论文标题
当心黑框：关于最近防御的鲁棒性，对对抗性示例
Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples
论文作者
论文摘要
最近在NIP，ICML，ICLR和CVPR等场所提出了许多防御。这些防御措施主要集中于减轻白框攻击。他们无法正确检查黑盒攻击。在本文中，我们扩展了对这些防御的分析，以包括自适应黑盒对手。我们的评估是对九个防御措施进行的，包括随机变换，comdefend，集成多样性，特征蒸馏，赔率是奇怪的，错误校正代码，分配分类器防御，K-Winner占据所有和缓冲区。我们的调查是使用两种黑盒对抗模型和六种广泛研究的CIFAR-10和Fashion-Mnist数据集的对抗性攻击进行的。我们的分析表明，与未防御性的网络相比，最新的防御（9分中的7个）仅提供了边缘的安全性（$ <25 \％$）。对于每个辩护，我们还显示了对手所拥有的数据量与自适应黑盒攻击的有效性之间的关系。总体而言，我们的结果绘制了清晰的图片：防御需要彻底的白色盒子和黑盒分析才能被认为是安全的。我们提供了这项大规模研究和分析，以激发该领域的发展，以发展更强大的黑盒防御力。
Many defenses have recently been proposed at venues like NIPS, ICML, ICLR and CVPR. These defenses are mainly focused on mitigating white-box attacks. They do not properly examine black-box attacks. In this paper, we expand upon the analysis of these defenses to include adaptive black-box adversaries. Our evaluation is done on nine defenses including Barrage of Random Transforms, ComDefend, Ensemble Diversity, Feature Distillation, The Odds are Odd, Error Correcting Codes, Distribution Classifier Defense, K-Winner Take All and Buffer Zones. Our investigation is done using two black-box adversarial models and six widely studied adversarial attacks for CIFAR-10 and Fashion-MNIST datasets. Our analyses show most recent defenses (7 out of 9) provide only marginal improvements in security ($<25\%$), as compared to undefended networks. For every defense, we also show the relationship between the amount of data the adversary has at their disposal, and the effectiveness of adaptive black-box attacks. Overall, our results paint a clear picture: defenses need both thorough white-box and black-box analyses to be considered secure. We provide this large scale study and analyses to motivate the field to move towards the development of more robust black-box defenses.
