Certifying Some Distributional Robustness with Principled Adversarial Training

Abstract

Neural networks are vulnerable to adversarial examples and researchers have proposed many heuristic attack and defense mechanisms. We address this problem through the principled lens of distributionally robust optimization, which guarantees performance under adversarial input perturbations. By considering a Lagrangian penalty formulation of perturbing the underlying data distribution in a Wasserstein ball, we provide a training procedure that augments model parameter updates with worst-case perturbations of training data. For smooth losses, our procedure provably achieves moderate levels of robustness with little computational or statistical cost relative to empirical risk minimization. Furthermore, our statistical guarantees allow us to efficiently certify robustness for the population loss. For imperceptible perturbations, our method matches or outperforms heuristic approaches.

ICLR 2018: https://openreview.net/forum?id=Hk6kPgZA-

References in corpus (6)

• Certified Defenses against Adversarial Examples
• Adversarial Patch
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Optimal Transport Based Distributionally Robust Optimization: Structural Properties and Iterative Schemes
• Accelerated Schemes For A Class of Variational Inequalities

Cited by in corpus (146)

• Offline Reinforcement Learning: Tutorial, Review, and Perspectives on Open Problems
• Fast is better than free: Revisiting adversarial training
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Generalizing to Unseen Domains via Adversarial Data Augmentation
• Out-of-Distribution Generalization via Risk Extrapolation (REx)
• Distributionally Robust Optimization: A Review
• On the Convergence and Robustness of Adversarial Training
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Motivating the Rules of the Game for Adversarial Example Research
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Constructing Unrestricted Adversarial Examples with Generative Models
• Scaling provable adversarial defenses
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Review
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• On the (In)fidelity and Sensitivity for Explanations
• Anchor regression: heterogeneous data meets causality
• Efficient Black-box Assessment of Autonomous Vehicle Safety
• Out of Distribution Generalization in Machine Learning
• Training individually fair ML models with Sensitive Subspace Robustness
• Overfitting in adversarially robust deep learning
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Robust Validation: Confident Predictions Even When Distributions Shift
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Learning perturbation sets for robust machine learning
• On the Geometry of Adversarial Examples
• A Convex Duality Framework for GANs
• Enhancing Adversarial Example Transferability with an Intermediate Level Attack
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Robust Hypothesis Testing Using Wasserstein Uncertainty Sets
• A Decentralized Parallel Algorithm for Training Generative Adversarial Nets
• Global Convergence and Variance-Reduced Optimization for a Class of Nonconvex-Nonconcave Minimax Problems
• Wasserstein Distributionally Robust Kalman Filtering
• On the Global Convergence of Actor-Critic: A Case for Linear Quadratic Regulator with Ergodic Cost
• Distributionally Robust Bayesian Optimization
• Local Saddle Point Optimization: A Curvature Exploitation Approach
• Evaluating Model Robustness and Stability to Dataset Shift
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• First-order Convergence Theory for Weakly-Convex-Weakly-Concave Min-max Problems
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• Adversarial Training Versus Weight Decay
• Improved Algorithms for Convex-Concave Minimax Optimization
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• Adversarially Robust Training through Structured Gradient Regularization
• SenSeI: Sensitive Set Invariance for Enforcing Individual Fairness
• Playing the Game of Universal Adversarial Perturbations
• Counterfactual Normalization: Proactively Addressing Dataset Shift and Improving Reliability Using Causal Mechanisms
• A Spectral View of Adversarially Robust Features
• Adversarial Attacks on Monocular Depth Estimation
• Neural Bridge Sampling for Evaluating Safety-Critical Autonomous Systems
• Invariant Policy Optimization: Towards Stronger Generalization in Reinforcement Learning
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Featurized Bidirectional GAN: Adversarial Defense via Adversarially Learned Semantic Inference
• Robust Reinforcement Learning with Wasserstein Constraint
• Counterfactual Data Augmentation using Locally Factored Dynamics
• Counterexample-Guided Learning of Monotonic Neural Networks
• Kernel Distributionally Robust Optimization
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• A First-Order Algorithmic Framework for Wasserstein Distributionally Robust Logistic Regression
• Auditing ML Models for Individual Bias and Unfairness
• Convergence and Margin of Adversarial Training on Separable Data
• Multivariate Distributionally Robust Convex Regression under Absolute Error Loss
• PDA: Progressive Data Augmentation for General Robustness of Deep Neural Networks
