{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/stochastic-substitute-training-a-gray-box","title":"Stochastic Substitute Training: A Gray-box Approach to Craft Adversarial Examples Against Gradient Obfuscation Defenses","arxiv_id":"1810.10031","date":"2018-10-23","proceeding":null,"authors":["Mohammad Hashemi","Greg Cusack","Eric Keller"],"abstract":"It has been shown that adversaries can craft example inputs to neural\nnetworks which are similar to legitimate inputs but have been created to\npurposely cause the neural network to misclassify the input. These adversarial\nexamples are crafted, for example, by calculating gradients of a carefully\ndefined loss function with respect to the input. As a countermeasure, some\nresearchers have tried to design robust models by blocking or obfuscating\ngradients, even in white-box settings. Another line of research proposes\nintroducing a separate detector to attempt to detect adversarial examples. This\napproach also makes use of gradient obfuscation techniques, for example, to\nprevent the adversary from trying to fool the detector. In this paper, we\nintroduce stochastic substitute training, a gray-box approach that can craft\nadversarial examples for defenses which obfuscate gradients. For those defenses\nthat have tried to make models more robust, with our technique, an adversary\ncan craft adversarial examples with no knowledge of the defense. For defenses\nthat attempt to detect the adversarial examples, with our technique, an\nadversary only needs very limited information about the defense to craft\nadversarial examples. We demonstrate our technique by applying it against two\ndefenses which make models more robust and two defenses which detect\nadversarial examples.","url_abs":"http://arxiv.org/abs/1810.10031v1","url_pdf":"http://arxiv.org/pdf/1810.10031v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"stochastic-substitute-training-a-gray-box","repo_url":"https://github.com/s-mohammad-hashemi/sst","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"tf","reach":null}],"tasks":[{"task_slug":"blocking","task_name":"Blocking"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}