Research map / Adversarial robustness and security / Certified and empirical robustness
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BPDA against thermometer encoding instead of relying on LS-PGA | Thermometer-encoded CIFAR-10 classifier · CIFAR-10, ε=0.031, ℓ∞ | accuracy: 80% -> 30% | Hurt |
| Add thermometer encoding (ablation) | CIFAR-10 classifier without adversarial training · CIFAR-10, ε=0.031, ℓ∞ | accuracy under attack: no measurable improvement | No clear effect |
| Add thermometer encoding to adversarial training (ablation) | CIFAR-10 adversarially trained classifier · CIFAR-10, ε=0.031, ℓ∞ | accuracy under attack: over 70% -> 30% | Hurt |
| Use BPDA and EOT against input transformations | ImageNet input-transformation defenses · ImageNet, ℓ2 dissimilarity 0.01 | targeted attack success rate: 100% | Helped |
| Estimate gradients over randomized SAP evaluations | SAP classifier · CIFAR-10, ε=0.031 | accuracy: 0% | Hurt |
| Use EOT over the transformation distribution rather than a fixed ensemble of randomization patterns | Randomized resizing-and-padding defense · ImageNet, ε=0.031, ℓ∞ | accuracy: 32.8% -> 0.0% | Hurt |
| Approximate gradients through PixelDefend with BPDA | PixelDefend · CIFAR-10, ε=0.031, ℓ∞ | accuracy: 95% -> 9% | Hurt |
| Add PixelDefend to adversarial training (ablation) | Adversarially trained CIFAR-10 classifier · CIFAR-10 | robustness | No clear effect |
| Use BPDA through Defense-GAN's approximate projection | Defense-GAN · MNIST, normalized ℓ2 distortion ≤ .0051 | accuracy: 55% accuracy | Hurt |
| Optimize adversarial examples in generator latent space | Defense-GAN · MNIST | mean ℓ2 distortion: 0.0019 -> 0.0027; 1.46× | Mixed |
| Use high-confidence adversarial examples without optimizing against LID | LID adversarial-example detector · LID detector, ε=0.015 | adversarial examples flagged benign: 97% | Helped |
Closest papers by meaning
- Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent (ICLR 2022 · similarity 0.88)
- A New Defense Against Adversarial Images: Turning a Weakness into a Strength (NeurIPS 2019 · similarity 0.87)
- AttackBench: Evaluating Gradient-based Attacks for Adversarial Examples (AAAI 2025 · similarity 0.86)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.85)
- Rethinking Adversarial Robustness in the Context of the Right to be Forgotten (ICML 2024 · similarity 0.85)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.