{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/distillation-as-a-defense-to-adversarial","title":"Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks","arxiv_id":"1511.04508","date":"2015-11-14","proceeding":null,"authors":["Nicolas Papernot","Patrick McDaniel","Xi Wu","Somesh Jha","Ananthram Swami"],"abstract":"Deep learning algorithms have been shown to perform extremely well on many\nclassical machine learning problems. However, recent studies have shown that\ndeep learning, like other machine learning techniques, is vulnerable to\nadversarial samples: inputs crafted to force a deep neural network (DNN) to\nprovide adversary-selected outputs. Such attacks can seriously undermine the\nsecurity of the system supported by the DNN, sometimes with devastating\nconsequences. For example, autonomous vehicles can be crashed, illicit or\nillegal content can bypass content filters, or biometric authentication systems\ncan be manipulated to allow improper access. In this work, we introduce a\ndefensive mechanism called defensive distillation to reduce the effectiveness\nof adversarial samples on DNNs. We analytically investigate the\ngeneralizability and robustness properties granted by the use of defensive\ndistillation when training DNNs. We also empirically study the effectiveness of\nour defense mechanisms on two DNNs placed in adversarial settings. The study\nshows that defensive distillation can reduce effectiveness of sample creation\nfrom 95% to less than 0.5% on a studied DNN. Such dramatic gains can be\nexplained by the fact that distillation leads gradients used in adversarial\nsample creation to be reduced by a factor of 10^30. We also find that\ndistillation increases the average minimum number of features that need to be\nmodified to create adversarial samples by about 800% on one of the DNNs we\ntested.","url_abs":"http://arxiv.org/abs/1511.04508v2","url_pdf":"http://arxiv.org/pdf/1511.04508v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"distillation-as-a-defense-to-adversarial","repo_url":"https://github.com/as791/Adversarial-Example-Attack-and-Defense","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"torch","reach":{"status":"ok"}},{"paper_slug":"distillation-as-a-defense-to-adversarial","repo_url":"https://github.com/shreyas269/Pytorch-defensive-distillation","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"autonomous-vehicles","task_name":"Autonomous Vehicles"},{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1511.04508","atlas_url":"https://app.syntology.ai/?focus=1511.04508","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}