Towards Counteracting Adversarial Perturbations to Resist Adversarial Examples
Authors: Haimin ZHANG
Min Xu
Venue:  (2021)
Keywords: adversarial robustness
resisting adversarial examples

Abstract: Studies show that neural networks are susceptible to adversarial attacks. This exposes a potential threat to neural network-based artificial intelligence systems. We observe that the probability of the correct result outputted by the network increases by applying small perturbations generated for class labels other than the original predicted one to adversarial examples. Based on this observation, we propose a method of counteracting adversarial perturbations to resist adversarial examples. In our method, we randomly select a number of class labels and generate small perturbations for these selected labels. The generated perturbations are added together and then clamped to a specified space. The obtained perturbation is finally added to the adversarial example to counteract the adversarial perturbation contained in the example. The proposed method is applied at inference time and does not require retraining or finetuning the model. We validate the proposed method on CIFAR-10 and CIFAR-100. The experimental results demonstrate that our method effectively improves the defense performance of the baseline methods, especially against strong adversarial examples generated using more iterations.

Under review as a conference paper at ICLR 2021
TOWARDS COUNTERACTING ADVERSARIAL PERTUR- BATIONS TO RESIST ADVERSARIAL EXAMPLES
Anonymous authors Paper under double-blind review
ABSTRACT
Studies show that neural networks are susceptible to adversarial attacks. This exposes a potential threat to neural network-based artificial intelligence systems. We observe that the probability of the correct result outputted by the neural net- work increases by applying small perturbations generated for non-predicted class labels to adversarial examples. Based on this observation, we propose method of countcracting adversarial perturbations to resist adversarial examples. In our method, we randomly select number of class labels and generate small perturba- tions for these selected labels, The generated perturbations are added together and then clamped onto specified space. The obtained perturbation is finally added to the adversarial example to counteract the adversarial perturbation contained in the example. The proposed method is applied at inference time and does not require retraining or finetuning the model. We validate the proposed method on CIFAR-10 and CIFAR-100. The experimental results demonstrate that our method effective- ly improves the defense performance of the baseline methods, especially against strong adversarial examples generated using more iterations.
INTRODUCTION
Deep neural networks (DNNs) have become the dominant approach for various tasks includ- ing image understanding, natural language processing and speech recognition (He et al., 2016; Devlin et al., 2018; Park al., 2018). However, recent studies demonstrate that neural networks are vulnerable to adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015). That is, these network models make an incorrect prediction with high confidence for inputs that are only slightly different from correctly predicted examples. This reveals potential threat to neural satwork-based artificial intelligence systems, many which have been widely deployed in real-world applications.
The adversarial vulnerability of neural networks reveals fundamental blind spots in the learning algorithms. Even with advanced learning and regularization techniques, neural networks are not leamiigg the true underlying distribution of the training data, although they can obtain extraordinary performance on test sets. This phenomenon is now attracting much research attention. There have been increasing studies attempting explain neural networks' adversarial vulnerability and develop methods to resist adversarial examples (Madry et al., 2018; Zhang et al., 2020; Pang et al., 2020). While much progress has been made, most existing studies remain preliminary. Because it is difficult to construct a theoretical model to explain the adversarial perturbation generating process, defending against adversarial attacks is still challenging task.
Existing methods of resisting adversarial perturbations perform defense either at training time or inference time. Training time defense methods attempt to increase model capacity improve ad- versarial robustness. One of the commonly used methods is adversarial training (Szegedy et al., 2014), in which a mixture of adversarial and clean examples are used to train the neural network. The adversarial training method can be seen as minimizing the worst case loss when the training example perturbed by an adversary (Goodfellow et al., 2015). Adversarial training requires an adversary to generate adversarial examples in the training procedure. This can significantly in- crease the training time. Adversarial training also results in reduced performance on clean exam- ples. Lamb et al. (2019) recently introduced interpolated adversarial training (IAT) that incorporates interpolation based training into the adversarial training framework. The IAT method helps to im- prove performance clean examples while maintaining adversarial robustness.

