4 ms·
> Although our models are more vulnerable to white-box FGSM samples compared to the v3adv model, ensemble adversarial training significantly increases robustnes
by LolWolf 9y ago
> Although our models are more vulnerable to white-box FGSM samples compared to the v3adv model, ensemble adversarial training significantly increases robustness to black-box attacks that transfer FGSM samples crafted on the holdout Inception v4.
So, I just train my new adversary on the "new" model that was trained on the previous adversarial examples. And now we're back to square one.
I suspect the problem of adversarial attacks is a problem of high-dimensional spaces, not of training on particular samples.
- pdeburen 9y agoI'm not sure how the quote supports your argument. Adversial examples generalize well accross many different classifiers. Shallow NN's can be fooled just as well, it seems to be more of a problem of linear models in general. Apparently Geoff Hintons Capsule Networks are more robust due to being "less linear" (Ian Goodfellow mentioned this in a recent talk, don't have the references now to back it up)
- LolWolf 9y agoI'm not sure it's about how shallow the network is; even logistic regression can be fooled by the same techniques (e.g. 1-layer NN). That being said, maybe it does have something to do with linearity (I suspect not) or maybe it's just generally harder to deal with nonlinear functions.