Comment on "Biologically inspired protection of deep networks from adversarial attacks"

Comment on Biologically inspired protection of deep networks from adversarial attacks Wieland Brendel 1,3 and Matthias Bethge 1,2,3,4 1 Werner Reichardt Center for Integrative Neuroscience, University of T ubingen, Germany 2 Max Planck Institute for Biological Cybernetics, T ubingen, Germany 3 Bernstein Center for Computational Neuroscience, T ubingen, Germany 4 Institute for Theoretical Physics, University of T ubingen, Germany Dated: October 29, 2017 A recent paper [1] suggests that Deep Neural Networks can be protected from gradient-based adversarial perturbations by driving the network activations into a highly saturated regime. Here we analyse such saturated networks and show that the attacks fail due to numerical limitations in the gradient computations. A simple stabilisation of the gradient estimates enables successful and efficient attacks. Thus, it has yet to be shown that the robustness observed in [1] is not simply due to numerical limitations. Evaluating the robustness of neural networks is difficult.