---

Under review as a conference paper at ICLR 2021
As to inference time defense methods, the main idea is to transfer adversarial perturbations such that the obtained inputs are no longer adversarial. Tabacof & Valle (2016) studied the use of ran- dom noise such Gaussian noise and heavy-tail noise to resist adversarial perturbations. Xie et al. (2018) introduced to apply two randomization operations, i.e., random resizing and random zero padding, to inputs to improve adversarial robustness. Guo et al. (2018) investigated the use of ran- dom cropping and rescaling to transfer adversarial perturbations. More recently, Pang et al. (2020) proposed the mixup inference method that uses the interpolation between the input and randomly selected clean image for inference. This method can shrink adversarial perturbations somewhat by the interpolation operation. Inference time defense methods can be directly applied to off-the-shelf network models without retraining or finetuning them. This can be much efficient as compared to training time defense methods.
Though adversarial perturbations are not readily perceivable by human observer, it is suggested that adversarial examples are outside the natural image manifold (Hu al., 2019). Previous studies have suggested that adversarial vulnerability is caused by the locally unstable behavior of classifiers on data manifolds (Fawzi et al., 2016; Pang et al., 2018). Pang et al. (2020) also suggested that adversarial perturbations have the locality property and could be resisted by breaking the locality. Existing inference time defense methods mainly use stochastic transformations such as mixup and random cropping and rescaling to break the locality. In this research, we observe that applying small perturbations generated for non-predicted class labels to the adversarial example helps to counteract the adversarial effect. Motivated by this observation, we propose a method that employs the use of small perturbations to counteract adversarial perturbations, In the proposed method, we generate small perturbation using local first-order gradient information for a number of randomly selected class lables. These small perturbations are added together and projected onto specified space before finally applying to the adversarial example. Our method can be used as preliminary step before applying existing inference time defense methods.
To the best of our knowledge, this is the first research on using local first-order gradient information to resist adversarial perturbations. Successful attack methods such as projected gradient descent (PGD) (Madry et al., 2018) usually use local gradient to obtain adversarial perturbations. Compared to random transformations, it would be more effective to use local gradient to resist adversarial perturbations. We show through experiments that our method is effective and complementary to random tranffrmatioon-asse methods to improve defense performance.
The contributions of this paper can be summarized as follows:
We propose a method that uses small first-order perturbations to defend against adversarial attacks. We show that our method is effective in counteracting adversarial perturbations and improving adversarial robustness.
We evaluate our method on CIFAR-10 and CIFAR-100 against PGD attacks in different settings. The experimental results demonstrate that our method significantly improves the defense performance of the baseline methods against both untargeted and targeted attacks and that it performs well in resisting strong adversarial examples generated using more iterations.
2 PRELIMINARY
2.1 ADVERSARIAL EXAMPLES
We consider a neural network f(-) with parameters that outputs a vector of probabilities for L = {1, 2..... I.. categories. In supervised learning, empirical risk minimization (ERM) (Vapnik, 1998) has been commonly used as the principle to optimize the parameters on a training set. Given an input x, the neural network makes a prediction c(x) arg max fz). The prediction is correct if c(x) is the same the actual target c² (x))
Unfortunately, ERM trained neural networks are vulnerable to adversarial examples, inputs formed by applying small but intentionally crafted perturbations (Szegedy et al., 2014; Madry et al., 2018). That is, an adversarial example x' is close to a clean example z under a distance metric, e.g. fxx distance, but the neural network outputs an incorrect result for the adversarial example x' with high
2

---

Under review as a conference paper at ICLR 2021
confidence. In most cases, the difference between the adversarial example and clean example is not readily recognizable to humans.
2.2 ATTACK METHODS
Existing attack methods be categorized into white-box attacks and black-box attacks. We focus on defending against white-box attacks, wherein the adversary has full access to the network model including the architecture and weights. The fast gradient sign (FGSM) method (Goodfellow al., attack methods.
2015) and PGD are two successful optimization-
The FGSM method is one-step attack method. It generates adversarial perturbations that yield the highest loss increase in the gradient sign direction. Let æ be the input to network model, the label associate with and I(O,,r; ar, y) be the loss function for training the neural network. The FGSM method generates a max-norm constrained perturbation as follows:
= Esign L. az y));
where e denotes the max-norm. This method was developed based on the view that the primary cause of neural networks' adversarial vulnerability is their linear nature. The required gradient can be computed efficiently using backpropagation.
The PGD method is a multistep attack method that iteratively applics projected gradient descent on the negative loss function (Kurakin al., 2016) as follows:
x ++1 12+ + asign( VV L(0, x ,y)),,
(2)
where a denotes the step size and II denotes the projection operator that projects the perturbed input onto x + S. We consider projecting the perturbed input onto a predefined fo ball from the original input. The PGD attack method can be seen as a multistep FGSM method. It is a much strong adversary that reliably causes variety of neural networks to misclassify their input.
METHODOLOGY
While many studies have been con- ducted on defending against adver- sarial attacks at inference time, these studies have not considered using local gradient information to resist adversarial perturbations. Previous work has suggested that the primary cause of neural networks' adversari- al vulnerability is their linear nature (Goodfellow et al., 2015). It would be more effective to use first-order gradient information to counterac- t adversarial perturbations such that the resulted perturbations no longer result in the model making an incor- rect prediction.
'Ship"
"Frog"
Label+
Lobve-
6.5c
0.106
0.104
0.061
0.049
8017
0.033
8.9c-5
8.3c-5
1.0e-4
Predicted probabiities
uning untargetd PGN,, methadion usampion
Figure I: An illustration that shows applying small perturbations generated for non- predicted labels the adversarial example helps suppress the adversurial effect and improve the prediction probability for the correct category. +Peribij demotes applying the small perturaation generated for i-th class label to the adversarial example.
Adversarial perturbations are smal- I crafted perturbations that slightly affect the visual quality of inputs but cause the neural network to misclassify the inputs favor of an incorrect answer with high probability. We show that this effect can be counteracted by applying small perturbations generated using local first-order gradi- ent information for class labels other than the predicted one. An illustration of this phenomenon is shown in Figure 1. We see that by adding perturbations generated for non non-predie non-predicted labels to the input, the prediction probability for the correct category increases and that for the incorrect label is suppressed.
3

