Comment on "Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network"
This is an incremental analysis that challenges robustness claims for BNNs in adversarial defense, relevant to researchers in machine learning security.
The paper critiques a prior study claiming adversarially trained Bayesian Neural Networks (BNNs) are more robust, arguing that adversarial attacks must account for BNN stochasticity for accurate evaluation, and finds no strong evidence of higher robustness.
A recent paper by Liu et al. combines the topics of adversarial training and Bayesian Neural Networks (BNN) and suggests that adversarially trained BNNs are more robust against adversarial attacks than their non-Bayesian counterparts. Here, I analyze the proposed defense and suggest that one needs to adjust the adversarial attack to incorporate the stochastic nature of a Bayesian network to perform an accurate evaluation of its robustness. Using this new type of attack I show that there appears to be no strong evidence for higher robustness of the adversarially trained BNNs.