Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Attacks and Defences Competition

Alexey Kurakin, Ian Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, Alan Yuille, Sangxia Huang, Yao Zhao, Yuzhe Zhao, Zhonglin Han, Junjiajia Long, Yerkebulan Berdibekov, Takuya Akiba, Seiya Tokui, Motoki Abe

TL;DR

The paper documents the NIPS 2017 Adversarial Attacks and Defences Competition, outlining the problem of adversarial examples, the competition’s structure, evaluation framework, and the array of top submissions. It surveys attack and defense techniques, including momentum-based and ensemble attacks, randomization and denoising defenses, and loss-ensemble strategies, illustrating how teams push the state of the art. Key contributions include TsAIL’s high-level representation guided denoiser, a momentum iterative attack achieving strong transferability, and randomization-based defenses that improve robustness against white-box and black-box attacks. The findings indicate strong average-case robustness for certain defenses, but worst-case scenarios reveal persistent vulnerability, underscoring the need for continued research and robust evaluation practices with diverse attack strategies.

Abstract

To accelerate research on adversarial examples and robustness of machine learning classifiers, Google Brain organized a NIPS 2017 competition that encouraged researchers to develop new methods to generate adversarial examples as well as to develop new ways to defend against them. In this chapter, we describe the structure and organization of the competition and the solutions developed by several of the top-placing teams.

Adversarial Attacks and Defences Competition

TL;DR

The paper documents the NIPS 2017 Adversarial Attacks and Defences Competition, outlining the problem of adversarial examples, the competition’s structure, evaluation framework, and the array of top submissions. It surveys attack and defense techniques, including momentum-based and ensemble attacks, randomization and denoising defenses, and loss-ensemble strategies, illustrating how teams push the state of the art. Key contributions include TsAIL’s high-level representation guided denoiser, a momentum iterative attack achieving strong transferability, and randomization-based defenses that improve robustness against white-box and black-box attacks. The findings indicate strong average-case robustness for certain defenses, but worst-case scenarios reveal persistent vulnerability, underscoring the need for continued research and robust evaluation practices with diverse attack strategies.

Abstract

To accelerate research on adversarial examples and robustness of machine learning classifiers, Google Brain organized a NIPS 2017 competition that encouraged researchers to develop new methods to generate adversarial examples as well as to develop new ways to defend against them. In this chapter, we describe the structure and organization of the competition and the solutions developed by several of the top-placing teams.

Paper Structure

This paper contains 45 sections, 27 equations, 10 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Adversarial examples
  3. Common attack scenarios
  4. Attack methods
  5. White box digital attacks
  6. Black box attacks
  7. Overview of defenses
  8. Adversarial competition
  9. Dataset
  10. Tasks and competition rules
  11. Evaluation metrics
  12. Competition schedule
  13. Technical aspects of evaluation
  14. Competition results
  15. Top scoring submissions
  16. ...and 30 more sections

Figures (10)

  • Figure 1: Plots which shows difference between score of top submission and best baseline in each round in each track. As could be seen from the plot, submissions kept improving each round.
  • Figure 2: Plots with scores of submissions in all three tracks. Solid line of each plot is scores of submissions depending on submission rank. Dashed lines are scores of baselines we provided. These plots demonstrate difference between best and worst submissions as well as how much top submissions were able to improve provided baselines.
  • Figure 3: The pipeline of the proposed defense method. The input image $x$ first goes through the random resizing layer with a random scale applied. Then the random padding layer pads the resized image $x^{\prime}$ in a random manner. The resulting padded image $x^{\prime\prime}$ is used for classification.
  • Figure 4: Target Hitting Matrix
  • Figure 5: Defender Accuracy Matrix
  • ...and 5 more figures