---

Under review as a conference paper at ICLR 2021
Algorithm 1 Counteracting adversarial perturbations using local first-order gradient.
Input: Neural network f; input æ;; step size a used in PGD to generate perturbations to counteract adver-
sarial perturbation.
Output: Prediction result for æ.
1: Randomly select N class labels (41, 12, (N)
2: for i to N do
3: 1): = PGD(L,, a, step=1) // generate perturbation 17s for 4 using the one-step PGD method.
4: end for
5: w + Ic ((())) // Ci Eoo bounded space.
6: return f()).
Based on this phenomenon, we propose a method of counteracting adversarial perturbations to im- prove adversarial robustness. In the proposed method, we generate small perturbations for number of randomly selected class labels and apply these perturbations to the input to resist the adversarial perturbation. Let æ be the imput model, which can be an adversarial or clean example. We ran- domly select class labels and generate small first-order perturbations for the N selected labels. These N small perturbations are added together and then projected onto -bounded space before applying to the input. This procedure can be formulated as follows:
= x + He
ns (x)))
where (x) denotes the small perturbation generated for the i-th selected class label, {t) ||t - =Iloo I μ1 is a μ bounded foo space. The one-step PGD method is used to generate s- mall perturbations. This is the same as using the FGSM method and empirically achieves better performance than using multiple steps. The perturbations can be generated in an untargeted or targeted manner. The combined perturbation projected onto the space C. This ensures that the obtained example is visually similar to the original one. We detail the procedure for counteracting adversarial perturbations Algorithm I.
Discussion and Analysis Adversarial examples exposes underlying flaws in the training algorithm- s. While much progress has been made in defending against adversarial attacks, it is difficult to theoretically understand neural networks' vulnerability to adversarial examples. Previous work (Athalye et al., 2018) has suggested that the adversarial perturbation can be obtained by solving the following optimization problem:
min ||8||,p
s.t. c(x + 5) + c² (x)), S.
where & is a hyperparameter constraining the size of the perturbation. This problem can be effec- tively solved by gradient descent- based attack methods such PGD and FGSM that reliably cause neural networks to output an incorrect result. These attack methods typically use local first-order gradient find the optimal solution. Because state-of-the-art neural networks usually have many parameters, perturbations obtained with these attack methods may overfit to the inputs. Therefore, perturbing and transferring these adversarial perturbations could be an effective way to resist the adversarial effect. Unlike previous random transformation-bast based methods, we employ the use of local first-order gradient information to counteract the adversarial effect. We show that the pro- posed method is effective in improving defense performance, especially against strong adversarial examples generated using more iterations.
Let æo be clean example and 8 be the adversarial perturbation. In our method, the following input fed to the neural network:
0, Do is not subject to adversarial attack, Wo + 8- 1((0)) + Hel Σ ((xo)), where le(w)) {1.
N
ap is subject to adversarial attack.
(5)
The perturbation 7)s generated to counteract the adversarial perturbation should be small, otherwise would be new adversarial perturbation. This would essentially have effect in counteracting the
4

---

Under review as a conference paper at ICLR 2021
Table 1: Classification accuray (%) adversarial exmples crafted the test of CIFAR-10 10. We report per- formance resisting PGD attacks with 10, 200 iterations. The numbers parentheses are performance improvements achieved by applying our method.
Untargeted attacks PGDs0
Targeted attacks PGDs0
Method
1G
PGD200
PGD10
PGD200
Mixup (Zhang et al., 2018)
3.1
SI
<
SI
Ours + Mixup
26.5
27.2
31.7
55.3
59.7
63.1
Xie al.'s (2018) Mixup
23.0
19.6
19.1
38.4
31.1
25,2
Ours Xic et + Mixup
35.5(.12.5)
36.46168)
41.3(222.2)
60.3
63.7(u326)
66. 1u4..9
Gno et al.'s (2018) 8)+ Mixup
31.2
28.8
28.3
57.8
49.1
48.9
Ours Guo et al.'s Mixup
(0.3
51.8
(6.2()
(4.1
78.0
79.8:+30.9
MI-OL (Pang al., 2020) Mixup
26.1
18.8
18.3
55,6
51.2
50.8
Ours M1-OL+ + Mixup
38.8(+12.7)
38.6(+19.8)
(1.5(+23.2)
55.3(0.)
60.0(+8.8)
63.0(+12.2)
(Lamb al., 2019)
46.7
43.5
42.5
65.6
62.5
61.9
Ours IAT
60.1
60.8
60.9
68.0
69.1
68.9
Xie et (2018) 1AT
59.7
58.4
57.9
71.1
69.7
69.3
Ours Xie et al.'s IAT
68.7(+9.)
69.2
69.3(-11.4)
76.7
76.6(+6.9)
76.6.+7.3)
Guo et al.'s (2018) LAT
60.9
60.7
60.3
73.2
72.1
71.6
Ours Guo et al's IAT
67.2(+6.3)
68.16474)
68.2(+7.9)
72.6,06)
72.4w00)
72.8
MI-OL (Pang al. 2020) LAT
64.5
63.8
63.3
75.3
74.7
74.5
IAT
68.6(-4
68.9(45.1)
68.8(45.5)
72.4(29)
72.8(2.)
72.9(.16)
adversarial perturbation. Adversarial training that has been shown to be effective to improve adver- sarial robustness usually employs a first-order adversarial like PGD to provide adversarial examples for training. These adversarial examples help regularize the model to be resistant to adversari- al perturbations. We show through experiments that our method complementary to adversarial training improve overall defense performance against both untargeted and targeted attacks.
The proposed method is applied at inference time. It can be directly applied to off-the-shelf models without retraining or finetuning them. The required gradient for generating small perturbations can be computed efficiently in parallel using backpropagation. This would not increase too much time for inference.
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
We conduct experiments on CIFAR-10 and CIFAR-100 (Krizhevsky et al., 2009). ResNet-50 (He et al., 2016) is used the network model. We validate the proposed method on models trained using two methods: Mixup (Zhang et al., 2018) and IAT (Lamb et al., 2019). For fair performance comparison, follow the same experimental setup Pang et al. (2020) to train the models. The training procedure is performed for 200 epochs with a batch size of 64. The learning rate is initial- ized to 0.1 and divided by a factor of 10 epoch 100 and 150. The values used for interpolation are sampled from Beta(1, 1) for both Mixup and IAT. The ratio between clean examples and ad adversarial examples used IAT set 1:1. The untargeted PGD10 method with a step size of 2/255 and set to 8 3/255 is used to generate adversarial examples in IAT.
We experiment against both untargeted and targeted PGD attacks with different iterations. The values of e and step size for the PGD attacks are set to 8/255 and 2/255, respectively. The one- step PDG method used to generate perturbations to resist adversarial perturbations. Unless stated generated in targeted fashion. The step
otherwise, perturbations used for defense purposes size for the one-step PGD and number of randomly selected class labels are set to 4/255 and 9, respectively. The value of is set to 8/255. For each experiment, and report the mean accuracy. Our method is implemented in Pytorch (Paszke et al., 2017) and all experiments are conducted one GPU.
model for three times
Baselines Three methods that were recently developed for inference time defense are used as base- lines. These three methods are Xie al.'s (2018), Guo al.'s (2018) and MI-OI. (mixup inference
5

