[Paper Review] Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

Nicholas Carlini, David Wagner|arXiv (Cornell University)|May 20, 2017

Adversarial Robustness in Machine Learning330 citations

TL;DR

The paper surveys ten adversarial-example detection methods and demonstrates they can be defeated with tailored attacks, arguing that adversarial examples are not easily detectable and outlining evaluation guidelines.

ABSTRACT

Neural networks are known to be vulnerable to adversarial examples: inputs that are close to natural inputs but classified incorrectly. In order to better understand the space of adversarial examples, we survey ten recent proposals that are designed for detection and compare their efficacy. We show that all can be defeated by constructing new loss functions. We conclude that adversarial examples are significantly harder to detect than previously appreciated, and the properties believed to be intrinsic to adversarial examples are in fact not. Finally, we propose several simple guidelines for evaluating future proposed defenses.

Motivation & Objective

• Assess the effectiveness of ten recent adversarial example detection methods across multiple threat models.
• Determine whether detected adversarial examples are robust to adaptive, white-box, and transferability attacks.
• Understand whether purported intrinsic differences between adversarial and natural images hold under strong evaluation.
• Offer practical recommendations for evaluating future defenses.

Proposed method

• Reproduce and re-implement ten detection schemes from seven papers.
• Use Carlini and Wagner’s L2 targeted attack to generate adversarial examples.
• Develop adaptive, white-box attacker losses to evade each detector.
• Leverage transferability to evaluate black-box (limited-knowledge) attacks.
• Define a unified attack framework that integrates classifier and detector to bypass defenses.
• Evaluate defenses under zero-knowledge, perfect-knowledge, and limited-knowledge threat models.

Experimental results

Research questions

• RQ1 Can existing adversarial detection methods reliably distinguish adversarial from natural images under strong adaptive attacks?
• RQ2 Are detectors robust when attackers have full knowledge of the defense (white-box) or only black-box access?
• RQ3 Does transferability enable successful evasion of detectors in limited-knowledge scenarios?
• RQ4 Do detection results on MNIST generalize to more complex datasets like CIFAR-10?

Key findings

• All ten detection methods can be defeated by attacks tailored to the specific defense.
• On simple datasets, distortion increases marginally; on CIFAR-10, adversarial examples remain indistinguishable from natural images.
• Some defenses perform well under zero-knowledge or simple attacks but fail under perfect-knowledge adversaries.
• Adaptive attacks significantly reduce or eliminate the apparent robustness of detectors, sometimes increasing distortion by only ~10% but still not yielding detectable inputs.
• Defense-by-dalselection approaches and those relying on layer-wise or PCA-based statistics are not truly robust against white-box evasion.
• The study suggests warnings about relying on MNIST-based results and calls for standardized evaluation approaches.