Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

We identify obfuscated gradients, a kind of gradient masking, as a phenomenon\nthat leads to a false sense of security in defenses against adversarial\nexamples. While defenses that cause obfuscated gradients appear to defeat\niterative optimization-based attacks, we find defenses relying on this effect\ncan be circumvented. We describe characteristic behaviors of defenses\nexhibiting the effect, and for each of the three types of obfuscated gradients\nwe discover, we develop attack techniques to overcome it. In a case study,\nexamining non-certified white-box-secure defenses at ICLR 2018, we find\nobfuscated gradients are a common occurrence, with 7 of 9 defenses relying on\nobfuscated gradients. Our new attacks successfully circumvent 6 completely, and\n1 partially, in the original threat model each paper considers.\n