Towards Evaluating the Robustness of Neural Networks

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2017, Pages 39-57

  Carlini, Nicholas ^a   Wagner, David ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DISTILLATION;

DISTANCE METRICS; GENERATION ALGORITHM; HIGH CONFIDENCE; SECURITY-CRITICAL; STATE OF THE ART; TARGET CLASSIFICATION;

NETWORK SECURITY;

EID: 85024480368     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2017.49     Document Type: Conference Paper

References (48)

1. ANDOR, D., ALBERTI, C., WEISS, D., SEVERYN, A., PRESTA, A., GANCHEV, K., PETROV, S., AND COLLINS, M. Globally normalized transition-based neural networks. ArXiv preprint arXiv:1603. 06042 (2016).
2. BASTANI, O., IOANNOU, Y., LAMPROPOULOS, L., VYTINIOTIS, D., NORI, A., AND CRIMINISI, A. Measuring neural net robustness with constraints. ArXiv preprint arXiv:1605. 07262 (2016).
3. BOJARSKI, M., DEL TESTA, D., DWORAKOWSKI, D., FIRNER, B., FLEPP, B., GOYAL, P., JACKEL, L. D., MONFORT, M., MULLER, U., ZHANG, J., et al. End to end learning for self-driving cars. ArXiv preprint arXiv:1604. 07316 (2016).
4. BOURZAC, K. Bringing big neural networks to self-driving cars, smartphones, and drones. http: //spectrum. ieee. org/computing/embedded-systems/ bringing-big-neural-networks-to-selfdriving-cars-smartphones-and-drones, 2016.
5. CARLINI, N., MISHRA, P., VAIDYA, T., ZHANG, Y., SHERR, M., SHIELDS, C., WAGNER, D., AND ZHOU, W. Hidden voice commands. In 25th USENIX Security Symposium (USENIX Security 16), Austin, TX (2016).
6. CHANDOLA, V., BANERJEE, A., AND KUMAR, V. Anomaly detection: A survey. ACM computing surveys (CSUR) 41, 3 (2009), 15.
7. CLEVERT, D.-A., UNTERTHINER, T., AND HOCHREITER, S. Fast and accurate deep network learning by exponential linear units (ELUs). ArXiv preprint arXiv:1511. 07289 (2015).
8. DAHL, G. E., STOKES, J. W., DENG, L., AND YU, D. Large-scale malware classification using random projections and neural networks. In 2013 IEEE International Conference on Acoustics, Speech and Signal Processing (2013), IEEE, pp. 3422-3426.
9. DENG, J., DONG, W., SOCHER, R., LI, L.-J., LI, K., AND FEI-FEI, L. Imagenet: A large-scale hierarchical image database. In Computer Vision and Pattern Recognition, 2009. CVPR 2009. IEEE Conference on (2009), IEEE, pp. 248-255.
10. GIUSTI, A., GUZZI, J., CIREşAN, D. C., HE, F.-L., RODRíGUEZ, J. P., FONTANA, F., FAESSLER, M., FORSTER, C., SCHMIDHUBER, J., DI CARO, G., et al. A machine learning approach to visual perception of forest trails for mobile robots. IEEE Robotics and Automation Letters 1, 2 (2016), 661-667.
11. GOODFELLOW, I. J., SHLENS, J., AND SZEGEDY, C. Explaining and harnessing adversarial examples. ArXiv preprint arXiv:1412. 6572 (2014).
12. GRAHAM, B. Fractional max-pooling. ArXiv preprint arXiv:1412. 6071 (2014).
13. GRAVES, A., MOHAMED, A.-R., AND HINTON, G. Speech recognition with deep recurrent neural networks. In 2013 IEEE international conference on acoustics, speech and signal processing (2013), IEEE, pp. 6645-6649.
14. GROSSE, K., PAPERNOT, N., MANOHARAN, P., BACKES, M., AND MCDANIEL, P. Adversarial perturbations against deep neural networks for malware classification. ArXiv preprint arXiv:1606. 04435 (2016).
15. GU, S., AND RIGAZIO, L. Towards deep neural network architectures robust to adversarial examples. ArXiv preprint arXiv:1412. 5068 (2014).
16. HE, K., ZHANG, X., REN, S., AND SUN, J. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (2016), pp. 770-778.
17. HINTON, G., DENG, L., YU, D., DAHL, G., RAHMAN MOHAMED, A., JAITLY, N., SENIOR, A., VANHOUCKE, V., NGUYEN, P., SAINATH, T., AND KINGSBURY, B. Deep neural networks for acoustic modeling in speech recognition. Signal Processing Magazine (2012).
18. HINTON, G., DENG, L., YU, D., DAHL, G. E., MOHAMED, A.-R., JAITLY, N., SENIOR, A., VANHOUCKE, V., NGUYEN, P., SAINATH, T. N., et al. Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups. IEEE Signal Processing Magazine 29, 6 (2012), 82-97.
19. HINTON, G., VINYALS, O., AND DEAN, J. Distilling the knowledge in a neural network. ArXiv preprint arXiv:1503. 02531 (2015).
20. HUANG, R., XU, B., SCHUURMANS, D., AND SZEPESV áRI, C. Learning with a strong adversary. CoRR, abs/1511. 03034 (2015).
21. HUANG, X., KWIATKOWSKA, M., WANG, S., AND WU, M. Safety verification of deep neural networks. ArXiv preprint arXiv:1610. 06940 (2016).
22. JANGLOVá, D. Neural networks in mobile robot motion. Cutting Edge Robotics 1, 1 (2005), 243.
