Recently, Kannan et al. [2018] proposed several logit regularization methods to improve the adversarial robustness of classifiers. We show that the computationally fast methods they propose - Clean Logit Pairing (CLP) and Logit Squeezing (LSQ) - just make the gradient-based optimization problem of crafting adversarial examples harder without providing actual robustness. We find that Adversarial Logit Pairing (ALP) may indeed provide robustness against adversarial examples, especially when combined with adversarial training, and we examine it in a variety of settings. However, the increase in adversarial accuracy is much smaller than previously claimed. Finally, our results suggest that the evaluation against an iterative PGD attack relies heavily on the parameters used and may result in false conclusions regarding robustness of a model.


    Access

    Download


    Export, share and cite



    Title :

    Logit Pairing Methods Can Fool Gradient-Based Attacks


    Contributors:

    Publication date :

    2018


    Remarks:

    Accepted to NeurIPS 2018 Workshop on Security in Machine Learning


    Type of media :

    Preprint


    Type of material :

    Electronic Resource


    Language :

    English




    Adversarial Logit Pairing

    Kannan, Harini / Kurakin, Alexey / Goodfellow, Ian | ArXiv | 2018

    Free access

    Logit Regression

    Retherford, Robert D. / Choe, Minja Kim | Wiley | 1993



    Fool type left-right universal brake

    XIAO YIFU | European Patent Office | 2021

    Free access

    The pulpit-Fool. A satyr

    Dunton, John | TIBKAT | 1707