Towards Evaluating the Robustness of Neural Networks

被引:4821
作者
Carlini, Nicholas [1 ]
Wagner, David [1 ]
机构
[1] Univ Calif Berkeley, Berkeley, CA 94720 USA
来源
2017 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP) | 2017年
关键词
D O I
10.1109/SP.2017.49
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
Neural networks provide state-of-the-art results for most machine learning tasks. Unfortunately, neural networks are vulnerable to adversarial examples: given an input x and any target classification t, it is possible to find a new input x' that is similar to x but classified as t. This makes it difficult to apply neural networks in security-critical areas. Defensive distillation is a recently proposed approach that can take an arbitrary neural network, and increase its robustness, reducing the success rate of current attacks' ability to find adversarial examples from 95% to 0.5%. In this paper, we demonstrate that defensive distillation does not significantly increase the robustness of neural networks by introducing three new attack algorithms that are successful on both distilled and undistilled neural networks with 100% probability. Our attacks are tailored to three distance metrics used previously in the literature, and when compared to previous adversarial example generation algorithms, our attacks are often much more effective (and never worse). Furthermore, we propose using high-confidence adversarial examples in a simple transferability test we show can also be used to break defensive distillation. We hope our attacks will be used as a benchmark in future defense attempts to create neural networks that resist adversarial examples.
引用
收藏
页码:39 / 57
页数:19
相关论文
共 48 条
[1]  
[Anonymous], 2016, arXiv
[2]  
[Anonymous], P USENIX SEC 2016
[3]  
[Anonymous], 2012, SIGNAL PROCESSING MA
[4]  
[Anonymous], 2013, ICLR
[5]  
[Anonymous], BRINGING BIG NEURAL
[6]  
[Anonymous], PROC CVPR IEEE
[7]  
[Anonymous], 2015, COMPUTER SCI
[8]  
[Anonymous], 2015, ARXIV151104599
[9]  
[Anonymous], 2015, ARXIV151105432
[10]  
[Anonymous], 2015, ABS151103034 CORR