标题： 注意黑盒：对最近防御对抗样本鲁棒性的研究 显示英文标题

标题： Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples

摘要： 许多防御方法最近在NIPS、ICML、ICLR和CVPR等会议上被提出。 这些防御主要集中在缓解白盒攻击上。 它们没有正确检查黑盒攻击。 在本文中，我们将这些防御的分析扩展到包括适应性黑盒对手。 我们的评估包括Barrage of Random Transforms、ComDefend、Ensemble Diversity、Feature Distillation、The Odds are Odd、Error Correcting Codes、Distribution Classifier Defense、K-Winner Take All和Buffer Zones在内的九种防御方法。 我们的研究使用了两种黑盒对抗模型和针对CIFAR-10和Fashion-MNIST数据集的六种广泛研究的对抗攻击。 我们的分析显示，大多数最新防御（9种中的7种）与未受保护的网络相比，安全性的提升仅是有限的（$<25\%$）。 对于每种防御，我们还展示了对手可用的数据量与其适应性黑盒攻击效果之间的关系。 总体而言，我们的结果呈现出一个清晰的画面：为了被认为是安全的，防御需要进行彻底的白盒和黑盒分析。 我们提供了这项大规模的研究和分析，以促使该领域朝着开发更强大的黑盒防御方向发展。 显示英文摘要

摘要： Many defenses have recently been proposed at venues like NIPS, ICML, ICLR and CVPR. These defenses are mainly focused on mitigating white-box attacks. They do not properly examine black-box attacks. In this paper, we expand upon the analysis of these defenses to include adaptive black-box adversaries. Our evaluation is done on nine defenses including Barrage of Random Transforms, ComDefend, Ensemble Diversity, Feature Distillation, The Odds are Odd, Error Correcting Codes, Distribution Classifier Defense, K-Winner Take All and Buffer Zones. Our investigation is done using two black-box adversarial models and six widely studied adversarial attacks for CIFAR-10 and Fashion-MNIST datasets. Our analyses show most recent defenses (7 out of 9) provide only marginal improvements in security ($<25\%$), as compared to undefended networks. For every defense, we also show the relationship between the amount of data the adversary has at their disposal, and the effectiveness of adaptive black-box attacks. Overall, our results paint a clear picture: defenses need both thorough white-box and black-box analyses to be considered secure. We provide this large scale study and analyses to motivate the field to move towards the development of more robust black-box defenses.