Playing the Game of Universal Adversarial Perturbations

Abstract

We study the problem of learning classifiers robust to universal adversarial perturbations. While prior work approaches this problem via robust optimization, adversarial training, or input transformation, we instead phrase it as a two-player zero-sum game. In this new formulation, both players simultaneously play the same game, where one player chooses a classifier that minimizes a classification loss whilst the other player creates an adversarial perturbation that increases the same loss when applied to every sample in the training set. By observing that performing a classification (respectively creating adversarial samples) is the best response to the other player, we propose a novel extension of a game-theoretic algorithm, namely fictitious play, to the domain of training robust classifiers. Finally, we empirically show the robustness and versatility of our approach in two defence scenarios where universal attacks are performed on several image classification datasets -- CIFAR10, CIFAR100 and ImageNet.

References in corpus (9)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Ensemble Adversarial Training: Attacks and Defenses
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Learning with a Strong Adversary
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser

Cited by in corpus (6)

• A Survey On Universal Adversarial Attack
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Universal Adversarial Perturbations: A Survey
• Meta Adversarial Training against Universal Patches
• Universal Decision-Based Black-Box Perturbations: Breaking Security-Through-Obscurity Defenses