---

Under review as a conference paper at ICLR 2021
Table 2: Classification accuray (%) adversarial examples crafted on the test of CIFAR-100 100. We report performance resisting PGD attacks with 50 200 iterations. targeted attacks on LAT models, defense perturbations are generated in an untargeted manner. The numbres in parentheses are performance improvements achieved by applying our method.
Untargeted attacks
Targeted attcks
Method
PGD10
PGD50
PGD200
PGD1o
PGDs0
PGD200
Mixup (Zhang et al., 2018)
5.5
5.3
5.2
<1
<
Ours Mixup
9.2
12.3
14.3
31.8
32.4
33.8
Xic all's (2018) + Mixup
9.6
7.6
7.4
30.2
22.5
22.3
Ours + Xie ot al''s Mixup
19.3
21.100335
23.4(-16.)
40.9(410)
40.7,48.2)
41.2((18.9)
Guo et al.'s (2018) Mixup
13.1
10.8
10.5
33.3
26.3
26.
Ours
al.'s Mixup
28.3
(0.9()201)
32.9(v2244
50.8
50.9 (+24.))
51.7(c25.0)
MI-OL Pang al. (2020) + Mixup
12.6
9.4
37.0
29.0
28.7
Ours: + MI.LL Mixup
19.0n644
20.
21.9(+128)
36.5.0.5
35.9(669)
36.9(082)
IAT (Lamb et al., 2019)
26.6
24.1
24.0
52.0
50.1
49.8
Ours 1AT
32.6
33,9
34.6
54.3
53.2
53.2
(2018)
42.2
41.5
41.3
57.1
56.3
55.8
Ours + Xie et al.'s LAT
46.8.44.)
48.1(46.))
48.4(47.1
58.7(416)
57.5
57.4(-16)
Guo et al.'s (2018) TAT
36.2
33.7
33.3
53.8
52.4
52.2
Ours al.'s TAT
40.9u44
42. (44144
42.2(+8.9)
55.0/+12)
53.6
53.7
MI-OL Pang et al. (2020) + IAT
42.8
42.5
58.1
56.7
56.5
Ours + MI-OL + IAT
45.4
46,3
46.8/+4.)
57.5
56.7
57.4
with non-predicted labels) (Pang et al., 2020). We compare the performance our method and the baselines and present results of the joint use of our method and the baselines to resist adversarial examples.
4.2 EXPERIMENTAL RESULTS
We validate the proposed method against oblivious-box attacks (Carlini & Wagner, 2017). That is the adversary does not know about the existence of the defense mechanism, and adversarial examples are generated only based on targeted network models. We evaluate the performance of defenses on the entire test set. Table 1 and Table report the quantitative results on CIFAR-10 10 and CIFAR- 100, respectively, demonstrating the effectiveness of the proposed method in improving defense performance. We see from Table that the proposed method significantly helps to improve defense performance of the baseline methods against untageted attacks, achieving at least 12.5% and 4.1% performance gains for Mixup and IAT trained models, respectively. For defending against targeted attacks, the proposed method performs well in combination with Xie et al.'s and Guo et al.'s for Mixup trained models, and it performs well together with Xie et al.'s for IAT trained models. be seen from Table 2 that, with CIFAR-10. the proposed method also helps improve defense performance against untargeted attacks on CIFAR-100, achieving at least 6.4% and 1.6% performance improvements for Mixup and IAT trained models, respectively. For defending against targeted attacks, our method consistently helps to improve defense performance when applied on Xie al.'s and Guo al.'s methods. We can also make the following three observations from the quantitative results.
1. In most cases, the proposed method improves defense performance of the baseline methods. Especially for resisting untargeted attacks in different settings, our method significantly helps to improve defense performance. This shows that our method is complementary resist adversarial perturbations. Among the three baseline methods, the joint use of our method with Xie et al.'s and Guo al.'s methods performs well compared to with the MI-OL method. This could be because the perturbation used to counteract adversarial perturbations is reduced due to the interpolation operation in MI-OL.
the baselines to
2. The proposed method performs well against strong PGD attacks with more iterations. Previ- ous studies show that adversarial perturbations generated using more iterations are difficult to resist. The results of the baselines also show that PGD attacks with more iterations result in reduced perfor- mance. It is worth noting that the proposed method achieves improved performance for defending against most strong PDG attacks. And for the remaining attacks, the of more iterations results in

