Abstract
State-of-the-art defense mechanisms are typically evaluated in the context of white-box attacks, which is not realistic, as it assumes the attacker can access the gradients of the target network. To protect against this scenario,
Adversarial Training (AT) and
Adversarial Distillation (AD) include adversarial examples during the training phase, and
Adversarial Purification uses a generative model to reconstruct all the images given to the classifier. This paper considers an even more realistic evaluation scenario:
gray-box attacks, which assume that the attacker knows the architecture and the dataset used to train the target network, but cannot access its gradients. We provide empirical evidence that models are vulnerable to gray-box attacks and propose LISArD, a defense mechanism that does not increase computational and temporal costs but provides robustness against gray- and white-box attacks without including AT. Our method approximates a cross-correlation matrix, created with the embeddings of noisy (by adding random Gaussian noise) and clean images, to a diagonal matrix while simultaneously promoting correct image classification. Our results show that LISArD can effectively protect against gray-box attacks, can be used in multiple architectures, and carries over its resilience to the white-box scenario. Also, the results show that state-of-the-art models underperform greatly when removing AT and/or moving to gray-box settings, highlighting the lack of robustness from existing approaches to perform in various conditions (aside from white-box settings). All the source code is available at
https://github.com/Joana-Cabral/LISArD.