Towards Evaluating the Robustness of Neural Networks (C&W)
Date: 2016-08
Affected: MNIST, CIFAR-10, ImageNet classifiers; defensive distillation
Attack vector: adversarial-input
Category: research
Severity: High

Carlini and Wagner introduce three optimization-based attacks (L0, L2, L-inf) that achieve 100 percent success against distilled and undistilled networks and break defensive distillation. IEEE S&P 2017.


Mitigations:

Architectural layers (MAESTRO):