Increasing attack strength can bypass Feature Squeezing defenses

1. 01What problem does this paper attempt to solve?

   Test whether, after increasing attack strength, the Feature Squeezing joint detection framework can be bypassed by adversarial examples with relatively small visual distortion.

   Core question: whether the joint detection framework of Feature Squeezing proposed by Xu et al. (2017) remains effective under stronger attack configurations.

   • Problem setting: DNNs are vulnerable to adversarial example attacks; adversarial examples can be imperceptible to the human eye and are transferable (the authors cite Szegedy et al. 2013; Goodfellow et al. 2015; Liu et al. 2016, etc.).
   • Defense under examination: Feature Squeezing compresses the attacker's search space by transforming the input (reducing color depth, smoothing), compares the model prediction difference between the original input and the squeezed input, and flags an adversarial example if the difference exceeds a threshold; its authors claim that combining multiple squeezers can detect 11 attack methods (Xu et al. 2017).
   • The paper's hypothesis: the high detection rate of this detection framework was obtained under a specific (weaker) attack configuration and may be bypassed after increasing attack strength.
   • The paper's approach: on MNIST and CIFAR-10, using EAD, C&W (the β=0 special case of EAD), and I-FGSM, strengthen attacks by increasing κ or ε, test the joint detector, and observe the visual distortion of the examples.
   • Threat model:
     • Goal: generate adversarial examples that bypass the Feature Squeezing joint detector and have small visual distortion.
     • Knowledge: the attacks are white-box—EAD, C&W, and I-FGSM all require model gradients; the detector configuration and thresholds follow the public settings of Xu et al. (2017).
     • Capability: the attacker can adjust attack strength parameters (κ for EAD/C&W, ε for I-FGSM).
     • Victim system: the MNIST and CIFAR-10 joint detection configurations of Xu et al. (2017) and their pretrained models.

   Collapse this answer

2. 02What related research exists?

   It centers on adversarial example attacks, the Feature Squeezing defense, and the EAD and I-FGSM attacks used in this paper.

   Adversarial examples and transferability

   • Szegedy et al. (2013), Goodfellow et al. (2015)—found that DNNs are easily misled by adversarial examples, and that the perturbations can be made hard for human eyes to discern.
   • Liu et al. (2016), Papernot et al. (2016), Sharma & Chen (2017)—transferability of adversarial examples: examples generated against one model can mislead other models on the same task.

   Feature Squeezing defense (the attack target of this paper)

   • Xu et al. (2017)—proposed Feature Squeezing: using input transformations such as reducing color depth and local/non-local smoothing to compress the attack space, comparing the L1 difference between predictions on the original and squeezed inputs for detection, and jointly detecting with multiple squeezers by taking the maximum distance; its authors claim it can detect 11 attack methods. This paper points out that the attack configurations used in its experiments (κ=10, MNIST ε=0.3, CIFAR-10 ε=0.008) are insufficiently strong.

   Attack methods used in this paper

   • Carlini & Wagner (2017)—C&W L2 attack; Chen et al. (2017)—EAD, an elastic-net regularized generalization of C&W L2, where β controls the trade-off between L1 and L2, and β=0 is equivalent to C&W L2.
   • Goodfellow et al. (2015)—FGM (fast gradient methods); Kurakin et al. (2016)—I-FGSM, an iterative version of FGM with ε-ball clipping; Tramèr et al. (2017)—10 steps with step size ε/10, which they call an effective attack setting, and this paper follows it.

   Positioning: The authors position themselves as a re-evaluation of the Feature Squeezing defense—they do not propose a new attack or a new defense, but demonstrate that existing attacks under stronger configurations can bypass this detection framework, and suggest that new defenses should be validated with maximum attack strength while maintaining visual similarity.

   Baselines and benchmarks: There is no independent baseline method; the comparison is against the original configuration of the joint detector of Xu et al. (2017), on the MNIST and CIFAR-10 datasets.

   Collapse this answer

3. 03How does the paper address this problem?

   Following the detector and models of Xu et al. (2017), increase κ for EAD/C&W and ε for I-FGSM to generate adversarial examples and measure the detection rate.

   Overall approach: do not modify the detector, only strengthen the attack—use EAD, C&W, I-FGSM to generate adversarial examples under higher-strength parameters, and directly test the missed detections of the joint detector of Xu et al. (2017).

