Lessons Learned from Evaluating the Robustness of Defenses to Adversarial Examples
summary
Evaluation shows many published defenses fail under careful white‑box attack: of nine ICLR 2018 defenses tested, two hold up and seven are broken. Defenses like thermometer encoding or random input transforms mainly produce obfuscated gradients, and a simple fix—replace non‑differentiable layers with nearby differentiable surrogates on the backward pass and run iterative PGD—recovers usable gradients and finds high‑quality adversarial examples. Tests also use random‑noise baselines and monotonic accuracy-vs‑epsilon plots to validate attacks.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:30How do we generate adversarial examples?
- 9:37Threat Models
- 10:00A threat model is a formal statement defining when a system is intended to be secure.
- 14:02This talk: non-certified defenses
- 14:28For example: adversarial training
- 18:51How complete are evaluations?
- 19:06Case Study: ICLR 2018
- 19:51Broken Defenses Correct Defenses
- 23:11Lessons Learned from Evaluating the Robustness of Defenses to Adversarial Examples
- 31:34Disentangling true robustness from apparent robustness is nontrivial
- 32:36Lessons (2 of 2) performing better evaluations
- 42:38To understand adversarial examples, repeatedly attack and defend, optimizing for lessons learned.
related talks
36mAdversarial Machine Learning: How Secure Is ML?
21mAdversarial Attacks
36mAdversarial Attacks on Deep Learning
38mUsing adversarial samples to robustify your Neural Network Models
43mDefending Against Adversarial Model Attacks using Kubeflow
02h 13mUnderstanding Security Threats Against Machine/Deep Learning Applications
40mEvasion, Poisoning, Extraction, and Inference: Tools to Defend and Evaluate
01h 24mAdversarial Examples