Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
This addresses a critical security vulnerability in machine learning systems for applications like cybersecurity, though it is incremental as it improves upon existing attack methods.
The paper tackled the problem of evading adversarial example detection defenses by generating adversarial examples that are both misclassified and undetected, achieving a 0% detection rate and 0% defense accuracy against four state-of-the-art defenses.
Evading adversarial example detection defenses requires finding adversarial examples that must simultaneously (a) be misclassified by the model and (b) be detected as non-adversarial. We find that existing attacks that attempt to satisfy multiple simultaneous constraints often over-optimize against one constraint at the cost of satisfying another. We introduce Orthogonal Projected Gradient Descent, an improved attack technique to generate adversarial examples that avoids this problem by orthogonalizing the gradients when running standard gradient-based attacks. We use our technique to evade four state-of-the-art detection defenses, reducing their accuracy to 0% while maintaining a 0% detection rate.