---

Under review as a conference paper at ICLR 2021
CIPAR-10
CIAAR110
100
50-
Veee
beat Oun
Own
Orrekeel wil
70
68-
60
20-
30
Sbbo dederee prruuattion 07256
Size of sefenco perturbation a1265
Figure Impact of the size of perturbations generated defense purposes on classification accuracy (%). report performance of resisting both untargeted and targeted PGD1o attacks.
CIFAR-19
CIFAR-100
100
102
Moup Durk
Noup Dur lgt
70
Number sampled target bbatt
samp target abote
Figure 3: Impact of the number of randomly selected class labels in our method on classification accuracy (%). We report performance of resisting both untargeted and targeted PGD attacks.
comparable performance the use of less iterations. The results show that adversarial perturbations generated using more iterations can easily counteracted by using first-order perturbations.
3. For defending against targeted PGD50 and PGD200 attacks on CIFAR-10, 10, our method together with Guo et al.'s on Mixup trained models achieve higher performance than those obtained on IAT trained models, improving the classification accuracy 1.4% and 3.2%, respectively. Overall, our method together with Guo et al.'s achieve better or comparable performance than pure IAT trained know, are the first outperform pure adversarial training-obtained models
models. As far using only inference time defense methods. This shows that it is promising that adversarial training could be unnecessary if proper perturbations applied to adversarial examples.
Next, we analyse the impact of the step size used in the one-step PGD method on defense perfor- mance. We experiment CIFAR-10 and CIFAR-100 resisting both untargeted and targeted PGD attacks. The experimental results are reported in Figure 2. We see that the step size affects different- ly for untargeted and targeted attacks. The performance improves as the step size increases from to 8 for untargeted tasks on the two datasets. For targeted attacks, the performance improves as the step size increases from to 4 but starts reduce or maintain similar performance as the step size further increases.
We also analyse the impact of the number of selected class labels our method on defense per- formance. Figure 3 demonstrates the results of resisting untargetd and targeted PGD attacks on CIFAR-10 and CIFAR-100. We see that the performance improves for both untargeted and targeted attacks the number increases from I to 9 CIFAR-10. On CIFAR-100, the performance also improves as the number increases from to 9 but begins to drop or remain similar as the number further increases.
Discussion on type of defense perturbations In our experiments, small perturbations used to coun- teract the adversarial perturbation generated in targeted manner other than for targeted attacks on IAT trained models on CIFAR-100, small perturbations are generated an untargeted manner. Overall, untargeted adversarial perturbations be effectively counteracted using perturbations

---

Under review as a conference paper at ICLR 2021
Table 3: Classification accuracy (%) of different method used in combination with Guo et al's (2018). We
report performance resisting targeted attacks on Mixup trained models.
CIFAR-10
CIFAR- 100
Method
PGD
PGD50
PGD200
LGD
PGD50
PGD200
Guo al.' (2018)
57.8
49.1
48.9
33.3
26.3
26.1
Gaussian noise + Guo al.'s
63.9
63.8
63.3
34.0
30.3
29.0
Random rotation
+ Guo et al.'s
63.8
63.6
63.2
40.8
36.4
35.1
Xie et al.'s (2018) Guo et al.'s
59.1
58.3
58,2
41.1
35.8
33.7
MI-OL (Pang al., 2020) Guo al.'s
62.9
62.6
65.1
37.6
34.0
35.7
Ours
+ Guo al.'s
74.1
78.0
79.8
50.8
50.9
51.7
generated in targeted manner by our method. The results also suggest that adversarial training has an unstable behavior for different data distributions.
Discussion on number of steps used to generate defense perturbations The perturbations for defense purposes are generated using the one-step PGD method. We also experiment using mul- tiple steps to generate perturbations for defense purposes. However, we find that this results in reduced performance in defending against adversarial exam- ples. This could be because pertur- bations generated using multiple steps have adversarial effects and they do not help much to counteract the original ad- versarial perturbation.
Table 4: Classification accuracy (%) clean examples.
CIFAR 10
CIFAR-10K 100
Method
Mixup
LAT
Mixup
IAT
ResNet- 50 (wlo defense)
93.8
89.7
74.2
64.7
(2018)
82.1
82.1
66.3
62.1
Guo et al's (2018)
83.3
83.9
66.1
61.5
MI-OL (Pang et al., 2020)
83.9
84.2
68.8
62.0
Ours (targted perturhations)
61.2
75.3
8.3
47.4
(untargted perturhations)
87.1
88.3
66.0
65.1
To demonstrate the advantage our method, we further compare the performance of different meth- ods used together with Guo et al.'s. The results of defending against attacks on Mixup trained models are reported in Table 3. We see that although these methods, including Xie et al.'s, MI-OL, as well random rotation and Gaussian noise, are effective in improving performance, out methods out- performs these methods by large margin, especially when resisting adversarial examples generated using more iterations.
Finally, we evaluate our method on clean examples. Table 4 compares the performance our method and the baseline methods. We see that our method performs differently using different types of perturbations that are generated for defense purposes. Our method mostly performs very well on clean inputs compared to the baselines when the perturbations used for defense purposes are generated in an untargeted manner.
5 CONCLUSION
We proposed a method of counteracting adversarial perturbations for defending against adversarial attacks. In our method, we generate small perturbations for a number of randomly selected class labels and apply these small perturbations the input counteract the adversarial perturbation. Unlike previous methods, our method employs the use of local first-order gradient for defense pur- poses and can effectively improve adversarial robustness. Our method is applied inference time and complementary to the adversarial training method to improve overall defense performance. We experimentally validated our method on CIFAR-10 and CIFAR-100 against both untargeted and targeted PGD attacks. We presented extensive results demonstrating our method significantly im- proves the defense performance of the baseline methods. We showed that our method performs well in resisting strong adversarial perturbations generated using more iterations, demonstrating the ad- vantage of using local first-order gradient to resist adversarial perturbations. Notably, our method together with Guo al.'s (2018) achieved better performance than those obtained on IAT trained models when resisting targeted PGD50 and PGD attacks. This shows that is promising adver- sarial training could be unnecessary if proper perturbations are applied inputs.
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. International Conference on Machine Learning. 2018.
Nicholas Carlini and David Wagner. Adversarial examples are easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3-14, 2017.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:/810.048005 2018.
Alhussein Fawzi, Seyed-Mohsee Moosavi- Dezoavi--ezfooli, and Pascal Frossard. Robustness of classifiers: from adversarial to random noise. In Advances in Neural Information Processing Systems, pp- 1632-1640, 2016.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. International Conference on Learning Representations, 2015.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversar- ial images using input transformations. International Conference on Learning Representations, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Shengyuan Hu, Tao Yu, Chuan Guo, Wei-Lun Chao, and Kilian Q Weinberger. A new defense a- gainst adversarial images: Turning weakness into strength. In Advances in Neural Information Processing Systems, pp. 1635-1646, 2019.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 161 1.02366, 2016.
Alex Lamb, Vikas Verma, Juho Kannala, and Yoshua Bengio. Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, pp. 95-103, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018
Tianyu Pang, Chao Du, and Jun Zhu. Max-mahalanobis linear discriminant analysis networks. International Conference Machine Learning, 2018.
Tianyu Pang, Kun Xu, and Jun Zhu. Mixup inference: Better exploiting mixup to defend adversarial attacks. International Conference Learning Representations, 2020.
Jinhwan Park, Yoonho Boo, Iksoo Choi, Sungho Shin, and Wonyong Sung. Fully neural network based speech recognition on mobile and embedded devices. In Advances in Neural Information Processing Systems, pp. 10620-10630, 2018.
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties neural networks. International Conference on Learning Representations, 2014.

