> Their claim here is they can on the fly determine how important different samples are, and make sure samples that yield better results are in the chance more often than those with less importance.
Isn't that the exact same idea as in active learning?
I don't think you need active learning to get results like this, just decent statistical analysis. There are parallels here with distributed query planning.
Yeah they get you really hyped up first and drop the bomb at the end. Still quite impressive speedup, would be better though to show it on a benchmark where SVM's are used in practice
While it's true that these attacks work well on state-of-the-art models, there are defence strategies such as including adversial examples during training. Advanced defence strategies such as https://arxiv.org/abs/1705.07204 are robust to a wide array of attacks and achieve very competitive error rates.
I'm not saying it's not a problem but there are successful defence strategies already in place for many attacks.
> Although our models are more vulnerable to white-box FGSM samples compared to the v3adv model, ensemble adversarial training significantly increases robustness to black-box attacks that transfer FGSM samples crafted on the holdout Inception v4.
So, I just train my new adversary on the "new" model that was trained on the previous adversarial examples. And now we're back to square one.
I suspect the problem of adversarial attacks is a problem of high-dimensional spaces, not of training on particular samples.
I'm not sure how the quote supports your argument. Adversial examples generalize well accross many different classifiers.
Shallow NN's can be fooled just as well, it seems to be more of a problem of linear models in general. Apparently Geoff Hintons Capsule Networks are more robust due to being "less linear" (Ian Goodfellow mentioned this in a recent talk, don't have the references now to back it up)
I'm not sure it's about how shallow the network is; even logistic regression can be fooled by the same techniques (e.g. 1-layer NN). That being said, maybe it does have something to do with linearity (I suspect not) or maybe it's just generally harder to deal with nonlinear functions.