   The detection framework under attack

   • Squeezers: The MNIST joint detector uses 1-bit color depth + 2x2 median smoothing; CIFAR-10 uses 5-bit color depth + 2x2 median smoothing + non-local means (13x13 search window, 3x3 patch, Gaussian kernel bandwidth 2).
   • Decision method: Compare the L1 distance between predictions on the original input and the squeezed input, taking the maximum over multiple squeezers; the threshold follows Xu et al. (2017), selected so that the false positive rate is below 5%.

   Attack methods

   • EAD: The objective function is min_x c · f(x,t) + β|x−x₀|₁ + |x−x₀|₂², where f(x,t)=max{max_{j≠ t}[Logit(x)]_j−[Logit(x)]_t, −κ}; β controls the L1/L2 trade-off, and β=0 is the C&W L2 attack. β=0.01 on MNIST and β=0.001 on CIFAR-10.
   • I-FGSM: Iteratively apply FGM (x = x₀ − ϵ · sign(∇ J(x₀,t))) followed by ε-ball clipping; 10 steps with step size ε/10 (following the setting of Tramèr et al. 2017).

   Strength adjustment

   • κ (EAD/C&W): Controls the required margin between the predicted probability of the target class and the remaining classes, increased starting from 10 as used by Xu et al. (2017); the paper states that increasing κ strengthens the attack but sacrifices visual quality.
   • ε (I-FGSM): Controls the allowed L∞ distortion, increased starting from MNIST 0.3 and CIFAR-10 0.008 (the values used by Xu et al. 2017).

   Implementation details (Appendix 5.1)

   • EAD/C&W: A 9-step binary search over the regularization parameter c (starting at 0.001), with I=1000 iterations per step and an initial learning rate of 0.01; C&W uses ADAM, and EAD uses projected FISTA with a square-root decaying learning rate.
   • Samples and targets: 100 test images are randomly sampled from each dataset; there are three settings: non-targeted (causing misclassification) and targeted (Next class: t = label+1 mod number of classes; least-likely class LL).

   Collapse this answer

4. 04What experiments did the paper conduct?

   On 100 images each from MNIST and CIFAR-10, measure the ASR and distortion of three attacks at different strengths in bypassing the joint detector.

   Experimental setup

   • Victim models and detector: The pretrained MNIST and CIFAR-10 models used by Xu et al. (2017) and their joint detection configuration, with the same thresholds (the paper does not give model names or structural details).
   • Attacks: EAD (MNIST β=0.01, CIFAR-10 β=0.001), C&W (the special case of EAD with β=0), I-FGSM (10 steps, step size ε/10).
   • Datasets and sample size: 100 images randomly sampled from each of the MNIST and CIFAR-10 test sets; the paper does not report the number of repetitions.
   • Metrics: ASR (attack success rate, %); L1, L2, L∞ distortion, averaged only over successful samples.
   • Settings: Three settings: non-targeted, targeted-Next, targeted-LL; κ ∈ {10,20,30,40} (both datasets), and I-FGSM is shown at the smallest ε that achieves the highest ASR.

   Main results

   According to Table 1 (MNIST) and Table 2 (CIFAR-10), ASR rises as κ increases:

   Swipe horizontally to read the table

   Attack	Condition	MNIST ASR (Table 1)	CIFAR-10 ASR (Table 2)
   I-FGSM	non-targeted, lowest optimal ε	100%	100%
   C&W	non-targeted, κ=10 / highest κ	0% (κ=10) → 87% (κ=40)	32% (κ=10) → 100% (κ=70)
   C&W	targeted LL, κ=10 / highest κ	0% (κ=10) → 100% (κ=40)	0% (κ=10) → 100% (κ=70)
   EAD	non-targeted, κ=10 / highest κ	24% (κ=10) → 97% (κ=40)	46% (κ=10) → 100% (κ=70)
   EAD	targeted Next, κ=10 / highest κ	7% (κ=10) → 100% (κ=40)	10% (κ=10) → 100% (κ=70)
   EAD	targeted LL, κ=10 / highest κ	7% (κ=10) → 100% (κ=40)	0% (κ=10) → 100% (κ=70)

   • The authors state that at sufficient strength, each attack can reach close to 100% ASR against the joint detector.
   • The authors state that EAD outperforms C&W L2 in all cases, with a larger gap at low confidence, and consider this to indicate that minimizing L1 distortion is important for generating robust adversarial examples with small visual distortion.
   • Exception: On CIFAR-10, C&W targeted LL has an ASR of only 6% at κ=30 (targeted Next is 51% at the same κ), and only rises to 94% at κ=50 (Table 2).

