Measuring the False Sense of Security
This work addresses the issue of evaluating gradient masking in adversarial defenses for the machine learning security community, providing tools to compare defenses, but it is incremental as it builds on prior observations of the phenomenon.
The paper tackled the problem of measuring gradient masking in adversarial defenses, proposing several metrics that are computationally cheaper than strong attacks and enable comparisons between models, with results showing successful metrics for measuring the extent of gradient masking across different networks.
Recently, several papers have demonstrated how widespread gradient masking is amongst proposed adversarial defenses. Defenses that rely on this phenomenon are considered failed, and can easily be broken. Despite this, there has been little investigation into ways of measuring the phenomenon of gradient masking and enabling comparisons of its extent amongst different networks. In this work, we investigate gradient masking under the lens of its mensurability, departing from the idea that it is a binary phenomenon. We propose and motivate several metrics for it, performing extensive empirical tests on defenses suspected of exhibiting different degrees of gradient masking. These are computationally cheaper than strong attacks, enable comparisons between models, and do not require the large time investment of tailor-made attacks for specific models. Our results reveal metrics that are successful in measuring the extent of gradient masking across different networks