Certifying Some Distributional Robustness with Principled Adversarial Training

Abstract

Neural networks are vulnerable to adversarial examples and researchers have proposed many heuristic attack and defense mechanisms. We address this problem through the principled lens of distributionally robust optimization, which guarantees performance under adversarial input perturbations. By considering a Lagrangian penalty formulation of perturbing the underlying data distribution in a Wasserstein ball, we provide a training procedure that augments model parameter updates with worst-case perturbations of training data. For smooth losses, our procedure provably achieves moderate levels of robustness with little computational or statistical cost relative to empirical risk minimization. Furthermore, our statistical guarantees allow us to efficiently certify robustness for the population loss. For imperceptible perturbations, our method matches or outperforms heuristic approaches.

ICLR 2018: https://openreview.net/forum?id=Hk6kPgZA-

References in corpus (15)

• Ensemble Adversarial Training: Attacks and Defenses
• Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs)
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Certified Defenses against Adversarial Examples
• Distributional Smoothing with Virtual Adversarial Training
• Robustness and Regularization of Support Vector Machines
• Robust Wasserstein Profile Inference and Applications to Machine Learning
• Computing Nonvacuous Generalization Bounds for Deep (Stochastic) Neural Networks with Many More Parameters than Training Data
• Distributionally Robust Logistic Regression
• Adversarial Patch
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• Practical Black-Box Attacks against Machine Learning
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Optimal Transport Based Distributionally Robust Optimization: Structural Properties and Iterative Schemes
• Accelerated Schemes For A Class of Variational Inequalities

Cited by in corpus (148)

