Towards Robust Detection of Adversarial Examples
Although the recent progress is substantial, deep learning methods can be vulnerable to the maliciously generated adversarial examples. In this paper, we present a novel training procedure and a thresholding test strategy, towards robust detection of adversarial examples. In training, we propose to minimize the reverse crossentropy (RCE), which encourages a deep network to learn latent representations that better distinguish adversarial examples from normal ones. In testing, we propose to use a thresholding strategy as the detector to filter out adversarial examples for reliable predictions. Our method is simple to implement using standard algorithms, with little extra training cost compared to the common cross-entropy minimization. We apply our method to defend various attacking methods on the widely used MNIST and CIFAR-10 datasets, and achieve significant improvements on robust predictions under all the threat models in the adversarial setting.
Update: Thank you for addressing my comments. Please make sure to update your paper according to your responses (in particular about adding additional experimental results in the appendix and updating the current set of results).  In this paper, the authors propose a new loss (i.e., reverse cross-entropy) whose goal is to force non-maximal probability predictions to be uniform (in a classification task). In other words, the goal of the classification network is to maximize the entropy of all non-maximal softmax outputs. The authors show that the intermediate representations learned by the network are more meaningful when it comes to compare real and adversarial examples. Experiments are done on MNIST and CIFAR-10.  The paper is well written and clearly explained. The proposed loss is analyzed both in practice and in theory. I am a bit concerned with novelty as the "reverse cross-entropy" loss is not strictly new (as pointed out by the authors themselves in Section 3.2). However, the added analysis and explanation w.r.t. the use-case of detecting adversarial examples is valuable to the community. The authors provide enough evidence that this loss is useful and, as such, I am leaning towards acceptance. The experimental section would benefit from a few added experiments.  1) In general, the problem of detecting adversarial examples is important. However, the proposed solutions are not yet compelling. The authors explain that "in semi-autonomous systems, the detection of adversarial examples would allow disabling autonomous operation and requesting human intervention", but the detection method is often easier to attack - and keeping the system from being used can also have serious consequences. The authors should elaborate on this problem and also include experiments that only aim to disable the classifiers. In general the AUC of the detector remains poor and I am assuming that a lot of non-adversarial examples are still detected as adversarial.  Details: a) There has been a lot of exciting and new work on verification and training provably robust networks (see Wong & Kolter arXiv:1805.12514, arXiv:1711.00851 and Krishnamurthy et al. arXiv:1805.10265, arXiv:1803.06567). They are definitely orthogonal approaches to preventing misclassification of adversarial perturbations, but I feel they should find a space in your introduction.  b) As previously stated, it would useful to incorporate results about the minimal detectable perturbation radius.  c) Fig 2(a) should include Carlini & Wagner, I am unsure why a separate plot is needed. Similarly, the analysis done in Fig. 2(b) could be extended to include the other attacks.