Deep Defense: Training DNNs with Improved Adversarial Robustness

Abstract

Despite the efficacy on a variety of computer vision tasks, deep neural networks (DNNs) are vulnerable to adversarial attacks, limiting their applications in security-critical systems. Recent works have shown the possibility of generating imperceptibly perturbed image inputs (a.k.a., adversarial examples) to fool well-trained DNN classifiers into making arbitrary predictions. To address this problem, we propose a training recipe named "deep defense". Our core idea is to integrate an adversarial perturbation-based regularizer into the classification objective, such that the obtained models learn to resist potential attacks, directly and precisely. The whole optimization problem is solved just like training a recursive network. Experimental results demonstrate that our method outperforms training with adversarial/Parseval regularizations by large margins on various datasets (including MNIST, CIFAR-10 and ImageNet) and different DNN architectures. Code and models for reproducing our results are available at https://github.com/ZiangYan/deepdefense.pytorch

arXiv commentAccepted by NeurIPS 2018

Cited by in corpus (34)

• On the Convergence and Robustness of Adversarial Training
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Boosting Adversarial Training with Hypersphere Embedding
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• On Robustness of Neural Ordinary Differential Equations
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• GraphSAC: Detecting anomalies in large-scale graphs
• Generating 3D Adversarial Point Clouds
• Towards Robust, Locally Linear Deep Networks
• Adversarial Margin Maximization Networks
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Models
• Multitask Learning Strengthens Adversarial Robustness
• Sitatapatra: Blocking the Transfer of Adversarial Samples
• Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
• Revisiting Hilbert-Schmidt Information Bottleneck for Adversarial Robustness
• Identifying Classes Susceptible to Adversarial Attacks
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• Double Backpropagation for Training Autoencoders against Adversarial Attack
• Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder
• Adaptive Feature Alignment for Adversarial Training
• Attentive Representation Learning with Adversarial Training for Short Text Clustering
• On Procedural Adversarial Noise Attack And Defense
• Perceptually Constrained Adversarial Attacks
• AdvFilter: Predictive Perturbation-aware Filtering against Adversarial Attack via Multi-domain Learning
• Explaining Adversarial Vulnerability with a Data Sparsity Hypothesis
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Recent Advances in Large Margin Learning
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defenses
• Contextual Fusion For Adversarial Robustness