Defensive Distillation is Not Robust to Adversarial Examples

Not yet reviewed by Pith; the record is open.

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

Nicholas Carlini , David Wagner This is my paper · ORCID

classification cs.CRcs.CV

keywords defensivedistillationadversarialattacksexamplesmisclassificationnetworksneural

verification ladder T0 review T1 audit T2 compute T3 formal

0 comments

read the original abstract

We show that defensive distillation is not secure: it is no more resistant to targeted misclassification attacks than unprotected neural networks.

Forward citations

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense
cs.LG 2024-11 conditional novelty 6.0 of 10

Adaptive attacks reduce the robust accuracy of the 'Ensemble Everything Everywhere' defense to 11% on CIFAR-10 and 14% on CIFAR-100 under an l-infinity bound of 8/255.
Improving the Robustness/Accuracy Tradeoff Against Adversarial Attacks Using Information Bottleneck Distillation Through Dual Teachers
cs.LG 2026-07 conditional novelty 4.0 of 10

Adding a clean teacher to Information Bottleneck Distillation raises clean accuracy by about 0.8 points on CIFAR data while holding robust accuracy nearly steady.