Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

Wang, Dequan; Ju, An; Shelhamer, Evan; Wagner, David; Darrell, Trevor

doi:10.48550/arxiv.2105.08714

Cited by 7 publications

(20 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A model becomes adaptive by allowing an external procedure to modify its parameters (e.g., batch normalization statistics) (Wang et al, 2021a) or activations (Chen et al, 2021) while producing an output. It is possible to define implicit layers (Kang et al, 2021), whose output is computed via iterative schemes.…”

Section: Model Adaptation (Ma)mentioning

confidence: 99%

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Croce¹,

Gowal²,

Brunner³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Adaptive defenses that use test-time optimization promise to improve robustness to adversarial examples. We categorize such adaptive testtime defenses and explain their potential benefits and drawbacks. In the process, we evaluate some of the latest proposed adaptive defenses (most of them published at peer-reviewed conferences). Unfortunately, none significantly improve upon static models when evaluated appropriately. Some even weaken the underlying static model while simultaneously increasing inference cost. While these results are disappointing, we still believe that adaptive test-time defenses are a promising avenue of research and, as such, we provide recommendations on evaluating such defenses. We go beyond the checklist provided by Carlini et al. ( 2019) by providing concrete steps that are specific to this type of defense.

show abstract

Section: Model Adaptation (Ma)mentioning

confidence: 99%

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Croce¹,

Gowal²,

Brunner³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…We perform a systematic empirical study on various defenses. For RMC (Wu et al, 2020b), DENT (Wang et al, 2021), and URejectron (Goldwasser et al, 2020), we show that even weak instantiations of GMSA can break respective defenses. Specifically, for defenses based on adversarially training, we reduce the robust accuracy to that of adversarial training alone.…”

Section: Introductionmentioning

confidence: 51%

“…In view of "dynamic defenses", these proposals attempt to apply transductive learning to the test data and update the model, and then use the updated model to predict on the test data. In this work we consider three such work (Wu et al, 2020b;Wang et al, 2021;Goldwasser et al, 2020).…”

Section: Adversarial Robustness Via Test-time Defensesmentioning

confidence: 99%

“…Going beyond the inductive threat model, there has been emerging interest in using transductive learning (Vapnik, 1998) 1 for adversarial robustness (Goldwasser et al, 2020;Wu et al, 2020b;Wang et al, 2021). In essence, these defenses attempt to leverage a batch of test-time inputs, which is common for ML pipelines deployed with batch predictions (bat, 2021), to learn an updated model.…”

Section: Introductionmentioning

confidence: 99%

“…This objective is transductive as U , the attacker's output, appears in both attack (V in L a ) and defense (U in Γ). We extend this threat model to multiple rounds, which is necessary when considering DENT (Wang et al, 2021) and RMC (Wu et al, 2020b). We point out important subtleties in the modeling that were unclear or overlooked in previous work.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Towards Evaluating the Robustness of Neural Networks Learned by Transduction

Chen¹,

Wu²,

Guo³

et al. 2021

Preprint

View full text Add to dashboard Cite

There has been emerging interest in using transductive learning for adversarial robustness (Goldwasser et al., NeurIPS 2020; Wu et al., ICML 2020; Wang et al., ArXiv 2021). Compared to traditional defenses, these defense mechanisms "dynamically learn" the model based on test-time input; and theoretically, attacking these defenses reduces to solving a bilevel optimization problem, which poses difficulty in crafting adaptive attacks. In this paper, we examine these defense mechanisms from a principled threat analysis perspective. We formulate and analyze threat models for transductive-learning based defenses, and point out important subtleties. We propose the principle of attacking model space for solving bilevel attack objectives, and present Greedy Model Space Attack (GMSA), an attack framework that can serve as a new baseline for evaluating transductive-learning based defenses. Through systematic evaluation, we show that GMSA, even with weak instantiations, can break previous transductive-learning based defenses, which were resilient to previous attacks, such as AutoAttack (Croce and Hein, ICML 2020). On the positive side, we report a somewhat surprising empirical result of "transductive adversarial training": Adversarially retraining the model using fresh randomness at the test time gives a significant increase in robustness against attacks we consider.

show abstract

Evolving Deep Multiple Kernel Learning Networks Through Genetic Algorithms

Shen

Lin

et al. 2023

IEEE Trans. Ind. Inf.

View full text Add to dashboard Cite

Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks

Cited by 7 publications

References 26 publications

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Evaluating the Adversarial Robustness of Adaptive Test-time Defenses

Towards Evaluating the Robustness of Neural Networks Learned by Transduction

Evolving Deep Multiple Kernel Learning Networks Through Genetic Algorithms

Contact Info

Product

Resources

About