PubDef: Defending Against Transfer Attacks From Public Models

arXiv:2310.17645v2 Announce Type: replace-cross
Abstract: Adversarial attacks have been a looming and unaddressed threat in the industry. However, through a decade-long history of the robustness evaluation literature, we have learned that mounting a strong or optimal attack is challenging. It requires both machine learning and domain expertise. In other words, the white-box threat model, religiously assumed by a large majority of the past literature, is unrealistic. In this paper, we propose a new practical threat model where the adversary relies …

arxiv attacks cs.ai cs.cr cs.cv cs.lg defending public transfer