Adversarial Machine Learning at Scale

Abstract

Adversarial examples are malicious inputs designed to fool machine learning models. They often transfer from one model to another, allowing attackers to mount black box attacks without knowledge of the target model's parameters. Adversarial training is the process of explicitly training a model on adversarial examples, in order to make it more robust to attack or to reduce its test error on clean inputs. So far, adversarial training has primarily been applied to small problems. In this research, we apply adversarial training to ImageNet. Our contributions include: (1) recommendations for how to succesfully scale adversarial training to large models and datasets, (2) the observation that adversarial training confers robustness to single-step attack methods, (3) the finding that multi-step attack methods are somewhat less transferable than single-step attack methods, so single-step attacks are the best for mounting black-box attacks, and (4) resolution of a "label leaking" effect that causes adversarially trained models to perform better on adversarial examples than on clean examples, because the adversarial example construction process uses the true label and the model can learn to exploit regularities in the construction process.

17 pages, 5 figures

Cited by in corpus (122)

• Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)
• Generating Natural Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty
• Formal Security Analysis of Neural Networks using Symbolic Intervals
• Adversarial Examples: Attacks and Defenses for Deep Learning
• A General Framework for Adversarial Examples with Objectives
• Mitigating Adversarial Effects Through Randomization
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• Applying Machine Learning in Self-Adaptive Systems: A Systematic Literature Review
• Quantum noise protects quantum classifiers against adversaries
• AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Scaling provable adversarial defenses
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• Adversarial Examples for Semantic Segmentation and Object Detection
• Low Frequency Adversarial Perturbation
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustness
• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Facial Attributes: Accuracy and Adversarial Robustness
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• Contrastive Learning with Adversarial Examples
• Training individually fair ML models with Sensitive Subspace Robustness
• Boosting Adversarial Attacks with Momentum
• Towards Robust Neural Networks via Random Self-ensemble
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Recent Advances in Adversarial Training for Adversarial Robustness
• Adversarially Robust Neural Architectures
• Robustness of convolutional neural networks to physiological ECG noise
• Max-Mahalanobis Linear Discriminant Analysis Networks
• Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight
• Adversarial Attacks for Optical Flow-Based Action Recognition Classifiers
• Curriculum Adversarial Training
• Fortified Networks: Improving the Robustness of Deep Networks by Modeling the Manifold of Hidden Representations
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Attacking Binarized Neural Networks
• GraphDefense: Towards Robust Graph Convolutional Networks
• Towards Feature Space Adversarial Attack
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• There is Limited Correlation between Coverage and Robustness for Deep Neural Networks
• Robust Machine Comprehension Models via Adversarial Training
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Neural Networks Should Be Wide Enough to Learn Disconnected Decision Regions
• Improving adversarial robustness of deep neural networks by using semantic information
• Towards Analyzing Semantic Robustness of Deep Neural Networks
• Achieving Adversarial Robustness via Sparsity
• Towards Robust Detection of Adversarial Examples
• Risk Bounds for Robust Deep Learning
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• A Thorough Comparison Study on Adversarial Attacks and Defenses for Common Thorax Disease Classification in Chest X-rays
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Distributionally Adversarial Attack
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Unpacking Information Bottlenecks: Unifying Information-Theoretic Objectives in Deep Learning
• Ulixes: Facial Recognition Privacy with Adversarial Machine Learning
• Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks
• Adversarial Attacks and Defenses: An Interpretation Perspective
• Second-Order Provable Defenses against Adversarial Attacks
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• PointCloud Saliency Maps
• A State-of-the-Art Review on IoT botnet Attack Detection
• Theory-based residual neural networks: A synergy of discrete choice models and deep neural networks
• Fooling thermal infrared pedestrian detectors in real world using small bulbs
• Security Consideration For Deep Learning-Based Image Forensics
• Adversarial Attack and Defense in Deep Ranking
• On the Effect of Low-Rank Weights on Adversarial Robustness of Neural Networks
• Deep Neural Networks for Choice Analysis: Extracting Complete Economic Information for Interpretation
• Federated AI lets a team imagine together: Federated Learning of GANs
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Interpreting Interpretations: Organizing Attribution Methods by Criteria
• The Efficacy of SHIELD under Different Threat Models
• Subset Scanning Over Neural Network Activations
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Dealing with Adversarial Player Strategies in the Neural Network Game iNNk through Ensemble Learning
• Predicting Adversarial Examples with High Confidence
• Differentiable Language Model Adversarial Attacks on Categorical Sequence Classifiers
• Preserving Semantics in Textual Adversarial Attacks
• Input Hessian Regularization of Neural Networks
• Data Quality Matters For Adversarial Training: An Empirical Study
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• Signed Laplacian Deep Learning with Adversarial Augmentation for Improved Mammography Diagnosis
• Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions
• Understanding Catastrophic Overfitting in Adversarial Training
• Adaptive Feature Alignment for Adversarial Training
• Adversarial Defense Through Network Profiling Based Path Extraction
• Towards Deep Learning Models Resistant to Large Perturbations
• Robustifying deep networks for image segmentation
• Assessing the Adversarial Robustness of Monte Carlo and Distillation Methods for Deep Bayesian Neural Network Classification
• Generating Unrestricted Adversarial Examples via Three Parameters
• Provable Robustness of Adversarial Training for Learning Halfspaces with Noise
• Wasserstein Introspective Neural Networks
• Non-Determinism in Neural Networks for Adversarial Robustness
• MAT: A Multi-strength Adversarial Training Method to Mitigate Adversarial Attacks
• Reporting on Decision-Making Algorithms and some Related Ethical Questions
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• SPADE: A Spectral Method for Black-Box Adversarial Robustness Evaluation
• The art of defense: letting networks fool the attacker
• The Vulnerability of the Neural Networks Against Adversarial Examples in Deep Learning Algorithms
• Deterministic Gaussian Averaged Neural Networks
• LOTS about Attacking Deep Features
• Strategies to architect AI Safety: Defense to guard AI from Adversaries
• Polarizing Front Ends for Robust CNNs
• Constructing a provably adversarially-robust classifier from a high accuracy one
• Feature Losses for Adversarial Robustness
• Adversarial Attacks Against Deep Learning Systems for ICD-9 Code Assignment
• On Connections between Regularizations for Improving DNN Robustness
• GraCIAS: Grassmannian of Corrupted Images for Adversarial Security
• Extremal learning: extremizing the output of a neural network in regression problems
• Landmark Breaker: Obstructing DeepFake By Disturbing Landmark Extraction
• Recent Advancements in Self-Supervised Paradigms for Visual Feature Representation
• Multi-concept adversarial attacks
• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• Robust Regularization with Adversarial Labelling of Perturbed Samples
• Robust Deep Neural Networks Inspired by Fuzzy Logic
• HAWKEYE: Adversarial Example Detector for Deep Neural Networks
• On Configurable Defense against Adversarial Example Attacks