What are Adversarial Attacks in the context of Computer Vision and how can they be mitigated?
Instruction: Explain the concept of adversarial attacks and discuss strategies for defending against them in computer vision models.
Updated
Example Answer
I would define the adversarial threat model first: attacker access, allowed perturbations and the decision we want to protect. Adversarial training may improve robustness within a tested threat model, but no defense should be accepted because one attack fails. Input transformations or defensive distillation can obstruct gradients without stopping an adaptive attacker. I would test attacks that account for the defense, inspect clean accuracy and robust accuracy, and avoid claims beyond the tested assumptions.
Make it your own
Illustrative evaluation checklist: white-box adaptive attacks, multiple restarts, appropriate treatment of stochastic or nondifferentiable preprocessing, and held-out attacks. Distinguish empirical robustness from a formal certificate.
Why this works
Gradient masking can make an ineffective defense look strong. Follow-up: what would it suggest if a transfer attack succeeds more often than your white-box attack?
Sources: Obfuscated Gradients Give a False Sense of Security.