Assessing the Adversarial Robustness of Monte Carlo and Distillation Methods for Deep Bayesian Neural Network Classification

In this paper, we consider the problem of assessing the adversarial\nrobustness of deep neural network models under both Markov chain Monte Carlo\n(MCMC) and Bayesian Dark Knowledge (BDK) inference approximations. We\ncharacterize the robustness of each method to two types of adversarial attacks:\nthe fast gradient sign method (FGSM) and projected gradient descent (PGD). We\nshow that full MCMC-based inference has excellent robustness, significantly\noutperforming standard point estimation-based learning. On the other hand, BDK\nprovides marginal improvements. As an additional contribution, we present a\nstorage-efficient approach to computing adversarial examples for large Monte\nCarlo ensembles using both the FGSM and PGD attacks.\n