Recently, Kannan et al. [2018] proposed several logit regularization methods
to improve the adversarial robustness of classifiers. We show that the
computationally fast methods they propose - Clean Logit Pairing (CLP) and Logit
Squeezing (LSQ) - just make the gradient-based optimization problem of crafting
adversarial examples harder without providing actual robustness. We find that
Adversarial Logit Pairing (ALP) may indeed provide robustness against
adversarial examples, especially when combined with adversarial training, and
we examine it in a variety of settings. However, the increase in adversarial
accuracy is much smaller than previously claimed. Finally, our results suggest
that the evaluation against an iterative PGD attack relies heavily on the
parameters used and may result in false conclusions regarding robustness of a
model.

通过研究，我们发现 Clean Logit Pairing (CLP) 和 Logit Squeezing (LSQ) 等方法仅仅增加了制造对抗样本的梯度优化难度并未真正提高分类器的对抗鲁棒性；我们提出的 Adversarial Logit Pairing (ALP) 方法可以在对抗训练的情况下提高分类器的对抗鲁棒性，但是这种提高远远低于之前所声明的。我们得出的结论是，模型对迭代 PGD 攻击的评估严重依赖所使用的参数，并可能导致关于模型鲁棒性的错误结论。