English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Despite their accuracy, neural network-based classifiers are still prone tomanipulation through adversarial perturbations. Those perturbations aredesigned to be misclassified by the neural network, while being perceptuallyidentical to some valid input. The vast majority of attack methods rely onwhite-box conditions, where the attacker has full knowledge of the attackednetwork's parameters. This allows the attacker to calculate the network's lossgradient with respect to some valid input and use this gradient in order tocreate an adversarial example. The task of blocking white-box attacks hasproven difficult to solve. While a large number of defense methods have beensuggested, they have had limited success. In this work we examine thisdifficulty and try to understand it. We systematically explore the abilitiesand limitations of defensive distillation, one of the most promising defensemechanisms against adversarial perturbations suggested so far in order tounderstand the defense challenge. We show that contrary to commonly heldbelief, the ability to bypass defensive distillation is not dependent on anattack's level of sophistication. In fact, simple approaches, such as theTargeted Gradient Sign Method, are capable of effectively bypassing defensivedistillation. We prove that defensive distillation is highly effective againstnon-targeted attacks but is unsuitable for targeted attacks. This discoveryleads us to realize that targeted attacks leverage the same input gradient thatallows a network to be trained. This implies that blocking them will requirelosing the network's ability to learn, presenting an impossible tradeoff to theresearch community.

Why Blocking Targeted Adversarial Perturbations Impairs the Ability to Learn