• Learning to Learn Single Domain Generalization
• Adversarial Visual Robustness by Causal Intervention
• A Primal-Dual Smoothing Framework for Max-Structured Non-Convex Optimization
• Unified Group Fairness on Federated Learning
• Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Gradient Descent-Ascent Provably Converges to Strict Local Minmax Equilibria with a Finite Timescale Separation
• Distributionally Robust Deep Learning using Hardness Weighted Sampling
• Accounting for Unobserved Confounding in Domain Generalization
• Interpreting Neural Networks Using Flip Points
• Lipschitz Networks and Distributional Robustness
• Robust Models Are More Interpretable Because Attributions Look Normal
• Effects of Loss Functions And Target Representations on Adversarial Robustness
• Generalization of Reinforcement Learning with Policy-Aware Adversarial Data Augmentation
• Black Loans Matter: Distributionally Robust Fairness for Fighting Subgroup Discrimination
• Quantifying and Improving Transferability in Domain Generalization
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• Online Stochastic Convex Optimization: Wasserstein Distance Variation
• Efficient Stochastic Gradient Descent for Learning with Distributionally Robust Optimization
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Rearchitecting Classification Frameworks For Increased Robustness
• The Adversarial Attack and Detection under the Fisher Information Metric
• Manifold Adversarial Learning
• Gauss-Newton Unrolled Neural Networks and Data-driven Priors for Regularized PSSE with Robustness
• A Stochastic Subgradient Method for Distributionally Robust Non-Convex Learning
• Robustified Multivariate Regression and Classification Using Distributionally Robust Optimization under the Wasserstein Metric
• Uncertainty-guided Model Generalization to Unseen Domains
• FormulaZero: Distributionally Robust Online Adaptation via Offline Population Synthesis
• Identifying Invariant Factors Across Multiple Environments with KL Regression
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• From Predictions to Decisions: Using Lookahead Regularization
• Architecture Selection via the Trade-off Between Accuracy and Robustness
• DiPSeN: Differentially Private Self-normalizing Neural Networks For Adversarial Robustness in Federated Learning
• ATZSL: Defensive Zero-Shot Recognition in the Presence of Adversaries
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• Quantitative Projection Coverage for Testing ML-enabled Autonomous Systems
• Distributionally Robust Weighted $k$-Nearest Neighbors
• VideoDG: Generalizing Temporal Relations in Videos to Novel Domains
• Distributional Robustness with IPMs and links to Regularization and GANs
• Mixed Nash Equilibria in the Adversarial Examples Game
• Deconfounding and Causal Regularization for Stability and External Validity
• Concurrent Adversarial Learning for Large-Batch Training
• Worst-Case Risk Quantification under Distributional Ambiguity using Kernel Mean Embedding in Moment Problem
• Principled learning method for Wasserstein distributionally robust optimization with local perturbations
• Unbiased Gradient Estimation for Distributionally Robust Learning
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Mixed Strategies for Robust Optimization of Unknown Objectives
• Regularized Policies are Reward Robust
• Domain Invariant Adversarial Learning
• Rethinking Empirical Evaluation of Adversarial Robustness Using First-Order Attack Methods
• Learning Generalized Spatial-Temporal Deep Feature Representation for No-Reference Video Quality Assessment
• A Law of Robustness for Weight-bounded Neural Networks
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Adversarially Robust Kernel Smoothing
• Interpolation can hurt robust generalization even when there is no noise
• Recovery Guarantees for Compressible Signals with Adversarial Noise
• Improving the Generalization of Meta-learning on Unseen Domains via Adversarial Shift
• Distributionally Robust Multi-Output Regression Ranking
• Predictive Power of Nearest Neighbors Algorithm under Random Perturbation
• Fast and Robust Rank Aggregation against Model Misspecification
• Continual Learning of Generative Models with Limited Data: From Wasserstein-1 Barycenter to Adaptive Coalescence
• An Integrated Approach to Produce Robust Models with High Efficiency
• Generalization Bounds for Meta-Learning via PAC-Bayes and Uniform Stability
• Beyond Discriminant Patterns: On the Robustness of Decision Rule Ensembles
• Towards Data-Free Domain Generalization
• Convex-Concave Min-Max Stackelberg Games
• Learning Provably Robust Motion Planners Using Funnel Libraries
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Is the Rush to Machine Learning Jeopardizing Safety? Results of a Survey
• Robust, Deep, and Reinforcement Learning for Management of Communication and Power Networks
• Self-Gradient Networks
• A Le Cam Type Bound for Adversarial Learning and Applications
• Adversaries in Online Learning Revisited: with applications in Robust Optimization and Adversarial training
• Individually Fair Gradient Boosting
• Nested Learning For Multi-Granular Tasks
• Towards adversarial robustness with 01 loss neural networks
• Generating Adversarial Examples With Conditional Generative Adversarial Net
• Robust Machine Learning via Privacy/Rate-Distortion Theory