   Observations on visual distortion (Figures 1–6)

   • EAD: The authors state that EAD samples that bypass the detector at high κ have relatively small visual distortion (Figures 1 and 2 are non-targeted; Figures 3 and 4 are least-likely targeted); the appendix states that distortion is more pronounced in the targeted, especially least-likely, cases, but the samples still remain visually adversarial.
   • I-FGSM: The authors state that CIFAR-10 samples at high ε have relatively small visual distortion, but on MNIST the high-ε samples that achieve the best ASR have obvious distortion (Figures 5 and 6).

   Other ablations and analyses

   • Distortion rises with strength: e.g., for MNIST EAD non-targeted, L2 rises from 2.286 at κ=10 to 3.803 at κ=40, and L∞ rises from 0.879 to 0.972 (Table 1).
   • For CIFAR-10 EAD non-targeted, L1 rises from 6.371 at κ=10 to 83.14 at κ=70 (Table 2).
   • The paper does not ablate parameters other than κ and ε, and does not report the detector's specific detection rate or changes in false positive rate under the strengthened attacks.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors only propose to verify the robustness of other defenses to strong attackers; the experiments are limited to two datasets with 100 images each.

   Limitations and future directions noted by the authors

   • Validating other defenses: the authors plan in future work to validate whether other recently proposed defenses are robust to strong attackers (Conclusion).
   • Recommendation for defenses: the authors recommend that newly proposed defenses be validated with the maximum attack strength while examples remain visually similar to the input (Conclusion).

   Scope of experiments

   • The subjects under test are the MNIST and CIFAR-10 joint detection configurations of Xu et al. (2017) and the corresponding pretrained models, 2 datasets in total (Section 2).
   • The attack methods are EAD, C&W (the β=0 special case of EAD), and I-FGSM, three in total; the strength parameters are κ (starting from 10, up to 40/70) and ε (Section 2, Tables 1–2).
   • 100 test images are randomly sampled per dataset; the paper does not report the number of repetitions (Section 2).
   • Visual distortion is shown only through randomly selected example images (Figures 1–6); the paper does not report human evaluation or quantitative perceptual metrics.
   • The paper does not report model architecture, the detector's detection rate under strengthened attacks, or tests of defenses other than Feature Squeezing.

   Collapse this answer

6. 06Summarize the main content of the paper

   After increasing κ for EAD/C&W or ε for I-FGSM, the Feature Squeezing joint detector is bypassed on MNIST and CIFAR-10.

   This is a re-evaluation paper on adversarial example detection defenses (ICLR 2018 Workshop) that examines the effectiveness of the joint detection framework of Feature Squeezing by Xu et al. (2017) under stronger attack configurations.

   • Problem: Feature Squeezing detects adversarial examples by compressing the attack space through input transformation and comparing prediction differences; its authors claim it can detect 11 attacks; the authors of this paper believe these detection rates were only validated under weaker attack configurations.
   • Method: on 100 randomly sampled test images each from MNIST and CIFAR-10, generate adversarial examples with EAD, C&W (the β=0 special case of EAD), and I-FGSM, strengthen attacks by increasing the confidence parameter κ (starting from 10) or the L∞ constraint ε (starting from 0.3 / 0.008), and test with the original detector and original thresholds.
   • Results: ASR rises with strength—on MNIST, EAD at κ=40 achieves 97% non-targeted and 100% for both targeted Next and LL (Table 1); on CIFAR-10, C&W and EAD at κ=70 achieve 100% in all three settings (Table 2); I-FGSM achieves 100% non-targeted on both datasets at the lowest optimal ε shown.
   • Comparison: the authors state that EAD outperforms C&W L2 in each case, with a larger gap at low confidence, and argue that minimizing L1 distortion helps generate robust examples with small visual distortion.
   • Visual distortion: the authors state that EAD examples at high κ have small distortion; I-FGSM has small distortion at high ε on CIFAR-10, but noticeable distortion at high ε on MNIST (Figures 1–6).
   • Conclusion: the authors recommend that new defenses be validated with the maximum attack strength while examples remain visually similar, and plan to examine the robustness of other defenses to strong attackers in future work.

   Collapse this answer

Related papers