Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
Abstract
Evading adversarial example detection defenses requires finding adversarial examples that must simultaneously (a) be misclassified by the model and (b) be detected as non-adversarial. We find that existing attacks that attempt to satisfy multiple simultaneous constraints often over-optimize against one constraint at the cost of satisfying another. We introduce Selective Projected Gradient Descent and Orthogonal Projected Gradient Descent, improved attack techniques to generate adversarial examples that avoid this problem by orthogonalizing the gradients when running standard gradient-based attacks. We use our technique to evade four state-of-the-art detection defenses, reducing their accuracy to 0% while maintaining a 0% detection rate.
Cite
Text
Bryniarski et al. "Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent." International Conference on Learning Representations, 2022.Markdown
[Bryniarski et al. "Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent." International Conference on Learning Representations, 2022.](https://mlanthology.org/iclr/2022/bryniarski2022iclr-evading/)BibTeX
@inproceedings{bryniarski2022iclr-evading,
title = {{Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent}},
author = {Bryniarski, Oliver and Hingun, Nabeel and Pachuca, Pedro and Wang, Vincent and Carlini, Nicholas},
booktitle = {International Conference on Learning Representations},
year = {2022},
url = {https://mlanthology.org/iclr/2022/bryniarski2022iclr-evading/}
}