmarking Bayesian Deep Learning on Diabetic Retinopathy Detection Taskscited by 49
- 2020Robustness of Bayesian Neural Networks to Gradient-Based Attackscited by 48
- 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 48
- 2022Pre-Train Your Loss: Easy Bayesian Transfer Learning with Informative Priorscited by 43
- 2023Tractable Function-Space Variational Inference in Bayesian Neural Networkscited by 41
- 2021LiBRe: A Practical Bayesian Approach to Adversarial Detectioncited by 40
- 2020Evaluating Robustness of Predictive Uncertainty Estimation: Are Dirichlet-based Models Reliable?cited by 39
- 2018Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distributioncited by 32
- 2023Continual Learning via Sequential Function-Space Variational Inferencecited by 29
- 2021Bayesian Inference with Certifiable Adversarial Robustnesscited by 26
- 2018Robustness Guarantees for Bayesian Inference with Gaussian Processescited by 23
- 2019On the Hardness of Robust Classificationcited by 23
- 2022On the Limitations of Stochastic Pre-processing Defensescited by 21
- 2022Selective Prediction via Training Dynamicscited by 20
- 2023Function-Space Regularization in Neural Networks: A Probabilistic Perspectivecited by 20
- 2021Disrupting Deep Uncertainty Estimation Without Harming Accuracycited by 19
- 2018The Limitations of Model Uncertainty in Adversarial Settingscited by 14
- 2019Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network"cited by 12
- 2022On the Robustness of Bayesian Neural Networks to Adversarial Attackscited by 12
- 2017Adversarial Phenomenon in the Eyes of Bayesian Deep Learningcited by 11
- 2023Drug Discovery under Covariate Shift with Domain-Informed Prior Distributions over Functionscited by 10
- 2018Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Settingcited by 8
- 2020Adversarial Robustness Guarantees for Random Deep Neural Networkscited by 6
- 2021Evaluating the Robustness of Bayesian Neural Networks Against Different Types of Attackscited by 6
- 2023Informative Priors Improve the Reliability of Multimodal Clinical Data Classificationcited by 6
50 most cited of 56 All 56 (JSON)
Built on by
Citing papers per year: 2024: 1; 2025: 1.
2 papers.