Interpreting Adversarial Robustness: A View from Decision Surface in Input Space

Abstract

One popular hypothesis of neural network generalization is that the flat local minima of loss surface in parameter space leads to good generalization. However, we demonstrate that loss surface in parameter space has no obvious relationship with generalization, especially under adversarial settings. Through visualizing decision surfaces in both parameter space and input space, we instead show that the geometry property of decision surface in input space correlates well with the adversarial robustness. We then propose an adversarial robustness indicator, which can evaluate a neural network's intrinsic robustness property without testing its accuracy under adversarial attacks. Guided by it, we further propose our robust training method. Without involving adversarial training, our method could enhance network's intrinsic adversarial robustness against various adversarial attacks.

arXiv comment15 pages, submitted to ICLR 2019

References in corpus (3)

• mixup: Beyond Empirical Risk Minimization
• An empirical analysis of the optimization of deep network loss surfaces
• Unifying Adversarial Training Algorithms with Flexible Deep Data Gradient Regularization

Cited by in corpus (7)

• Adversarial Weight Perturbation Helps Robust Generalization
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• A Generative Model based Adversarial Security of Deep Learning and Linear Classifier Models
• Domain Invariant Adversarial Learning
• Adversarial training applied to Convolutional Neural Network for photometric redshift predictions
• Compressive Sensing Based Adaptive Defence Against Adversarial Images
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks