[Paper Review] Evaluating and Understanding the Robustness of Adversarial Logit Pairing

Logan Engstrom, Andrew Ilyas+1 more|arXiv (Cornell University)|Jul 26, 2018

Adversarial Robustness in Machine Learning11 references85 citations

TL;DR

The paper evaluates the robustness of Adversarial Logit Pairing (ALP) under white-box targeted attacks on ImageNet, showing ALP is not robust and can be bypassed with strong PGD attacks; it also analyzes the ALP objective and loss landscapes.

ABSTRACT

We evaluate the robustness of Adversarial Logit Pairing, a recently proposed defense against adversarial examples. We find that a network trained with Adversarial Logit Pairing achieves 0.6% accuracy in the threat model in which the defense is considered. We provide a brief overview of the defense and the threat models/claims considered, as well as a discussion of the methodology and results of our attack, which may offer insights into the reasons underlying the vulnerability of ALP to adversarial attack.

Motivation & Objective

• Assess the robustness of Adversarial Logit Pairing (ALP) under white-box targeted adversarial attacks on ImageNet.
• Compare ALP’s claimed robustness to empirical attacks and provide upper bounds on attack success.
• Analyze the ALP loss formulation relative to robust optimization (Madry et al.).
• Examine the ALP-induced loss landscape and attack convergence behavior to understand vulnerability.
• Propose evaluation methods for adversarial defenses based on empirical robustness and loss landscape analysis.

Proposed method

• Reproduce and extend the ALP evaluation using Projected Gradient Descent (PGD) with up to 1000 steps.
• Evaluate both targeted and untargeted attacks and measure attacker success rate and accuracy under perturbations.
• Compare ALP-trained models against baseline (naturally trained) models under varying perturbation budgets (epsilon).
• Analyze the ALP loss objective and contrast it with the robust optimization objective of Madry et al. (Equation 1).
• Visualize loss landscapes around test points to characterize the optimization terrain induced by ALP.
• Examine attack convergence behavior to assess gradient-based robustness.

Experimental results

Research questions

• RQ1 How robust is ALP to white-box targeted adversarial attacks on ImageNet under standard perturbation bounds?
• RQ2 How do attacker success rates and model accuracy compare between ALP and baseline models as perturbation strength increases?
• RQ3 How does the ALP loss formulation differ from the robust optimization objective in Madry et al.?
• RQ4 What loss-landscape characteristics does ALP induce, and how do they affect attack convergence?
• RQ5 Can empirical robustness analyses and loss-landscape visuals serve as general evaluation tools for adversarial defenses?

Key findings

• Under white-box targeted attacks with epsilon = 16/255, attacker success is 98.6% and ALP accuracy is 0.6%.
• Under untargeted attacks with epsilon = 16/255, ALP accuracy drops to 0.1%.
• The ALP objective differs from the robust optimization objective by training on natural inputs and by using targeted adversarial examples during training.
• Loss landscapes for ALP can be bumpier and locally depressed, suggesting altered optimization dynamics around inputs.
• Attack convergence on ALP requires more gradient steps but remains ultimately successful at defeating the defense.
• The authors provide an evaluation codebase and recommend their methods as general practice for assessing adversarial defenses.