English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In recent years, defending adversarial perturbations to natural examples inorder to build robust machine learning models trained by deep neural networks(DNNs) has become an emerging research field in the conjunction of deeplearning and security. In particular, MagNet consisting of an adversarydetector and a data reformer is by far one of the strongest defenses in theblack-box oblivious attack setting, where the attacker aims to crafttransferable adversarial examples from an undefended DNN model to bypass anunknown defense module deployed on the same DNN model. Under this setting,MagNet can successfully defend a variety of attacks in DNNs, including thehigh-confidence adversarial examples generated by the Carlini and Wagner'sattack based on the $L_2$ distortion metric. However, in this paper, under thesame attack setting we show that adversarial examples crafted based on the$L_1$ distortion metric can easily bypass MagNet and mislead the target DNNimage classifiers on MNIST and CIFAR-10. We also provide explanations on whythe considered approach can yield adversarial examples with superior attackperformance and conduct extensive experiments on variants of MagNet to verifyits lack of robustness to $L_1$ distortion based attacks. Notably, our resultssubstantially weaken the assumption of effective threat models on MagNet thatrequire knowing the deployed defense technique when attacking DNNs (i.e., thegray-box attack setting).

On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples