{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/towards-evaluating-the-robustness-of-neural","title":"Towards Evaluating the Robustness of Neural Networks","arxiv_id":"1608.04644","date":"2016-08-16","proceeding":null,"authors":["Nicholas Carlini","David Wagner"],"abstract":"Neural networks provide state-of-the-art results for most machine learning\ntasks. Unfortunately, neural networks are vulnerable to adversarial examples:\ngiven an input $x$ and any target classification $t$, it is possible to find a\nnew input $x'$ that is similar to $x$ but classified as $t$. This makes it\ndifficult to apply neural networks in security-critical areas. Defensive\ndistillation is a recently proposed approach that can take an arbitrary neural\nnetwork, and increase its robustness, reducing the success rate of current\nattacks' ability to find adversarial examples from $95\\%$ to $0.5\\%$.\n  In this paper, we demonstrate that defensive distillation does not\nsignificantly increase the robustness of neural networks by introducing three\nnew attack algorithms that are successful on both distilled and undistilled\nneural networks with $100\\%$ probability. Our attacks are tailored to three\ndistance metrics used previously in the literature, and when compared to\nprevious adversarial example generation algorithms, our attacks are often much\nmore effective (and never worse). Furthermore, we propose using high-confidence\nadversarial examples in a simple transferability test we show can also be used\nto break defensive distillation. We hope our attacks will be used as a\nbenchmark in future defense attempts to create neural networks that resist\nadversarial examples.","url_abs":"http://arxiv.org/abs/1608.04644v2","url_pdf":"http://arxiv.org/pdf/1608.04644v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/B-Yassine/Carlini-and-Wagner_InceptionV3_Imagenet","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/Bhushan-Jagtap-2013/Adversarial_Attack_on_RNN","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/Carco-git/CW_Attack_on_MNIST","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/KevinHuang841006/AI_Security_training","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/LeMinhThong/blackbox-attack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/MadryLab/cifar10_challenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/OwenSec/DeepDetector","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/SifatMd/Research-Papers","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/abahram77/mnistChallenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/abahram77/mnist_challenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/bethgelab/cifar10_challenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/dacostaHugo/Adversarial_attacks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/hope-yao/robust_attention_cifar","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/inspire-group/advml-traffic-sign","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/jeromerony/adversarial-library","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/jfc43/pixel-discretization","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/jfc43/robust-attribution-regularization","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/khieu/cifar10_challenge","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/kkew3/pytorch-cw2","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/matanbt/attack-tabular","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/taranO/defending-adversarial-attacks-by-RD","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/tataiani/enhanced_regularizers_attributional_robustness","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/ukky17/invert_MV_pytorch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/yevgm/deepadv3d","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/zetongqi/attacking_neural_networks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"towards-evaluating-the-robustness-of-neural","repo_url":"https://github.com/carlini/nn_robust_attacks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"tf","reach":null}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1608.04644","atlas_url":"https://app.syntology.ai/?focus=1608.04644","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1608.04644"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Bhushan-Jagtap-2013/Adversarial_Attack_on_RNN","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/dacostaHugo/Adversarial_attacks","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/carlini/nn_robust_attacks","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jfc43/pixel-discretization","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/LeMinhThong/blackbox-attack","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tataiani/enhanced_regularizers_attributional_robustness","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/kkew3/pytorch-cw2","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jfc43/robust-attribution-regularization","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zetongqi/attacking_neural_networks","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/yevgm/deepadv3d","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ukky17/invert_MV_pytorch","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/inspire-group/advml-traffic-sign","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/MadryLab/cifar10_challenge","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/B-Yassine/Carlini-and-Wagner_InceptionV3_Imagenet","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/bethgelab/cifar10_challenge","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Carco-git/CW_Attack_on_MNIST","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/hope-yao/robust_attention_cifar","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/khieu/cifar10_challenge","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/PerryXDeng/adversarial_mnist_attacks","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/abahram77/mnist_challenge","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jeromerony/adversarial-library","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/KevinHuang841006/AI_Security_training","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/taranO/defending-adversarial-attacks-by-RD","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/matanbt/attack-tabular","reach":{"status":"unanswered"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/abahram77/mnistChallenge","reach":{"status":"unanswered"}}],"summary":{"ran_draft_wrong":2,"ran_honours":1,"unverified":10},"by_repo_kind":{"listed":{"samples":13,"ran":3,"repositories":6}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":1,"samples":[{"code_sha256_prefix":"ae7a589f65750d71","entry":"generate_data","repo":"Bhushan-Jagtap-2013/Adversarial_Attack_on_RNN","repo_kind":"listed","path":"test_attack.py","file_url":"https://github.com/Bhushan-Jagtap-2013/Adversarial_Attack_on_RNN/blob/HEAD/test_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"ae7a589f65750d71"}},{"code_sha256_prefix":"33c3e5273c448151","entry":"generate_data","repo":"carlini/nn_robust_attacks","repo_kind":"listed","path":"test_attack.py","file_url":"https://github.com/carlini/nn_robust_attacks/blob/HEAD/test_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"33c3e5273c448151"}},{"code_sha256_prefix":"0cb12596aa3c0436","entry":"load_image","repo":"zetongqi/attacking_neural_networks","repo_kind":"listed","path":"CW_l2attack.py","file_url":"https://github.com/zetongqi/attacking_neural_networks/blob/HEAD/CW_l2attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0cb12596aa3c0436"}},{"code_sha256_prefix":"cc16b0d5bc15bb67","entry":"activation","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"neural_network.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/neural_network.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cc16b0d5bc15bb67"}},{"code_sha256_prefix":"39df9d693fbdc4de","entry":"cross_entropy","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"neural_network.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/neural_network.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"39df9d693fbdc4de"}},{"code_sha256_prefix":"6c0b9095663ceff6","entry":"denormalize","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"data_preparation.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/data_preparation.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6c0b9095663ceff6"}},{"code_sha256_prefix":"ab527cad8796ffd2","entry":"get_cuda_state","repo":"kkew3/pytorch-cw2","repo_kind":"listed","path":"runutils.py","file_url":"https://github.com/kkew3/pytorch-cw2/blob/HEAD/runutils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ab527cad8796ffd2"}},{"code_sha256_prefix":"9a04b87a21ee7dbd","entry":"make_cuda_consistent","repo":"kkew3/pytorch-cw2","repo_kind":"listed","path":"runutils.py","file_url":"https://github.com/kkew3/pytorch-cw2/blob/HEAD/runutils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9a04b87a21ee7dbd"}},{"code_sha256_prefix":"f33c321f1f8ee09c","entry":"normalize","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"data_preparation.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/data_preparation.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f33c321f1f8ee09c"}},{"code_sha256_prefix":"6189cef972a4615e","entry":"predict","repo":"kkew3/pytorch-cw2","repo_kind":"listed","path":"runutils.py","file_url":"https://github.com/kkew3/pytorch-cw2/blob/HEAD/runutils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6189cef972a4615e"}},{"code_sha256_prefix":"544bb80adbb9ade1","entry":"preprocess","repo":"jfc43/pixel-discretization","repo_kind":"listed","path":"data-specific-discretization/ImageNet/util.py","file_url":"https://github.com/jfc43/pixel-discretization/blob/HEAD/data-specific-discretization/ImageNet/util.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"544bb80adbb9ade1"}},{"code_sha256_prefix":"cf589faab9919534","entry":"sigmoid","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"neural_network.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/neural_network.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf589faab9919534"}},{"code_sha256_prefix":"aca0af8d07cfa276","entry":"vectorized_label","repo":"PerryXDeng/adversarial_mnist_attacks","repo_kind":"listed","path":"data_preparation.py","file_url":"https://github.com/PerryXDeng/adversarial_mnist_attacks/blob/HEAD/data_preparation.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"aca0af8d07cfa276"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}