---

Under review as a conference paper at ICLR 2021
Pedro Tabacof and Eduardo Valle. Exploring the space of adversarial images. In 2016 International Joint Conference on Neural Networks (IJCNN), pp. 426-433. IEEE, 2016.
Vladimir N. Vapnik. Statistical Learning Theory. Wiley-Interscience,, 1998.
Cihang Xie, Jianyu Wang. Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. International Conference on Learning Representations, 2018.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paze mixup: Beyond empirical risk minimization. International Conference Learning Representations. 2018.
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks. International Conference Learning Representations, 2020.
A APPENDIX
A.1 TRAINING USING MIXUP
In the Mixup method (Zhang et al., 2018), neural networks are trained by minimizing the following loss:
L(F) = m Σ E(f((t.))))
(6)
where l a loss function that penalizes the difference between the prediction and its actual target, and
f Ar. + (1 - ))æ3,
y = Ayy + (1 X)ys-
(I,, 3/) and (Iy. are randomly sampled from the training data. A~Beta(a, a), a E (0, +oo). Training using Mixup empirically improves the generalization performance clean samples and slightly improves robustness against adversarial examples.
A.2 ADVERSARIAL TRAINING
Adversarial training was introduced by Szegedy al. (2014). In the adversarial training method, mixture of adversarial and clean examples are used train a neural network. Madry et al. (2018) formulated adversarially robust training of neural networks as the saddle point problem:
min p(0), where p(0) (aa))>
max L(0, x 6. bES
(8)
where 0 denotes the parameters of the neural network and S is the allowed set for perturbations. The inner maximization problem aims to find an adversarial version of given data point x that achieves high loss, while the outer minimization aims to find model parameters such that the adversarial loss given by the inner attack problem is minimized. PGD as a first-order adversary can reliably solve the inner maximization problem, even though the inner maximization is non-concave.
Lamb et al. (2019) proposed the interpolated adversarial training (IAT) method that combines Mixup with adversarial training. In the IAT method, the interpolation of adversarial examples and that of clean examples used for training neural networks. Compared to adversarial training, IAT can achieve high accuracy on clean examples while maintaining adversarial robustness.
A.3 MORE TECHNICAL DETAILS
The hyperparameter settings used in our method on CIFAR-10 and CIFAR-100 are given in Table and Table 6, respectively.
10

---

Under review as a conference paper at ICLR 2021
Table 5: Parameter settings for experiments CIFAR-10. For each experiment, the number of executions set to 50 for Xie et al's and Guo et al.'s and to 30 for MI-OL. [T] denotes small perturbations generated in targeted manner and [U] denotes mall perturbations are generated an untargeted manner.
Method
Mixup models
IAT models
Def. pertb. type: [T]
Def. pertb. type: [T]
Ours Xie et al.'s (2018)
Random crop size: [22 30]
Random crop size: [26 32]
Def. pertb. type: [T]
Def. pertb. type: [T]
Ours Guo et al'ss (2018)
Random crop size: [22 30]
Random crop size: [24 32]
Ours MI-OL (2020)
=055
A01==.66
Table 6: Parameter settings for experiments CIFAR-100. For each experiment, the number of executions is set to 50 for Xie et al.'s and Guo et al.'s and to 30 for MI-OL. (T] denotes small perturbations generated in targeted manner and [U] denotes mall perturbations are generated in an untargeted manner.
Method
Mixup models
IAT models
Def. pertb. type: [T]
Def. pertb. type: [T]
Ours Xie et al.'s (2018)
Random crop size: [26 32]
Random crop size: [26 32] for untgt. att.
and [24 32] for tgt. att.
Def. pertb. type: [T]
Def. pertb. type: [U]
Ours Guo el al.'s (2018)
Random crop size: [24 32]
Random crop size: [24 32]
Ours MI MI-OL (2020)
Ao5=0.5
001=0.6
11


