NeurIPS 2020poster998 citations
On Adaptive Attacks to Adversarial Example Defenses
Florian Tramer, Nicholas Carlini, Wieland Brendel, Aleksander Madry
Abstract
Adaptive attacks have (rightfully) become the de facto standard for evaluating defenses to adversarial examples. We find, however, that typical adaptive evaluations are incomplete. We demonstrate that 13 defenses recently published at ICLR, ICML and NeurIPS---and which illustrate a diverse set of defense strategies---can be circumvented despite attempting to perform evaluations using adaptive attacks.
BibTeX
@inproceedings{NEURIPS2020_11f38f8e,
author = {Tramer, Florian and Carlini, Nicholas and Brendel, Wieland and Madry, Aleksander},
booktitle = {Advances in Neural Information Processing Systems},
editor = {H. Larochelle and M. Ranzato and R. Hadsell and M.F. Balcan and H. Lin},
pages = {1633--1645},
publisher = {Curran Associates, Inc.},
title = { On Adaptive Attacks to Adversarial Example Defenses},
url = {https://proceedings.neurips.cc/paper_files/paper/2020/file/11f38f8ecd71867b42433548d1078e38-Paper.pdf},
volume = {33},
year = {2020}
}