Feature Squeezing is a recently proposed defense method which reduces the
search space available to an adversary by coalescing samples that correspond to
many different feature vectors in the original space into a single sample. It
has been shown that feature squeezing defenses can be combined in a joint
detection framework to achieve high detection rates against state-of-the-art
attacks. However, we demonstrate on the MNIST and CIFAR-10 datasets that by
increasing the adversary strength of said state-of-the-art attacks, one can
bypass the detection framework with adversarial examples of minimal visual
distortion. These results suggest for proposed defenses to validate against
stronger attack configurations.

Feature Squeezing 是一种新提出的防御方法，可通过将对应于原始空间中许多不同特征向量的样本合并为单个样本，从而减少对手可用的搜索空间。虽然已经证明特征压缩防御可以在联合检测框架中组合，以实现对最先进的攻击的高检测率，但我们证明，在 MNIST 和 CIFAR-10 数据集上，通过增加所述最先进的攻击方案的对手强度，可以使用最小的视觉扭曲来绕过检测框架的对抗性示例。这些结果表明，建议的防御措施需要针对更强的攻击配置进行验证。

提高对手实力绕过功能压缩

Bypassing Feature Squeezing by Increasing Adversary Strength

Feature squeezing is a recently-introduced framework for mitigating and
detecting adversarial examples. In previous work, we showed that it is
effective against several earlier methods for generating adversarial examples.
In this short note, we report on recent results showing that simple feature
squeezing techniques also make deep learning models significantly more robust
against the Carlini/Wagner attacks, which are the best known adversarial
methods discovered to date.

简单的特征压缩技术可以显著提高深度学习模型抵抗当前已知最强的对抗攻击方法 ——Carlini/Wagner 攻击的能力。

特征压缩减轻和检测 Carlini/Wagner 对抗样本

Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial  Examples

Although deep neural networks (DNNs) have achieved great success in many
tasks, they can often be fooled by \emph{adversarial examples} that are
generated by adding small but purposeful distortions to natural examples.
Previous studies to defend against adversarial examples mostly focused on
refining the DNN models, but have either shown limited success or required
expensive computation. We propose a new strategy, \emph{feature squeezing},
that can be used to harden DNN models by detecting adversarial examples.
Feature squeezing reduces the search space available to an adversary by
coalescing samples that correspond to many different feature vectors in the
original space into a single sample. By comparing a DNN model's prediction on
the original input with that on squeezed inputs, feature squeezing detects
adversarial examples with high accuracy and few false positives. This paper
explores two feature squeezing methods: reducing the color bit depth of each
pixel and spatial smoothing. These simple strategies are inexpensive and
complementary to other defenses, and can be combined in a joint detection
framework to achieve high detection rates against state-of-the-art attacks.

该研究提出了一种新的策略，即特征压缩，用于检测对深度神经网络模型的对抗性攻击，通过减小搜索空间，该方法显著提高了攻击检测的准确性和少量误报率，并结合其他防御方法，可对抗最先进的攻击。