Comment on "Biologically inspired protection of deep networks from adversarial attacks"

TL;DR

This paper critically examines claims that saturation-based methods protect deep networks from adversarial attacks, revealing that such robustness may be due to numerical issues rather than true security.

Contribution

The study demonstrates that gradient-based attacks can succeed on saturated networks when numerical stabilization is applied, questioning the effectiveness of saturation as a defense.

Findings

Gradient attacks succeed with stabilized gradients

Saturation may cause numerical limitations, not robustness

Robustness claims need reevaluation

Abstract

A recent paper suggests that Deep Neural Networks can be protected from gradient-based adversarial perturbations by driving the network activations into a highly saturated regime. Here we analyse such saturated networks and show that the attacks fail due to numerical limitations in the gradient computations. A simple stabilisation of the gradient estimates enables successful and efficient attacks. Thus, it has yet to be shown that the robustness observed in highly saturated networks is not simply due to numerical limitations.