[Paper Review] Logit Pairing Methods Can Fool Gradient-Based Attacks

Marius Mosbach, Maksym Andriushchenko+3 more|arXiv (Cornell University)|Oct 29, 2018

Adversarial Robustness in Machine LearningComputer Science21 references46 citations

TL;DR

The paper demonstrates that fast logit regularization methods like CLP and LSQ do not provide true robustness, while ALP offers limited robustness, and stresses the need for thorough PGD parameter testing and many restarts in evaluations.

ABSTRACT

Recently, Kannan et al. [2018] proposed several logit regularization methods to improve the adversarial robustness of classifiers. We show that the computationally fast methods they propose - Clean Logit Pairing (CLP) and Logit Squeezing (LSQ) - just make the gradient-based optimization problem of crafting adversarial examples harder without providing actual robustness. We find that Adversarial Logit Pairing (ALP) may indeed provide robustness against adversarial examples, especially when combined with adversarial training, and we examine it in a variety of settings. However, the increase in adversarial accuracy is much smaller than previously claimed. Finally, our results suggest that the evaluation against an iterative PGD attack relies heavily on the parameters used and may result in false conclusions regarding robustness of a model.

Motivation & Objective

• Evaluate whether logit pairing methods (CLP, LSQ, ALP) provide genuine adversarial robustness beyond masking gradient behavior.
• Assess robustness of these methods across MNIST, CIFAR-10, and Tiny ImageNet under strong gradient-based attacks.
• Investigate how evaluation practices (PGD parameter grids, restarts) affect robustness conclusions.

Proposed method

• Empirically compare CLP, LSQ, and ALP against strong white-box PGD attacks with varying iterations, step sizes, and restarts.
• Use MNIST (LeNet), CIFAR-10 (ResNet20-v2), and Tiny ImageNet (ResNet50-v2) under L_infinity perturbations with large epsilon values.
• Perform grid searches over PGD parameters and extensive random restarts to reveal attack success.
• Contrast against adversarial training and SPSA attacks to gauge true robustness.
• Visualize input-space loss surfaces to illustrate gradient obfuscation effects.

Experimental results

Research questions

• RQ1 Do CLP and LSQ provide actual robustness or merely obstruct gradient-based attacks?
• RQ2 Does ALP offer genuine robustness beyond adversarial training, and how significant is any gain?
• RQ3 How sensitive are robustness evaluations to PGD parameter choices and restart counts across datasets?

Key findings

• CLP and LSQ distort the input-space loss surface, making gradient-based attacks harder without providing real robustness (evidence via loss-surface analysis).
• MNIST: LSQ adversarial accuracy drops from 70.6% (single restart) to 5.0% with a larger PGD step size, iterations, and restarts; CLP drops from 62.4% to 4.1% under stronger PGD settings.
• CIFAR-10: CLP/LSQ robustness collapses to near 0% under PGD, with LSQ at 1.7% adversarial accuracy for some settings; ALP shows some robustness, outperforming plain adversarial training by about 3.4% under strongest PGD, but not dramatically.
• Tiny ImageNet: ALP can dramatically reduce adversarial accuracy (e.g., from 31.8% to 3.6% in some configurations), but fine-tuning and targeted attacks yield limited gains; overall, ALP does not achieve state-of-the-art robustness.
• The study emphasizes that PGD evaluation with default settings is unreliable; exhaustive PGD parameter grid searches and many restarts are essential to draw valid conclusions.