3 ms·
While it's true that these attacks work well on state-of-the-art models, there are defence strategies such as including adversial examples during training. Adva
by pdeburen 9y ago
While it's true that these attacks work well on state-of-the-art models, there are defence strategies such as including adversial examples during training. Advanced defence strategies such as https://arxiv.org/abs/1705.07204 https://arxiv.org/abs/1705.07204 are robust to a wide array of attacks and achieve very competitive error rates.
I'm not saying it's not a problem but there are successful defence strategies already in place for many attacks.
- LolWolf 9y ago> Although our models are more vulnerable to white-box FGSM samples compared to the v3adv model, ensemble adversarial training significantly increases robustness to black-box attacks that transfer FGSM samples crafted on the holdout Inception v4. So, I just train my new adversary on the "new" model that was trained on the previous adversarial examples. And now we're back to square one. I suspect the problem of adversarial attacks is a problem of high-dimensional spaces, not of training on particular samples.
- pdeburen 9y agoI'm not sure how the quote supports your argument. Adversial examples generalize well accross many different classifiers. Shallow NN's can be fooled just as well, it seems to be more of a problem of linear models in general. Apparently Geoff Hintons Capsule Networks are more robust due to being "less linear" (Ian Goodfellow mentioned this in a recent talk, don't have the references now to back it up)
- LolWolf 9y agoI'm not sure it's about how shallow the network is; even logistic regression can be fooled by the same techniques (e.g. 1-layer NN). That being said, maybe it does have something to do with linearity (I suspect not) or maybe it's just generally harder to deal with nonlinear functions.