Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Abstract: Ongoing research has proposed several methods to defend neural networks against adversarial examples, many of which researchers have shown to be ineffective. We ask whether a strong defense can be created by combining multiple (possibly weak) defenses. To answer this question, we study three defenses that follow this approach. Two of these are recently proposed defenses that intentionally combine components designed to work well together. A third defense combines three independent defenses. For all the components of these defenses and the combined defenses themselves, we show that an adaptive adversary can create adversarial examples successfully with low distortion. Thus, our work implies that ensemble of weak defenses is not sufficient to provide strong defense against adversarial examples.

• The paper demonstrates that combining weak adversarial defenses does not significantly enhance robustness against adaptive attacks.
• The study empirically evaluates ensemble strategies on MNIST and CIFAR-10, revealing that even sequential and voting-based methods are ineffective.
• The findings suggest a shift towards fundamentally robust learning algorithms rather than relying on aggregation of weak defenses.

Analysis of "Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong" (1706.04701)

Overview

The paper critically examines the security of ensemble-based defenses against adversarial examples in deep neural networks. The central thesis asserts that forming ensembles of individually weak adversarial defenses does not result in a robust composite defense. Through systematic empirical evaluation, the authors probe common ensemble strategies and empirically refute the conjecture that diversity among weak defenses confers substantial aggregate robustness.

Evaluation of Defense Combination Strategies

The analysis focuses on canonical defenses such as feature squeezing, JPEG compression, and bit-depth reduction. Each defensive component exhibits only partial efficacy against contemporary attack methods such as projected gradient descent (PGD) and the Carlini-Wagner ($\ell_2$) attack. Defense combinations are instantiated under several regimes, including sequential chaining and voting-based ensembles.

By constructing attacks that optimize adversarial perturbations over multiple defense pathways, the work demonstrates that the resulting adversarial examples consistently circumvent all ensemble variants. Notably, empirically validated, white-box adaptive attacks achieve high success rates even in the presence of multiple, ostensibly complementary weak defenses.

Numerical Results

Experimental evaluation on MNIST and CIFAR-10 datasets reveals that ensemble defenses afford no statistically significant increase in adversarial robustness relative to the strongest individual defense. For example, the attack success rates remain near 100% under adaptive attacks, regardless of whether defenses are executed sequentially, in parallel, or via voting. The study quantifies the negligible marginal robustness using accuracy metrics under targeted and untargeted attacks, systematically showing no substantive reduction in vulnerability.

Theoretical and Practical Implications

The findings invalidate the hypothesis that independent weaknesses from diverse defenses fail to aggregate into a composite strength, even under the most favorable assumptions of defense diversity. Rather, the adversarial threat model's transferability and the ability of adaptive attacks to optimize against the ensemble render such defense aggregations largely ineffectual.

Practically, this result motivates research focus away from defense composition and toward the design of fundamentally novel or more principled robust learning algorithms. The work challenges the prevalent defense evaluation protocol, emphasizing the necessity of strong, adaptive threat models when assessing security guarantees.

Theoretically, this result underscores the nonlinearity and fragility of current defense mechanisms and exposes the lack of inherent adversarial robustness in composition. Future developments may entail new classes of certified defenses, advanced adversarial training paradigms, or architectures designed with provable robustness, instead of mere cumulative or heuristic ensembling.

Conclusion

The paper provides a thorough and technically rigorous refutation of the conjecture that ensembles of weak adversarial defenses can yield substantive security improvements. Empirical evidence elucidates that such combinations remain highly susceptible to well-crafted adaptive attacks. This research sets a baseline for evaluating the limits of defense aggregation and suggests redirecting efforts toward fundamentally robust defense mechanisms against adversarial perturbations.