Published as a conference paper at ICLR 2015 EXPLAINING AND HARNESSING ADVERSARIAL EXAMPLES

Abstract edit

Summary

This paper discusses the vulnerability of machine learning models, particularly neural networks, to adversarial examples, which are inputs altered by small, intentional perturbations that lead to incorrect predictions. The authors argue that the primary cause of this vulnerability is the linear nature of neural networks rather than nonlinearity or overfitting. They introduce a fast method for generating adversarial examples using the fast gradient sign method and demonstrate its effectiveness in adversarial training, which provides additional regularization benefits over traditional methods like dropout. The paper also explores various models' capacities to resist adversarial perturbations and concludes that only more complex architectures with hidden layers can effectively address this issue. Observations include the notion that adversarial examples tend to generalize across different classifiers, and it emphasizes the inadequacies of current models in accurately understanding input distributions. Finally, the authors discuss potential improvements in optimization methods to enhance model stability against adversarial inputs.

Methods add

This paper employs the following methods:

• Fast Gradient Sign Method

Models Used add

• Maxout Network
• Logistic Regression
• RBF Network

Datasets add

The following datasets were used in this research:

• MNIST
• ImageNet
• CIFAR-10

Evaluation Metrics add

• Error Rate

Results add

• Reduced test set error of a maxout network on the MNIST dataset from 0.94% to 0.84% with adversarial training
• Achieved error rate of 17.9% on adversarial examples after adversarial training

Limitations add

The authors identified the following limitations:

• Current models are susceptible to adversarial examples
• The existence of adversarial examples suggests models do not truly understand given tasks
• Models' responses are overly confident in areas outside the data distribution

Technical Requirements edit

• Number of GPUs: None specified
• GPU Type: None specified

Related Papers

Papers with similar methods or datasets:

• Adversarial Examples: Attacks and Defenses for Deep Learning (2017) - 1574 citations
• Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples (2020) - 142 citations
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks (2017) - 131 citations
• Patch-wise Attack for Fooling Deep Neural Network (2020) - 130 citations
• Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications (2019) - 122 citations
• ADAM: A METHOD FOR STOCHASTIC OPTIMIZATION (2014) - 146110 citations
• Very Deep Convolutional Networks for Large-Scale Image Recognition (2014) - 97625 citations
• Going deeper with convolutions (2014) - 42731 citations
• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift (2015) - 42400 citations
• Microsoft COCO: Common Objects in Context (2014) - 41625 citations

Papers Using Similar Methods

• Adversarial Examples: Attacks and Defenses for Deep Learning (2017)
• Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples (2020)
• Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks (2017)
• Patch-wise Attack for Fooling Deep Neural Network (2020)
• Evaluating Adversarial Evasion Attacks in the Context of Wireless Communications (2019)

External Resources