DataTerminology.comNEW
A training technique that uses softened labels to reduce a model’s sensitivity to adversarial perturbations.
DESCRIPTION
Defensive distillation adapts knowledge distillation for robustness by training a model to match class probabilities produced at elevated temperature. Soft labels reduce sensitivity to small input changes, weakening gradient-based attacks. The approach can improve resilience but may cause gradient obfuscation and provide limited guarantees. It is part of a broader adversarial defense toolkit including adversarial training and certified defenses. Evaluation requires diverse threat models and robustness benchmarks. Governance teams should document defense assumptions and limitations.
ALTERNATIVE DEFINITIONS
Papernot et al. (arXiv)
We propose distillation as a defense to adversarial perturbations, by training models using class probabilities produced at an elevated temperature to reduce the sensitivity to input variations.
Original formulation highlighting temperature and soft probabilities.
MITRE ATLAS
Defensive distillation trains models on softened labels to make gradients less useful for crafting adversarial examples.
Operational perspective linking softened labels to gradient resistance.
IBM Research
Defensive distillation is a strategy that leverages distillation techniques to improve robustness by training on soft targets.
Vendor research view connecting distillation and robustness.
RELATED TERMS
Knowledge Distillation Adversarial Examples Robustness Temperature Scaling Soft Labels Model Calibration Gradient Masking Attack Surface Security in AI
COMPETING TERMS
Adversarial Training Certified Robustness
RELATIONS
- Broader: Distillation
KNOWLEDGE AREAS
AI Data Science MLOps AI Governance Data Security
TARGET AUDIENCE
AI Engineer Data Scientist MLOps Engineer Chief AI Officer Chief Information Security Officer Cybersecurity Engineer
EXTERNAL SOURCES
- Wikipedia - Adversarial machine learning
- arXiv - Original defensive distillation paper
- MITRE ATLAS - Technique catalog entry
- CleverHans - Adversarial defense overview
TOP QUESTIONS
When should Defensive Distillation be used?
Use it to harden models against gradient-based attacks, especially when adversarial training is too costly.
Category: Opinion
What is the key mechanism behind Defensive Distillation?
Training with elevated temperature softens label distributions, reducing model sensitivity to small input perturbations.
Category: Overview
What are common limitations of Defensive Distillation?
It may cause gradient obfuscation and fail under strong adaptive attacks; robustness is not guaranteed.
Category: Risks
How do you evaluate Defensive Distillation?
Test against white-box and black-box attacks, use standardized benchmarks, and compare with adversarial training.
Category: Testing
What’s a misunderstanding about Defensive Distillation?
That it fully prevents adversarial examples; it can raise difficulty but doesn’t eliminate attacks.
Category: Misunderstanding
What are alternatives to Defensive Distillation?
Adversarial training, randomized smoothing, certified defenses, and robust architecture design.
Category: Alternatives
What governance documentation is needed for Defensive Distillation?
Document threat models, defense parameters, empirical results, and known failure modes.
Category: Management
How does temperature affect Defensive Distillation?
Higher temperature produces softer targets, influencing gradient behavior and robustness properties.
Category: Requirements
Where did Defensive Distillation originate?
It was introduced by Papernot et al. as a defense against adversarial perturbations in deep networks.
Category: Origin