• Offline Reinforcement Learning: Tutorial, Review, and Perspectives on Open Problems
• Fast is better than free: Revisiting adversarial training
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Generalizing to Unseen Domains via Adversarial Data Augmentation
• Out-of-Distribution Generalization via Risk Extrapolation (REx)
• Distributionally Robust Optimization: A Review
• On the Convergence and Robustness of Adversarial Training
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Motivating the Rules of the Game for Adversarial Example Research
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Constructing Unrestricted Adversarial Examples with Generative Models
• Scaling provable adversarial defenses
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Review
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• On the (In)fidelity and Sensitivity for Explanations
• Anchor regression: heterogeneous data meets causality
• Efficient Black-box Assessment of Autonomous Vehicle Safety
• Training individually fair ML models with Sensitive Subspace Robustness
• Out of Distribution Generalization in Machine Learning
• Overfitting in adversarially robust deep learning
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Robust Validation: Confident Predictions Even When Distributions Shift
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Learning perturbation sets for robust machine learning
• On the Geometry of Adversarial Examples
• A Convex Duality Framework for GANs
• Enhancing Adversarial Example Transferability with an Intermediate Level Attack
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• A Decentralized Parallel Algorithm for Training Generative Adversarial Nets
• Robust Hypothesis Testing Using Wasserstein Uncertainty Sets
• Global Convergence and Variance-Reduced Optimization for a Class of Nonconvex-Nonconcave Minimax Problems
• Wasserstein Distributionally Robust Kalman Filtering
• On the Global Convergence of Actor-Critic: A Case for Linear Quadratic Regulator with Ergodic Cost
• Distributionally Robust Bayesian Optimization
• Local Saddle Point Optimization: A Curvature Exploitation Approach
• Evaluating Model Robustness and Stability to Dataset Shift
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• First-order Convergence Theory for Weakly-Convex-Weakly-Concave Min-max Problems
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Adversarial Training Versus Weight Decay
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Improved Algorithms for Convex-Concave Minimax Optimization
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• Adversarially Robust Training through Structured Gradient Regularization
• SenSeI: Sensitive Set Invariance for Enforcing Individual Fairness
• Counterfactual Normalization: Proactively Addressing Dataset Shift and Improving Reliability Using Causal Mechanisms
• A Spectral View of Adversarially Robust Features
• Adversarial Attacks on Monocular Depth Estimation
• Playing the Game of Universal Adversarial Perturbations
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Neural Bridge Sampling for Evaluating Safety-Critical Autonomous Systems
• Semi-supervised Learning based on Distributionally Robust Optimization
• Invariant Policy Optimization: Towards Stronger Generalization in Reinforcement Learning
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Counterfactual Data Augmentation using Locally Factored Dynamics
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Counterexample-Guided Learning of Monotonic Neural Networks
• Robust Reinforcement Learning with Wasserstein Constraint
• Kernel Distributionally Robust Optimization
• Auditing ML Models for Individual Bias and Unfairness
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• A First-Order Algorithmic Framework for Wasserstein Distributionally Robust Logistic Regression
• Multivariate Distributionally Robust Convex Regression under Absolute Error Loss
• Convergence and Margin of Adversarial Training on Separable Data
• PDA: Progressive Data Augmentation for General Robustness of Deep Neural Networks
• Learning to Learn Single Domain Generalization
• Unified Group Fairness on Federated Learning
• A Primal-Dual Smoothing Framework for Max-Structured Non-Convex Optimization
• Adversarial Visual Robustness by Causal Intervention
• Gradient Descent-Ascent Provably Converges to Strict Local Minmax Equilibria with a Finite Timescale Separation
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Distributionally Robust Deep Learning using Hardness Weighted Sampling
• Robust Models Are More Interpretable Because Attributions Look Normal
• Lipschitz Networks and Distributional Robustness
• Generalization of Reinforcement Learning with Policy-Aware Adversarial Data Augmentation
• Interpreting Neural Networks Using Flip Points
• Accounting for Unobserved Confounding in Domain Generalization
• Black Loans Matter: Distributionally Robust Fairness for Fighting Subgroup Discrimination
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Quantifying and Improving Transferability in Domain Generalization
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Rearchitecting Classification Frameworks For Increased Robustness
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Efficient Stochastic Gradient Descent for Learning with Distributionally Robust Optimization
• Manifold Adversarial Learning
• Online Stochastic Convex Optimization: Wasserstein Distance Variation
• The Adversarial Attack and Detection under the Fisher Information Metric
• Gauss-Newton Unrolled Neural Networks and Data-driven Priors for Regularized PSSE with Robustness
• Robustified Multivariate Regression and Classification Using Distributionally Robust Optimization under the Wasserstein Metric
• A Stochastic Subgradient Method for Distributionally Robust Non-Convex Learning
• Architecture Selection via the Trade-off Between Accuracy and Robustness
• DiPSeN: Differentially Private Self-normalizing Neural Networks For Adversarial Robustness in Federated Learning
• Uncertainty-guided Model Generalization to Unseen Domains
• ATZSL: Defensive Zero-Shot Recognition in the Presence of Adversaries
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• FormulaZero: Distributionally Robust Online Adaptation via Offline Population Synthesis
• From Predictions to Decisions: Using Lookahead Regularization
• Identifying Invariant Factors Across Multiple Environments with KL Regression
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• Mixed Nash Equilibria in the Adversarial Examples Game
• Concurrent Adversarial Learning for Large-Batch Training
• Distributionally Robust Weighted $k$-Nearest Neighbors
• VideoDG: Generalizing Temporal Relations in Videos to Novel Domains
• Distributional Robustness with IPMs and links to Regularization and GANs
• Deconfounding and Causal Regularization for Stability and External Validity
• Quantitative Projection Coverage for Testing ML-enabled Autonomous Systems
• A Law of Robustness for Weight-bounded Neural Networks
• A Robust Learning Algorithm for Regression Models Using Distributionally Robust Optimization under the Wasserstein Metric
• Adversarially Robust Kernel Smoothing
• Distributionally Robust Multi-Output Regression Ranking
• Improving the Generalization of Meta-learning on Unseen Domains via Adversarial Shift
• Rethinking Empirical Evaluation of Adversarial Robustness Using First-Order Attack Methods
• Learning Generalized Spatial-Temporal Deep Feature Representation for No-Reference Video Quality Assessment
• Interpolation can hurt robust generalization even when there is no noise
• Predictive Power of Nearest Neighbors Algorithm under Random Perturbation
• Mixed Strategies for Robust Optimization of Unknown Objectives
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Worst-Case Risk Quantification under Distributional Ambiguity using Kernel Mean Embedding in Moment Problem
• Principled learning method for Wasserstein distributionally robust optimization with local perturbations
• Unbiased Gradient Estimation for Distributionally Robust Learning
• Domain Invariant Adversarial Learning
• Regularized Policies are Reward Robust
• Fast and Robust Rank Aggregation against Model Misspecification
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Learning Provably Robust Motion Planners Using Funnel Libraries
• Adversaries in Online Learning Revisited: with applications in Robust Optimization and Adversarial training
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Self-Gradient Networks
• Individually Fair Gradient Boosting
• Robust, Deep, and Reinforcement Learning for Management of Communication and Power Networks
• Is the Rush to Machine Learning Jeopardizing Safety? Results of a Survey
• Continual Learning of Generative Models with Limited Data: From Wasserstein-1 Barycenter to Adaptive Coalescence
• Nested Learning For Multi-Granular Tasks
• Generalization Bounds for Meta-Learning via PAC-Bayes and Uniform Stability
• Convex-Concave Min-Max Stackelberg Games
• Towards adversarial robustness with 01 loss neural networks
• Towards Data-Free Domain Generalization
• Beyond Discriminant Patterns: On the Robustness of Decision Rule Ensembles
• Robust Machine Learning via Privacy/Rate-Distortion Theory
• A Le Cam Type Bound for Adversarial Learning and Applications
• Generating Adversarial Examples With Conditional Generative Adversarial Net
• An Integrated Approach to Produce Robust Models with High Efficiency