[Paper Review] Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them

Florian Tramèr|arXiv (Cornell University)|Jul 24, 2021

Adversarial Robustness in Machine Learning11 citations

TL;DR

This paper establishes a formal hardness reduction between robust detection and robust classification of adversarial examples, proving that any robust detector for perturbations of size ϵ can be used to construct an inefficient but robust classifier for perturbations of size ϵ/2. The key contribution is showing that detecting adversarial examples is nearly as hard as classifying them, implying that strong detection claims likely imply equally strong, and often implausibly high, robustness in classification—raising red flags for empirical detector defenses.

ABSTRACT

Making classifiers robust to adversarial examples is hard. Thus, many defenses tackle the seemingly easier task of detecting perturbed inputs. We show a barrier towards this goal. We prove a general hardness reduction between detection and classification of adversarial examples: given a robust detector for attacks at distance {\epsilon} (in some metric), we can build a similarly robust (but inefficient) classifier for attacks at distance {\epsilon}/2. Our reduction is computationally inefficient, and thus cannot be used to build practical classifiers. Instead, it is a useful sanity check to test whether empirical detection results imply something much stronger than the authors presumably anticipated. To illustrate, we revisit 13 detector defenses. For 11/13 cases, we show that the claimed detection results would imply an inefficient classifier with robustness far beyond the state-of-the-art.

Motivation & Objective

• To establish a formal connection between the difficulty of detecting and classifying adversarial examples.
• To challenge the assumption that detection is an easier task than robust classification.
• To provide a theoretical framework for evaluating the credibility of empirical detection defenses.
• To expose that many claimed detection robustness results imply breakthroughs in robust classification that are inconsistent with current state-of-the-art.
• To guide future research by identifying when detector claims may be implausibly strong due to hidden implications for classification robustness.

Proposed method

• Proposes a hardness reduction from robust detection to robust classification, showing that any detector robust at distance ϵ can be transformed into a classifier robust at distance ϵ/2.
• Uses a minimum-distance decoding approach to construct an inefficient but formally correct classifier from a detector.
• Applies the reduction to 14 empirical detection defenses, demonstrating that their claimed robustness implies inefficient classifiers with far superior robustness than current state-of-the-art.
• Employs risk decomposition to analyze detector performance under adversarial attacks, separating false positive and false negative rates.
• Compares results with certified defenses to validate the reduction’s tightness, showing near-perfect alignment with theoretical bounds.
• Uses the reduction as a sanity check: if a detector claims high robustness, it likely implies a classifier with similarly high robustness, which is often implausible with current techniques.

Experimental results

Research questions

• RQ1 Is robust detection fundamentally easier than robust classification, or are they computationally equivalent?
• RQ2 Can a robust detector for ϵ-perturbations be used to construct a robust classifier for ϵ/2-perturbations?
• RQ3 Do strong empirical detection claims in practice imply equally strong, and possibly infeasible, improvements in robust classification?
• RQ4 To what extent do current detector defenses overstate their robustness due to unacknowledged implications for classification robustness?
• RQ5 Can this reduction serve as a general-purpose sanity check for evaluating new detector defenses before they are broken by stronger attacks?

Key findings

• A robust detector for ℓp-perturbations of size ϵ can be used to construct an inefficient but formally correct classifier for perturbations of size ϵ/2, proving that detection is nearly as hard as classification.
• Among 14 empirical detection defenses reviewed, 12/14 claimed robustness levels that imply inefficient classifiers with robustness far exceeding the current state-of-the-art, suggesting implausible claims.
• For example, a detector claiming 95% robust detection accuracy at ϵ = 8.9 in ℓ2 on MNIST implies a classifier with 56% robust accuracy at ϵ = 4.45, which exceeds the best known robust classifier’s 10% at ϵ = 2.
• In the case of certified defenses, the results from the reduction closely match actual performance: Zhang et al. (2020a) achieve 39% certified robust accuracy at ϵ = 4/255, and Sheikholeslami et al. (2021) achieve 37% robust detection accuracy at ϵ = 8/255—within 2% of the theoretical bound.
• The reduction reveals that detector defenses with strong claims are likely overstating robustness unless they implicitly rely on computational inefficiency, which is not typically feasible in practice.
• The authors argue that detector defenses should be evaluated not just on their own claims, but by comparing their implied classification robustness to known state-of-the-art results, which often reveals implausibility.