Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace transfer-based evaluation with SPSA against PixelDefend end-to-end | PixelDefend · CIFAR-10 (ϵ = 8) | accuracy: 75% -> 10% | Hurt |
| Attack JPEG preprocessing with SPSA instead of relying on gradient-based or transfer-based attacks | JPEG compression defense · ImageNet (ϵ = 2) | accuracy: 15% -> 0% | Hurt |
| Attack the stochastic model by optimizing expected margin over its internal randomness | Stochastic padding and resizing · ImageNet (ϵ = 2) | accuracy: 36% -> 1% | Hurt |
| Use PGD against the full differentiable denoiser-classifier rather than a transfer-based surrogate | High-level Guided Denoiser · ImageNet (ϵ = 2) | accuracy: 75% -> 0% | Hurt |
| Attack the non-differentiable defense with SPSA | Non-differentiability defense · ImageNet (ϵ = 2) | accuracy: 15% -> 0% | Hurt |
| Add adversarial training | CIFAR-10 classifier · CIFAR-10 (ϵ = 8) | accuracy: 47% | Helped |
| Evaluate adversarially trained model with SPSA rather than the gradient-based adversary | Adversarial Training · CIFAR-10 (ϵ = 8) | accuracy: 47% -> 51% | No clear effect |
| Optimize misclassification jointly with high likelihood under PixelCNN | PixelCNN likelihood detector · CIFAR-10 (ϵ = 8) | adversarial-example detection rate: 99.7% -> 0% | Hurt |
Closest papers by meaning
- Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.91)
- Increasing Confidence in Adversarial Robustness Evaluations (NeurIPS 2022 · similarity 0.91)
- Are adversarial examples inevitable? (ICLR 2019 · similarity 0.91)
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.90)
- Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples (NeurIPS 2022 · similarity 0.90)
- Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.