[Paper Review] Technical Report on the CleverHans v2.1.0 Adversarial Examples Library

Nicolas Papernot, Fartash Faghri+24 more|arXiv (Cornell University)|Oct 3, 2016

Adversarial Robustness in Machine Learning2 references404 citations

TL;DR

CleverHans v2.1.0 provides standardized TensorFlow reference implementations of adversarial attacks and defenses to enable robust model benchmarking and adversarial training.

ABSTRACT

CleverHans is a software library that provides standardized reference implementations of adversarial example construction techniques and adversarial training. The library may be used to develop more robust machine learning models and to provide standardized benchmarks of models' performance in the adversarial setting. Benchmarks constructed without a standardized implementation of adversarial example construction are not comparable to each other, because a good result may indicate a robust model or it may merely indicate a weak implementation of the adversarial example construction procedure. This technical report is structured as follows. Section 1 provides an overview of adversarial examples in machine learning and of the CleverHans software. Section 2 presents the core functionalities of the library: namely the attacks based on adversarial examples and defenses to improve the robustness of machine learning models to these attacks. Section 3 describes how to report benchmark results using the library. Section 4 describes the versioning system.

Motivation & Objective

• Provide standardized reference implementations of adversarial example construction techniques.
• Enable adversarial training and robust model development.
• Ensure benchmark results are comparable by using a common attack library.
• Describe library structure, versioning, and reporting guidelines for benchmarks.

Proposed method

• Implement attacks module with an Attack interface and multiple specific attack algorithms.
• Provide a Model abstraction to integrate with various frameworks (Keras, TensorFlow, etc.).
• Include defenses such as adversarial training within the training pipeline."
• Offer reporting guidelines to ensure reproducible benchmarks and versioned results.
• Adopt semantic versioning and document release notes for benchmark comparability.

Experimental results

Research questions

• RQ1 How can standardized attack implementations improve comparability of adversarial robustness benchmarks?
• RQ2 What attacks and defenses are implemented in CleverHans v2.1.0 and how do they interact with different model frameworks?
• RQ3 How should researchers report benchmark results to ensure reproducibility across versions?

Key findings

• A library of attacks includes FGSM, BIM, PGD, CW, EAD, JSMA, DeepFool, SPSA, and more, with corresponding generate functions.
• Defenses primarily focus on adversarial training implemented within the training pipeline.
• Versioning guidance emphasizes compatibility, reproducibility, and explicit reporting of attack methods and configurations.
• The library is open-source, TensorFlow-based, and designed to be framework-agnostic at the interface level.
• Benchmark reporting should specify CleverHans version and attack configurations to ensure comparability.