Reviews:
[{"review_id": "_cKlY5FnPC8", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The author proposed a input transformation method for countering adversarial attacks. The proposed method can be applied to any pretrained network and improve the adversarial robustness.\n\nHowever, I have some strong concerns regarding the evaluation method of this paper:\n\n- The proposed method is based on the principle of obfuscated gradient, which has shown to be vulnerable against adaptive attacks [1]. The authors did not mention this at all in their paper, nor evaluate their method against adaptive attacks.\nThey only evaluate the adversarial accuracy under PGD attack. I believe this is based on the assumption that the attacker does not known the defense algorithm. However, this is not a comfortable assumption in the cryptography point of view when building a defense algorithm.\n The author should evaluate their method against some adaptive attacks before making the conclusion of whether the method is robust or not.\n\n- As pointed out in [1], defenses based on obfuscated gradient may still suffer from gradient-free attacks. The author should also evaluate their method on gradient-free attacks like [2] or [3].\n\nOther minor comments:\n\n- Some baseline methods used by the author (e.g., Guo et al. and Xie et al.) have already been shown that are not effective [1]. It is not necessary to include them as baselines.\n\n- This paper [4] also utilize the first-order gradient information at inference time. I'm not sure how similar is [4] to the proposed method but the author should discuss the difference in the related work.\n\n\n\n[1] Anish Athalye, Nicholas Carlini, and David Wagner. \"Obfuscated gradients give a false sense of\nsecurity: Circumventing defenses to adversarial examples.\" International Conference on Machine\nLearning, 2018.\n\n[2] Chen, Jianbo, Michael I. Jordan, and Martin J. Wainwright. \"Hopskipjumpattack: A query-efficient decision-based attack.\" 2020 ieee symposium on security and privacy (sp). IEEE, 2020.\n\n[3] Ilyas, Andrew, Logan Engstrom, Anish Athalye, and Jessy Lin. \"Black-box Adversarial Attacks with Limited Queries and Information.\"  International Conference on Machine Learning, 2018.\n\n[4] Xiao, Chang, and Changxi Zheng. \"One Man's Trash Is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.", "extra_scores": {}, "extra_text": {}}, {"review_id": "Zrwgwm_GFH6", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a defense against adversarial examples. The idea of the defense is to counteract transformation generated by PGD attack. This is done by running one step of PGD on network input several times (and using different target labels) and then average the result.\n\nAs described below, I think there are multiple serious flaws in the evaluation and the defense likely won’t work. Thus I recommend rejecting the paper.\n\nIssues with the paper:\n* Experiment section is lacking rigor which is necessary to properly evaluate defense against adversarial examples. Points below explain it in more detail.\n* One clear indication of a problem with evaluation is the fact that accuracy under attack is increasing (see table 2) when seemingly stronger attack is used. [i.e. PGD with larger number of steps]\n* The whole premise of the defense idea is to counteract very specific thing which PGD does, thus it’s unlikely to help against more sophisticated attacks or simply different attacks.\n* Evaluation procedure implies that the attacker has no knowledge about the defense and even no ability to query the defended model. Which is very strong restrictions on the attacker, moreover they are impractical from security standpoint [even in black box case attacker usually has an ability to query the model]\n* Authors cite (Carlini & Wagner, 2017) to justify oblivious-box attack setup. However  (Carlini & Wagner, 2017) actually proposes white-box attack and provides justification why white-box should be used.\n* https://arxiv.org/pdf/1802.00420.pdf (which authors cite) shows how to break defenses based on input transformations. Nevertheless authors do not address why the proposed defense (which is also input transformation) is not broken.\n* Authors use Guo et al.’s (2018) as one of the baselines, despite that this is a broken defense (per https://arxiv.org/pdf/1802.00420.pdf )\n* No comparison with adversarial training, in particular authors should consider comparing to  A. Madry’s paper https://arxiv.org/pdf/1706.06083.pdf which also performs experiments on CIFAR dataset.\n\n\nFeedback on how to improve paper:\n* The evaluation should be performed in the assumption that adversary is either aware of the attack (white-box case) or able to query the defended model (black box attack).\n* Use https://arxiv.org/abs/1902.06705 as a guide on how to properly evaluate models for adversarial robustness. And redo evaluation following this guide.\n* In particular, consider running gradient free attacks on the whole model (baseline model + defense on top of it) and try to make an attack which will break the proposed defense.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "Pe-smn7-UBp", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "#################################### Summary ######################################\n\nThe paper presents an inference-time defense which generates single-step attacks towards other classes, and adds a sum of all these perturbations projected to an $\\ell_\\infty$ ball to the original image before inference. This combined with other existing methods achieves 69.3% robust accuracy on CIFAR-10 dataset. The authors claim to achieve a 11.4%  boost in robustness without the use of adversarial training. \n\n##################################### Details #######################################\n\n  -  The threat model chosen is not justified. The paper considers a white-box threat model where only the network model (architecture and weights) is accessible to the attacker. Even in the experiments section, only oblivious attacks which are unaware of the defense mechanism are considered. As explained by Carlini et al. [1], for white-box or black-box defenses, it is not reasonable to assume that the defense algorithm can be held secret. The only secret can be the randomness chosen during test time. In this case, the authors select a random subset of classes for the single-step attack during inference, and it can be assumed that the attacker is not aware of which classes are chosen. Apart from this, it must be assumed that all other details related to the defense are known to the attacker.  