23. KINGMA, D., AND BA, J. Adam: A method for stochastic optimization. ArXiv preprint arXiv:1412. 6980 (2014).
24. KRIZHEVSKY, A., AND HINTON, G. Learning multiple layers of features from tiny images.
25. KRIZHEVSKY, A., SUTSKEVER, I., AND HINTON, G. E. ImageNet classification with deep convolutional neural networks. In Advances in neural information processing systems (2012), pp. 1097-1105.
26. KURAKIN, A., GOODFELLOW, I., AND BENGIO, S. Adversarial examples in the physical world. ArXiv preprint arXiv:1607. 02533 (2016).
27. LECUN, Y., BOTTOU, L., BENGIO, Y., AND HAFFNER, P. Gradientbased learning applied to document recognition. Proceedings of the IEEE 86, 11 (1998), 2278-2324.
28. LECUN, Y., CORTES, C., AND BURGES, C. J. The mnist database of handwritten digits, 1998.
29. MAAS, A. L., HANNUN, A. Y., AND NG, A. Y. Rectifier nonlinearities improve neural network acoustic models. In Proc. ICML (2013), vol. 30.
30. MELICHER, W., UR, B., SEGRETI, S. M., KOMANDURI, S., BAUER, L., CHRISTIN, N., AND CRANOR, L. F. Fast, lean and accurate: Modeling password guessability using neural networks. In Proceedings of USENIX Security (2016).
31. MISHKIN, D., AND MATAS, J. All you need is a good init. ArXiv preprint arXiv:1511. 06422 (2015).
32. MNIH, V., KAVUKCUOGLU, K., SILVER, D., GRAVES, A., ANTONOGLOU, I., WIERSTRA, D., AND RIEDMILLER, M. Playing Atari with deep reinforcement learning. ArXiv preprint arXiv:1312. 5602 (2013).
33. MNIH, V., KAVUKCUOGLU, K., SILVER, D., RUSU, A. A., VENESS, J., BELLEMARE, M. G., GRAVES, A., RIEDMILLER, M., FIDJELAND, A. K., OSTROVSKI, G., et al. Human-level control through deep reinforcement learning. Nature 518, 7540 (2015), 529-533.
34. MOOSAVI-DEZFOOLI, S.-M., FAWZI, A., AND FROSSARD, P. Deepfool: A simple and accurate method to fool deep neural networks. ArXiv preprint arXiv:1511. 04599 (2015).
35. PAPERNOT, N., GOODFELLOW, I., SHEATSLEY, R., FEINMAN, R., AND MCDANIEL, P. cleverhans v1. 0. 0: An adversarial machine learning library. ArXiv preprint arXiv:1610. 00768 (2016).
36. PAPERNOT, N., AND MCDANIEL, P. On the effectiveness of defensive distillation. ArXiv preprint arXiv:1607. 05113 (2016).
37. PAPERNOT, N., MCDANIEL, P., AND GOODFELLOW, I. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. ArXiv preprint arXiv:1605. 07277 (2016).
38. PAPERNOT, N., MCDANIEL, P., JHA, S., FREDRIKSON, M., CELIK, Z. B., AND SWAMI, A. The limitations of deep learning in adversarial settings. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) (2016), IEEE, pp. 372-387.
39. PAPERNOT, N., MCDANIEL, P., WU, X., JHA, S., AND SWAMI, A. Distillation as a defense to adversarial perturbations against deep neural networks. IEEE Symposium on Security and Privacy (2016).
40. PASCANU, R., STOKES, J. W., SANOSSIAN, H., MARINESCU, M., AND THOMAS, A. Malware classification with recurrent networks. In 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) (2015), IEEE, pp. 1916-1920.
41. RUSSAKOVSKY, O., DENG, J., SU, H., KRAUSE, J., SATHEESH, S., MA, S., HUANG, Z., KARPATHY, A., KHOSLA, A., BERNSTEIN, M., BERG, A. C., AND FEI-FEI, L. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) 115, 3 (2015), 211-252.
42. SHAHAM, U., YAMADA, Y., AND NEGAHBAN, S. Understanding adversarial training: Increasing local stability of neural nets through robust optimization. ArXiv preprint arXiv:1511. 05432 (2015).
43. SILVER, D., HUANG, A., MADDISON, C. J., GUEZ, A., SIFRE, L., VAN DEN DRIESSCHE, G., SCHRITTWIESER, J., ANTONOGLOU, I., PANNEERSHELVAM, V., LANCTOT, M., et al. Mastering the game of Go with deep neural networks and tree search. Nature 529, 7587 (2016), 484-489.
44. SPRINGENBERG, J. T., DOSOVITSKIY, A., BROX, T., AND RIEDMILLER, M. Striving for simplicity: The all convolutional net. ArXiv preprint arXiv:1412. 6806 (2014).
45. SZEGEDY, C., VANHOUCKE, V., IOFFE, S., SHLENS, J., AND WOJNA, Z. Rethinking the Inception architecture for computer vision. ArXiv preprint arXiv:1512. 00567 (2015).
46. SZEGEDY, C., ZAREMBA, W., SUTSKEVER, I., BRUNA, J., ERHAN, D., GOODFELLOW, I., AND FERGUS, R. Intriguing properties of neural networks. ICLR (2013).
47. WARDE-FARLEY, D., AND GOODFELLOW, I. Adversarial perturbations of deep neural networks. Advanced Structured Prediction, T. Hazan, G. Papandreou, and D. Tarlow, Eds (2016).
48. YUAN, Z., LU, Y., WANG, Z., AND XUE, Y. Droid-sec: Deep learning in android malware detection. In ACM SIGCOMM Computer Communication Review (2014), vol. 44, ACM, pp. 371-372.