{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/on-the-limitation-of-magnet-defense-against","title":"On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples","arxiv_id":"1805.00310","date":"2018-04-14","proceeding":null,"authors":["Pei-Hsuan Lu","Pin-Yu Chen","Kang-Cheng Chen","Chia-Mu Yu"],"abstract":"In recent years, defending adversarial perturbations to natural examples in\norder to build robust machine learning models trained by deep neural networks\n(DNNs) has become an emerging research field in the conjunction of deep\nlearning and security. In particular, MagNet consisting of an adversary\ndetector and a data reformer is by far one of the strongest defenses in the\nblack-box oblivious attack setting, where the attacker aims to craft\ntransferable adversarial examples from an undefended DNN model to bypass an\nunknown defense module deployed on the same DNN model. Under this setting,\nMagNet can successfully defend a variety of attacks in DNNs, including the\nhigh-confidence adversarial examples generated by the Carlini and Wagner's\nattack based on the $L_2$ distortion metric. However, in this paper, under the\nsame attack setting we show that adversarial examples crafted based on the\n$L_1$ distortion metric can easily bypass MagNet and mislead the target DNN\nimage classifiers on MNIST and CIFAR-10. We also provide explanations on why\nthe considered approach can yield adversarial examples with superior attack\nperformance and conduct extensive experiments on variants of MagNet to verify\nits lack of robustness to $L_1$ distortion based attacks. Notably, our results\nsubstantially weaken the assumption of effective threat models on MagNet that\nrequire knowing the deployed defense technique when attacking DNNs (i.e., the\ngray-box attack setting).","url_abs":"http://arxiv.org/abs/1805.00310v2","url_pdf":"http://arxiv.org/pdf/1805.00310v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"on-the-limitation-of-magnet-defense-against","repo_url":"https://github.com/ysharma1126/EAD-Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}