This is because an attacker is assumed to be infinitely thorough, without any computational restrictions, towards finding an adversarial perturbation within the threat model if it exists. The attacker could even use a naive attack which considers infinitely many random samples in the constraint set to fool the model. This random sampling based attack would almost surely succeed if an adversarial perturbation exists within the constraint set, and it also does not require knowledge of the defense. However, for practical evaluation, where we are limited by the computation available, we need to make use of the knowledge of the defense to find the strongest possible attack. \n  -  While Carlini & Wagner define the Zero-Knowledge threat model in their earlier paper [2], they clarify in their subsequent work [1] that there is no justification for such a threat model, and it was defined only to highlight that some defenses were not even robust against such a weak threat model. \n  -  Given that the defense must be known to the attacker, it is possible to construct an adaptive attack which includes the defense (addition of single-step attacks to multiple random classes) in each attack step. Different random classes can be chosen in each step of the attack. This is similar to the attack constructed by Tramer et al. [3] to break the defense by Pang et al. [4]. Using this attack, the accuracy can potentially be brought down to the baseline method (IAT). Another possible adaptive attack is EOT [5], since the proposed defense involves randomization. \n  -  All the baselines and methods that the proposed defense is combined with, are broken in prior work. The work by Guo et al. [6] and Xie et al. [7] are broken using EOT and BPDA attacks by Athalye et al. [5]. The defense by Pang et al. [4] is broken by Tramer et al. [3]. Hence, they are not justified as baselines, and their contribution in the proposed combined defense can also be nullified using the same attacks. \n  -  Robustness evaluation has only been done using PGD-200. Robust accuracy needs to be reported on more recent attacks such as AutoAttack [8] and Multi Targeted attack [9]. As mentioned above, even for these evaluations, the defense needs to be considered while generating the attack. \n\n[1] Carlini et al., On evaluating Adversarial Robustness, https://arxiv.org/abs/1902.06705\n\n[2] Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods, ACM Workshop, 2017\n\n[3] Tramer et al., On Adaptive Attacks to Adversarial Example Defenses, NeurIPS 2020\n\n[4] Pang et al., Mixup inference: Better exploiting mixup to defend adversarial attacks, ICLR 2020\n\n[5] Athalye et al., Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples, ICML 2018\n\n[6] Guo et al., Countering adversarial images using input transformations, ICLR 2018\n\n[7] Xie et al., Mitigating adversarial effects through randomization. ICLR 2018.\n\n[8] Croce et al., Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks, ICML 2020\n\n[9] Gowal et al., An Alternative Surrogate Loss for PGD-based Adversarial Testing, https://arxiv.org/pdf/1910.09338.pdf\n\n################################# Reasons for the score #################################\n\nThe paper rests on a threat model that considers the attacker to be oblivious to the defense used. Prior works [1, 3] consider such a threat model to be unjustified. An adaptive adversary cognizant of the defense can potentially break the proposed defense by incorporating the defense during attack generation, and by using EOT attacks. Hence I strongly vote to reject the paper. \n", "extra_scores": {}, "extra_text": {}}, {"review_id": "1yKptR2rbPt", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 2, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a defense that works by adding multiple targeted adversarial perturbations (with random classes) on the input sample before classifying it. There is little theoretical reasoning for why this is a sensible defense. More importantly though, the defense is only evaluated in an oblivious threat model where the attacker is unaware of the defense mechanism. As has been argued again and again in the literature and in community guidelines such as [1, 2], the oblivious threat model is trivial and yields absolutely no insights into the effectiveness of a defense (e.g. you can just manipulate the backpropagated gradient in random ways to prevent any gradient-based attack from finding adversarial perturbations). The problem with oblivious attacks is clearly visible in the results section where more PGD iterations are less effective than fewer iterations - a clear red flag that the evaluation is ineffective. The paper also fails to point out that Pang et al. 2020, one of the methods they combine their method with, has been shown to be ineffective [2].\n\nThis work clearly violates the guidelines and best practices that the adversarial robustness community has developed and the claims are not substantiated by the evaluation or the results. Fixing this problem will require developing adaptive attacks that are effective against the proposed defense. [2] is a good starting point, in particular the attack against Pang et al. 2020. This will require time, care and effort to get right, and I don't see a way how reliable results from a new adaptive evaluation can be generated during the relatively brief rebuttal period.\n\n[1] On Evaluating Adversarial Robustness, https://arxiv.org/abs/1902.06705\n[2] On adaptive attacks to adversarial example defenses, https://arxiv.org/abs/2002.08347", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work is attempting to develop a new way to train models that are robust to (l_p-bounded) adversarial perturbations and to do so in a way that departs from the tools successfully used for this purpose in the past. This is a worthwhile aspiration, however, as pointed out in the comments/reviews, there are significant problems with the methodology of evaluating the proposed approach (and some well-founded skepticism that this approach is indeed successful). As such, this paper cannot be accepted in its current form.  
Decision: Reject