Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Abstract

We evaluate the robustness of Adversarial Logit Pairing, a recently proposed defense against adversarial examples. We find that a network trained with Adversarial Logit Pairing achieves 0.6% correct classification rate under targeted adversarial attack, the threat model in which the defense is considered. We provide a brief overview of the defense and the threat models/claims considered, as well as a discussion of the methodology and results of our attack. Our results offer insights into the reasons underlying the vulnerability of ALP to adversarial attack, and are of general interest in evaluating and understanding adversarial defenses. ContributionsFor summary, the contributions of this note are as follows:1. Robustness: Under the white-box targeted attack threat model specified in Kannan et al., we upper bound the correct classification rate of the defense to 0.6% (Table 1). We also perform targeted and untargeted attacks and show that the attacker can reach success rates of 98.6% and 99.9% respectively (Figures 1, 2). Formulation:We analyze the ALP loss function and contrast it to that of Madry et al., pointing out several differences from the robust optimization objective (Section 4.1). Loss landscape:We analyze the loss landscape induced by ALP by visualizing loss landscapes and adversarial attack trajectories (Section 4.2).Furthermore, we suggest the experiments conducted in the analysis of ALP as another evaluation method for adversarial defenses.

Smoothness Analysis of Adversarial Training

“…For improving adversarial robustness, several studies focus on the flatness or smoothness of the loss landscape in the input data space because adversarial examples are perturbations in the input space [17,19,4,7]. Qin et al [17] have presented a regularization method to flatten the loss landscape in terms of data points.…”

THAT: Two Head Adversarial Training for Improving Robustness at Scale

“…Adversarial robustness. To mitigate threats posed by adversarial examples [29,38], adversarial training [14,25,36,43,11,50,47] solves a min-max optimization problem in which adversarial examples are crafted to maximize the training loss, and these examples are then used to update network parameters during loss minimization. This process can be interpreted as approximately solving the saddlepoint optimization problem:…”

Attribution-driven Causal Analysis for Detection of Adversarial Examples

“…But the adoption of these models in safety-critical or high-security applications is inhibited due to two major concerns: their brittleness to adversarial attack methods that can make imperceptible modification to inputs and trigger wrong decisions (Szegedy et al, 2013;Papernot et al, 2016a), and the lack of interpretability (Gunning, 2017). Significant progress has also been made towards adversarial robustness (Papernot et al, 2016b;Madry et al, 2017;Engstrom et al, 2018) and explainability (Li & Yu, 2015;Yi et al, 2016;Sundararajan et al, 2017), and a few recent theoretical studies (Kilbertus et al, 2018;Chalasani et al, 2018) indicate a strong connection between these two issues.…”

“…• We propose a defense layer based on Kahneman's decomposition of cognition into intuitive System 1 and deliberative System 2. This approach does not rely on analyzing training data such as manifold-based defense (Ilyas et al, 2017;Jha et al, 2018), or statistical signature of the machine learning models such as logit pairing (Engstrom et al, 2018), or methods that exploit the knowledge of specific attack for adversarial training (Tramèr et al, 2017), or robust optimization with L p norm bounds (Madry et al, 2017;Raghunathan et al, 2018).…”