Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 2,982

The DOI matches its Crossref record; 10 of the 10 references it cites were found in a registry or an index.

Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks

Open access
Papernot, Nicolas, McDaniel, Patrick, Wu, Xi, Jha, Somesh, Swami, Ananthram·2016·2016 IEEE Symposium on Security and Privacy (SP)
DOI 10.1109/sp.2016.41
Open this paper in CoChat — free account

Abstract

Deep learning algorithms have been shown to perform extremely well on many classical machine learning problems. However, recent studies have shown that deep learning, like other machine learning techniques, is vulnerable to adversarial samples: inputs crafted to force a deep neural network (DNN) to provide adversary-selected outputs. Such attacks can seriously undermine the security of the system supported by the DNN, sometimes with devastating consequences. For example, autonomous vehicles can be crashed, illicit or illegal content can bypass content filters, or biometric authentication systems can be manipulated to allow improper access. In this work, we introduce a defensive mechanism called defensive distillation to reduce the effectiveness of adversarial samples on DNNs. We analytically investigate the generalizability and robustness properties granted by the use of defensive distillation when training DNNs. We also empirically study the effectiveness of our defense mechanisms on two DNNs placed in adversarial settings. The study shows that defensive distillation can reduce effectiveness of sample creation from 95% to less than 0.5% on a studied DNN. Such dramatic gains can be explained by the fact that distillation leads gradients used in adversarial sample creation to be reduced by a factor of 1030. We also find that distillation increases the average minimum number of features that need to be modified to create adversarial samples by about 800% on one of the DNNs we tested.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/sp.2016.41

Cites

10 of 10 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 10 references

Research works printed but not linked: 31

  1. 10.1007/s10994-010-5188-5 · DOI · Paper page
  2. warde-farley, 2016, Adversarial perturbations of deep neural networks, Advanced Structured Prediction
  3. 10.1007/BF02134016 · DOI · Paper page
  4. 10.1109/CVPR.2015.7298640 · DOI · Paper page
  5. 10.1109/72.165600 · DOI
  6. fawzi, 2015, Analysis of classifiers' robustness to adversarial perturbations, Deep Learning Workshop at ICML 2015 arXiv preprint arXiv 1502 02590
  7. 10.1145/2666652.2666666 · DOI
  8. bergstra, 2010, Theano: a cpu and gpu math expression compiler, Proceedings of the Python for Scientific Computing Conference (SciPy), 4, 3
  9. shalev-shwartz, 2010, Learn-ability, stability and uniform convergence, The Journal of Machine Learning Research, 11, 2635
  10. 2015, Nvidia tegra drive px: Self-driving car computer, Nvidia
  11. xu, 2016, Automatically evading classifiers, Proceedings of the 2016 Network and Distributed Systems Symposium, 10.14722/ndss.2016.23115 · DOI
  12. 10.1142/S0218001414600027 · DOI
  13. 10.1109/IJCB.2011.6117503 · DOI · Paper page
  14. 10.1145/1180405.1180414 · DOI
  15. gu, 2015, Towards deep neural network architectures robust to adversarial examples, Proceedings of the 2015 International Conference on Learning Representations Computational and Biological Learning Society
  16. ba, 2014, Do deep nets really need to be deep?, Advances in neural information processing systems, 2654
  17. erhan, 2010, Why does unsupervised pre-training help deep learning?, The Journal of Machine Learning Research, 11, 625
  18. 10.1109/ICASSP.2013.6638293 · DOI · Paper page
  19. 10.1007/978-3-642-21735-7_7 · DOI · Paper page
  20. sermanet, 2014, Overfeat: Integrated recognition, localization and detection using convolutional networks, International Conference on Learning Representations (ICLR 2014) arXiv preprint arXiv 1312 6229
  21. miyato, 2015, Distributional smoothing by virtual adversarial examples, CoRR vol abs/1507 00677
  22. 10.1145/2740070.2631434 · DOI
  23. 10.1109/ICASSP.2013.6639347 · DOI · Paper page
  24. krizhevsky, 2012, Imagenet classification with deep convolutional neural networks, Advances in neural information processing systems, 1097
  25. 10.1109/TKDE.2013.57 · DOI · Paper page
  26. 10.1145/1128817.1128824 · DOI · Paper page
  27. 10.1016/j.tics.2007.09.004 · DOI · Paper page
  28. biggio, 2011, Support vector machines under adversarial label noise, ACML, 97
  29. glorot, 2011, Domain adaptation for large-scale sentiment classification: A deep learning approach, Proceedings of the 28th International Conference on Machine Learning (ICML-11), 513
  30. biggio, 2012, Poisoning attacks against support vector machines, Proceedings of the 29th International Conference on Machine Learning
  31. bergstra, 2012, Random search for hyper-parameter optimization, The Journal of Machine Learning Research, 13, 281

Cited by

See all 2,982

Metadata

Authors
Papernot, N., McDaniel, P., Wu, X., Jha, S., & Swami, A.
Venue
2016 IEEE Symposium on Security and Privacy (SP)
Publisher
IEEE
Published
2016-05
Pages
582-597
ISSN
1081-6011 (ISSN-L)
DOI
10.1109/sp.2016.41
OpenAlex
W2174868984
Cited by
2,982
References
10
FWCI
132.14
Type
conference paper
Language
en
Open access
green

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. https://app.cochat.ai/papers/10.1109/sp.2016.41
The paper
Papernot, N., McDaniel, P., Wu, X., Jha, S., & Swami, A. (2016). Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. 2016 IEEE Symposium on Security and Privacy (SP). https://doi.org/10.1109/sp.2016.41

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.